"Python" Hackback (Get the IP source of brute force server password)

1. Preface

Again on the 0x00sec to the good stuff.

https://0x00sec.org/t/python-hackback-updated/882

The script in the post gets the IP and username that have failed the brute server password, and uses the Shodan API to do a traceability.

#!/usr/bin/python3.4import reimport urllib.requestimport jsonlog_path = "/var/log/auth.log" hosts = []key = "{YOUR_API_ KEY} "#GET FAILED PASSWORD attemptdef get_host (test): For line in Text.split (' \ n '): If Line.find (" Fai LED password for invalid ")! = -1:if Get_ip (line) not in Hosts:hos Ts.append (GET_IP) return hosts#get usernamedef get_username (line): Username_word = Line.split ("Failed Password for invalid user ") Username = (username_word[1]). Split (" ") return Username[0] #LOCATE IP with Geoi Pdef GeoIP (host): Response = Urllib.request.urlopen ("http://freegeoip.net/json/" +host) GeoIP = Response.read (). Decode ("Utf-8") GeoIP = Json.loads (geoip) print ("\n[+] Tracking IP {}". Format (geoip[' IP ')) print ( "-------------------------------") print (' \tcountry: {}\n\ttimezone: {}\n\tlatitude: {}\n\tlongitude: {} '). forma T (geoip[' country_name '],geoip[' time_zone '],geoip[' latitude '],geoip[' longitude ']) def Passive_recon (host,key): url = "Https://api.shodan.io/sho                Dan/host/{}?key={}&minify=true ". Format (host,key) try:response = Urllib.request.urlopen (URL) result = Response.read (). Decode (' utf-8 ') result = Json.loads (result) print ("[+] Passive Recon using Shodan.io ") print ("-------------------------------") Print (" \tport: {}\                        n\torganisation {} ". Format (result[' ports '],result[' org '))) for X in range (len (result[' ports ']): Print ("Banner {}". Format (result[' data '][x][' data ')) Except:print ("[+] Passive Recon u Sing Shodan.io ") print ("-------------------------------") print (" \tcan ' t retrieve Informatio n ") passif __name__ = =" __main__ ": With open (Log_path, ' RT ') as Log:text = Log.read ( ) Get_host (text) for host In Hosts:geoip (Host) Passive_recon (Host,key) 

2, the function of the script implementation

def get_host(test):        for line in text.split(‘\n‘):                if line.find("Failed password for invalid ") != -1:                        if get_ip(line) not in hosts:                                hosts.append(get_ip(line))        return hostsdef get_username(line):        username_word = line.split("Failed password for invalid user ")        username = (username_word[1]).split(" ")        return username[0]

These functions will get the IP and user name of the test server password from the Auth.log file

Using Freegeoip.net to get an IP location (but you can also use the Shodan.io API), the function simply parses the JSON output into a glorified text output.

def geoip(host):        response = urllib.request.urlopen("http://freegeoip.net/json/"+host)        geoip = response.read().decode("utf-8")        geoip = json.loads(geoip)        print("\n[+] Tracking ip {}".format(geoip[‘ip‘]))        print("-------------------------------")        print(‘\tCountry : {}\n\ttimezone : {}\n\tlatitude : {}\n\tlongitude : {}‘.format(geoip[‘country_name‘],geoip[‘time_zone‘],geoip[‘latitude‘],geoip[‘longitude‘]))

The script functions associated with Shodan are as follows:

def passive_recon(host,key):        url = "https://api.shodan.io/shodan/host/{}?key={}&minify=true".format(host,key)        try:                response = urllib.request.urlopen(url)                result = response.read().decode(‘utf-8‘)                result = json.loads(result)                print("[+] Passive Recon using shodan.io")                print("-------------------------------")                print("\tPort : {}\n\tOrganisation {}".format(result[‘ports‘],result[‘org‘]))                for x in range(len(result[‘ports‘])):                        print("Banner {}".format(result[‘data‘][x][‘data‘]))        #If we don‘t get a 200 response code print ‘Can‘t retrive information        except:                print("[+] Passive Recon using shodan.io")                print("-------------------------------")                print("\tCan‘t retrieve information")                pass

To get information about hackers, you only need to run:

./hackBack.py

"Python" Hackback (Get the IP source of brute force server password)