> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/cms.md).

# CMS 利用

面向枚举、认证绕过、插件滥用、文件上传 RCE、LFI 到 RCE、命令执行和反向 shell 投递的 CMS 和管理面板利用笔记。

## CMS 利用工作流

1. 识别应用程序、框架、CMS、版本、插件、主题、模块以及暴露的管理面板。
2. 枚举用户、登录行为、备份文件、上传功能、API 路由、调试页面和公开的配置泄露。
3. 检查默认凭据、弱密码、密码重置流程、会话处理以及认证绕过。
4. 验证已知 CVE、插件漏洞、LFI 到 RCE 链、命令注入和文件上传路径。
5. 在保留精确利用路径的同时，将访问转换为受控 Web Shell 或反向 Shell。
6. 清晰记录凭据、有效载荷、概念验证以及利用后的交接信息。

## 重点部分

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-wordpress" style="color:$primary;">:wordpress:</i></h3></td><td><h4>WordPress</h4></td><td>用于枚举、WPScan、插件发现、xmlrpc.php 暴力破解、已认证 RCE、存在漏洞的插件、LFI 和泄露凭据的 WordPress 渗透测试笔记。</td><td><a href="/pages/11a1e3c1210b1aad2be143d1f91e48685eeff594">/pages/11a1e3c1210b1aad2be143d1f91e48685eeff594</a></td></tr><tr><td><h3><i class="fa-database" style="color:$primary;">:database:</i></h3></td><td><h4>phpMyAdmin</h4></td><td>针对特定版本 RCE、LFI 到 RCE、会话文件滥用、命令注入、内部端口发现和反向 Shell 的 phpMyAdmin 利用笔记。</td><td><a href="/pages/a326870b1370b8952e89234c0a3b11cb1795a07e">/pages/a326870b1370b8952e89234c0a3b11cb1795a07e</a></td></tr><tr><td><h3><i class="fa-server" style="color:$primary;">:server:</i></h3></td><td><h4>Tomcat</h4></td><td>针对管理器访问、默认凭据暴力破解、WAR 有效载荷部署、文本管理器滥用和反向 Shell 的 Apache Tomcat 利用笔记。</td><td><a href="/pages/0650de196c01496d99c9e2896a43f66d5e0117b3">/pages/0650de196c01496d99c9e2896a43f66d5e0117b3</a></td></tr><tr><td><h3><i class="fa-drupal" style="color:$primary;">:drupal:</i></h3></td><td><h4>Drupal</h4></td><td>用于 Droopescan 枚举、密码重置请求操控、Drupal 7 RCE、CVE-2018-7602 利用和反向 Shell 的 Drupal 渗透测试笔记。</td><td><a href="/pages/4d28888d5f737844cfb58cb767dd1ed657d02448">/pages/4d28888d5f737844cfb58cb767dd1ed657d02448</a></td></tr><tr><td><h3><i class="fa-floppy-disk" style="color:$primary;">:floppy-disk:</i></h3></td><td><h4>Duplicati</h4></td><td>针对 SQLite 配置密钥、登录认证绕过、密码短语恢复、备份还原滥用和敏感文件提取的 Duplicati 利用笔记。</td><td><a href="/pages/428ce5cef3431c6d268c73b56e7192a163297b54">/pages/428ce5cef3431c6d268c73b56e7192a163297b54</a></td></tr><tr><td><h3><i class="fa-server" style="color:$primary;">:server:</i></h3></td><td><h4>Nostromo</h4></td><td>针对 CVE-2019-16278 远程命令执行、反向 Shell 投递、HomeDirs 配置审查和受保护用户内容发现的 Nostromo 利用笔记。</td><td><a href="/pages/6f0450dddbeba9259e5e34cba5a63d29f8aa5188">/pages/6f0450dddbeba9259e5e34cba5a63d29f8aa5188</a></td></tr><tr><td><h3><i class="fa-helmet-safety" style="color:$primary;">:helmet-safety:</i></h3></td><td><h4>HardHat C2</h4></td><td>针对 JWT 认证绕过、管理员令牌构造、TeamLead 用户创建、ImplantInteract 终端滥用和 RCE 的 HardHat C2 利用笔记。</td><td><a href="/pages/ea39747c13acfc028dedd5df8db7ec140784eb49">/pages/ea39747c13acfc028dedd5df8db7ec140784eb49</a></td></tr></tbody></table>

### 独立笔记

<table><thead><tr><th data-type="content-ref"></th></tr></thead><tbody><tr><td><a href="/pages/819c2d9fa1b915d69c921b1be4eaa49e14d104c8">/pages/819c2d9fa1b915d69c921b1be4eaa49e14d104c8</a></td></tr><tr><td><a href="/pages/78b9fd78b3fc01af8df9b1cc1cb46a4deb961981">/pages/78b9fd78b3fc01af8df9b1cc1cb46a4deb961981</a></td></tr><tr><td><a href="/pages/0cfa6df582afcaf9d776b978de8493e5028eb5df">/pages/0cfa6df582afcaf9d776b978de8493e5028eb5df</a></td></tr><tr><td><a href="/pages/ef45beee8fe8d322d45b8355f7bced8ec9557958">/pages/ef45beee8fe8d322d45b8355f7bced8ec9557958</a></td></tr><tr><td><a href="/pages/62d1339ef99faa6368f2f36b42d81d2b3063aa72">/pages/62d1339ef99faa6368f2f36b42d81d2b3063aa72</a></td></tr><tr><td><a href="/pages/66373cd766005a0f60896e358ecd88a9716b64f7">/pages/66373cd766005a0f60896e358ecd88a9716b64f7</a></td></tr><tr><td><a href="/pages/e8d194d8c63896173456257de6e933a73b61936d">/pages/e8d194d8c63896173456257de6e933a73b61936d</a></td></tr><tr><td><a href="/pages/bcd2a28b20f6c1db8d365e55840653b75f5e0191">/pages/bcd2a28b20f6c1db8d365e55840653b75f5e0191</a></td></tr><tr><td><a href="/pages/c29d30a4ca11bb23a150f066c02b4fd83d5c0e45">/pages/c29d30a4ca11bb23a150f066c02b4fd83d5c0e45</a></td></tr><tr><td><a href="/pages/6224ecbcac55ca232d2d2dc9e354ca935fdad227">/pages/6224ecbcac55ca232d2d2dc9e354ca935fdad227</a></td></tr><tr><td><a href="/pages/279f651bf71afb9692ab1aefa1cc3f6d62243de0">/pages/279f651bf71afb9692ab1aefa1cc3f6d62243de0</a></td></tr><tr><td><a href="/pages/4ae292f6090edb11e76648798502bcb64f7b2bb2">/pages/4ae292f6090edb11e76648798502bcb64f7b2bb2</a></td></tr><tr><td><a href="/pages/81735616de76a158878cb2ea23457bd5aae381c2">/pages/81735616de76a158878cb2ea23457bd5aae381c2</a></td></tr><tr><td><a href="/pages/a646157e896cd368c62569d95dbd1f14310f9e8a">/pages/a646157e896cd368c62569d95dbd1f14310f9e8a</a></td></tr><tr><td><a href="/pages/8b561a14872621817907880fe0d0c4bc97e03384">/pages/8b561a14872621817907880fe0d0c4bc97e03384</a></td></tr><tr><td><a href="/pages/96f1a5ff6a8a950bee7c910f3a9528eb028c2e84">/pages/96f1a5ff6a8a950bee7c910f3a9528eb028c2e84</a></td></tr><tr><td><a href="/pages/7d5ff4a1248fa693be5dff3c2f9f9b40bc963537">/pages/7d5ff4a1248fa693be5dff3c2f9f9b40bc963537</a></td></tr><tr><td><a href="/pages/2751acb5d743378552b118a2ba61be76162f7302">/pages/2751acb5d743378552b118a2ba61be76162f7302</a></td></tr><tr><td><a href="/pages/76b9a49db12f7684eee68a0d220774e1854a9481">/pages/76b9a49db12f7684eee68a0d220774e1854a9481</a></td></tr><tr><td><a href="/pages/e6fe294cf6ae52e155b34e996cb6de6f52e4e7f0">/pages/e6fe294cf6ae52e155b34e996cb6de6f52e4e7f0</a></td></tr><tr><td><a href="/pages/0fda471c6f1d2e106d2cd2245f64acae74aef48b">/pages/0fda471c6f1d2e106d2cd2245f64acae74aef48b</a></td></tr><tr><td><a href="/pages/fe8c34e067316f06992f40c93c8daef863e73a76">/pages/fe8c34e067316f06992f40c93c8daef863e73a76</a></td></tr><tr><td><a href="/pages/5597c61e1980a3c736c2b2d47c39aa9e7aa93d05">/pages/5597c61e1980a3c736c2b2d47c39aa9e7aa93d05</a></td></tr><tr><td><a href="/pages/c8e9058cf9d758efa9ec9678bd96e6ea169d9d1a">/pages/c8e9058cf9d758efa9ec9678bd96e6ea169d9d1a</a></td></tr><tr><td><a href="/pages/d2bb3cea6fc90845ff867a5e51bc1c9a23e34001">/pages/d2bb3cea6fc90845ff867a5e51bc1c9a23e34001</a></td></tr><tr><td><a href="/pages/62ea4bf937f58be10ce220d72d7238c7cc3d8a2e">/pages/62ea4bf937f58be10ce220d72d7238c7cc3d8a2e</a></td></tr><tr><td><a href="/pages/4a95f4cdc9c337edd2b8be3b8a50bdf0bdd8c2bc">/pages/4a95f4cdc9c337edd2b8be3b8a50bdf0bdd8c2bc</a></td></tr><tr><td><a href="/pages/2e4e8ec7d12732fee942aa2adbf80115b1c4f6a2">/pages/2e4e8ec7d12732fee942aa2adbf80115b1c4f6a2</a></td></tr><tr><td><a href="/pages/5d117285d5ff3c4eaaf38a70d87f29c7534a6287">/pages/5d117285d5ff3c4eaaf38a70d87f29c7534a6287</a></td></tr><tr><td><a href="/pages/4af3a97934d18f689a83d8388f9abacd16c7ac83">/pages/4af3a97934d18f689a83d8388f9abacd16c7ac83</a></td></tr><tr><td><a href="/pages/c8b016737e9ab64751037f49419d0b71d1342786">/pages/c8b016737e9ab64751037f49419d0b71d1342786</a></td></tr><tr><td><a href="/pages/550760c9b61da7be9a7e4ee1a7a2d05381b2740f">/pages/550760c9b61da7be9a7e4ee1a7a2d05381b2740f</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/cms.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.