-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathindex.html
More file actions
263 lines (224 loc) · 44.6 KB
/
Copy pathindex.html
File metadata and controls
263 lines (224 loc) · 44.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
<!DOCTYPE html><html lang="zh-CN" data-theme="light"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><title>KB-AT的博客 - KB-AT</title><meta name="keywords" content="KB-AT 网络安全 渗透测试 Web安全 内网渗透"><meta name="author" content="AT"><meta name="copyright" content="AT"><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#ffffff"><meta name="description" content="网络安全 | 渗透测试 | Web安全 ｜ 内网渗透">
<meta property="og:type" content="website">
<meta property="og:title" content="KB-AT的博客">
<meta property="og:url" content="https://kb-at-zero.github.io/index.html">
<meta property="og:site_name" content="KB-AT的博客">
<meta property="og:description" content="网络安全 | 渗透测试 | Web安全 ｜ 内网渗透">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://kb-at-zero.github.io/img/touxiang.gif">
<meta property="article:author" content="AT">
<meta property="article:tag" content="KB-AT 网络安全 渗透测试 Web安全 内网渗透">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://kb-at-zero.github.io/img/touxiang.gif"><link rel="shortcut icon" href="/img/favicon.png"><link rel="canonical" href="https://kb-at-zero.github.io/"><link rel="preconnect" href="//cdn.jsdelivr.net"/><link rel="preconnect" href="//hm.baidu.com"/><link rel="preconnect" href="//busuanzi.ibruce.info"/><link rel="stylesheet" href="/css/index.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free/css/all.min.css" media="print" onload="this.media='all'"><script>var _hmt = _hmt || [];
(function() {
var hm = document.createElement("script");
hm.src = "https://hm.baidu.com/hm.js?https://hm.baidu.com/hm.js?ad9755e2bb4766b21a8ee011534e2a90";
var s = document.getElementsByTagName("script")[0];
s.parentNode.insertBefore(hm, s);
})();
</script><script>const GLOBAL_CONFIG = {
root: '/',
algolia: undefined,
localSearch: {"path":"search.xml","languages":{"hits_empty":"找不到您查询的内容：${query}"}},
translate: undefined,
noticeOutdate: undefined,
highlight: {"plugin":"highlighjs","highlightCopy":true,"highlightLang":true,"highlightHeightLimit":false},
copy: {
success: '复制成功',
error: '复制错误',
noSupport: '浏览器不支持'
},
relativeDate: {
homepage: false,
post: false
},
runtime: '',
date_suffix: {
just: '刚刚',
min: '分钟前',
hour: '小时前',
day: '天前',
month: '个月前'
},
copyright: undefined,
lightbox: 'fancybox',
Snackbar: undefined,
source: {
jQuery: 'https://cdn.jsdelivr.net/npm/jquery@latest/dist/jquery.min.js',
justifiedGallery: {
js: 'https://cdn.jsdelivr.net/npm/justifiedGallery/dist/js/jquery.justifiedGallery.min.js',
css: 'https://cdn.jsdelivr.net/npm/justifiedGallery/dist/css/justifiedGallery.min.css'
},
fancybox: {
js: 'https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@latest/dist/jquery.fancybox.min.js',
css: 'https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@latest/dist/jquery.fancybox.min.css'
}
},
isPhotoFigcaption: false,
islazyload: false,
isanchor: false
}</script><script id="config-diff">var GLOBAL_CONFIG_SITE = {
isPost: false,
isHome: true,
isHighlightShrink: false,
isToc: false,
postUpdate: '2022-12-19 18:01:36'
}</script><noscript><style type="text/css">
#nav {
opacity: 1
}
.justified-gallery img {
opacity: 1
}
#recent-posts time,
#post-meta time {
display: inline !important
}
</style></noscript><script>(win=>{
win.saveToLocal = {
set: function setWithExpiry(key, value, ttl) {
if (ttl === 0) return
const now = new Date()
const expiryDay = ttl * 86400000
const item = {
value: value,
expiry: now.getTime() + expiryDay,
}
localStorage.setItem(key, JSON.stringify(item))
},
get: function getWithExpiry(key) {
const itemStr = localStorage.getItem(key)
if (!itemStr) {
return undefined
}
const item = JSON.parse(itemStr)
const now = new Date()
if (now.getTime() > item.expiry) {
localStorage.removeItem(key)
return undefined
}
return item.value
}
}
win.getScript = url => new Promise((resolve, reject) => {
const script = document.createElement('script')
script.src = url
script.async = true
script.onerror = reject
script.onload = script.onreadystatechange = function() {
const loadState = this.readyState
if (loadState && loadState !== 'loaded' && loadState !== 'complete') return
script.onload = script.onreadystatechange = null
resolve()
}
document.head.appendChild(script)
})
win.activateDarkMode = function () {
document.documentElement.setAttribute('data-theme', 'dark')
if (document.querySelector('meta[name="theme-color"]') !== null) {
document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
}
}
win.activateLightMode = function () {
document.documentElement.setAttribute('data-theme', 'light')
if (document.querySelector('meta[name="theme-color"]') !== null) {
document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
}
}
const t = saveToLocal.get('theme')
if (t === 'dark') activateDarkMode()
else if (t === 'light') activateLightMode()
const asideStatus = saveToLocal.get('aside-status')
if (asideStatus !== undefined) {
if (asideStatus === 'hide') {
document.documentElement.classList.add('hide-aside')
} else {
document.documentElement.classList.remove('hide-aside')
}
}
})(window)</script><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="KB-AT的博客" type="application/atom+xml">
</head><body><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="author-avatar"><img class="avatar-img" src="/img/touxiang.gif" onerror="onerror=null;src='/img/friend_404.gif'" alt="avatar"/></div><div class="site-data"><div class="data-item is-center"><div class="data-item-link"><a href="/archives/"><div class="headline">文章</div><div class="length-num">16</div></a></div></div><div class="data-item is-center"><div class="data-item-link"><a href="/tags/"><div class="headline">标签</div><div class="length-num">22</div></a></div></div><div class="data-item is-center"><div class="data-item-link"><a href="/categories/"><div class="headline">分类</div><div class="length-num">13</div></a></div></div></div><hr/><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 时间轴</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></div><div class="menus_item"><a class="site-page" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> 友链</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div></div></div></div><div class="page" id="body-wrap"><header class="full_page" id="page-header" style="background-image: url('/img/index_top.jpg')"><nav id="nav"><span id="blog_name"><a id="site-name" href="/">KB-AT的博客</a></span><div id="menus"><div id="search-button"><a class="site-page social-icon search"><i class="fas fa-search fa-fw"></i><span> 搜索</span></a></div><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 时间轴</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></div><div class="menus_item"><a class="site-page" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> 友链</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div></div><div id="toggle-menu"><a class="site-page"><i class="fas fa-bars fa-fw"></i></a></div></div></nav><div id="site-info"><h1 id="site-title">KB-AT的博客</h1></div><div id="scroll-down"><i class="fas fa-angle-down scroll-down-effects"></i></div></header><main class="layout" id="content-inner"><div class="recent-posts" id="recent-posts"><div class="recent-post-item"><div class="post_cover left_radius"><a href="/2022/12/19/%E7%BA%A2%E9%98%9F-%E4%BB%A3%E7%90%86%E9%9A%A7%E9%81%93/" title="红队-代理隧道"> <img class="post_bg" src="/images/image-20220902231147705.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="红队-代理隧道"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/12/19/%E7%BA%A2%E9%98%9F-%E4%BB%A3%E7%90%86%E9%9A%A7%E9%81%93/" title="红队-代理隧道">红队-代理隧道</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-12-19T09:48:00.000Z" title="发表于 2022-12-19 17:48:00">2022-12-19</time></span><span class="article-meta tags"><span class="article-meta__separator">|</span><i class="fas fa-tag"></i><a class="article-meta__tags" href="/tags/%E4%BB%A3%E7%90%86%E9%9A%A7%E9%81%93/">代理隧道</a></span></div><div class="content">红队-代理隧道前言啥是代理隧道：理论上，任何接入互联网的计算机都可以被访问，但事实上，内网的计算机由于安全问题而被防火墙等边界设备做一些策略隔离，从而不被外界访问或诸多限制。这时我们可以借助一些端口转发工具来建立边界设备允许的协议通信，从而使我们可以访问内网环境，或者说内网机器可以与我们建立通信。也就是说代理隧道就是我们进入内网的通道。
正向代理架设在客户机和目标主机之间，简单的说，就是客户端主动向代理发送一个请求，然后代理向服务器请求并将获取的内容返回给客户端
基本情况下：
监听本地一个端口,然后连接部署在远程WEB的webshell,远端的webshell会把端口转发请求转发到本地或者本地内网远程的主机
Neo-reGeorghttps://github.com/L-codes/Neo-reGeorg
Neo-reGeorg 是一个旨在积极重构 reGeorg 的项目
用法：
1、设置密码生成 tunnel.(aspx|ashx|jsp|jspx|php) 并上传到WEB服务器
1python3 neoreg.py generate -k password
2、使用 neore ...</div></div></div><div class="recent-post-item"><div class="post_cover right_radius"><a href="/2022/12/19/%E7%BA%A2%E9%98%9Fjava%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E7%94%9F%E5%91%BD%E5%91%A8%E6%9C%9F/" title="红队-java代码审计生命周期"> <img class="post_bg" src="/images/image-20221111160018658.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="红队-java代码审计生命周期"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/12/19/%E7%BA%A2%E9%98%9Fjava%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E7%94%9F%E5%91%BD%E5%91%A8%E6%9C%9F/" title="红队-java代码审计生命周期">红队-java代码审计生命周期</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-12-19T08:19:00.000Z" title="发表于 2022-12-19 16:19:00">2022-12-19</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/">代码审计</a></span><span class="article-meta tags"><span class="article-meta__separator">|</span><i class="fas fa-tag"></i><a class="article-meta__tags" href="/tags/java%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/">java代码审计</a></span></div><div class="content">红队-java代码审计生命周期前言红队java代码审计生命周期中常见的一些漏洞学习总结以及一些审计思路。
红队java代码审计生命周期源码获取->审计环境配置->代码审计->poc&exp编写->后渗透利用->相关文档输出
源码获取
开源、二开（官网、github、码云）
相似站点批量扫备份文件
相似站点getshell打包
网盘搜索
咸鱼、淘宝、TG
云市场
……
审计环境
idea
vscode
jdk8（按源码支持的）
tomcat
burp
jd-gui
…..
代码审计快速代码审计
提取源码中的全部jsp，find /domain/ -name “*.jsp”,提取出来后用路径直接去用burp批量跑目录（可换请求的方法，GET、POST），把返回200(根据网站情况)的路径提取出来，表示可以直接未认证访问；然后在跟进这些jsp代码，通过查找相关的sink函数，在去定位source是否可控，如果可控那么就形成一条污染链，在看是否需要绕过sanitizer。
通过提取web.xml里面的servlet-name路径，然后 ...</div></div></div><div class="recent-post-item"><div class="post_cover left_radius"><a href="/2022/04/20/%E9%AA%8C%E8%AF%81%E7%A0%81%E8%AF%86%E5%88%AB-%E6%9A%B4%E5%8A%9B%E7%A0%B4%E8%A7%A3/" title="验证码识别&暴力破解"> <img class="post_bg" src="/images/ddddocr.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="验证码识别&暴力破解"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/04/20/%E9%AA%8C%E8%AF%81%E7%A0%81%E8%AF%86%E5%88%AB-%E6%9A%B4%E5%8A%9B%E7%A0%B4%E8%A7%A3/" title="验证码识别&暴力破解">验证码识别&暴力破解</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-04-20T14:22:00.000Z" title="发表于 2022-04-20 22:22:00">2022-04-20</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/Web%E5%AE%89%E5%85%A8/">Web安全</a></span><span class="article-meta tags"><span class="article-meta__separator">|</span><i class="fas fa-tag"></i><a class="article-meta__tags" href="/tags/%E6%9A%B4%E5%8A%9B%E7%A0%B4%E8%A7%A3/">暴力破解</a><span class="article-meta__link">•</span><a class="article-meta__tags" href="/tags/%E9%AA%8C%E8%AF%81%E7%A0%81%E8%AF%86%E5%88%AB/">验证码识别</a></span></div><div class="content">验证码识别&暴力破解前言对于平常Web渗透中，验证码的问题难倒一群英雄汉，前端加密+验证码更是直接放弃，所以下面就分享一下自己在渗透中对验证码识别和存在前端加密情况的暴力破解。
所有工具都是开源的，并且都是学习需求，切勿用于不法用途，觉得可以的话去给作者点个star吧。
验证码识别burp插件-captcha-killercaptcha-killer是只专注做好对各种验证码识别技术接口的调用工具，具体点就是burp通过同一个插件，就可以适配各种验证码识别接口，无需重复编写调用代码。
原GitHub项目地址：https://github.com/c0ny1/captcha-killer
修改版GitHub项目地址：https://github.com/f0ng/captcha-killer-modified
使用说明：https://gv7.me/articles/2019/burp-captcha-killer-usage/
将获取验证码的数据包发送到插件
使用burp抓取获取验证码数据包，然后右键captcha-killer -> send to captcha p ...</div></div></div><div class="recent-post-item"><div class="post_cover right_radius"><a href="/2022/02/15/fastjosn%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E5%88%86%E6%9E%90/" title="fastjosn漏洞原理分析"> <img class="post_bg" src="/images/fastjson.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="fastjosn漏洞原理分析"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/02/15/fastjosn%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E5%88%86%E6%9E%90/" title="fastjosn漏洞原理分析">fastjosn漏洞原理分析</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-02-15T03:43:00.000Z" title="发表于 2022-02-15 11:43:00">2022-02-15</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/fastjson/">fastjson</a></span><span class="article-meta tags"><span class="article-meta__separator">|</span><i class="fas fa-tag"></i><a class="article-meta__tags" href="/tags/%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/">反序列化</a></span></div><div class="content">fastjosn漏洞原理分析前言Fastjson 是一个 Java 库，可以将 Java 对象转换为 JSON 格式，当然它也可以将 JSON 字符串转换为 Java 对象。Fastjson 可以操作任何 Java 对象，即使是一些预先存在的没有源码的对象。Fastjson 源码地址：https://github.com/alibaba/fastjsonFastjson 中文 Wiki：https://github.com/alibaba/fastjson/wiki/Quick-Start-CNJar下载：https://mvnrepository.com/artifact/com.alibaba/fastjson/1.2.24
fastjson序列化与反序列化序列化Student.java
12345678910111213141516171819202122232425262728public class Student { private String name; private int age; public Student() { ...</div></div></div><div class="recent-post-item"><div class="post_cover left_radius"><a href="/2021/12/19/CVE-2021-42278-42287%EF%BC%88%E5%9F%9F%E6%8E%A7%EF%BC%89%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E4%B8%8E%E5%88%A9%E7%94%A8/" title="CVE-2021-42278&42287（域控）漏洞分析与利用"> <img class="post_bg" src="/images/dc.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="CVE-2021-42278&42287（域控）漏洞分析与利用"></a></div><div class="recent-post-info"><a class="article-title" href="/2021/12/19/CVE-2021-42278-42287%EF%BC%88%E5%9F%9F%E6%8E%A7%EF%BC%89%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E4%B8%8E%E5%88%A9%E7%94%A8/" title="CVE-2021-42278&42287（域控）漏洞分析与利用">CVE-2021-42278&42287（域控）漏洞分析与利用</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2021-12-19T14:42:00.000Z" title="发表于 2021-12-19 22:42:00">2021-12-19</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/%E5%9F%9F%E6%B8%97%E9%80%8F/">域渗透</a></span><span class="article-meta tags"><span class="article-meta__separator">|</span><i class="fas fa-tag"></i><a class="article-meta__tags" href="/tags/%E5%86%85%E7%BD%91/">内网</a></span></div><div class="content">CVE-2021-42278/42287（域控）漏洞分析与利用0x00 漏洞介绍2021 年 11 月 9 日，国外研究员在推特上发布了 Active Directory 相关的 CVE，CVE-2021-42278 & CVE-2021-42287 ，两个漏洞组合可导致域内普通用户权限提升至域管权限。
CVE-2021-42278，机器账户的名字一般来说应该以$结尾，但AD没有对域内机器账户名做验证。
CVE-2021-42287，配合 CVE-2021-42278 使用，创建与域控机器账户名字相同的机器账户（不以$结尾），账户请求一个TGT后，更名账户，然后通过S4U2self 申请TGS Ticket，接着域控在 TGS_REP 阶段，这个账户不存在的时候，DC会使用自己的密钥加密 TGS Ticket ，提供一个属于该账户的 PAC，然后我们就得到了一个高权限ST。
0x01 影响范围
CVE-2021-42287
123456789101112131415161718Windows Server 2012 R2 (Server Core installation) ...</div></div></div><div class="recent-post-item"><div class="post_cover right_radius"><a href="/2021/09/26/frp%E6%94%B9%E9%80%A0/" title="frp改造"> <img class="post_bg" src="/images/frp.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="frp改造"></a></div><div class="recent-post-info"><a class="article-title" href="/2021/09/26/frp%E6%94%B9%E9%80%A0/" title="frp改造">frp改造</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2021-09-26T06:59:00.000Z" title="发表于 2021-09-26 14:59:00">2021-09-26</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/%E5%86%85%E7%BD%91/">内网</a></span><span class="article-meta tags"><span class="article-meta__separator">|</span><i class="fas fa-tag"></i><a class="article-meta__tags" href="/tags/%E5%85%8D%E6%9D%80/">免杀</a><span class="article-meta__link">•</span><a class="article-meta__tags" href="/tags/frp/">frp</a></span></div><div class="content">frp改造
.ini配置文件泄露服务器信息
frp 建立 TLS 连接的第一个字节为 0x17
客户端的留存的配置文件较敏感
去除特征值
通过配置文件加密压缩数据，达到去除流量特征的目的。
1234567891011121314[common]server_addr = 192.168.205.137server_port = 7000token = 123456tls_enable = trueuse_encryption = trueuse_compression = trueprotocol = websocket[rdp]type = tcplocal_ip = 127.0.0.1 local_port = 3389remote_port = 7001
使用tls： tls_enable = true
压缩数据： use_compression = true。
使用websocket通信： protocol = websocket
tls特征
非TL ...</div></div></div><div class="recent-post-item"><div class="post_cover left_radius"><a href="/2021/06/21/%E5%9F%9F%E6%B8%97%E9%80%8F%E6%80%BB%E7%BB%93/" title="域渗透总结"> <img class="post_bg" src="/images/ad.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="域渗透总结"></a></div><div class="recent-post-info"><a class="article-title" href="/2021/06/21/%E5%9F%9F%E6%B8%97%E9%80%8F%E6%80%BB%E7%BB%93/" title="域渗透总结">域渗透总结</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2021-06-21T06:30:00.000Z" title="发表于 2021-06-21 14:30:00">2021-06-21</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/%E5%9F%9F/">域</a></span><span class="article-meta tags"><span class="article-meta__separator">|</span><i class="fas fa-tag"></i><a class="article-meta__tags" href="/tags/%E5%9F%9F%E6%B8%97%E9%80%8F/">域渗透</a></span></div><div class="content">域渗透总结学习
总结/记录一下域渗透的渗透过程和一些坑点。
注意事项
https://pentestlab.blog/tag/ntds-dit/https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abusehttps://adsecurity.org/
在域中对机器进行访问（如dir/psexec等），不能使用IP，需要使用完整的机器名.域名。注意域内相关的攻击，最好先把攻击机的DNS设置为域控，不然要手工把相关的域名、机器名的解析加入到hosts文件。
123456789101112票据，经过KDC（一般就是域控）验证用户名密码正确后，生成的会话票据（可以理解为网站登录后的session）。黄金票据，使用krbtgt账号的hash，可以生成任意用户的票据。白银票据，使用主机账号的hash，可以生成用来控制该主机的服务票据（CIFS、WMI等）。非约束委派，服务可以使用其他用户的票据，如果其他用户登录过这个服务，则可以再这台服务的主机上导出登录用户的票据。约束委派，一个用户可 ...</div></div></div><div class="recent-post-item"><div class="post_cover right_radius"><a href="/2021/06/14/%E5%85%8D%E6%9D%80%E6%80%BB%E7%BB%93/" title="免杀总结"> <img class="post_bg" src="/images/image-20221111160018658.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="免杀总结"></a></div><div class="recent-post-info"><a class="article-title" href="/2021/06/14/%E5%85%8D%E6%9D%80%E6%80%BB%E7%BB%93/" title="免杀总结">免杀总结</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2021-06-14T08:00:00.000Z" title="发表于 2021-06-14 16:00:00">2021-06-14</time></span><span class="article-meta tags"><span class="article-meta__separator">|</span><i class="fas fa-tag"></i><a class="article-meta__tags" href="/tags/%E5%85%8D%E6%9D%80/">免杀</a></span></div><div class="content">免杀总结学习总结免杀技巧
1、杀毒原理360、腾讯电脑管家、火绒剑、金山毒霸、瑞星等等，这几个杀毒软件领头羊，现在的杀毒软件都无法脱离三个部分，扫描器、病毒库、虚拟机。然而一个杀毒软件做的是否好用，最主要的还是扫描器的速度、准确率以及病毒库是否庞大。
1.1、基于特征码的静态扫描技术这种技术很容易被人想到，所以第一代的杀毒软件出现了，他们的杀毒思想就是，我只要匹配到特征字符串就可以判断出来这个文件是一个病毒。但这种方法在当今病毒技术迅猛发展的形势下已经起不到很好的作用了。
1.2、启发式扫描为了对付病毒的不断变化和对未知病毒的研究，启发式扫描方式出现了。启发式扫描是通过分析指令出现的顺序，或特定组合情况等常见病毒的标准特征来判断文件是否感染未知病毒。
可以根据扫描特定的行为或多种行为的组合来判断一个程序是否是病毒。例如，制定一套打分机制，在系统目录下释放文件得20分，对分区进行格式化得100分，对启动项进行操作得50分等，只要评分达到某个预设值，即可判断为病毒文件。
1.3、虚拟机技术查毒引擎中的虚拟机，并不是像 VMWare 的工作原理那样，为待查的可执行程序创建一个虚拟的执行环境 ...</div></div></div><div class="recent-post-item"><div class="post_cover left_radius"><a href="/2021/05/03/Apache-Shiro-RememberMe-%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/" title="Apache Shiro RememberMe 反序列化漏洞分析"> <img class="post_bg" src="/images/shiro.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Apache Shiro RememberMe 反序列化漏洞分析"></a></div><div class="recent-post-info"><a class="article-title" href="/2021/05/03/Apache-Shiro-RememberMe-%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/" title="Apache Shiro RememberMe 反序列化漏洞分析">Apache Shiro RememberMe 反序列化漏洞分析</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2021-05-03T15:36:00.000Z" title="发表于 2021-05-03 23:36:00">2021-05-03</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/shiro/">shiro</a></span><span class="article-meta tags"><span class="article-meta__separator">|</span><i class="fas fa-tag"></i><a class="article-meta__tags" href="/tags/%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/">反序列化</a></span></div><div class="content">Apache Shiro RememberMe 反序列化漏洞分析
概述Apache Shiro 是ASF旗下的一款开源软件，它提供了一个强大而灵活的安全框架，提供身份验证、授权、密码学和会话管理。Apache Shiro 1.2.4及以前版本中，加密的用户信息序列化后存储在名为remember-me的Cookie中，攻击者可以使用Shiro的默认密钥伪造用户Cookie，触发Java反序列化漏洞，进而在目标机器上执行任意命令
漏洞简介issues：https://issues.apache.org/jira/browse/SHIRO-550在shiro <= 1.2.4版本中，如果用户选择了Remember Me，那么shiro就会进行如下操作
1234获取Remember Me cookie值Base64解码AES解码反序列化
而我们知道Remember cookie的生成方式是
1234序列化AES加密Base64加密生成Remember Me cookie值
由于AES加解密的秘钥被硬编码在代码中，这意味着有权访问源代码的任何人都知道默认加密密钥是什么，因此，攻击者可 ...</div></div></div><div class="recent-post-item"><div class="post_cover right_radius"><a href="/2021/04/23/%E5%BE%AE%E4%BF%A1-Chrome%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/" title="微信-Chrome远程代码执行"> <img class="post_bg" src="/images/chrome.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="微信-Chrome远程代码执行"></a></div><div class="recent-post-info"><a class="article-title" href="/2021/04/23/%E5%BE%AE%E4%BF%A1-Chrome%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/" title="微信-Chrome远程代码执行">微信-Chrome远程代码执行</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2021-04-23T09:22:00.000Z" title="发表于 2021-04-23 17:22:00">2021-04-23</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox"></i><a class="article-meta__categories" href="/categories/%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/">远程代码执行</a></span><span class="article-meta tags"><span class="article-meta__separator">|</span><i class="fas fa-tag"></i><a class="article-meta__tags" href="/tags/%E5%BE%AE%E4%BF%A1/">微信</a><span class="article-meta__link">•</span><a class="article-meta__tags" href="/tags/chrome/">chrome</a></span></div><div class="content">微信-Chrome远程代码执行前言2021年04月13日,国外安全研究员发布了Chrome 远程代码执行 0Day的POC详情，后又爆出微信内置浏览器用的就是低版本Chrome内核，且默认关闭沙盒–no-sandbox，正好能够结合Chrome漏洞进行利用，这里借着这个时间来复现一下这个漏洞。
Chrome漏洞复现国外安全研究员发布了Chrome远程代码执行0Day漏洞的POC详情，漏洞为“严重”级别。攻击者利用此漏洞，构造一个恶意的web页面，用户访问该页面时，会造成远程代码执行。
大量采用Chrome内核的浏览器同样也会受此漏洞影响，如微软的Edge浏览器，影响版本：Chrome: <=89.0.4389.114，可通过在Chrome浏览器中输入chrome://version查看版本等信息。
本地测试版本：89.0.4389.9，这个漏洞利用条件是必须关闭Chrome浏览器沙盒–no-sandbox，默认为开启状态，所以一般用户不会受此漏洞影响。
1chrome.exe -no-sandbox
POC验证（弹计算器）：https://github.com/r4j0x00 ...</div></div></div><nav id="pagination"><div class="pagination"><span class="page-number current">1</span><a class="page-number" href="/page/2/#content-inner">2</a><a class="extend next" rel="next" href="/page/2/#content-inner"><i class="fas fa-chevron-right fa-fw"></i></a></div></nav></div><div class="aside-content" id="aside-content"><div class="card-widget card-info"><div class="card-info-avatar is-center"><img class="avatar-img" src="/img/touxiang.gif" onerror="this.onerror=null;this.src='/img/friend_404.gif'" alt="avatar"/><div class="author-info__name">AT</div><div class="author-info__description">网络安全 | 渗透测试 | Web安全 ｜ 内网渗透</div></div><div class="card-info-data"><div class="card-info-data-item is-center"><a href="/archives/"><div class="headline">文章</div><div class="length-num">16</div></a></div><div class="card-info-data-item is-center"><a href="/tags/"><div class="headline">标签</div><div class="length-num">22</div></a></div><div class="card-info-data-item is-center"><a href="/categories/"><div class="headline">分类</div><div class="length-num">13</div></a></div></div><a class="button--animated" id="card-info-btn" target="_blank" rel="noopener" href="https://github.com/kb-at-zero"><i class="fab fa-github"></i><span>Follow Me</span></a></div><div class="card-widget card-announcement"><div class="item-headline"><i class="fas fa-bullhorn card-announcement-animation"></i><span>公告</span></div><div class="announcement_content">记录、学习、分享、成长</div></div><div class="sticky_layout"><div class="card-widget card-recent-post"><div class="item-headline"><i class="fas fa-history"></i><span>最新文章</span></div><div class="aside-list"><div class="aside-list-item"><a class="thumbnail" href="/2022/12/19/%E7%BA%A2%E9%98%9F-%E4%BB%A3%E7%90%86%E9%9A%A7%E9%81%93/" title="红队-代理隧道"><img src="/images/image-20220902231147705.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="红队-代理隧道"/></a><div class="content"><a class="title" href="/2022/12/19/%E7%BA%A2%E9%98%9F-%E4%BB%A3%E7%90%86%E9%9A%A7%E9%81%93/" title="红队-代理隧道">红队-代理隧道</a><time datetime="2022-12-19T09:48:00.000Z" title="发表于 2022-12-19 17:48:00">2022-12-19</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2022/12/19/%E7%BA%A2%E9%98%9Fjava%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E7%94%9F%E5%91%BD%E5%91%A8%E6%9C%9F/" title="红队-java代码审计生命周期"><img src="/images/image-20221111160018658.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="红队-java代码审计生命周期"/></a><div class="content"><a class="title" href="/2022/12/19/%E7%BA%A2%E9%98%9Fjava%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E7%94%9F%E5%91%BD%E5%91%A8%E6%9C%9F/" title="红队-java代码审计生命周期">红队-java代码审计生命周期</a><time datetime="2022-12-19T08:19:00.000Z" title="发表于 2022-12-19 16:19:00">2022-12-19</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2022/04/20/%E9%AA%8C%E8%AF%81%E7%A0%81%E8%AF%86%E5%88%AB-%E6%9A%B4%E5%8A%9B%E7%A0%B4%E8%A7%A3/" title="验证码识别&暴力破解"><img src="/images/ddddocr.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="验证码识别&暴力破解"/></a><div class="content"><a class="title" href="/2022/04/20/%E9%AA%8C%E8%AF%81%E7%A0%81%E8%AF%86%E5%88%AB-%E6%9A%B4%E5%8A%9B%E7%A0%B4%E8%A7%A3/" title="验证码识别&暴力破解">验证码识别&暴力破解</a><time datetime="2022-04-20T14:22:00.000Z" title="发表于 2022-04-20 22:22:00">2022-04-20</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2022/02/15/fastjosn%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E5%88%86%E6%9E%90/" title="fastjosn漏洞原理分析"><img src="/images/fastjson.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="fastjosn漏洞原理分析"/></a><div class="content"><a class="title" href="/2022/02/15/fastjosn%E6%BC%8F%E6%B4%9E%E5%8E%9F%E7%90%86%E5%88%86%E6%9E%90/" title="fastjosn漏洞原理分析">fastjosn漏洞原理分析</a><time datetime="2022-02-15T03:43:00.000Z" title="发表于 2022-02-15 11:43:00">2022-02-15</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2021/12/19/CVE-2021-42278-42287%EF%BC%88%E5%9F%9F%E6%8E%A7%EF%BC%89%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E4%B8%8E%E5%88%A9%E7%94%A8/" title="CVE-2021-42278&42287（域控）漏洞分析与利用"><img src="/images/dc.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="CVE-2021-42278&42287（域控）漏洞分析与利用"/></a><div class="content"><a class="title" href="/2021/12/19/CVE-2021-42278-42287%EF%BC%88%E5%9F%9F%E6%8E%A7%EF%BC%89%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E4%B8%8E%E5%88%A9%E7%94%A8/" title="CVE-2021-42278&42287（域控）漏洞分析与利用">CVE-2021-42278&42287（域控）漏洞分析与利用</a><time datetime="2021-12-19T14:42:00.000Z" title="发表于 2021-12-19 22:42:00">2021-12-19</time></div></div></div></div><div class="card-widget card-categories"><div class="item-headline">
<i class="fas fa-folder-open"></i>
<span>分类</span>
<a class="card-more-btn" href="/categories/" title="查看更多">
<i class="fas fa-angle-right"></i></a>
</div>
<ul class="card-category-list" id="aside-cat-list">
<li class="card-category-list-item "><a class="card-category-list-link" href="/categories/SQL-Server/"><span class="card-category-list-name">SQL Server</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/Web%E5%AE%89%E5%85%A8/"><span class="card-category-list-name">Web安全</span><span class="card-category-list-count">3</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/Wiki/"><span class="card-category-list-name">Wiki</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/fastjson/"><span class="card-category-list-name">fastjson</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/shiro/"><span class="card-category-list-name">shiro</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/"><span class="card-category-list-name">代码审计</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/%E5%86%85%E7%BD%91/"><span class="card-category-list-name">内网</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/%E5%9F%9F/"><span class="card-category-list-name">域</span><span class="card-category-list-count">1</span></a></li>
</ul></div><div class="card-widget card-tags"><div class="item-headline"><i class="fas fa-tags"></i><span>标签</span></div><div class="card-tag-cloud"><a href="/tags/SQL-Server/" style="font-size: 1.1em; color: #999">SQL Server</a> <a href="/tags/Sql%E6%B3%A8%E5%85%A5/" style="font-size: 1.1em; color: #999">Sql注入</a> <a href="/tags/chrome/" style="font-size: 1.1em; color: #999">chrome</a> <a href="/tags/frp/" style="font-size: 1.1em; color: #999">frp</a> <a href="/tags/java%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/" style="font-size: 1.1em; color: #999">java代码审计</a> <a href="/tags/netkeeper/" style="font-size: 1.1em; color: #999">netkeeper</a> <a href="/tags/shadowsocks/" style="font-size: 1.1em; color: #999">shadowsocks</a> <a href="/tags/ssr%E7%A7%91%E5%AD%A6%E4%B8%8A%E7%BD%91/" style="font-size: 1.1em; color: #999">ssr科学上网</a> <a href="/tags/%E4%BB%A3%E7%90%86%E9%9A%A7%E9%81%93/" style="font-size: 1.1em; color: #999">代理隧道</a> <a href="/tags/%E4%BF%A1%E6%81%AF%E6%94%B6%E9%9B%86/" style="font-size: 1.1em; color: #999">信息收集</a> <a href="/tags/%E5%85%8D%E6%9D%80/" style="font-size: 1.3em; color: #99a1ac">免杀</a> <a href="/tags/%E5%86%85%E7%BD%91/" style="font-size: 1.1em; color: #999">内网</a> <a href="/tags/%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/" style="font-size: 1.3em; color: #99a1ac">反序列化</a> <a href="/tags/%E5%9F%9F%E6%B8%97%E9%80%8F/" style="font-size: 1.1em; color: #999">域渗透</a> <a href="/tags/%E5%BE%AE%E4%BF%A1/" style="font-size: 1.1em; color: #999">微信</a> <a href="/tags/%E6%8F%90%E6%9D%83/" style="font-size: 1.1em; color: #999">提权</a> <a href="/tags/%E6%94%BB%E9%98%B2%E6%BC%94%E7%BB%83/" style="font-size: 1.1em; color: #999">攻防演练</a> <a href="/tags/%E6%97%A0%E7%BA%BF%E7%A0%B4%E8%A7%A3/" style="font-size: 1.1em; color: #999">无线破解</a> <a href="/tags/%E6%9A%B4%E5%8A%9B%E7%A0%B4%E8%A7%A3/" style="font-size: 1.1em; color: #999">暴力破解</a> <a href="/tags/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/" style="font-size: 1.5em; color: #99a9bf">渗透测试</a> <a href="/tags/%E7%9F%A5%E8%AF%86%E5%BA%93/" style="font-size: 1.1em; color: #999">知识库</a> <a href="/tags/%E9%AA%8C%E8%AF%81%E7%A0%81%E8%AF%86%E5%88%AB/" style="font-size: 1.1em; color: #999">验证码识别</a></div></div><div class="card-widget card-archives"><div class="item-headline"><i class="fas fa-archive"></i><span>归档</span><a class="card-more-btn" href="/archives/" title="查看更多">
<i class="fas fa-angle-right"></i></a></div><ul class="card-archive-list"><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2022/12/"><span class="card-archive-list-date">十二月 2022</span><span class="card-archive-list-count">2</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2022/04/"><span class="card-archive-list-date">四月 2022</span><span class="card-archive-list-count">1</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2022/02/"><span class="card-archive-list-date">二月 2022</span><span class="card-archive-list-count">1</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2021/12/"><span class="card-archive-list-date">十二月 2021</span><span class="card-archive-list-count">1</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2021/09/"><span class="card-archive-list-date">九月 2021</span><span class="card-archive-list-count">1</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2021/06/"><span class="card-archive-list-date">六月 2021</span><span class="card-archive-list-count">2</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2021/05/"><span class="card-archive-list-date">五月 2021</span><span class="card-archive-list-count">1</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2021/04/"><span class="card-archive-list-date">四月 2021</span><span class="card-archive-list-count">4</span></a></li></ul></div><div class="card-widget card-webinfo"><div class="item-headline"><i class="fas fa-chart-line"></i><span>网站资讯</span></div><div class="webinfo"><div class="webinfo-item"><div class="item-name">文章数目 :</div><div class="item-count">16</div></div><div class="webinfo-item"><div class="item-name">本站访客数 :</div><div class="item-count" id="busuanzi_value_site_uv"></div></div><div class="webinfo-item"><div class="item-name">本站总访问量 :</div><div class="item-count" id="busuanzi_value_site_pv"></div></div><div class="webinfo-item"><div class="item-name">最后更新时间 :</div><div class="item-count" id="last-push-date" data-lastPushDate="2022-12-19T10:01:36.286Z"></div></div></div></div></div></div></main><footer id="footer"><div id="footer-wrap"><div class="copyright">©2018 - 2022 By AT</div><div class="footer_custom_text">Hi, welcome to my <a href="https://kb-at-zero.github.io/">blog</a>!</div></div></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="darkmode" type="button" title="浅色和深色模式转换"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button" title="单栏和双栏切换"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside_config" type="button" title="设置"><i class="fas fa-cog fa-spin"></i></button><button id="go-up" type="button" title="回到顶部"><i class="fas fa-arrow-up"></i></button></div></div><div id="local-search"><div class="search-dialog"><div class="search-dialog__title" id="local-search-title">本地搜索</div><div id="local-input-panel"><div id="local-search-input"><div class="local-search-box"><input class="local-search-box--input" placeholder="搜索文章" type="text"/></div></div></div><hr/><div id="local-search-results"></div><span class="search-close-button"><i class="fas fa-times"></i></span></div><div id="search-mask"></div></div><div><script src="/js/utils.js"></script><script src="/js/main.js"></script><script src="/js/search/local-search.js"></script><div class="js-pjax"></div><script async data-pjax src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script></div><script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"pluginRootPath":"live2dw/","pluginJsPath":"lib/","pluginModelPath":"assets/","model":{"jsonPath":"/live2dw/assets/miku.model.json"},"display":{"position":"right","width":150,"height":300},"mobile":{"show":true},"log":false,"tagMode":false});</script></body></html>