群友靶机-su

Thu, 15 Oct 2026 00:00:00 +0800

绕得有点远

群友靶机-Cyrene

Tue, 22 Sep 2026 00:00:00 +0800

XSS+Twig SSTI+chromedriver提权手法

wsl2镜像网络模式配置

Mon, 14 Sep 2026 00:00:00 +0800

终于修改了这些东西

低版本log4shell

Sun, 13 Sep 2026 00:00:00 +0800

复现低版本log4shell 1.环境准备： 1.1.靶机搭建参考项目： https://github.com/tothi/log4shell-vulnerable-app?utm_source=chatgpt.com lily2663@ubuntu:~/src/log4shell-vulnerable-app$ lily2663@ubuntu:~/src/log4shell-vulnerable-app$ ls build gradle gradlew.bat log4shell_rce_demo.png src build.gradle gradlew log4shell_rce_demo_empire.png README.md lily2663@ubuntu:~/src/log4shell-vulnerable-app$ ./gradlew./gradlew shadowJar -bash: ./gradlew./gradlew: 没有那个文件或目录 lily2663@ubuntu:~/src/log4shell-vulnerable-app$ ./gradlew shadowJar Starting a Gradle Daemon, 2 busy Daemons could not be reused, use --status for details BUILD SUCCESSFUL in 19s 3 actionable tasks: 1 executed, 2 up-to-date lily2663@ubuntu:~/src/log4shell-vulnerable-app$ ./gradlew appRun 九月 13, 2026 9:17:45 下午 org.apache.coyote.AbstractProtocol init 信息: Initializing ProtocolHandler ["http-nio-8080"] 九月 13, 2026 9:17:45 下午 org.apache.catalina.core.StandardService initInternal 严重: Failed to initialize connector [Connector[HTTP/1.1-8080]] org.apache.catalina.LifecycleException: Protocol handler initialization failed at org.apache.catalina.connector.Connector.initInternal(Connector.java:1077) at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136) at org.apache.catalina.core.StandardService.initInternal(StandardService.java:557) at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136) at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:850) at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:173) at org.apache.catalina.startup.Tomcat.start(Tomcat.java:440) at org.apache.catalina.startup.Tomcat$start$0.call(Unknown Source) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:47) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:115) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:119) at org.akhikhl.gretty.TomcatServerManager.startServer(TomcatServerManager.groovy:59) at org.akhikhl.gretty.ServerManager$startServer$0.call(Unknown Source) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:47) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:115) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:127) at org.akhikhl.gretty.Runner.run(Runner.groovy:129) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:497) at org.codehaus.groovy.runtime.callsite.PlainObjectMetaMethodSite.doInvoke(PlainObjectMetaMethodSite.java:43) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite$PogoCachedMethodSiteNoUnwrapNoCoerce.invoke(PogoMetaMethodSite.java:190) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.call(PogoMetaMethodSite.java:70) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:47) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:115) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:119) at org.akhikhl.gretty.Runner.main(Runner.groovy:54) Caused by: java.net.BindException: 地址已在使用 at sun.nio.ch.Net.bind0(Native Method) at sun.nio.ch.Net.bind(Net.java:433) at sun.nio.ch.Net.bind(Net.java:425) at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223) at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74) at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:222) at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1147) at org.apache.tomcat.util.net.AbstractJsseEndpoint.init(AbstractJsseEndpoint.java:222) at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:599) at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:80) at org.apache.catalina.connector.Connector.initInternal(Connector.java:1074) ... 28 more 九月 13, 2026 9:17:45 下午 org.apache.catalina.core.StandardService startInternal 信息: Starting service [Tomcat] 九月 13, 2026 9:17:45 下午 org.apache.catalina.core.StandardEngine startInternal 信息: Starting Servlet engine: [Apache Tomcat/8.5.68] 九月 13, 2026 9:17:46 下午 org.apache.catalina.startup.ContextConfig getDefaultWebXmlFragment 信息: No global web.xml found 九月 13, 2026 9:17:47 下午 org.apache.jasper.servlet.TldScanner scanJars 信息: At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time. 21:17:47 INFO Tomcat 8.5.68 started and listening on port -1 21:17:47 INFO app runs at: 21:17:47 INFO http://localhost:-1/app > Task :appRun Press any key to stop the server. <===========--> 87% EXECUTING [16m 4s] > :appRun 1.2.网络环境： Windows 宿主机（192.168.31.85）：真正的局域网 IP，连接靶机和外部网络的桥头堡 Kali (WSL2 虚拟机，内部 IP 172.22.79.147)：攻击工具的实际运行环境。它处于 NAT 网络，局域网其他机器无法直接访问它靶机（192.168.31.27:8080）：受害者，运行着 log4shell-vulnerable-app，JDK 版本 8u65 构建wsl2的端口转发：

群友靶机-Netdata2

Wed, 26 Aug 2026 00:00:00 +0800

python缓存劫持

群友靶机-Preference

Mon, 24 Aug 2026 00:00:00 +0800

第二次首杀，半夜偶得

群友靶机-wellplayed