|
|
<!DOCTYPE html><html lang="zh-CN"><head><meta charset="utf-8"><meta http-equiv="x-dns-prefetch-control" content="on"><meta name="viewport" content="width=device-width,initial-scale=1,minimum-scale=1,maximum-scale=1,user-scalable=no"><meta name="renderer" content="webkit"><meta name="force-rendering" content="webkit"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><meta name="HandheldFriendly" content="True"><meta name="mobile-web-app-capable" content="yes"><link rel="shortcut icon" href="https://hans362-img.oss.0vv0.top/favicon.ico"><link rel="icon" type="image/png" sizes="16x16" href="https://hans362-img.oss.0vv0.top/favicon-16x16.png"><link rel="icon" type="image/png" sizes="32x32" href="https://hans362-img.oss.0vv0.top/favicon-32x32.png"><link rel="apple-touch-icon" sizes="180x180" href="https://hans362-img.oss.0vv0.top/apple-touch-icon.png"><link rel="mask-icon" href="https://hans362-img.oss.0vv0.top/safari-pinned-tab.svg"><title>归档：2020/2 | Hans362 's Blog</title><meta name="keywords" content="Hans362"><meta name="description" content="不以物喜，不以己悲"><meta property="og:type" content="website"><meta property="og:title" content="Hans362 's Blog"><meta property="og:url" content="https://blog.hans362.cn/archives/2020/02/"><meta property="og:site_name" content="Hans362 's Blog"><meta property="og:description" content="不以物喜，不以己悲"><meta property="og:locale" content="zh_CN"><meta property="article:author" content="Hans362"><meta property="article:tag" content="Hans362"><meta name="twitter:card" content="summary_large_image"><link rel="stylesheet" href="/css/style/main.css"><script src="/js/darkmode.js"></script><link rel="dns-prefetch" href="https://analytics.0vv0.top"><link rel="preconnect" href="https://hans362-img.oss.0vv0.top"><meta name="generator" content="Hexo 7.1.1"><link rel="alternate" href="/atom.xml" title="Hans362 's Blog" type="application/atom+xml"></head><body><div class="app-shell-loader">加载中...</div><div class="container" tabindex="-1"><header><div class="header__left"><a href="/" class="button"><span class="logo__text">Hans362 's Blog</span></a></div><div class="header__right"><div class="navbar__menus"><a href="/" class="button"><div class="navbar-menu">首页</div></a><a href="/archives/" class="button"><div class="navbar-menu">归档</div></a><a href="/tags/" class="button"><div class="navbar-menu">标签</div></a><a href="/bangumi/" class="button"><div class="navbar-menu">追番</div></a><a href="/links/" class="button"><div class="navbar-menu">友链</div></a><a href="/about/" class="button"><div class="navbar-menu">关于</div></a><a href="/atom.xml" class="button"><div class="navbar-menu">RSS</div></a></div><a href="/search/" class="button"><div id="btn-search"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1024 1024" width="24" height="24" fill="currentColor" stroke="currentColor" stroke-width="32"><path d="M192 448c0-141.152 114.848-256 256-256s256 114.848 256 256-114.848 256-256 256-256-114.848-256-256z m710.624 409.376l-206.88-206.88A318.784 318.784 0 0 0 768 448c0-176.736-143.264-320-320-320S128 271.264 128 448s143.264 320 320 320a318.784 318.784 0 0 0 202.496-72.256l206.88 206.88 45.248-45.248z"></path></svg></div></a><a href="javaScript:void(0);" rel="external nofollow noreferrer" class="button"><div id="btn-toggle-dark"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"></path></svg></div></a><a href="#" class="button" id="b2t" aria-label="回到顶部" title="回到顶部"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1024 1024" width="32" height="32"><path d="M233.376 722.752L278.624 768 512 534.624 745.376 768l45.248-45.248L512 444.128zM192 352h640V288H192z" fill="currentColor"></path></svg> </a><a class="dropdown-icon button" tabindex="0"><div id="btn-dropdown"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" width="24" height="24" fill="none" stroke="currentColor" stroke-width="0.7" stroke-linecap="round" stroke-linejoin="round"><path fill="currentColor" d="M3.314,4.8h13.372c0.41,0,0.743-0.333,0.743-0.743c0-0.41-0.333-0.743-0.743-0.743H3.314c-0.41,0-0.743,0.333-0.743,0.743C2.571,4.467,2.904,4.8,3.314,4.8z M16.686,15.2H3.314c-0.41,0-0.743,0.333-0.743,0.743s0.333,0.743,0.743,0.743h13.372c0.41,0,0.743-0.333,0.743-0.743S17.096,15.2,16.686,15.2z M16.686,9.257H3.314c-0.41,0-0.743,0.333-0.743,0.743s0.333,0.743,0.743,0.743h13.372c0.41,0,0.743-0.333,0.743-0.743S17.096,9.257,16.686,9.257z"></path></svg></div></a><div class="dropdown-menus" id="dropdown-menus"><a href="/" class="dropdown-menu button">首页</a> <a href="/archives/" class="dropdown-menu button">归档</a> <a href="/tags/" class="dropdown-menu button">标签</a> <a href="/bangumi/" class="dropdown-menu button">追番</a> <a href="/links/" class="dropdown-menu button">友链</a> <a href="/about/" class="dropdown-menu button">关于</a> <a href="/atom.xml" class="dropdown-menu button">RSS</a></div></div></header><cover><div class="cover__logo"><h1>Hans362 's Blog</h1></div><div class="cover__intro"><p>不以物喜，不以己悲</p></div></cover><main><div class="post-list"><div class="post-entry card"><div class="post-entry__header"></div><div class="post-entry__content"><h2 class="post-entry__title">一次任意文件上传漏洞的实战经历</h2><p><s>这一切都要从一只蝙蝠说起…</s></p><p>最近看到了一个站，是某高中的在线英语人机对话练习平台，目测了一下网站应该是外包的，因为首页上还有客服的 QQ 和定制的联系方式…</p><p>像这种看上去<s>粗制滥造</s>的小网站肯定一挖一堆洞…果然1小时后搞定</p><p><strong>声明：本文作者没有利用该漏洞做出任何恶意或违法行为，也未触及任何数据，本文仅限技术研究与讨论，严禁用于非法用途，否则产生的一切后果自行承担</strong></p></div><div class="post-entry__meta"><a href="/archives/2020/02/" class="post-meta__date button">2020-02-29</a> <span class="separate-dot"></span> <a href="/categories/%E6%9D%82%E6%96%87/" class="button"><span class="post-meta__cats">杂文</span></a><style>.post-meta__pv{color:var(--t-l);visibility:hidden;opacity:0;transition:.2s}</style><span class="separate-dot"></span> <span class="post-meta__pv"></span></div><a href="/post/arbitary-file-upload-vulnerabilty/" class="post-entry__link">一次任意文件上传漏洞的实战经历</a></div><div class="post-entry card"><div class="post-entry__header"></div><div class="post-entry__content"><h2 class="post-entry__title">【转载】不能把冬天唱成春的开始</h2><blockquote><p>本文据传是成都七中的开课致辞，原文链接（现已被屏蔽）：<a target="_blank" rel="noopener" href="http://mp.weixin.qq.com/s?__biz=MzU2NjYwNzY3OQ==&mid=2247485068&idx=1&sn=96e2868cfdec5ba4e281e933a89551a9&chksm=fca8acdccbdf25cadc1f3ceb798feb16c01351e4dc10c6b2015048290a28ec0857dee7820b4e&mpshare=1&scene=23&srcid=&sharer_sharetime=1581432513873&sharer_shareid=cbef77fc67bcd1a7d4a59ca7933ee127#rd">成都七中老师开课致辞：不能把冬天唱成春的开始</a><br>由于无法确认原作者，暂且转载，如有不妥或侵权请务必与我联系：i@hans362.cn，感谢。</p></blockquote></div><div class="post-entry__meta"><a href="/archives/2020/02/" class="post-meta__date button">2020-02-12</a> <span class="separate-dot"></span> <a href="/categories/%E6%9D%82%E6%96%87/" class="button"><span class="post-meta__cats">杂文</span></a><style>.post-meta__pv{color:var(--t-l);visibility:hidden;opacity:0;transition:.2s}</style><span class="separate-dot"></span> <span class="post-meta__pv"></span></div><a href="/post/never-regard-winter-as-the-start-of-spring/" class="post-entry__link">【转载】不能把冬天唱成春的开始</a></div></div></main><footer><p class="footer-copyright">Copyright © 2017 - 2025 <a href="/">Hans362 's Blog</a></p><p>Powered by <a href="https://hexo.io" target="_blank">Hexo</a> | Theme - <a href="https://github.com/ChrAlpha/hexo-theme-cards" target="_blank">Cards</a></p><script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script><ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-8746554831230893" data-ad-slot="6356225601" data-ad-format="auto" data-full-width-responsive="true"></ins><script>(adsbygoogle=window.adsbygoogle||[]).push({})</script></footer></div><script defer src="https://blog.hans362.cn/npm/vanilla-lazyload@17.8.3/dist/lazyload.min.js"></script><script>window.lazyLoadOptions={elements_selector:".lazy"}</script><script async defer data-website-id="5d181692-8a81-4c20-a282-cee87a6b90ef" src="https://analytics.0vv0.top/vue.js"></script><script src="/js/pageviews.js"></script><link rel="stylesheet" href="https://blog.hans362.cn/npm/katex@0.16.0/dist/katex.min.css" crossorigin="anonymous"></body></html> |