我的这台机器没有这个漏洞,所以有点尴尬,这里写一下这个漏洞的利用方式。 检测完是否存在此漏洞后,检测是否对目标文件夹有写权限,需要目标文件夹的权限是Everyone:(OI)(CI)(F) 检测方式:icacls 目标文件夹路径 接破解网站,入侵服务器,渗透测试,删库,数据删除 拿数据库 木马注入 黑客接单/黑客业务/入侵改分,改单/逆向破解/外挂/渗透业务咨询:@HXheike888

Channel
黑客渗透 木马劫持 黑客改成绩
@hiekemuma
On this record: Topic · Growth · Engagement · Reactions · Posts · Citations · Cite this entry
8,899subscribers
-2,224 since we began measuring on 7 August 2026
Risers and fallers across the register · movement among entries of 3,162–10,000.
Register entry
| Telegram ID | -1002040275290 |
|---|---|
| Type | Channel |
| Username | @hiekemuma |
| Created | Between 1 November 2023 and 31 May 2024 — estimated from Telegram’s id allocation, not measured. How this range is calculated. |
| First recorded | 7 August 2026 |
| Last confirmed live | 18 September 2026 |
| Measurements held | 30 |
| Confirmed unchanged | 1 time, most recently 18 September 2026 |
| On Telegram | t.me/hiekemuma |
Topic
Hacking & security — a classification, not a measurement. An on-box language model (Qwen3.6-35B-A3B-FP8, prompt version 1) read this channel’s own recent posts on 11 September 2026 and assigned it the closest of 31 fixed categories, at 100% confidence. This is a model’s judgement about what the channel is likely to be about, not a fact this register measured the way a subscriber count or a view count is measured — it can be revised on a later pass, and it carries no weight anywhere else on this page. How this classification works, and why it has no browse page of its own yet.
Growth
| Measured (UTC) | Subscribers | Change |
|---|---|---|
| 18 Sept 2026, 02:55 | 8,899 | -329 |
| 14 Sept 2026, 00:17 | 9,228 | -353 |
| 10 Sept 2026, 06:37 | 9,581 | -322 |
| 5 Sept 2026, 07:58 | 9,903 | -144 |
| 3 Sept 2026, 11:39 | 10,047 | -23 |
| 2 Sept 2026, 05:33 | 10,070 | -37 |
| 1 Sept 2026, 07:09 | 10,107 | -15 |
| 31 Aug 2026, 05:25 | 10,122 | -9 |
| 30 Aug 2026, 08:46 | 10,131 | -78 |
| 29 Aug 2026, 09:22 | 10,209 | -36 |
| 28 Aug 2026, 08:55 | 10,245 | -9 |
| 27 Aug 2026, 10:49 | 10,254 | -8 |
| 26 Aug 2026, 12:18 | 10,262 | -10 |
| 25 Aug 2026, 14:08 | 10,272 | -10 |
| 24 Aug 2026, 10:56 | 10,282 | -8 |
| 22 Aug 2026, 15:23 | 10,290 | -11 |
| 21 Aug 2026, 04:14 | 10,301 | -14 |
| 20 Aug 2026, 07:35 | 10,315 | -17 |
| 19 Aug 2026, 04:23 | 10,332 | -39 |
| 18 Aug 2026, 07:02 | 10,371 | first reading |
Engagement
18 posts held, back to 27 July 2026 — the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 38 pages of Telegram’s post history, 20 posts per page.
- ERR · 30 days
- 0.21%
- avg views ÷ 8,899 subscribers
- Avg views / post
- 18.7
- 3 posts measured
- Reaction rate
- 3.13%
- reactions ÷ views · ER floor
- Posts in window
- 3
- of 18 held
ERR is average views per post over the last 30 days divided by subscribers, the definition TGStat uses, so this figure is comparable with the one you will see elsewhere. It falls structurally as a channel grows: a high ERR on a small channel and a low one on a large channel describe reach mathematics, not quality. We publish the figure and the sample it came from and pass no verdict on it.
ER is defined industry-wide as (forwards + reactions + comments) ÷ views — note the denominator is views, not subscribers. Telegram’s public web preview carries views and reactions but not forward or comment counts, so the reaction rate above is the reactions term only and is therefore a floor: the true ER for this channel is higher by an amount we have not measured and will not estimate. It is computed over the 1 of 3 measured posts that carry a reaction reading, and over those same posts' views.
| Window | Rolling 30 days · latest post in window 29 August 2026 |
|---|---|
| Posts held | 18 (27 July 2026 – 29 August 2026) |
| Views total | 56 |
| Reactions total | 1 |
| Forwards / comments | not exposed by the public surface — not measured, not estimated |
| Readings taken | 29 Aug 2026, 03:30 UTC |
Views are a single reading per post, taken at the time above. A post published in the last day or two is still accumulating views, which pulls the 30-day average down slightly. That is a property of the standard definition rather than a fault in it, so we keep the definition rather than “correcting” the number into something nobody can reproduce.
Precision. Telegram publishes view counts on its public widget in short form — 8.12K, 3.7M — so any reading at or above 1,000 reaches us rounded to three significant figures, and only counts below 1,000 are exact. Averages and rates derived from them are shown to the same precision rather than to the unit: a figure like 3,701,250 would assert digits nobody measured.
Reaction counts are published per emoji and rounded the same way, so a total below 1,000 is exact and a larger one is a sum that may carry a rounded component from each emoji above 1,000. Because it is a sum, it does not look rounded — read a large reaction total as three significant figures per contributing emoji rather than as the figure it prints.
Reaction mix
1 reaction across 1 post, in 1 kind.
| Reaction | Count | Share | Share, drawn |
|---|---|---|---|
| 👍 | 1 | 100.0% |
No sentiment is inferred, and none should be read in. This table is ordered by count and by nothing else. Emoji do not carry stable meaning across languages or communities — 🙏 is thanks in one channel and mourning in another — so we publish which ones were pressed and how often, and pass no judgement on what an audience meant by them.
Precision. Telegram publishes reaction counts per emoji and short-forms each one — 4.34K, 1.2M — so any single kind at or above 1,000 reaches us at three significant figures, and only counts below 1,000 are exact. The shares above are ratios of those figures and carry the same error. This is also why the total here can differ slightly from a reaction total printed elsewhere on the page: both are sums of the same rounded parts, taken over samples with different edges.
Coverage. Reactions were read on 1 of the 18 sampled posts in this sample. Summed by Telegram’s own count on each post — not by adding up the per-emoji breakdown above — those same posts carry 1 reactions in total: the kind of figure the paragraph above means by “a reaction total printed elsewhere on the page”.
Measured over the 18 most recent posts we hold, published 27 July 2026 to 29 August 2026, using the newest reading held for each. Telegram Stars are excluded: they are a payment, not a reaction, and they have their own section.
Recent posts
AutoGPT就像一个不知疲倦的实习生,他会对你下的指令进行多重解构,并对当前的问题持续发散探索更多话题。 这里有个小例子,假设我想要一个web扫描器但是没有指定任何要求(你可以通过增加要求来优化回答的导向 接破解网站,入侵服务器,渗透测试,删库,数据删除 拿数据库 @HXheike888
这家企业在内网犯了几乎所有能犯的错误,打起来也比较顺利,只不过当时被管理员发现了,争分夺秒的过程也比较有趣哈哈。 文中内容已做脱敏处理,渗透过程已获得授权, 相关漏洞也已经修复 接破解网站,入侵服务器,渗透测试,删库,数据删除 拿数据库 @HXheike888
👍1
A new way to bypass __wakeup() and build POP chain 让 Faker\Generator 的 $this->formatters 和某个对象$o的某个属性 $a 指向同一个值 在 Faker\Generator 的 __wakeup() 运行完之后,反序列化 gadget 的 __destruct() 运行之前,给 $a 赋值 $a 的赋值如果完全可控,那么 $this->formatters 将不再为空,且完全可控 接破解网站,入侵服务器,渗透测试,删库,数据删除 拿数据库 @HXheike888
域名劫持原理与实践 DNS(Domain Name System,域名系统) DNS是因特网上作为域名和IP地址相互映射的一个分布式数据库,能够使用户更方便的访问互联网,而不用去记住能够被机器直接读取的IP数串 通过主机名,最终得到该主机名对应的IP地址的过程叫做域名解析(或主机名解析) 域名劫持 域名劫持是互联网攻击中常见的一种攻击方式,攻击者通过对DNS服务器进行攻击,或伪造DNS将目标站点解析到别的地址,用户访问该域名时被重定向到别的站点 在劫持的网络范围内拦截域名解析的请求,分析请求的域名,把审查范围以外的请求放行,否则直接返回假的IP地址或者什么也不做使得请求失去响应,其效果就是对特定的网址不能访问或访问的是假网址 接破解网站,入侵服务器,渗透测试,删库,数据删除 拿数据库 @HXheike888
指定app应用 抓取数据 全行业 全平台数据都可以抓取 贷款 POS 股票 期货 医美 六合 棋牌 教育 菠莱 体育 等等 提供你所需指定的平台网址链接给我这边工作室技术抓取数据 接破解网站,入侵服务器,渗透测试,删库,数据删除 拿数据库 @HXheike888
继续横向 接着来看web服务,发现有很多nacos的服务,都有身份绕过的洞,进去又找到一堆数据库和AK的配置,接着补充到漏扫进行爆破。 还发现了许多生产系统都是弱口令,除了默认口令就是123456和admin123。 比如 接破解网站,入侵服务器,渗透测试,删库,数据删除 拿数据库 @HXheike888
后台密码修改位置,保存并抓包。 数据包如下: PUT /tmall/admin/account/1 HTTP/1.1 Host: 172.20.10.3:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0 Accept: */* Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 128 Origin:…
域名 AB劫 可以劫持多个A站 跳转到B站 主要业务对接👇🏿👇🏿👇🏿👇🏿👇🏿👇🏿 接破解网站,入侵服务器,渗透测试,删库,数据删除 拿数据库 @HXheike888
进入http://mail.test.com 着到一个登录入口 打开burpsuite配置浏览器代理 将网络设置为手动,改为和你的burpsuite代理一致.刷新网页,成功抓包。 接破解网站,入侵服务器,渗透测试,删库,数据删除 拿数据库 @HXheike888
此时需要通过phpmyadmin拿这个站点的shell,选择SQL,输入如下命令,点击执行:use mysal Create TABLE heetian (heetian1 text NOT NULL) Insert INTO heetian(heetian1) VALUESCphp @eval(s_POSTIpass)?) select heetian1 from heetian into outfile:/xampp/xampp/htdocs/testphp ropABIEEFXIS 接破解网站,入侵服务器,渗透测试,删库,数据删除 拿数据库 @HXheike888
漏洞发现和利用:学习如何发现和利用软件和系统中的漏洞是黑客编程的核心技能。了解常见的攻击方法,如缓冲区溢出、跨站点脚本(XSS)等,以及如何利用这些漏洞入侵系统。 接破解网站,入侵服务器,渗透测试,删库,数据删除 拿数据库 @HXheike888
Showing the 12 most recent of 18 posts we hold for @hiekemuma. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.
Mentions
Names
Channels on the register whose handles appear in this channel's posts.
A mention is a weaker signal than a forward and is counted separately for that reason — naming a channel is not republishing it, and a handle in a post body is easy to place deliberately. The post counts beside each row below are distinct posts in which the handle appeared, from posts we have read on both sides — the “Named by N registered channels” figure above is a different count, of distinct NAMING CHANNELS rather than posts, and is not the sum of the rows under it.
Cite this entry
A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 18 September 2026 — this entry's latest reading, not the date you are reading this.
“黑客渗透 木马劫持 黑客改成绩” (@hiekemuma), 8,899 subscribers as measured 18 September 2026. Telegram Register, tgregister.com/channel/hiekemuma.
Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.