|
|
<!DOCTYPE html><html lang="zh-CN"><head><meta charset="utf-8"><meta http-equiv="x-dns-prefetch-control" content="on"><meta name="viewport" content="width=device-width,initial-scale=1,minimum-scale=1,maximum-scale=1,user-scalable=no"><meta name="renderer" content="webkit"><meta name="force-rendering" content="webkit"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><meta name="HandheldFriendly" content="True"><meta name="mobile-web-app-capable" content="yes"><link rel="shortcut icon" href="https://hans362-img.oss.0vv0.top/favicon.ico"><link rel="icon" type="image/png" sizes="16x16" href="https://hans362-img.oss.0vv0.top/favicon-16x16.png"><link rel="icon" type="image/png" sizes="32x32" href="https://hans362-img.oss.0vv0.top/favicon-32x32.png"><link rel="apple-touch-icon" sizes="180x180" href="https://hans362-img.oss.0vv0.top/apple-touch-icon.png"><link rel="mask-icon" href="https://hans362-img.oss.0vv0.top/safari-pinned-tab.svg"><title>一次任意文件上传漏洞的实战经历 | Hans362 's Blog</title><meta name="keywords" content="Web, 网络安全, 漏洞, 实战, Hans362"><meta name="description" content="这一切都要从一只蝙蝠说起… 最近看到了一个站，是某高中的在线英语人机对话练习平台，目测了一下网站应该是外包的，因为首页上还有客服的 QQ 和定制的联系方式… 像这种看上去粗制滥造的小网站肯定一挖一堆洞…果然1小时后搞定 声明：本文作者没有利用该漏洞做出任何恶意或违法行为，也未触及任何数据，本文仅限技术研究与讨论，严禁用于非法用途，否则产生的一切后果自行承担"><meta property="og:type" content="article"><meta property="og:title" content="一次任意文件上传漏洞的实战经历"><meta property="og:url" content="https://blog.hans362.cn/post/arbitary-file-upload-vulnerabilty/"><meta property="og:site_name" content="Hans362 's Blog"><meta property="og:description" content="这一切都要从一只蝙蝠说起… 最近看到了一个站，是某高中的在线英语人机对话练习平台，目测了一下网站应该是外包的，因为首页上还有客服的 QQ 和定制的联系方式… 像这种看上去粗制滥造的小网站肯定一挖一堆洞…果然1小时后搞定 声明：本文作者没有利用该漏洞做出任何恶意或违法行为，也未触及任何数据，本文仅限技术研究与讨论，严禁用于非法用途，否则产生的一切后果自行承担"><meta property="og:locale" content="zh_CN"><meta property="og:image" content="https://hans362-img.oss.0vv0.top/2020/02/29/login.jpeg?width=1920"><meta property="og:image" content="https://hans362-img.oss.0vv0.top/2020/02/29/index.jpeg?width=1920"><meta property="og:image" content="https://hans362-img.oss.0vv0.top/2020/02/29/settings.jpeg?width=1920"><meta property="og:image" content="https://hans362-img.oss.0vv0.top/2020/02/29/error.jpeg?width=1920"><meta property="og:image" content="https://hans362-img.oss.0vv0.top/2020/02/29/ojs.jpeg?width=1920"><meta property="og:image" content="https://hans362-img.oss.0vv0.top/2020/02/29/editjs.png?width=1920"><meta property="og:image" content="https://hans362-img.oss.0vv0.top/2020/02/29/dc.jpeg?width=1920"><meta property="og:image" content="https://hans362-img.oss.0vv0.top/2020/02/29/fiddler.jpeg?width=1920"><meta property="og:image" content="https://hans362-img.oss.0vv0.top/2020/02/29/njs.jpeg?width=1920"><meta property="og:image" content="https://hans362-img.oss.0vv0.top/2020/02/29/hacked.jpeg?width=1920"><meta property="article:published_time" content="2020-02-29T12:23:26.000Z"><meta property="article:modified_time" content="2025-04-11T10:35:15.353Z"><meta property="article:author" content="Hans362"><meta property="article:tag" content="Web"><meta property="article:tag" content="网络安全"><meta property="article:tag" content="漏洞"><meta property="article:tag" content="实战"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:image" content="https://hans362-img.oss.0vv0.top/2020/02/29/login.jpeg?width=1920"><link rel="stylesheet" href="/css/style/main.css"><link rel="stylesheet" id="hl-default-theme" href="https://blog.hans362.cn/npm/highlight.js@10.1.2/styles/atom-one-light.css" media="none"><link rel="stylesheet" id="hl-dark-theme" href="https://blog.hans362.cn/npm/highlight.js@10.1.2/styles/atom-one-dark.css" media="none"><script src="/js/darkmode.js"></script><link rel="dns-prefetch" href="https://analytics.0vv0.top"><link rel="preconnect" href="https://hans362-img.oss.0vv0.top"><meta name="generator" content="Hexo 7.1.1"><link rel="alternate" href="/atom.xml" title="Hans362 's Blog" type="application/atom+xml"></head><body><div class="app-shell-loader">加载中...</div><div class="container" tabindex="-1"><header><div class="header__left"><a href="/" class="button"><span class="logo__text">Hans362 's Blog</span></a></div><div class="header__right"><div class="navbar__menus"><a href="/" class="button"><div class="navbar-menu">首页</div></a><a href="/archives/" class="button"><div class="navbar-menu">归档</div></a><a href="/tags/" class="button"><div class="navbar-menu">标签</div></a><a href="/bangumi/" class="button"><div class="navbar-menu">追番</div></a><a href="/links/" class="button"><div class="navbar-menu">友链</div></a><a href="/about/" class="button"><div class="navbar-menu">关于</div></a><a href="/atom.xml" class="button"><div class="navbar-menu">RSS</div></a></div><a href="/search/" class="button"><div id="btn-search"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1024 1024" width="24" height="24" fill="currentColor" stroke="currentColor" stroke-width="32"><path d="M192 448c0-141.152 114.848-256 256-256s256 114.848 256 256-114.848 256-256 256-256-114.848-256-256z m710.624 409.376l-206.88-206.88A318.784 318.784 0 0 0 768 448c0-176.736-143.264-320-320-320S128 271.264 128 448s143.264 320 320 320a318.784 318.784 0 0 0 202.496-72.256l206.88 206.88 45.248-45.248z"></path></svg></div></a><a href="javaScript:void(0);" rel="external nofollow noreferrer" class="button"><div id="btn-toggle-dark"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"></path></svg></div></a><a href="#" class="button" id="b2t" aria-label="回到顶部" title="回到顶部"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1024 1024" width="32" height="32"><path d="M233.376 722.752L278.624 768 512 534.624 745.376 768l45.248-45.248L512 444.128zM192 352h640V288H192z" fill="currentColor"></path></svg> </a><a class="dropdown-icon button" tabindex="0"><div id="btn-dropdown"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" width="24" height="24" fill="none" stroke="currentColor" stroke-width="0.7" stroke-linecap="round" stroke-linejoin="round"><path fill="currentColor" d="M3.314,4.8h13.372c0.41,0,0.743-0.333,0.743-0.743c0-0.41-0.333-0.743-0.743-0.743H3.314c-0.41,0-0.743,0.333-0.743,0.743C2.571,4.467,2.904,4.8,3.314,4.8z M16.686,15.2H3.314c-0.41,0-0.743,0.333-0.743,0.743s0.333,0.743,0.743,0.743h13.372c0.41,0,0.743-0.333,0.743-0.743S17.096,15.2,16.686,15.2z M16.686,9.257H3.314c-0.41,0-0.743,0.333-0.743,0.743s0.333,0.743,0.743,0.743h13.372c0.41,0,0.743-0.333,0.743-0.743S17.096,9.257,16.686,9.257z"></path></svg></div></a><div class="dropdown-menus" id="dropdown-menus"><a href="/" class="dropdown-menu button">首页</a> <a href="/archives/" class="dropdown-menu button">归档</a> <a href="/tags/" class="dropdown-menu button">标签</a> <a href="/bangumi/" class="dropdown-menu button">追番</a> <a href="/links/" class="dropdown-menu button">友链</a> <a href="/about/" class="dropdown-menu button">关于</a> <a href="/atom.xml" class="dropdown-menu button">RSS</a></div></div></header><cover></cover><main><div class="post-content"><div class="post-title"><h1 class="post-title__text">一次任意文件上传漏洞的实战经历</h1><div class="post-title__meta"><a href="/archives/2020/02/" class="post-meta__date button">2020-02-29</a> <span class="separate-dot"></span> <a href="/categories/%E6%9D%82%E6%96%87/" class="button"><span class="post-meta__cats">杂文</span></a><style>.post-meta__pv{color:var(--t-l);visibility:hidden;opacity:0;transition:.2s}</style><span class="separate-dot"></span> <span class="post-meta__pv"></span></div></div><aside class="post-side"><div class="post-side__toc"><div class="toc-title">文章目录</div><ol class="toc"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E%E6%98%AF%E4%B8%AA%E5%95%A5"><span class="toc-text">文件上传漏洞是个啥？</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%AE%9E%E6%88%98%E7%BB%8F%E5%8E%86"><span class="toc-text">实战经历</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E9%82%A3%E4%B9%88%E6%80%8E%E4%B9%88%E4%BF%AE%E5%A5%BD%E5%AE%83%E5%91%A2"><span class="toc-text">那么怎么修好它呢？</span></a></li></ol></div></aside><a class="btn-toc button" id="btn-toc" tabindex="0"><svg viewBox="0 0 1024 1024" width="32" height="32" xmlns="http://www.w3.org/2000/svg"><path d="M128 256h64V192H128zM320 256h576V192H320zM128 544h64v-64H128zM320 544h576v-64H320zM128 832h64v-64H128zM320 832h576v-64H320z" fill="currentColor"></path></svg></a><div class="toc-menus" id="toc-menus"><div class="toc-title">文章目录</div><ol class="toc"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E%E6%98%AF%E4%B8%AA%E5%95%A5"><span class="toc-text">文件上传漏洞是个啥？</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%AE%9E%E6%88%98%E7%BB%8F%E5%8E%86"><span class="toc-text">实战经历</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E9%82%A3%E4%B9%88%E6%80%8E%E4%B9%88%E4%BF%AE%E5%A5%BD%E5%AE%83%E5%91%A2"><span class="toc-text">那么怎么修好它呢？</span></a></li></ol></div><article class="post post__with-toc card"><div class="post__header"><div class="post__expire" id="post-expired-notify"><p><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16" style="fill:#f5a623;stroke:#f5a623"><path fill-rule="evenodd" d="M8.893 1.5c-.183-.31-.52-.5-.887-.5s-.703.19-.886.5L.138 13.499a.98.98 0 0 0 0 1.001c.193.31.53.501.886.501h13.964c.367 0 .704-.19.877-.5a1.03 1.03 0 0 0 .01-1.002L8.893 1.5zm.133 11.497H6.987v-2.003h2.039v2.003zm0-3.004H6.987V5.987h2.039v4.006z"></path></svg> 本文最后更新于 <span id="expire-date"></span> 天前，文中部分描述可能已经过时。</p></div><script>(()=>{var e=Date.parse("2020-02-29"),t=(new Date).getTime(),t=Math.floor((t-e)/864e5);120<=t&&(document.querySelectorAll("#expire-date")[0].innerHTML=t,document.querySelectorAll("#post-expired-notify")[0].style.display="block")})()</script></div><div class="post__content"><html><head><script>var meting_api="https://api-v2.hans362.cn/vip/?server=:server&type=:type&id=:id&r=:r"</script><script class="meting-secondary-script-marker" src="/js/Meting.min.js"></script></head><body><p><s>这一切都要从一只蝙蝠说起…</s></p><p>最近看到了一个站，是某高中的在线英语人机对话练习平台，目测了一下网站应该是外包的，因为首页上还有客服的 QQ 和定制的联系方式…</p><p>像这种看上去<s>粗制滥造</s>的小网站肯定一挖一堆洞…果然1小时后搞定</p><p><strong>声明：本文作者没有利用该漏洞做出任何恶意或违法行为，也未触及任何数据，本文仅限技术研究与讨论，严禁用于非法用途，否则产生的一切后果自行承担</strong></p><span id="more"></span><h2 id="文件上传漏洞是个啥"><a class="markdownIt-Anchor" href="#文件上传漏洞是个啥"></a> 文件上传漏洞是个啥？</h2><p>正如这个漏洞的名称一样，攻击者利用网站本身的文件上传功能（比如图片上传、文档上传、头像上传等）上传可执行的脚本文件并被解释器正常解释，从而实现恶意代码的运行。</p><p>但是事情并没有你想的那么简单，因为几乎所有网站对上传文件的 MIME 类型或后缀名都有限制。换句话说，如果是上传图片的区域，一般不太可能让你正常地成功上传一个 Word 文档。</p><p>问题就在一些网站的文件上传功能虽做出了相应的限制，却不够严格、只是浮于表面。这就导致攻击者可以借助一些手段上传任意文件，并能够将这些文件传递给相应的解释器，就可以在网站服务器上执行任意脚本。</p><h2 id="实战经历"><a class="markdownIt-Anchor" href="#实战经历"></a> 实战经历</h2><p>首先显而易见这是个 ASP 站，随手搞一个404出来发现是 IIS 7.5</p><p>直接访问网站会自动跳转到 login.asp 页面，应该是平台的登录页面（忽略那个 Flash 提示</p><p><img src="https://hans362-img.oss.0vv0.top/2020/02/29/login.jpeg?width=1920" class="lazy" data-srcset="https://hans362-img.oss.0vv0.top/2020/02/29/login.jpeg?width=1920" srcset="/loading.gif" alt=""></p><p>习惯性地把 login.asp 改成 index.asp 发现并没有强制跳回，而是出现了如下页面：</p><p><img src="https://hans362-img.oss.0vv0.top/2020/02/29/index.jpeg?width=1920" class="lazy" data-srcset="https://hans362-img.oss.0vv0.top/2020/02/29/index.jpeg?width=1920" srcset="/loading.gif" alt=""></p><p>无意中点击右边的设置按钮就发现了一个上传背景图片的按钮…</p><p><img src="https://hans362-img.oss.0vv0.top/2020/02/29/settings.jpeg?width=1920" class="lazy" data-srcset="https://hans362-img.oss.0vv0.top/2020/02/29/settings.jpeg?width=1920" srcset="/loading.gif" alt=""></p><p>至此，就已经找到了突破口</p><p>之后我先尝试强行丢了一个 ASP 脚本上去，提示文件类型不匹配，上传失败</p><p><img src="https://hans362-img.oss.0vv0.top/2020/02/29/error.jpeg?width=1920" class="lazy" data-srcset="https://hans362-img.oss.0vv0.top/2020/02/29/error.jpeg?width=1920" srcset="/loading.gif" alt=""></p><p>于是打开 F12 开发者视图，在网络选项卡内发现了 upload.js，里面有相关的限制文件类型的代码</p><p><img src="https://hans362-img.oss.0vv0.top/2020/02/29/ojs.jpeg?width=1920" class="lazy" data-srcset="https://hans362-img.oss.0vv0.top/2020/02/29/ojs.jpeg?width=1920" srcset="/loading.gif" alt=""></p><p>这么看来，应该是这部分代码阻止了 ASP 文件的上传，只要后端没有二次校验，劫持掉 upload.js 应该就没问题了</p><p>于是我复制了一份 upload.js，做出如下修改：</p><p><img src="https://hans362-img.oss.0vv0.top/2020/02/29/editjs.png?width=1920" class="lazy" data-srcset="https://hans362-img.oss.0vv0.top/2020/02/29/editjs.png?width=1920" srcset="/loading.gif" alt=""></p><p>然后打开 Disable cache 并启动 Fiddler 开始抓包，强制将 upload.js 重定向到本地修改过的 upload.js</p><p><img src="https://hans362-img.oss.0vv0.top/2020/02/29/dc.jpeg?width=1920" class="lazy" data-srcset="https://hans362-img.oss.0vv0.top/2020/02/29/dc.jpeg?width=1920" srcset="/loading.gif" alt=""></p><p><img src="https://hans362-img.oss.0vv0.top/2020/02/29/fiddler.jpeg?width=1920" class="lazy" data-srcset="https://hans362-img.oss.0vv0.top/2020/02/29/fiddler.jpeg?width=1920" srcset="/loading.gif" alt=""></p><p>再次 F12 发现修改后的代码已经被加载，试着传了个 ASP 上去，成功～</p><p><img src="https://hans362-img.oss.0vv0.top/2020/02/29/njs.jpeg?width=1920" class="lazy" data-srcset="https://hans362-img.oss.0vv0.top/2020/02/29/njs.jpeg?width=1920" srcset="/loading.gif" alt=""></p><p>这样就搞定了…</p><p><img src="https://hans362-img.oss.0vv0.top/2020/02/29/hacked.jpeg?width=1920" class="lazy" data-srcset="https://hans362-img.oss.0vv0.top/2020/02/29/hacked.jpeg?width=1920" srcset="/loading.gif" alt=""></p><p>只要再传个一句话木马上去，就可以拿到 WebShell 啦（当然考虑到违法的问题我没有这样做</p><h2 id="那么怎么修好它呢"><a class="markdownIt-Anchor" href="#那么怎么修好它呢"></a> 那么怎么修好它呢？</h2><p>其实也非常的简单～</p><p>漏洞的实现无非就是限制不够严格，前端虽然对文件类型做了限制但是可以被轻易劫持，后端则没有任何的二次校验，就会导致这个问题。</p><p>后端的上传接口应做好过滤，只接受特定类型的文件，并且要考虑到方方面面的限制（要知道还有00截断这种骚操作），必要时可以采取对文件随机改名、将图片文件写入一个新的图片文件之类的措施。</p><p>毕竟你永远也不知道用户究竟会如何使用你的网站，稍不留神你的网站可能就成为了用户的图床2333333</p></body></html></div><div class="license"><div class="license-title">一次任意文件上传漏洞的实战经历</div><div class="license-link"><a href="https://blog.hans362.cn/post/arbitary-file-upload-vulnerabilty/">https://blog.hans362.cn/post/arbitary-file-upload-vulnerabilty/</a></div><div class="license-meta"><div class="license-meta-item"><div class="license-meta-title">本文作者</div><div class="license-meta-text">Hans362</div></div><div class="license-meta-item"><div class="license-meta-title">最后更新</div><div class="license-meta-text">2020-02-29</div></div><div class="license-meta-item"><div class="license-meta-title">许可协议</div><div class="license-meta-text"><a href="https://creativecommons.org/licenses/by-nc-sa/4.0/deed.zh" rel="nofollow noopener noreferrer" target="_blank">CC BY-NC-SA 4.0</a></div></div></div><div>转载或引用本文时请遵守许可协议，注明出处、不得用于商业用途！</div></div><div class="post-footer__cats"><a href="/categories/%E6%9D%82%E6%96%87/" class="post-cats__link button">杂文</a><a href="/tags/Web/" class="post-tags__link button"># Web</a><a href="/tags/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/" class="post-tags__link button"># 网络安全</a><a href="/tags/%E6%BC%8F%E6%B4%9E/" class="post-tags__link button"># 漏洞</a><a href="/tags/%E5%AE%9E%E6%88%98/" class="post-tags__link button"># 实战</a></div></article><div class="nav"><div class="nav__prev"><a href="/post/thinkpad-x201s-ssd/" class="nav__link"><div><svg viewBox="0 0 1024 1024" xmlns="http://www.w3.org/2000/svg" width="24" height="24"><path d="M589.088 790.624L310.464 512l278.624-278.624 45.248 45.248L400.96 512l233.376 233.376z" fill="#808080"></path></svg></div><div><div class="nav__label">上一篇</div><div class="nav__title">ThinkPad X201s 固态硬盘升级记</div></div></a></div><div class="nav__next"><a href="/post/never-regard-winter-as-the-start-of-spring/" class="nav__link"><div><div class="nav__label">下一篇</div><div class="nav__title">【转载】不能把冬天唱成春的开始</div></div><div><svg viewBox="0 0 1024 1024" xmlns="http://www.w3.org/2000/svg" width="24" height="24"><path d="M434.944 790.624l-45.248-45.248L623.04 512l-233.376-233.376 45.248-45.248L713.568 512z" fill="#808080"></path></svg></div></a></div></div><div class="post__sponsers card"><div class="sponser-label">喜欢这篇文章吗？考虑支持一下作者吧～</div><a class="sponser-button button" href="https://afdian.net/@hans362" rel="external nofollow noreferrer" target="_blank" data-type="afdian">爱发电</a> <a class="sponser-button button" data-type="alipay">支付宝<img class="sponser-qrcode" src="https://hans362-img.oss.0vv0.top/2021/08/05/68281340.jpg"></a></div><div class="post__comments post__with-toc card" id="comment"><h4>评论</h4><div id="disqus_thread">您所在的地区可能无法访问 Disqus 评论系统，请切换网络环境再尝试。</div></div></div></main><footer><p class="footer-copyright">Copyright © 2017 - 2025 <a href="/">Hans362 's Blog</a></p><p>Powered by <a href="https://hexo.io" target="_blank">Hexo</a> | Theme - <a href="https://github.com/ChrAlpha/hexo-theme-cards" target="_blank">Cards</a></p><script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script><ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-8746554831230893" data-ad-slot="6356225601" data-ad-format="auto" data-full-width-responsive="true"></ins><script>(adsbygoogle=window.adsbygoogle||[]).push({})</script></footer></div><script defer src="https://blog.hans362.cn/npm/vanilla-lazyload@17.8.3/dist/lazyload.min.js"></script><script>window.lazyLoadOptions={elements_selector:".lazy"}</script><script async defer data-website-id="5d181692-8a81-4c20-a282-cee87a6b90ef" src="https://analytics.0vv0.top/vue.js"></script><script src="/js/pageviews.js"></script><link rel="stylesheet" href="https://blog.hans362.cn/npm/katex@0.16.0/dist/katex.min.css" crossorigin="anonymous"><script>function loadComment(){let n,e;(n=document.createElement("script")).src="https://blog.hans362.cn/js/disqus.js",document.body.appendChild(n),n.onload=()=>{new DisqusJS({shortname:"hans362-s-blog",siteName:"Hans362 's Blog",api:"https://api-v3.hans362.cn/",apikey:"8Z1UVT4UOk22yNyk9MhpqQ0FLb27Hb1bpV066b4v9zOFie0GQ6VCoJ9TJwoGlCVF",admin:"hans362",identifier:"post/arbitary-file-upload-vulnerabilty/",url:"https://blog.hans362.cn/post/arbitary-file-upload-vulnerabilty/",nesting:"4"})},(e=document.createElement("link")).rel="stylesheet",e.href="https://blog.hans362.cn/css/disqusjs.css",document.head.appendChild(e)}var runningOnBrowser="undefined"!=typeof window,isBot=runningOnBrowser&&!("onscroll"in window)||"undefined"!=typeof navigator&&/(gle|ing|ro|msn)bot|crawl|spider|yand|duckgo/i.test(navigator.userAgent),supportsIntersectionObserver=runningOnBrowser&&"IntersectionObserver"in window;setTimeout(function(){var e;!isBot&&supportsIntersectionObserver?(e=new IntersectionObserver(function(n){n[0].isIntersecting&&(loadComment(),e.disconnect())},{threshold:[0]})).observe(document.getElementById("comment")):loadComment()},1)</script></body></html> |