手把手教你打造自己的弱口令扫描工具(系统弱口令篇)
0x01 前言
在渗透测试过程中,弱口令检测是必要的一个环节,选择一个好用的弱口令扫描工具,尤为重要。
类似的弱口令检测工具如:Hydra、Hscan、X-Scan,很多时候满足不了自己的需求。
通过Python打造自己的弱口令扫描工具,集成在一起的Python脚本,在实战应用中,更切合实际。
0x02 FTP模块
FTP一般分为两种情况,匿名访问和弱口令,分别编写:
import ftplib
def ftp_anonymous(ip,port):
try:
ftp = ftplib.FTP()
ftp.connect(ip,port,2)
ftp.login()
ftp.quit()
print '[+] FTP login for anonymous'
except:
print '[-] checking for FTP anonymous fail'
def ftp_login(ip,port,user,pwd):
try:
ftp = ftplib.FTP()
ftp.connect(ip,port,2)
ftp.login(user,pwd)
ftp.quit()
print '[+] FTP weak password: '+user,pwd
except:
print '[-] checking for '+user,pwd+' fail'
0x03 SSH模块
import paramiko
def ssh_login(ip,port,user,pwd):
try:
ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect(ip,port,user,pwd,timeout=5)
print '[+] SSH weak password: '+user,pwd
ssh.close()
except:
print '[-] checking for '+user,pwd+' fail'
0x04 Telnet模块
import telnetlib
def telnet(ip,port=23):
try:
tn = telnetlib.Telnet(ip,timeout=5)
tn.set_debuglevel(0)
tn.read_until("login: ")
tn.write(user + '\r\n')
tn.read_until("assword: ")
tn.write(pwd + '\r\n')
result = tn.read_some()
result = result+tn.read_some()
if result.find('Login Fail')>0 or result.find('incorrect')>0:
print "[-] Checking for "+user,pwd+" fail"
else:
print "[+] Success login for "+user,pwd
tn.close()
except:
print '[-] Something Error'+username,password+" fail"
0x05 ipc$模块
from impacket import smb
def smb_login(ip,port,user,pwd):
try:
client = smb.SMB('*SMBSERVER',ip)
client.login(user,pwd)
flag ='[+] IPC$ weak password: '+user,pwd
except:
print '[-] checking for '+user,pwd+' fail'