ImageMagick漏洞 on 办公AI智能小助手 https://blog.qife122.com/tags/imagemagick%E6%BC%8F%E6%B4%9E/ Recent content in ImageMagick漏洞 on 办公AI智能小助手 Hugo zh-cn qife Fri, 19 Sep 2025 04:59:42 +0800 HTB Titanic靶机渗透：从目录遍历到ImageMagick漏洞提权 https://blog.qife122.com/p/htb-titanic%E9%9D%B6%E6%9C%BA%E6%B8%97%E9%80%8F%E4%BB%8E%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86%E5%88%B0imagemagick%E6%BC%8F%E6%B4%9E%E6%8F%90%E6%9D%83/ Fri, 19 Sep 2025 04:59:42 +0800 https://blog.qife122.com/p/htb-titanic%E9%9D%B6%E6%9C%BA%E6%B8%97%E9%80%8F%E4%BB%8E%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86%E5%88%B0imagemagick%E6%BC%8F%E6%B4%9E%E6%8F%90%E6%9D%83/ <h1 id="htb-titanic">HTB: Titanic</h1> <h2 id="侦察">侦察</h2> <h3 id="nmap扫描">Nmap扫描</h3> <p>Nmap扫描发现两个开放的TCP端口：SSH（22）和HTTP（80）：</p> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span><span class="lnt">7 </span><span class="lnt">8 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">oxdf@hacky$ nmap -p- --min-rate <span class="m">10000</span> 10.10.11.55 </span></span><span class="line"><span class="cl">Starting Nmap 7.94SVN <span class="o">(</span> https://nmap.org <span class="o">)</span> at 2025-02-19 13:45 EST </span></span><span class="line"><span class="cl">Nmap scan report <span class="k">for</span> 10.10.11.55 </span></span><span class="line"><span class="cl">Host is up <span class="o">(</span>0.087s latency<span class="o">)</span>. </span></span><span class="line"><span class="cl">Not shown: <span class="m">65533</span> closed tcp ports <span class="o">(</span>reset<span class="o">)</span> </span></span><span class="line"><span class="cl">PORT STATE SERVICE </span></span><span class="line"><span class="cl">22/tcp open ssh </span></span><span class="line"><span class="cl">80/tcp open http </span></span></code></pre></td></tr></table> </div> </div><p>详细版本扫描显示：</p>