添加链接
link管理
链接快照平台
  • 输入网页链接,自动生成快照
  • 标签化管理网页链接
import threading import socket def server_loop(local_host,local_port,remote_host,remote_port,receive_first): server=socket.socket(socket.AF_INET,socket.SOCK_STREAM) server.blind((local_host,local_port)) except: print “[!!] Failed to listen on %s:%d” % (local_host,local_port) print “[!!] Check for other listing sockets or correct permissions.” sys.exit(0) print “[*] Listening on %s:%d” % (local_host,local_port) server.listen(5) while True: client_socket,addr=server.accept() print “[==>] Received incoming connection from %s:%d %(addr[0],addr[1])” proxy_thread=threading.Thread(target=proxy_handler,args=(client_socket,remote_host,remote_port,receive_first)) proxy_thread.start() def proxy_handler(client_socket,remote_host,remote_port,receive_first): remote_socket=socket.socket(socket.AF_INET,socket.SOCK_STREAM) remote_socket.connect((remote_host,remote_port)) if receive_first: remote_buffer=receive_from(remote_socket) hexdump(remote_buffer) remote_buffer=response_handler(remote_buffer) if len(remote_buffer): print “[<==] Sening %d bytes to localhost.” % len(remote_buffer) client_socket.send(remote_buffer) while True: local_buffer=receive_from(cilent_socket) if len(local_buffer): print “[==>] Received %d bytes from localhost.” % len(local_buffer) hexdump(local_buffer) local_buffer=request_handler(local_buffer) remote_socket.send(local_buffer) print “[==>] Send to remote.” remote_buffer=receive_from(remote_socket) if len(remote_buffer): print “[<==] Received %d bytes from remote.” % len(remote_buffer) hexdump(remote_buffer) remote_buffer=response_handler(remote_buffer) cilent_socket.send(remote_buffer) print “[<==] Sent to localhost.” if not len(local_buffer) or not len(remote_buffer): client_socket.close() remote_socket.close() print “[*] No more data.Closing connection.” break def hexdump(src,length=16): result=[] digits=4 if isinstance(src,unicode) else 2 for i in xrange(0,len(src),length): s=src[i:i+length] hexa=b’ ‘.join([“%0*X” % (digits, ord(x)) for x in s]) text=b”.join([x if 0x20 <=ord(x) < 0x7F else b’.’ for x in s]) result.append( b”%04X %S” (i, length*(digits + 1),hexa,text)) print b’\n’,join(result) def receive_from(connection): buffer=”” connection.settimeout(2) while True: data=connection.recv(4096) if not data: break buffer += data except: return buffer def request_handler(buffer): return buffer def response_handler(buffer): return buffer def main(): if len(sys.argv[1:]) !=5: print “Usage: ./proxy.py [localhost] [localport] [remotehost] [remoteport] [receive_first]” print “Example: ./proxy.py 127.0.0.1 9000 10.12.132.1 9000 Ture” sys.exit(0) local_host=sys.argv[1] local_port=int(sys.argv[2]) remote_host=sys.argv[3] remote_port=int(sys.argv[4]) receive_first=sys.argv[5] if “True” in receive_first: receive_first=True else: receive_first=False server_loop(local_host,local_port,remote_host,remote_port,receive_first) main()

0x02 代理服务器

# coding:utf8
# 创建一个 TCP 代理
import sys
import socket
import threading
def server_loop(local_host, local_port, remote_host, remote_port, receive_first):
    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        # 服务器监听的 host和端口
        server.bind((local_host, local_port))
    except Exception, e:
        print "[!!] Failed to listen on %s:%d" % (local_host, local_port)
        print "[!!] Check for other listening sockets or correct permissions"
        sys.exit(0)
    print "[*] Listening on %s:%d" % (local_host, local_port)
    #开始监听TCP传入连接
    server.listen(5)
    while True:
        # 获取客户端请求过来的数据
        client_socket, addr = server.accept()
        # 打印出本地客户端连接的信息
        print "[==>] Received incoming connection from %s:%d" % (addr[0], addr[1])
        # 开启一个线程 与 远程主机通信
        proxy_thread = threading.Thread(target=proxy_handler, args=(client_socket, remote_host, remote_port, receive_first))
        proxy_thread.start()
# 十六进制转储的函数
def hexdump(src, length=16):
    result = []
    digits = 4 if isinstance(src, unicode) else 2
    for i in xrange(0, len(src), length):
        s = src[i:i+length]
        hexa = b' ' . join(["%0*X" % (digits, ord(x)) for x in s])
        text = b''.join([x if 0x20 <= ord(x) < 0x7F else b'.' for x in s])
        result.append(b"%04X %-*s %s" % (i, length*(digits + 1), hexa, text))
    print b'\n'.join(result)
# 从远程服务器里面接受数据
def receive_from(connection):
    print "receive_from function start ........... "
    buffer = ""
    # 我们设置了两秒的超时, 这取决于目标的情况, 可能需要调整
    connection.settimeout(2)
        # 持续从缓存中读取数据直到没有数据或者超时
        while True:
            data = connection.recv(4096)
            print "receive_from data is %s " % data
            if not data:
                print "receive_from data is break ......."
                break
            buffer += data
    except Exception, e:
        print str(e)
        print str(Exception)
        print 'error for receive_from'
    return buffer
# 对目标是远程主机的请求进行修改
def request_handler(buffer):
    #执行包修改
    return buffer
# 对目标是本地主机的响应进行修改
def response_handler(buffer):
    #执行包修改
    return buffer
def proxy_handler(client_socket, remote_host, remote_port, receive_first):
    # 连接远程主机
    remote_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    print "remote_socket start ...... %s %d" % (remote_host, remote_port)
    remote_socket.connect((remote_host, remote_port))
    # 如果必要从远程主机接收数据
    if receive_first:
        remote_buffer = receive_from(remote_socket)
        hexdump(remote_buffer)
        # 发送给我们的响应处理
        remote_buffer = response_handler(remote_buffer)
        # 如果我们有数据传递给本地客户端,发送它
        if len(remote_buffer):
            print "[<==] Sending %d bytes to localhost." % len(remote_buffer)
            client_socket.send(remote_buffer)
    # 现在我们从本地循环读取数据, 发送给远处主机和本地主机
    while True:
        # 从本地读取数据
        local_buffer = receive_from(client_socket)
        print "local_buffer is %s " % local_buffer
        if len(local_buffer):
            print "[==>] Received %d bytes from localhost." % len(local_buffer)
            hexdump(local_buffer)
            # 这里可以改变我们请求的数据 过滤等功能
            local_buffer = request_handler(local_buffer)
            # 向远处主机发送数据
            remote_socket.send(local_buffer)
            print "[==>] Sent to remote."
        # 接收响应的数据
        remote_buffer = receive_from(remote_socket)
        if len(remote_buffer):
            print "[<==] Received %d bytes from remote." % len(remote_buffer)
            hexdump(remote_buffer)
            # 发送到响应处理函数
            remote_buffer = response_handler(remote_buffer)
            # 将响应发送给本地socket
            client_socket.send(remote_buffer)
        # 如果两边都没有数据, 关闭连接
        if not len(local_buffer) or not len(remote_buffer):
            client_socket.close()
            remote_socket.close()
            print "[*] No more data. Closing connections."
            sys.exit(0)
            break
def main():
    if len(sys.argv[1:]) != 5:
        print "Usage: ./proxy.py [localhost] [localport] [remotehost] [remoteport] [receive_first]"
        print "Example: ./proxy.py 127.0.0.1 9000 10.12.132.1 9000 True"
        sys.exit(0)
    # 设置本地监听参数
    local_host = sys.argv[1]
    local_port = int(sys.argv[2])
    # 设置远程目标
    remote_host = sys.argv[3]
    remote_port = int(sys.argv[4])
    # 告诉代理在发送给远程主机之前连接和接受数据
    receive_first = sys.argv[5]
    if "True" in receive_first:
        receive_first = True
    else:
        receive_first = False
    # 设置好我们的监听 socket
    server_loop(local_host, local_port, remote_host, remote_port, receive_first)
main()
##python index5.py 0.0.0.0 9999 120.25.249.52 80 True
##cd D:\python_code\httPython

0x03 TCP客户端

# coding:utf8
import socket
target_host = '127.0.0.1'
target_port = 9999
# 建立一个socket 对象
# socket.AF_INET表示IPv4地址,或者主机名
# socket.SCOK_STREAM 这将是一个TCP客户端
client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# 连接客户端
client.connect((target_host, target_port))
# 发送一些数据
client.send("GET / HTTP/1.1\r\nHost: chengzhier.com\r\n\r\n") # 这里不要直接打字符串,需要用http的形式请求
# 接收一些数据
response = client.recv(4096)
print response

0x04 总结

全篇水文,只为以后造轮子,安排!

标签云

渗透测试 (26) 漏洞复现 (24) python (16) python学习 (13) 代码审计 (13) 通达OA (8) windows (6) SQL注入 (5) 内网渗透 (5) 信息收集 (5) getshell (5) CVE (3) Apache (3) WebLogic (3) 逻辑漏洞 (3) mimikatz (3) Cobalt Strike (3) 提权 (3) 文件包含 (3) 信息泄露 (3) Adminxe (2) Linux (2) Tomcat (2) Nginx (2) msf (2) windows认证 (2) 域渗透 (2) 弱口令 (2) CS (2) RCE (2) 文件上传 (2) 未授权访问 (2) 后渗透 (2) 攻防演练 (2) 中国蚁剑 (2) bypass (2) XXE (2) 远程代码执行 (2) 任意文件读取 (2) 任意文件读取漏洞 (2) redis (2) 信息安全 (1) java (1) ctf (1) python爬虫 (1) EXP (1) sudo (1) 面向对象 (1) 中间件 (1) web安全 (1) IIS (1) Crlf (1) jBoss (1) SSRF (1) Writeup (1) AWD (1) 永恒之蓝 (1) 越权 (1) 防火墙 (1) php (1) esp8266 (1) wifi钓鱼 (1) Dnslog注入 (1) sqli (1) Zabbix (1) 白银票据 (1) 黄金票据 (1) kerberos (1) edusrc (1) POST注入 (1) 水平越权 (1) DDOS (1) 参数可控 (1) procdump (1) WMIC (1) seacms (1) Metasploit (1) UDF提权 (1) 内网漫游 (1) 横向渗透 (1) psexec (1) Ajp (1) CVE-2020-1938 (1) Apache-Tomcat-Ajp (1) XSS (1) linux运维 (1) mysql (1) phpmyadmin (1) shiro反序列化漏洞 (1) 远程下载 (1) 端口转发 (1) socks4a代理 (1) CVE-2019-17564 (1) Apache dubbo (1) HTTP协议反序列化漏洞分析 (1) dnslog (1) fastjson (1) 反序列化 (1) 分块传输 (1) 安全开发 (1) sqlmap (1) CVE-2020-0796 (1) 代码执行 (1) phpinfo (1) 端口 (1) Snort rules (1) 致远OA (1) bypassUAC (1) 横向移动 (1) IPC (1) docker (1) docker容器逃逸 (1) go (1) kali (1) MS16-032 (1) 系统安全 (1) CrossC2 (1) OrientDB (1) Joomla (1) 钓鱼邮件 (1) 邮件网关 (1) 解析漏洞 (1) phpstudy (1) 内网利器 (1) Ant Sword (1) 中国菜刀 (1) cert_has_expired (1) 注入 (1) ThinkAdminV6 (1) 用友GRP-u8 (1) 泛微OA云桥 (1) 未授权任意文件读 (1) 天融信TopApp-LB 负载均衡系统 (1) 单机维权 (1) 凭证窃取 (1) CVE-2020-14882 (1) Apache Flink (1) 月神 (1) 支付漏洞 (1) 并发漏洞 (1) 验证码绕过 (1) powershell (1) 钓鱼凭证 (1) SSP (1) 小技巧 (1) 列盘符 (1) XenMobile (1) CVE-2020-8209 (1) SSTI (1) 服务器模板注入 (1) BloodHound (1) IDS对抗 (1) Nexus (1) 远程命令执行 (1) CVE-2020-10199 (1) 用友NC (1) 任意文件上传 (1) Vmware vcenter (1) 未授权任意文件 (1) Vmware vcenter未授权任意文件RCE (1) Apache Druid (1) CVE-2021-25646 (1) Apache Axis2 (1) 文件上传getshell (1) 任意用户登录 (1) 锐捷RG-UAC统一上网行为管理审计系统 (1) CNVD-2021-14536 (1) Zeppelin (1) Zeppelin未授权 (1) Zeppelin未授权访问getshell (1) webshell (1) CVE-2016-0638 (1) CVE-2017-10271 (1) CVE-2019-2725 (1) CVE-2019-2729 (1) CVE-2020-2551 (1) CVE-2020-2555 (1) CVE-2020-14750 (1) CVE-2020-14882&14883 (1) zimbra SSRF漏洞 (1) thinkphp5.x漏洞利用EXP (1) thinkphp5.x (1) thinkphp (1) 天擎 (1) Apache Solr (1) SSRF漏洞 (1) chrome-0day (1) --no-sandbox (1) D-Link DCS (1) 监控账号密码 (1) Jellyfin (1) Jellyfin 任意文件读取漏洞 (1) WordPress 插件SuperForms漏洞 (1) Zyxel NBG2105 (1) 身份验证绕过 (1) 帆软 (1) 任意文件覆盖漏洞 (1) 泛微OA V8 SQL注入 (1) 泛微OAV9 前台文件上传 (1) 好视通视频会议 (1) 弱口令和任意文件下载漏洞 (1) 和信创天云桌面 (1) 文件上传漏洞 (1) 金山 V8 终端安全系统 (1) 浪潮 ClusterEngineV4.0 (1) 任意命令执行 (1) 齐治堡垒机任意用户登录漏洞 (1) 奇安信 网康下一代防火墙 (1) 亿邮电子邮件 (1) 亿邮电子邮件系统远程命令执行漏洞 (1) 用友ERP-NC 目录遍历漏洞 (1) 致远OA-ajax.do上传文件漏洞 (1) 中新金盾信息安全管理系统 (1) 微信上线 (1) CobaltStrike (1) 钓鱼 (1) WeChat上线CobaltStrike钓鱼 (1) 微信客户端远程命令执行0day漏洞 (1) ShowDoc (1) ShowDoc 远程代码执行漏洞 (1) XMind (1) XMind-XSS-V8命令执行复现 (1) XMind-XSS-V8命令执行漏洞复现 (1) 蓝凌OA (1) 蓝凌OA漏洞复现 (1) 蓝凌OA任意文件写入SSRF命令执行 (1) 用友 NC bsh.servlet.BshServlet (1) 用友 NC bsh.servlet.BshServlet 远程命令执行漏洞 (1) 致远 OA 组合 getshell (1) H3C SecParh堡垒机 (1) data_provider.php 远程命令执行漏洞 (1) Windows Print Spooler (1) CVE-2021-1675 (1) Windows Print Spooler 远程代码执行漏洞(CVE-2021-1675) (1) DC (1) 绿盟BAS日志 (1) 绿盟BAS日志数据安全性分析系统未授权访问 (1) 若依(Ruoyi)管理系统后台sql注入+任意文件下载漏洞 (1) YApi接口管理平台远程代码执行漏洞(含批量POC) (1) 钓鱼网站渗透过程 (1) weblogic上传木马 (1) weblogic上传木马路径选择 (1) 前端加密登陆绕过 (1) 前端加密 (1) JS加密 (1) 登陆绕过 (1) 网站安装SSL证书 (1) EduSrc漏洞挖掘 (1) 马氏五连鞭EduSrc漏洞挖掘 (1) DC-1靶机 (1) DC-2靶机 (1) Ueditor (1) Ueditor不出网 (1) Ueditor不出网getshell (1) 针对Ueditor不出网getshell的解决方法 (1) CVE-2021-22205 (1) GitLab (1) 未授权RCE (1) 黑白盒审计 (1) 攻防演练复盘 (1) CVE-2021-36749 (1) CVE-2021-36749 Apache Druid LoadData 任意文件读取漏洞 (1) Apache Druid LoadData (1) CVE-2020-1472 域内提权 (1) CVE-2020-1472 (1) 域内提权 (1) Apache ShenYu (1) JWT认证缺陷绕过 (1) CVE-2021-37580 (1) Apache APISIX Dashboard 身份验证绕过漏洞 (1) Apache APISIX Dashboard (1) 身份验证绕过漏洞 (1) CVE-2021-45232 (1) CVE-2021-4034 (1) Linux Polkit本地权限提升 (1) linux提权 (1) GO语言学习 (1) Sunlogin,向日葵远程代码执行 (1) clash (1) CVE-2022-0543 (1) RDP劫持 (1) ADCS (1) APP渗透 (1) 逆向破解 (1) hook (1)