> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/cms.md).

# CMS 利用

针对 WordPress、Drupal、Tomcat、phpMyAdmin、Jenkins、管理面板、文件上传 RCE、LFI 到 RCE、认证绕过、插件漏洞以及暴露 Web 应用的 CMS 利用方法。

针对枚举、认证绕过、插件滥用、文件上传 RCE、LFI 转 RCE、命令执行和反向 shell 投递的 CMS 和管理面板利用笔记。

## CMS 利用流程

1. 识别应用、框架、CMS、版本、插件、主题、模块以及暴露的管理面板。
2. 枚举用户、登录行为、备份文件、上传功能、API 路由、调试页面以及公开的配置泄露。
3. 检查默认凭据、弱密码、密码重置流程、会话处理和认证绕过。
4. 验证已知 CVE、插件漏洞、LFI 转 RCE 链、命令注入以及文件上传路径。
5. 在保留确切利用路径的同时，将访问权限转换为可控的 web shell 或反向 shell。
6. 清晰记录凭据、载荷、概念验证和后渗透交接。

## 重点章节

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-wordpress" style="color:$primary;">:wordpress:</i></h3></td><td><h4>WordPress</h4></td><td>用于枚举、WPScan、插件发现、xmlrpc.php 暴力破解、已认证 RCE、易受攻击插件、LFI 和泄露凭据的 WordPress 渗透测试笔记。</td><td><a href="/zh/cms/wordpress-cms-exploitation.md">WordPress</a></td></tr><tr><td><h3><i class="fa-database" style="color:$primary;">:database:</i></h3></td><td><h4>phpMyAdmin</h4></td><td>针对特定版本 RCE、LFI 转 RCE、会话文件滥用、命令注入、内部端口发现和反向 shell 的 phpMyAdmin 利用笔记。</td><td><a href="/zh/cms/phpmyadmin-cms-exploitation.md">phpMyAdmin</a></td></tr><tr><td><h3><i class="fa-server" style="color:$primary;">:server:</i></h3></td><td><h4>Tomcat</h4></td><td>针对管理器访问、默认凭据暴力破解、WAR 载荷部署、文本管理器滥用和反向 shell 的 Apache Tomcat 利用笔记。</td><td><a href="/zh/cms/tomcat-cms-exploitation.md">Tomcat</a></td></tr><tr><td><h3><i class="fa-drupal" style="color:$primary;">:drupal:</i></h3></td><td><h4>Drupal</h4></td><td>用于 Droopescan 枚举、密码重置请求操控、Drupal 7 RCE、CVE-2018-7602 利用和反向 shell 的 Drupal 渗透测试笔记。</td><td><a href="/zh/cms/drupal-cms-exploitation.md">Drupal</a></td></tr><tr><td><h3><i class="fa-floppy-disk" style="color:$primary;">:floppy-disk:</i></h3></td><td><h4>Duplicati</h4></td><td>针对 SQLite 配置密钥、登录认证绕过、密码短语恢复、备份还原滥用和敏感文件提取的 Duplicati 利用笔记。</td><td><a href="/zh/cms/duplicati-cms-exploitation.md">Duplicati</a></td></tr><tr><td><h3><i class="fa-server" style="color:$primary;">:server:</i></h3></td><td><h4>Nostromo</h4></td><td>针对 CVE-2019-16278 远程命令执行、反向 shell 投递、HomeDirs 配置审查和受保护用户内容发现的 Nostromo 利用笔记。</td><td><a href="/zh/cms/nostromo-cms-exploitation.md">Nostromo</a></td></tr><tr><td><h3><i class="fa-helmet-safety" style="color:$primary;">:helmet-safety:</i></h3></td><td><h4>HardHat C2</h4></td><td>针对 JWT 认证绕过、管理员令牌构造、TeamLead 用户创建、ImplantInteract 终端滥用和 RCE 的 HardHat C2 利用笔记。</td><td><a href="/zh/cms/hardhatc2-cms-exploitation.md">HardHat C2</a></td></tr></tbody></table>

### 独立笔记

<table><thead><tr><th data-type="content-ref"></th></tr></thead><tbody><tr><td><a href="/zh/cms/joomla-cms-exploitation.md">Joomla</a></td></tr><tr><td><a href="/zh/cms/magento-cms-exploitation.md">Magento</a></td></tr><tr><td><a href="/zh/cms/jenkins-cms-exploitation.md">Jenkins</a></td></tr><tr><td><a href="/zh/cms/chamilo-cms-exploitation.md">Chamilo</a></td></tr><tr><td><a href="/zh/cms/pluck-cms-exploitation.md">Pluck</a></td></tr><tr><td><a href="/zh/cms/wonder-cms-exploitation.md">Wonder</a></td></tr><tr><td><a href="/zh/cms/sqlpad-cms-exploitation.md">SQLPad</a></td></tr><tr><td><a href="/zh/cms/froxlor-cms-exploitation.md">Froxlor</a></td></tr><tr><td><a href="/zh/cms/kibana-cms-exploitation.md">Kibana</a></td></tr><tr><td><a href="/zh/cms/cups-cms-exploitation.md">CUPS</a></td></tr><tr><td><a href="/zh/cms/pandora-cms-exploitation.md">Pandora</a></td></tr><tr><td><a href="/zh/cms/cacti-cms-exploitation.md">Cacti</a></td></tr><tr><td><a href="/zh/cms/umbraco-cms-exploitation.md">Umbraco</a></td></tr><tr><td><a href="/zh/cms/pokermax-cms-exploitation.md">PokerMax</a></td></tr><tr><td><a href="/zh/cms/backdrop-cms-exploitation.md">Backdrop</a></td></tr><tr><td><a href="/zh/cms/snowfox-cms-exploitation.md">SnowFox</a></td></tr><tr><td><a href="/zh/cms/nibbles-blog-cms-exploitation.md">Nibbles Blog</a></td></tr><tr><td><a href="/zh/cms/ghost-cms-exploitation.md">Ghost</a></td></tr><tr><td><a href="/zh/cms/voting-system-cms-exploitation.md">Voting System</a></td></tr><tr><td><a href="/zh/cms/msfvenom-apk-exploitation.md">使用 Msfvenom 制作 APK</a></td></tr><tr><td><a href="/zh/cms/laravel-cms-exploitation.md">Laravel</a></td></tr><tr><td><a href="/zh/cms/adobe-coldfusion-8-cms-exploitation.md">Adobe ColdFusion 8</a></td></tr><tr><td><a href="/zh/cms/helpdesk-cms-exploitation.md">HelpDesk</a></td></tr><tr><td><a href="/zh/cms/helpdeskz.md">HelpDeskZ</a></td></tr><tr><td><a href="/zh/cms/apache-struts-exploitation-.action.md">Apache Struts</a></td></tr><tr><td><a href="/zh/cms/network-admin-panel-cms-exploitation.md">网络管理面板</a></td></tr><tr><td><a href="/zh/cms/httpfileserver-2.3-cms-exploitation.md">HttpFileServer 2.3</a></td></tr><tr><td><a href="/zh/cms/strapi-cms-exploitation.md">Strapi</a></td></tr><tr><td><a href="/zh/cms/prtg-network-monitor-cms-exploitation.md">PRTG Network Monitor</a></td></tr><tr><td><a href="/zh/cms/h2-database-cms-exploitation.md">H2 数据库</a></td></tr><tr><td><a href="/zh/cms/daloradius-cms-exploitation.md">DaloRADIUS</a></td></tr><tr><td><a href="/zh/cms/dolibarr-cms-exploitation.md">Dolibarr</a></td></tr><tr><td><a href="/zh/cms/limesurvey-cms-exploitation.md">LimeSurvey</a></td></tr><tr><td><a href="/zh/cms/nvms-1000.md">NVMS-1000</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/cms.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.