|
| 1 | +# 毒刺(pystinger) |
| 2 | +毒刺(pystinger)是一个通过webshell实现**内网端口转发出网&内网SOCK5代理出网**.工具主体使用python开发,当前支持php,jsp(x),aspx三种代理脚本. |
| 3 | +# 使用方法 |
| 4 | +## 端口转发 |
| 5 | +* proxy.php上传到目标服务器,确保 [http://www.test.com/proxy.php](http://192.168.1.106:81/proxy.php)可以访问,页面返回 stinger XXX! |
| 6 | +* 修改config.ini,示例如下(确保服务器127.0.0.1:8000,127.0.0.1:1080可以正常绑定) |
| 7 | +``` |
| 8 | +[NET-CONFIG] |
| 9 | +WEBSHELL = http://www.test.com/proxy.php |
| 10 | +SERVER_LISTEN = 127.0.0.1:8000 |
| 11 | +TARGET_ADDR = 127.0.0.1:3389 |
| 12 | +LOCAL_ADDR = 127.0.0.1:33899 |
| 13 | +
|
| 14 | +[TOOL-CONFIG] |
| 15 | +LOG_LEVEL = INFO |
| 16 | +READ_BUFF_SIZE = 10240 |
| 17 | +SLEEP_TIME = 0.0 |
| 18 | +``` |
| 19 | +* 将stinger_server.exe和config.ini上传到目标服务器同一目录,菜刀(蚁剑)执行mirror_server.exe启动服务端 |
| 20 | +* stinger_client和config.ini拷贝到本地PC的同一目录,命令行执行stinger_client,生成如下输出表示成功 |
| 21 | +``` |
| 22 | +2019-09-29 12:57:11,493 - INFO - 215 - Use SERVER_LISTEN as REMOTE_SERVER |
| 23 | +2019-09-29 12:57:11,493 - INFO - 219 - ------------Client Config------------ |
| 24 | +2019-09-29 12:57:11,493 - INFO - 222 - |
| 25 | +LOG_LEVEL: INFO |
| 26 | +SLEEP_TIME:0.1 |
| 27 | +READ_BUFF_SIZE: 10240 |
| 28 | +WEBSHELL: http://192.168.3.10:82/proxy.php |
| 29 | +REMOTE_SERVER: http://127.0.0.1:8000 |
| 30 | +LOCAL_ADDR: 127.0.0.1:33899 |
| 31 | +
|
| 32 | +
|
| 33 | +2019-09-29 12:57:11,500 - INFO - 63 - ------------Server Config------------ |
| 34 | +2019-09-29 12:57:11,500 - INFO - 69 - |
| 35 | +LOG_LEVEL: INFO |
| 36 | +READ_BUFF_SIZE: 10240 |
| 37 | +SERVER_LISTEN: 127.0.0.1:8000 |
| 38 | +TARGET_ADDR: 127.0.0.1:3389 |
| 39 | +client_address_list:[] |
| 40 | +SOCK5: False |
| 41 | +``` |
| 42 | +* 此时已经将192.168.3.10的3389端口映射到了你本地pc的33899端口 |
| 43 | +## SOCK5代理 |
| 44 | +* proxy.php上传到目标服务器,确保 [http://www.test.com/pro](http://192.168.1.106:81/proxy.php)[xy.](http://192.168.1.106:81/proxy.php)[php](http://192.168.1.106:81/proxy.php)可以访问,页面返回 stinger XXX! |
| 45 | +* 修改config.ini,示例如下(确保服务器127.0.0.1:8000可以正常绑定) |
| 46 | +``` |
| 47 | +[NET-CONFIG] |
| 48 | +WEBSHELL = http://www.test.com/proxy.php |
| 49 | +SERVER_LISTEN = 127.0.0.1:8000 |
| 50 | +TARGET_ADDR = 127.0.0.1:1080 |
| 51 | +LOCAL_ADDR = 127.0.0.1:10800 |
| 52 | +
|
| 53 | +[TOOL-CONFIG] |
| 54 | +LOG_LEVEL = INFO |
| 55 | +READ_BUFF_SIZE = 10240 |
| 56 | +SLEEP_TIME = 0.01 |
| 57 | +[ADVANCED-CONFIG] |
| 58 | +SOCKS5 = True |
| 59 | +``` |
| 60 | +* 将stinger_server.exe和config.ini上传到目标服务器同一目录,菜刀(蚁剑)执行mirror_server.exe启动服务端 |
| 61 | +* stinger_client和config.ini拷贝到本地PC的同一目录,命令行执行stinger_client,生成如下输出表示成功 |
| 62 | +``` |
| 63 | +2019-09-29 13:03:41,164 - INFO - 215 - Use SERVER_LISTEN as REMOTE_SERVER |
| 64 | +2019-09-29 13:03:41,164 - INFO - 219 - ------------Client Config------------ |
| 65 | +2019-09-29 13:03:41,164 - INFO - 222 - |
| 66 | +LOG_LEVEL: INFO |
| 67 | +SLEEP_TIME:0.1 |
| 68 | +READ_BUFF_SIZE: 10240 |
| 69 | +WEBSHELL: http://192.168.3.10:82/proxy.php |
| 70 | +REMOTE_SERVER: http://127.0.0.1:8000 |
| 71 | +LOCAL_ADDR: 127.0.0.1:10800 |
| 72 | +
|
| 73 | +
|
| 74 | +2019-09-29 13:03:41,171 - INFO - 63 - ------------Server Config------------ |
| 75 | +2019-09-29 13:03:41,171 - INFO - 69 - |
| 76 | +LOG_LEVEL: INFO |
| 77 | +READ_BUFF_SIZE: 10240 |
| 78 | +SERVER_LISTEN: 127.0.0.1:8000 |
| 79 | +TARGET_ADDR: 127.0.0.1:1080 |
| 80 | +client_address_list:[] |
| 81 | +SOCK5: True |
| 82 | +2019-09-29 13:03:41,171 - INFO - 72 - Connet to server success |
| 83 | +2019-09-29 13:03:41,173 - WARNING - 43 - LoopThread start |
| 84 | +2019-09-29 13:03:41,173 - WARNING - 234 - Tcpserver start |
| 85 | +``` |
| 86 | +* 此时已经你本地10800启动了一个192.168.3.10所在内网的socks5代理 |
| 87 | +# 相关工具 |
| 88 | +[https://github.com/nccgroup/ABPTTS](https://github.com/nccgroup/ABPTTS) |
| 89 | +[https://github.com/sensepost/reGeorg](https://github.com/sensepost/reGeorg) |
| 90 | +[https://github.com/SECFORCE/Tunna](https://github.com/SECFORCE/Tunna) |
| 91 | +# 已测试 |
| 92 | +## stinger_server\stinger_client |
| 93 | +* windows |
| 94 | +* linux |
| 95 | +## proxy.jsp(x)/php/aspx |
| 96 | +* php7.2 |
| 97 | +* tomcat7.0 |
| 98 | +* iis8.0 |
| 99 | +# 更新日志 |
| 100 | +**1.0** |
| 101 | +更新时间: 2019-09-29 |
| 102 | +* 1.0正式版发布 |
| 103 | + |
0 commit comments