本程序包括一个python脚本文件：ssh.py
*****************************************
The tool for scan ssh weak password
by zonadu
*****************************************
usage: ssh.py [-h] -t [-p] [-user] [-pass] [-uf] [-pf] [-rk] [-dk] [-kp] [-o]
The tool for scan ssh weak password
optional arguments:
-h, --help show this help message and exit
-t , --target the ip of target , eg: 127.0.0.1 or
127.0.0.1-127.0.0.255 or 127.0.0.1,172.0.0.2
-p , --port the port of ssh
-user , --username username
-pass , --password password
-uf , --user-file the dict of username
-pf , --pass-file the dict of password
-rk , --rsa-key use rsa private key filepath
-dk , --dsa-key use dsa private key filepath
-kp , --key-password
the password of private key file
-o , --output-file write output to file
特点介绍：
支持IP多种形式，如：192.168.1.1
192.168.1.1,192.168.1.5,192.168.1.100
192.168.1.1--192.168.1.255
支持自定义SSH的端口
支持使用单个ssh用户名和密码
支持使用ssh用户名字典和密码字典
支持使用rsa和dsa的私钥进行扫描，可以配置私钥对应的密码，可以指定私钥扫描时对应的ssh用户名
支持输出结果到文件
源代码：ssh.py
[Python] 纯文本查看 复制代码 #!/usr/bin/python
import sys
import paramiko
import argparse
#****login to ssh****
#
#ip: ip address of ssh connect
#post: port of ssh connect
#username: username of login for ssh
#password: password of login for ssh
#pkey: the private key for ssh
#
def scan(ip,port,username=None,password=None, pkey=None):
port=int(port)
#print ip+":"+str(port)+" ==> "+username+"/"+password
try:
ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect(ip, port, username, password, pkey)
ssh.close()
except paramiko.AuthenticationException,e:
try:
print e
ssh.close()
except:
pass
return -1
except Exception,e:
print e
try:
ssh.close()
except:
pass
return -2
if(username!=None) and (password!=None):
print ip+":"+str(port)+" ==> "+username+"/"+password+"...success"
elif(username!=None) and (pkey!=None):
print username+"@"+ip+"...succcess"
return 0
if __name__=="__main__":
print """
*****************************************
The tool for scan ssh weak password
by zonadu
*****************************************
"""
parser=argparse.ArgumentParser(description="The tool for scan ssh weak password")
parser.add_argument("-t","--target",metavar="",help="the ip of target , eg: 127.0.0.1 or 127.0.0.1-127.0.0.255 or 127.0.0.1,172.0.0.2",required=True)
parser.add_argument("-p","--port",metavar="",help="the port of ssh",default="22")
parser.add_argument("-user","--username",metavar="",help="username")
parser.add_argument("-pass","--password",metavar="",help="password")
parser.add_argument("-uf","--user-file",metavar="",help="the dict of username")
parser.add_argument("-pf","--pass-file",metavar="",help="the dict of password")
parser.add_argument("-rk","--rsa-key",metavar="",help="use rsa private key filepath")
parser.add_argument("-dk","--dsa-key",metavar="",help="use dsa private key filepath")
parser.add_argument("-kp","--key-password",metavar="",help="the password of private key file")
parser.add_argument("-o","--output-file",metavar="",help="write output to file")
args=parser.parse_args()
ip=[]
username=[]
password=[]
if(args.output_file!=None):
filename=args.output_file
output=sys.stdout
f=open(filename,"a+")
sys.stdout=f
###### ip ########
if(args.target.find("-")!=-1):
target=args.target.split("-")
ip1=target[0].split(".")
ip2=target[1].split(".")
for a in range(int(ip1[0]),int(ip2[0])+1):
for b in range(int(ip1[1]),int(ip2[1])+1):
for c in range(int(ip1[2]),int(ip2[2])+1):
for d in range(int(ip1[3]),int(ip2[3])+1):
ip.append((str(a)+"."+str(b)+"."+str(c)+"."+str(d)))
#print ip
elif(args.target.find(",")!=-1):
ip=args.target.split(",")
#print ip
else:
ip1=args.target.split(".")
ip1=str(ip1[0])+"."+str(ip1[1])+"."+str(ip1[2])+"."+str(ip1[3])
ip.append(ip1)
#print ip
###### port ##########
port_tmp=args.port
if(args.username!=None):
######## username ############
username.append(args.username)
if(args.password!=None):
######## password ############
password.append(args.password)
if(args.user_file!=None):
#if in windows,please change \n to \r\n
username_1=open(args.user_file).read().split('\n')
username_1.pop()
username=username+username_1
#print username
if(args.pass_file!=None):
password_1=open(args.pass_file).read().split('\n')
password_1.pop()
password=password+password_1
#print password
if(args.rsa_key!=None):
pkey_tmp=paramiko.RSAKey.from_private_key_file(args.rsa_key,args.key_password)
elif(args.dsa_key!=None):
pkey_tmp=paramiko.DSSKey.from_private_key_file(args.dsa_key,args.key_password)
else:
pkey_tmp=None
############ use username and password ##########
if ip and username and password:
for ip_tmp in ip:
print ip_tmp
for user_tmp in username:
for pass_tmp in password:
scan(ip_tmp,port=port_tmp,username=user_tmp,password=pass_tmp)
############# use private key ################
elif(pkey_tmp!=None) and ip:
if username:
for ip_tmp in ip:
print ip_tmp
for user_tmp in username:
scan(ip_tmp,port=port_tmp,username=user_tmp,pkey=pkey_tmp)
else:
user_tmp="root"
for ip_tmp in ip:
print ip_tmp
scan(ip_tmp,port=port_tmp,username=user_tmp,pkey=pkey_tmp)
######
if(args.output_file!=None):
sys.stdout=output
print "done. the result write to "+args.output_file
f.close()
测试截图：
|