https://baozongwi.xyz/categories/offensive/Currently exploring Java security and internal network penetration, with CTFs as a hobby.Hugozh-cnhttps://baozongwi.xyz/p/springautumn-cloudmirror--delegation/Thu, 28 Aug 2025 21:47:03 +0800https://baozongwi.xyz/p/springautumn-cloudmirror--delegation/easyCMS7.7.5、LocalSystem转储hash、DFSCoerce强制认证 + Kerberos 票据劫持、DCSynchttps://baozongwi.xyz/p/springautumn-cloudmirror-time/Tue, 26 Aug 2025 21:45:29 +0800https://baozongwi.xyz/p/springautumn-cloudmirror-time/CVE-2021-34371、ASREPRoast攻击、SIDHistory攻击https://baozongwi.xyz/p/spring-autumn-mirror-certify/Fri, 22 Aug 2025 17:48:09 +0800https://baozongwi.xyz/p/spring-autumn-mirror-certify/log4j、smb未授权、Kerberoasting攻击、ADCS ESC1https://baozongwi.xyz/p/springautumn-cloudmirror-magicrelay/Wed, 20 Aug 2025 17:39:42 +0800https://baozongwi.xyz/p/springautumn-cloudmirror-magicrelay/Redis利用DLL劫持、向日葵RCE、CVE-2022-26923、Pass-The-Certhttps://baozongwi.xyz/p/springautumn-cloudmirror-brute4road/Wed, 20 Aug 2025 13:30:44 +0800https://baozongwi.xyz/p/springautumn-cloudmirror-brute4road/Redis主从复制RCE、base64利用suid提权、CVE-2021-25003、FULL-S4U攻击https://baozongwi.xyz/p/chunqiu-cloud-mirror-tsclient/Mon, 11 Aug 2025 16:47:31 +0000https://baozongwi.xyz/p/chunqiu-cloud-mirror-tsclient/MDUT、SeImpersonatePrivilege提权、C2基础使用、进程注入、放大镜提权、SeDebugPrivilege权限利用https://baozongwi.xyz/p/chunqiu-cloud-mirror-aoselu/Sun, 10 Aug 2025 21:25:22 +0000https://baozongwi.xyz/p/chunqiu-cloud-mirror-aoselu/Java反序列化header打入内存马、SeImpersonatePrivilege提权、msf上线、SeBackupPrivilege转储注册表、WriteDacl打RBCDhttps://baozongwi.xyz/p/chunqiu-cloud-mirror-initial/Sat, 09 Aug 2025 21:49:36 +0000https://baozongwi.xyz/p/chunqiu-cloud-mirror-initial/thinkphp5.0.23RCE、MS17-010、DCSynchttps://baozongwi.xyz/p/ligolo-ng-intranet-tun-proxy-setup/Mon, 09 Jun 2025 20:52:43 +0000https://baozongwi.xyz/p/ligolo-ng-intranet-tun-proxy-setup/非常好用的代理工具https://baozongwi.xyz/p/guoguang-range-ssrf-intranet-penetration/Wed, 02 Apr 2025 14:18:15 +0000https://baozongwi.xyz/p/guoguang-range-ssrf-intranet-penetration/国光是神