go hacker
Go黑帽子
使用go语言来实现python黑帽子和绝技的代码
1.unix密码破解器
package main
import(
"bufio"
"flag"
"io/ioutil"
"os"
"log"
"fmt"
"strings"
crypt "github.com/amoghe/go-crypt" //加密包
)
var (
passfile string //unix密码文件
dict_pass string //密码字典文件
)
func init(){
flag.StringVar(&passfile,"f","","open pass") //设置命令行
flag.StringVar(&dict_pass,"d","","open pass dict")
}
func main(){
flag.Parse() //解析命令行
if passfile=="" || dict_pass==""{
println("Please "+ os.Args[0]+" -h")
os.Exit(0)
}
passFile,err:=os.Open(passfile)
if err!=nil{
log.Fatalln(err)
}
defer passFile.Close()
dictFile,err:=ioutil.ReadFile(dict_pass)
if err!=nil{
log.Fatalln(err)
}
passDict:=strings.Split(string(dictFile),"\n") //以换行为分割放入切片中
scanner:=bufio.NewScanner(passFile)
for scanner.Scan(){
j:=scanner.Text()
if strings.Contains(j,":"){ //查询是否包含:
user:=strings.Split(j,":")[0]
cryptPass:=strings.Split(j,":")[1]
fmt.Printf("[*]for :%v",user)
for i:=0;i<len(passDict)-1;i++{
if testpass(cryptPass,passDict[i])!=""{
println(testpass(cryptPass,passDict[i]))
break
}
}
}
}
}
func testpass(cryptpass string,password string)string{
saltsearch:=strings.LastIndex(cryptpass,"$")//寻找$位置,返回索引
salt:=cryptpass[0:saltsearch]
cryptword,err:=crypt.Crypt(password,salt)
if err!=nil{
log.Fatalf("sha:%v",err)
}
if cryptword==cryptpass{
return "[+]Found password:"+password
}
return ""
}
包的话需要GCC支持.
需要unix的密码文件和很好的密码字典.
原理就是通过把字典里的密码循环跟unix密码文件的salt进行加密得出是否跟Unix密码一样.暴力破解,需要字典的深度,还需要密码文件,一般来说密码文件很难获取,除非能下载下来
而且字典不行会导致匹配到最后都得不到结果,只针对于zip格式的,如果需要其他格式的还需要其他格式压缩包支持的包或自己写
2.然后是zip爆破工具
package main
import(
"bufio"
"flag"
"log"
"os"
"github.com/alexmullins/zip"
)
var (
zipfile string
dict_pass string
)
func init(){
flag.StringVar(&zipfile,"f","","open zip")
flag.StringVar(&dict_pass,"d","","open dict")
}
func main(){
flag.Parse()
if zipfile=="" || dict_pass==""{
println("Please "+os.Args[0]+" -h")
os.Exit(0)
}
zipr,err:=zip.OpenReader(zipfile)
if err!=nil{
log.Fatal(err)
}
dict_Pass,err:=os.Open(dict_pass)
if err!=nil{
log.Fatalln(err)
}
defer dict_Pass.Close()
scanner:=bufio.NewScanner(dict_Pass)
for scanner.Scan(){
pass:=scanner.Text()
for _,z:=range zipr.File{
z.SetPassword(pass)
_,err:=z.Open()
if err==nil{
println("[+]Found Password:"+pass)
os.Exit(0)
}
}
}
}
需要go get zip包,是第三方包,需要代理下载.http和https都需要,可以在终端设置下
http_proxy="http://127.0.0.1:1080"
http_proxy="http://127.0.0.1:1080"
前提是你有代理服务器
这个zip爆破原理是通过字典循环,用密码去试着解压,没报错解压成功就是密码对了
3.端口扫描器
package main
import (
"fmt"
"io"
"net"
"os"
"strconv"
"sync"
"time"
)
func main(){
if len(os.Args) !=2{
fmt.Fprintf(os.Stderr,"%s ip-addr\n",os.Args[0])
os.Exit(1)
}
target:=os.Args[1]
wg:=sync.WaitGroup{}
c:=func(ports int){
conn,err:=net.DialTimeout("tcp",target+":"+strconv.Itoa(ports),time.Duration(2)*time.Second)
if err==nil{
fmt.Fprintf(conn,"hello\r\n")
buf:=make([]byte,0,4096)
tmp:=make([]byte,256)
for {
n,err:=conn.Read(tmp)
if err!=nil{
if err!=io.EOF{
fmt.Println("read error:",err)
}
break
}
buf=append(buf,tmp[:n]...)
}
conn.Close()
//str := string(buf[:])
fmt.Println(ports,"open",string(buf[:]))
}
wg.Done()
}
wg.Add(65534)
for i:=0;i<65534;i++{
go c(i)
}
wg.Wait()
os.Exit(0)
}
依次对IP扫描65534个端口,并发送Hello获取回应内容,就是得到banner
这里面用到了go的goroutine,比python的多线程稳定,这里设置了两秒的超时时间,一般来说一秒足以,但之前测试几次有响应慢的情况所以多加了一秒.
4.结合namp来扫描,以下为linux上
package main
import(
"fmt"
"os"
"os/exec"
"syscall"
)
func main(){
if len(os.Args)!=2{
fmt.Fprintf(os.Stderr,"%s ip-addr\n",os.Args[0])
os.Exit(1)
}
bin,err:=exec.LookPath("/usr/bin/nmap")//检测目录可执行文件是否存在
if err != nil{
panic(err)
}
args:=[]string{"namp","-v","-A",os.Args[1]}
env:=os.Environ() //执行环境的副本
execErr:=syscall.Exec(bin,args,env)//目录,命令和执行环境
if execErr!=nil{
panic(execErr)
}
}
前提是安装了nmap,可用apt-get install nmap命令快速安装,会在/usr/bin/目录中生成nmap可执行文件.
然后使用os包调用类似的cmd运行nmap的命令,如果想运行更多功能可以拓展代码.
5.ssh连接代码,python中是分了两个来进行连接,一个是使用检测命令行,一个是使用特定模块直接连接,第二种写起来更方便
package main
import (
"fmt"
"os/exec"
"regexp"
"time"
"log"
"github.com/shavac/gexpect"
)
func main(){
ssh,err:=exec.LookPath("/usr/bin/ssh") //查询ssh文件,如果没有则apt-get安装
if err !=nil{
log.Println(err)
}
child,_:=gexpect.NewSubProcess(ssh,"pool@127.0.0.1") //这里ssh连接账户及地址,因为是直接使用软件,可以改端口或者不改
if err:=child.Start();err!=nil{
fmt.Println(err)
}
defer child.Close()
if idx,_:=child.ExpectTimeout(0*time.Second,regexp.MustCompile("password:"));idx>=0{ //检测命令行判断登入后是否显示password.让我们输入密码
child.SendLine("password")
}
child.SendLine("sudo cat /etc/shadow | grep root") //登入成功后把密码文件内容发送过来
if xxx,_:=child.ExpectTimeout(0*time.Second,regexp.MustCompile("password:"));xxx>=0{ //因为如果不是root用户的话sudo可能还需要再输入一次所以在检测一遍
child.SendLine("password")
}
child.InteractTimeout(3*time.Second)
}
因为没写爆破就不执行了,环境在linux上运行,可以加上爆破内容,字典遍历,但感觉不是很方便.
6.使用go操作pdf
package main
import (
"fmt"
"log"
"os"
"strings"
"rsc.io/pdf"
)
func main(){
if len(os.Args)!=2{
fmt.Fprintf(os.Stderr,"%s file.pdf\n",os.Args[0])
os.Exit(1)
}
open_Pring(os.Args[1])
}
func open_Pring(filename string){
pdfFile,err:=pdf.Open(filename) //打开pdf文件
if err!=nil{
log.Println(err)
}
docInfo:=pdfFile.Trailer().Key("Info").String() //寻找pdf中的info内容
docInfo=strings.TrimLeft(docInfo,"<<") //删除左边<<
docInfo=strings.TrimRight(docInfo,">>") //删除右边>>
info:=strings.Split(docInfo,"/") //分隔
for _,v:=range info{
println(v)
}
}
需要对应的pdf包支持,使用go get rsc.io/pdf
7.使用数据库查询查询IP经纬度及位置信息
package main
import (
"fmt"
"log"
"os"
"net"
"path/filepath"
"github.com/oschwald/geoip2-golang"
)
func main(){
if len(os.Args)!=2{
fmt.Fprintf(os.Stderr,"%s ip addr\n",os.Args[0]) //命令行获取需要查询的IP
os.Exit(1)
}
target:=os.Args[1]
use_Print(target)
}
func use_Print(target string){
if target==""{
log.Fatalln("error ip")
}
ipMdbPath,_:=filepath.Abs("GeoLite2-City.mmdb") //在GITHUB地址上下载IP数据库
ipDb,err:=geoip2.Open(ipMdbPath)
if err!=nil{
log.Fatal(err)
}
defer ipDb.Close()
ip:=net.ParseIP(target)
record,err:=ipDb.City(ip)
if err!=nil{
log.Fatal(err)
}
fmt.Printf("[*] Target: %v Geo-located.\n", target) //根据作者格式写出想查询的信息,这里跟PYTHON是一样的
//fmt.Printf("[+] %v, %v, %v\n", record.City.Names["ru"], record.Subdivisions[0].Names["ru"], record.Country.Names["ru"])
fmt.Printf("[+] ISO country code: %v\n", record.Country.IsoCode)
fmt.Printf("[+] Time zone: %v\n", record.Location.TimeZone)
fmt.Printf("[+] Coordinates: %v, %v\n", record.Location.Latitude, record.Location.Longitude)
println()
}
go get github.com/oschwald/geoip2-golang,在这个github地址中存在数据库,下载后使用数据库查询,也能查询的更多.
8.扫描网口数据包把源IP和目的IP输出
package main
import (
"fmt"
"log"
"net"
"path/filepath"
"time"
"github.com/google/gopacket" //谷歌的数据包处理
"github.com/google/gopacket/pcap"
"github.com/oschwald/geoip2-golang"
)
var (
device string = "wlp5s0" //网口名称
snapshot_len int32 = promiscuous bool = false
err error
timeout time.Duration = 30 * time.Second
handle *pcap.Handle
)
func main() {
handle, err = pcap.OpenLive(device, snapshot_len, promiscuous, timeout)
if err != nil {
log.Fatal(err)
}
defer handle.Close()
packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
for packet := range packetSource.Packets() {
if net := packet.NetworkLayer(); net != nil {
src, dst := net.NetworkFlow().Endpoints()
fmt.Printf("[+] Src: %v, --> Dst: %v \n", src, dst)
printRecord(src.String(), dst.String())
}
}
}
func printRecord(src string, dst string) {
if src == "" || dst == "" {
log.Fatalln("Error IP")
}
absPath, _ := filepath.Abs("GeoLite2-City.mmdb")
db, err := geoip2.Open(absPath)
if err != nil {
log.Fatal(err)
}
defer db.Close()
ipSRC := net.ParseIP(src)
recordSRC, err := db.City(ipSRC)
if err != nil {
log.Fatal(err)
}
ipDST := net.ParseIP(dst)
recordDST, err := db.City(ipDST)
if err != nil {
log.Fatal(err)
}
fmt.Printf("[+] SRC: %v, %v\n", recordSRC.City.Names["ru"], recordSRC.Country.Names["ru"])
fmt.Printf("[+] DST: %v, %v\n", recordDST.City.Names["ru"], recordDST.Country.Names["ru"])
}
```
需要go get github.com/google/gopacket
linux还需要支持apt-get install libpcap-dev
这里面也用到了IP数据库,用来获取IP所在城市,然后不停抓包把源地址和目的地址输出出来.只是需要注意输出的格式就可以了
注意网口不要写错了,ifconfig查看