Rappel python

Fiche express
Domaine	Rappels Python orientés sécurité
Modules	socket, nmap (python-nmap)
Voir aussi	Test de penetration · Python

Rappels de syntaxe Python appliqués au test d'intrusion : installation de python-nmap, types de base, chaînes, listes, dictionnaires, réseau par sockets, gestion d'exceptions et fonctions. Les exemples utilisent la syntaxe Python 2.

Installation des bibliothèques nmap

wget http://xael.org/norman/python/python-nmap/python-nmap-0.2.4.tar.gz -O nmap.tar.gz
tar -xzf nmap.tar.gz
cd python-nmap-0.2.4/
python setup.py install

ou :

easy_install python-nmap
easy_install pyPdf python-nmap pygeoip mechanize BeautifulSoup4

Dépendances utiles :

apt-get install python-bluez bluetooth python-obexftp

Premier script

echo 'print "Hello World"' > hello.py
python hello.py

Variables

>>> port = 21
>>> banner = "FreeFloat FTP Server"
>>> print "[+] Checking for " + banner + " on port " + str(port)
[+] Checking for FreeFloat FTP Server on port 21

Types

>>> banner = "FreeFloat FTP Server"   # une chaîne
>>> type(banner)
<type 'str'>
>>> port = 21                         # un entier
>>> type(port)
<type 'int'>
>>> portList = [21, 22, 80, 110]      # une liste
>>> type(portList)
<type 'list'>
>>> portOpen = True                   # un booléen
>>> type(portOpen)
<type 'bool'>

Chaînes

>>> banner = "FreeFloat FTP Server"
>>> print banner.upper()
FREEFLOAT FTP SERVER
>>> print banner.lower()
freefloat ftp server
>>> print banner.replace('FreeFloat', 'Ability')
Ability FTP Server
>>> print banner.find('FTP')
10

Listes

>>> portList = []
>>> portList.append(21)
>>> portList.append(80)
>>> portList.append(443)
>>> portList.append(25)
>>> print portList
[21, 80, 443, 25]
>>> portList.sort()
>>> print portList
[21, 25, 80, 443]
>>> pos = portList.index(80)
>>> print "[+] There are " + str(pos) + " ports to scan before 80."
[+] There are 2 ports to scan before 80.
>>> portList.remove(443)
>>> print portList
[21, 25, 80]
>>> cnt = len(portList)
>>> print "[+] Scanning " + str(cnt) + " Total Ports."
[+] Scanning 3 Total Ports.

Dictionnaires

>>> services = {'ftp': 21, 'ssh': 22, 'smtp': 25, 'http': 80}
>>> services.keys()
['ftp', 'smtp', 'ssh', 'http']
>>> services.items()
[('ftp', 21), ('smtp', 25), ('ssh', 22), ('http', 80)]
>>> services.has_key('ftp')
True
>>> services['ftp']
21
>>> print "[+] Found vuln with FTP on port " + str(services['ftp'])
[+] Found vuln with FTP on port 21

Réseau

>>> import socket
>>> socket.setdefaulttimeout(2)
>>> s = socket.socket()
>>> s.connect(("192.168.95.148", 21))
>>> ans = s.recv(1024)
>>> print ans
220 FreeFloat Ftp Server (Version 1.00).

Sélection

>>> import socket
>>> socket.setdefaulttimeout(2)
>>> s = socket.socket()
>>> s.connect(("192.168.95.148", 21))
>>> ans = s.recv(1024)
>>> if "FreeFloat Ftp Server (Version 1.00)" in ans:
...     print "[+] FreeFloat FTP Server is vulnerable."
... elif "3Com 3CDaemon FTP Server Version 2.0" in banner:
...     print "[+] 3CDaemon FTP Server is vulnerable."
... elif "Ability Server 2.34" in banner:
...     print "[+] Ability FTP Server is vulnerable."
... elif "Sami FTP Server 2.0.2" in banner:
...     print "[+] Sami FTP Server is vulnerable."
... else:
...     print "[-] FTP Server is not vulnerable."
...
[+] FreeFloat FTP Server is vulnerable.

Gestion des exceptions

>>> print 1337 / 0
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ZeroDivisionError: integer division or modulo by zero

>>> import socket
>>> socket.setdefaulttimeout(2)
>>> s = socket.socket()
>>> try:
...     s.connect(("192.168.95.149", 21))
... except Exception, e:
...     print "[-] Error=" + str(e)
...
[-] Error = Operation timed out

Fonctions

Récupérer la bannière d'un serveur FTP :

import socket

def retBanner(ip, port):
    try:
        socket.setdefaulttimeout(2)
        s = socket.socket()
        s.connect((ip, port))
        banner = s.recv(1024)
        return banner
    except:
        return

def main():
    ip1 = '192.168.95.148'
    ip2 = '192.168.95.149'
    port = 21

    banner1 = retBanner(ip1, port)
    if banner1:
        print '[+] ' + ip1 + ': ' + banner1
    banner2 = retBanner(ip2, port)
    if banner2:
        print '[+] ' + ip2 + ': ' + banner2

if __name__ == '__main__':
    main()

Note : les adresses 192.168.95.x sont des adresses privées de laboratoire (RFC 1918).

Voir aussi

• Test de penetration — scanners de ports et intégration nmap
• Python — sommaire du langage
• Reseau::py — programmation par sockets