1、前言

又在0x00sec上翻到好東東。

https://0x00sec.org/t/python-hackback-updated/882

帖子裏的腳本會得到那些暴力服務器密碼失敗的IP和用戶名，並且使用shodan api做一個溯源定位。

#!/usr/bin/python3.4
import re
import urllib.request
import json
log_path = "/var/log/auth.log"
hosts = []
key = "{YOUR_API_KEY}"
#GET FAILED PASSWORD ATTEMPT
def get_host(test):
        for line in text.split(‘\n‘):
                if line.find("Failed password for invalid ") != -1:
                        if get_ip(line) not in hosts:
                                hosts.append(get_ip(line))
        return hosts
#GET USERNAME
def get_username(line):
        username_word = line.split("Failed password for invalid user ")
        username = (username_word[1]).split(" ")
        return username[0]

#LOCATE IP WITH GEOIP
def geoip(host):
        response = urllib.request.urlopen("http://freegeoip.net/json/"+host)
        geoip = response.read().decode("utf-8")
        geoip = json.loads(geoip)
        print("\n[+] Tracking ip {}".format(geoip[‘ip‘]))
        print("-------------------------------")
        print(‘\tCountry : {}\n\ttimezone : {}\n\tlatitude : {}\n\tlongitude : {}‘.format(geoip[‘country_name‘],geoip[‘time_zone‘],geoip[‘latitude‘],geoip[‘longitude‘]))
def passive_recon(host,key):
        url = "https://api.shodan.io/shodan/host/{}?key={}&minify=true".format(host,key)
        try:
                response = urllib.request.urlopen(url)
                result = response.read().decode(‘utf-8‘)
                result = json.loads(result)
                print("[+] Passive Recon using shodan.io")
                print("-------------------------------")
                print("\tPort : {}\n\tOrganisation {}".format(result[‘ports‘],result[‘org‘]))
                for x in range(len(result[‘ports‘])):
                        print("Banner {}".format(result[‘data‘][x][‘data‘]))
        except:
                print("[+] Passive Recon using shodan.io")
                print("-------------------------------")
                print("\tCan‘t retrieve information")
                pass
if __name__ == "__main__":
        with open(log_path, ‘rt‘) as log:
                text = log.read()
get_host(text)
for host in hosts:
        geoip(host)
        passive_recon(host,key)
 

2、腳本實現的功能

def get_host(test):
        for line in text.split(‘\n‘):
                if line.find("Failed password for invalid ") != -1:
                        if get_ip(line) not in hosts:
                                hosts.append(get_ip(line))
        return hosts

def get_username(line):
        username_word = line.split("Failed password for invalid user ")
        username = (username_word[1]).split(" ")
        return username[0]
 

這些函數將從auth.log文件中獲取測試服務器密碼的ip和用戶名

使用freegeoip.net來獲取ip位置（但是也可以使用shodan.io api），函數只是將json輸出解析為一個美化後的文本輸出。

def geoip(host):
        response = urllib.request.urlopen("http://freegeoip.net/json/"+host)
        geoip = response.read().decode("utf-8")
        geoip = json.loads(geoip)
        print("\n[+] Tracking ip {}".format(geoip[‘ip‘]))
        print("-------------------------------")
        print(‘\tCountry : {}\n\ttimezone : {}\n\tlatitude : {}\n\tlongitude : {}‘.format(geoip[‘country_name‘],geoip[‘time_zone‘],geoip[‘latitude‘],geoip[‘longitude‘]))
 

與shodan進行關聯的腳本函數如下：

def passive_recon(host,key):
        url = "https://api.shodan.io/shodan/host/{}?key={}&minify=true".format(host,key)
        try:
                response = urllib.request.urlopen(url)
                result = response.read().decode(‘utf-8‘)
                result = json.loads(result)
                print("[+] Passive Recon using shodan.io")
                print("-------------------------------")
                print("\tPort : {}\n\tOrganisation {}".format(result[‘ports‘],result[‘org‘]))
                for x in range(len(result[‘ports‘])):
                        print("Banner {}".format(result[‘data‘][x][‘data‘]))
        #If we don‘t get a 200 response code print ‘Can‘t retrive information
        except:
                print("[+] Passive Recon using shodan.io")
                print("-------------------------------")
                print("\tCan‘t retrieve information")
                pass

要獲取關於黑客的信息，只需要運行：

./hackBack.py

【Python】HackBack（獲取暴力破解服務器密碼的IP來源）