-m与-p调配运用留意：作为提示，这儿的meterpreter后门履行进程是分阶段的，履行之一阶段会后会经过反向注入将真实的进犯载荷(metsrv.x86.dll或许metsrv.x64.dll)注入到内存傍边。 下面的截图展现了靶机的外部ip:*$_SERVER没有过滤能够大局搜搜getip相似的函数名，检查代码怎么获取ipwget http://download.macromedi *** /pub/flex/sdk/flex_sdk_4.6.zip unzip flex_sdk_4.6.zip 三、进犯方针 2

$sql = 'select ua.*,u.address_id as adds_id from ' . $this->pre . 'user_address as ua left join '. $this->pre . 'users as u on ua.address_id =u.address_id'. ' where ua.user_id = ' . $user_id . ' order by ua.address_id limit ' . $start . ', ' . $num; //很明显没有单引号,直接拼接进去造成了注入。