[fix]删除不必要模块，增加可能的风险路径

2022-03-21 14:26:57 +08:00
parent 59a1b3f8f9
commit ef35be4029
9 changed files with 5 additions and 167 deletions
--- a/ipq/Main_ipq.py
+++ b/ipq/Main_ipq.py
@@ -1,9 +0,0 @@
-# -*- coding: utf-8 -*-
-
-import ipq.ipq
-
-def exec(URL):
-    ipq.ipq.attack(URL)
-
-if __name__ == "__main__":
-    exec()
--- a/ipq/init.py
+++ b/ipq/init.py
@@ -1 +0,0 @@
-# -*- coding: utf-8 -*-
--- a/ipq/ipq.py
+++ b/ipq/ipq.py
@@ -1,39 +0,0 @@
-# -*- coding: utf-8 -*-
-import sqlite3
-def attack(URL):
-    conn = sqlite3.connect('F:/anwang.db')
-    cursor = conn.cursor()
-    #模糊查询
-    s = cursor.execute(f"select * from '资产0521' where IP地址 LIKE '%{URL}%' or 所属业务系统 LIKE '%{URL}%' or 负责部门 LIKE '%{URL}%' or 负责人 LIKE '%{URL}%' or 科室 LIKE '%{URL}%';")
-    if s.fetchall():
-        print('[+]互联网中心 - 发现资产。')
-        s = cursor.execute(f"select * from '资21' where IP地址 LIKE '%{URL}%' or 所属业务系统 LIKE '%{URL}%' or 负责部门 LIKE '%{URL}%' or 负责人 LIKE '%{URL}%' or 科室 LIKE '%{URL}%';")
-        for ss in s:
-            print(ss)
-    else:
-        print('[-]互联网中心 - 未发现相关资产。')
-
-    conn1 = sqlite3.connect('F:zhgxin.db')
-    cursor1 = conn1.cursor()
-    #模糊查询
-    s = cursor1.execute(f"select * from '19itong' where IP地址 LIKE '%{URL}%' or 所属业务系统 LIKE '%{URL}%' or 负责部门 LIKE '%{URL}%' or 负责人 LIKE '%{URL}%' or 科室 LIKE '%{URL}%';")
-    if s.fetchall():
-        print('[+]位置中心 - 业务系统发现资产。')
-        s = cursor1.execute(f"select * from '190itong' where IP地址 LIKE '%{URL}%' or 所属业务系统 LIKE '%{URL}%' or 负责部门 LIKE '%{URL}%' or 负责人 LIKE '%{URL}%' or 科室 LIKE '%{URL}%';")
-        for ss in s:
-            print(ss)
-    else:
-        print('[-]位置中心 - 业务系统未发现相关资产。')
-
-    s = cursor1.execute(f"select * from '1905han' where IP地址 LIKE '%{URL}%' or 所属业务系统 LIKE '%{URL}%' or 负责部门 LIKE '%{URL}%' or 负责人 LIKE '%{URL}%' or 科室 LIKE '%{URL}%';")
-    if s.fetchall():
-        print('[+]位置中心 - 负责部门负责人发现资产。')
-        s = cursor1.execute(f"select * from '19han' where IP地址 LIKE '%{URL}%' or 所属业务系统 LIKE '%{URL}%' or 负责部门 LIKE '%{URL}%' or 负责人 LIKE '%{URL}%' or 科室 LIKE '%{URL}%';")
-        for ss in s:
-            print(ss)
-    else:
-        print('[-]位置中心 - 负责部门负责人未发现相关资产。')
-
-if __name__ == "__main__":
-    attack()
-
--- a/ipquery/Main_ipquery.py
+++ b/ipquery/Main_ipquery.py
@@ -1,12 +0,0 @@
-# -*- coding: utf-8 -*-
-import ipquery.ipquery
-
-
-def exec(URL):
-    ipquery.ipquery.attack(URL)
-
-
-
-
-if __name__ == "__main__":
-    exec()
--- a/ipquery/init.py
+++ b/ipquery/init.py
@@ -1 +0,0 @@
-# -*- coding: utf-8 -*-
--- a/ipquery/ipquery.py
+++ b/ipquery/ipquery.py
@@ -1,97 +0,0 @@
-# -*- coding: utf-8 -*-
-from urllib.parse import urlparse
-import socket
-import requests
-import urllib3
-from bs4 import BeautifulSoup
-
-
-def attack(URL):
-    # 百度查询模块
-    url = URL
-    URL = urlparse(URL).netloc
-    if URL == '':
-        URL = url
-    else:
-        pass
-    try:
-        ip = URL
-        payload = {'query': ip, 'resource_id': '6006'}
-        r = requests.get("https://sp0.baidu.com/8aQDcjqpAAV3otqbppnN2DJv/api.php", params=payload)
-
-        print('百度结果：',r.json().get('data')[0].get('location'))
-    except Exception:
-        try:
-            ip = socket.gethostbyname(URL)
-            print('IP查询目标：' + ip)
-            payload = {'query': ip, 'resource_id': '6006'}
-            r = requests.get("https://sp0.baidu.com/8aQDcjqpAAV3otqbppnN2DJv/api.php", params=payload)
-            print('百度结果：',r.json().get('data')[0].get('location'))
-        except Exception:
-            print('获取IP地址错误：'+URL)
-
-    # IPIP查询模块
-    print('IPIP结果：')
-    urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
-    url = 'https://www.ipip.net/ip.html'
-    headers = {"User-Agent": 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.9 Safari/537.36'}
-    data = {'ip': URL}
-    re = requests.post(url,headers=headers,data=data,verify=False,timeout=5)
-    soup=BeautifulSoup(re.content,"lxml")
-
-    def information_one(table):
-        length = len(table.find_all('td'))
-        data2 = table.find_all('td')[2].get_text().strip()
-        information2 = table.find_all('span')[3].get_text().strip()
-        print(data2, ':', information2)
-        m = 5
-        x = 4
-        while x < length:
-            data = table.find_all('td')[x].get_text().strip()
-            information = table.find_all('span')[m].get_text().strip()
-            print(data, ':', information)
-            x = x + 2
-            m = m + 1
-
-    def information_two(table):
-        data = table.find_all('td')[0].get_text().strip()
-        information = table.find_all('span')[1].get_text().strip()
-        if '威胁情报' in data:
-            print(data, ':', information)
-        else:
-            pass
-
-    def information_three(table):
-        data1 = table.find_all('th')[0].get_text().strip()
-        information1 = table.find_all('td')[0].get_text().strip()
-        data2 = table.find_all('th')[1].get_text().strip()
-        information2 = table.find_all('td')[1].get_text().strip()
-        data3 = table.find_all('th')[2].get_text().strip()
-        information3 = table.find_all('td')[2].get_text().strip()
-        if '纯真IP库数据' in data2:
-            print(data1, ':', information1)
-            print(data2, ':', information2)
-            print(data3, ':', information3)
-        else:
-            pass
-    for x in range(0, 7):
-        try:
-            table = soup.find_all('div')[6].find_all('table')[x]
-        except Exception:
-            pass
-        try:
-            information_one(table)
-        except Exception:
-            pass
-        try:
-            information_two(table)
-        except Exception:
-            pass
-        try:
-            information_three(table)
-        except Exception:
-            pass
-
-
-if __name__ == "__main__":
-    attack()
--- a/moon.py
+++ b/moon.py
@@ -2,7 +2,6 @@
 import sys
 import tomcat.Main_tomcat
 import fckeditor.Main_fckeditor
-import ipquery.Main_ipquery
 import weblogic.Main_weblogic
 import iis.Main_iis
 import docker_vuln.Main_docker
@@ -10,7 +9,6 @@ import redis_vuln.Main_redis
 import zabbix_vuln.Main_zabbix
 import navigate_vuln.Main_navigate
 import gatepass_vuln.Main_gatepass
-import ipq.Main_ipq
 import spring_vuln.Main_spring
 import jboss.Main_jboss
 import kindeditor.Main_kindeditor
@@ -54,8 +52,6 @@ modul: exploits
            tomcat.Main_tomcat.exec(sys.argv[3])
        elif sys.argv[2] == 'fck':
            fckeditor.Main_fckeditor.exec(sys.argv[3])
-        elif sys.argv[2] == 'ip':
-            ipquery.Main_ipquery.exec(sys.argv[3])
        elif sys.argv[2] == 'weblogic':
            weblogic.Main_weblogic.exec(sys.argv[3])
        elif sys.argv[2] == 'iis':
@@ -72,8 +68,6 @@ modul: exploits
            gatepass_vuln.Main_gatepass.exec(sys.argv[3])
        elif sys.argv[2] == 'spring':
            spring_vuln.Main_spring.exec(sys.argv[3])
-        elif sys.argv[2] == 'ipq':
-            ipq.Main_ipq.exec(sys.argv[3])
        elif sys.argv[2] == 'jboss':
            jboss.Main_jboss.exec(sys.argv[3])
        elif sys.argv[2] == 'kindeditor':
--- a/tomcat/example_vulnerability.py
+++ b/tomcat/example_vulnerability.py
@@ -25,7 +25,10 @@ def attack(URL):
        '/host-manager/html',   #401
        '/icons/',
        '/manual/',
-        '/examples/jsp/snp/snoop.jsp'
+        '/examples/jsp/snp/snoop.jsp',
+        '/lib/catalina.jar',
+        '/conf/tomcat-users.xsd',
+        '/bin/catalina-tasks.xml'
    )

    print('[+]开始检测-Tomcat-example_vulnerability。[+]')
--- a/weblogic/weblogic_weakpasswd.py
+++ b/weblogic/weblogic_weakpasswd.py
@@ -13,7 +13,7 @@ def attack(URL):

    #设定用于爆破的账户密码
    a = 0
-    accounts = ['guest','WebLogic', 'weblogic', 'Oracle@123', 'system', 'Administrator', 'admin', 'security', 'joe', 'wlcsystem', 'wlpisystem','portaladmin']
+    accounts = ['guest','WebLogic', 'weblogic', 'Oracle@123', 'system', 'Administrator', 'admin', 'security', 'joe', 'wlcsystem', 'wlpisystem','portaladmin','mary']
    passwds = ['guest','weblogic1','WebLogic', 'weblogic', 'Oracle@123', 'password', 'system', 'Administrator', 'admin', 'security', 'joe','wlcsystem', 'wlpisystem','passwd','portaladmin']
    for account in accounts:
        for passwd in passwds: