ABUSING DATABASES AND FILESYSTEMS

mongo客户端

mgo手册 https://my.oschina.net/ffs/blog/300148

package main
import (
    "fmt"
    "gopkg.in/mgo.v2"
    "gopkg.in/mgo.v2/bson"
)
type admin struct {
    Id bson.ObjectId `bson:"_id"`
    Username string `bson:"username"`
    Password string `bson:password`
}
func main() {
    session,err := mgo.Dial("192.168.0.174") // server地址
    if err != nil{panic(err)}
    db := session.DB("admin") // 切换数据库
    c := db.C("admin") // 切换collection
    results := make([]admin,0)
    if err := c.Find(nil).All(&results);err!=nil{
        panic(err)
    }
    for _,res := range results{
        fmt.Println(res.Username,res.Password)
    }
}

mysql客户端

package main
import (
    "database/sql"
    "fmt"
    _ "github.com/go-sql-driver/mysql" // 仅执行init函数，不导入整个包
)
var user string
func main() {
    db,err := sql.Open("mysql", "root:root@tcp(192.168.0.174:3306)/mysql")
    if err !=nil{panic(err)}
    rows,err := db.Query("select user()")
    defer rows.Close()
    if err != nil{panic(err)}
    for rows.Next(){
        err := rows.Scan(&user)
        if err != nil{panic(err)}
        fmt.Println(user)
    }
}

特殊文件搜集

package main
import (
    "fmt"
    "os"
    "path/filepath"
    "regexp"
)
var regexps = [] *regexp.Regexp{
    regexp.MustCompile(`(?i)user`),
    regexp.MustCompile(`(?i)conf`),
    regexp.MustCompile(`(?i)key`),
    regexp.MustCompile(`(?i)pass(?i)`),
}
func main() {
    root := os.Args[1]
    if err:=filepath.Walk(root,walkFn);err!=nil{
        panic(err)
    }
}
func walkFn(path string, info os.FileInfo, err error) error {
    for _,r := range regexps{
        if r.MatchString(path){
            fmt.Printf("[+] %s\n",path)
        }
    }
    return nil
}