You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
64 lines
2.4 KiB
64 lines
2.4 KiB
#mysql
|
|
#pip install mysql-connector-python
|
|
import mysql.connector
|
|
from mysql.connector import Error
|
|
from tools.ToolBase import ToolBase
|
|
|
|
class MysqlTool(ToolBase):
|
|
|
|
def test_empty_password_mysql_connection(self,host, username='root'):
|
|
"""
|
|
测试使用空密码连接到指定 MySQL 服务器。
|
|
|
|
参数:
|
|
host (str): MySQL 服务器的主机地址，例如 'haitutech.cn'
|
|
username (str): MySQL 用户名，默认值为 'root'
|
|
"""
|
|
try:
|
|
# 尝试使用空密码连接 MySQL
|
|
connection = mysql.connector.connect(
|
|
host=host, # 主机地址
|
|
user=username, # 用户名
|
|
password='', # 空密码
|
|
connection_timeout=10 # 设置10秒连接超时
|
|
)
|
|
if connection.is_connected():
|
|
res = f"成功连接到 {host}，用户 {username} 使用空密码"
|
|
connection.close() # 关闭连接以释放资源
|
|
except Error as e:
|
|
# 捕获并打印连接错误
|
|
res = f"连接失败: {host} - {e}"
|
|
return res
|
|
|
|
def validate_instruction(self, instruction):
|
|
#mysql暂只执行空密码攻击
|
|
timeout = 0
|
|
modified_code = "mysql空密码登录测试"
|
|
return modified_code,0
|
|
|
|
#对于非sh命令调用的工具，自己实现命令执行的内容
|
|
def execute_instruction(self, instruction_old):
|
|
ext_params = self.create_extparams()
|
|
# 第一步：验证指令合法性
|
|
instruction,time_out = self.validate_instruction(instruction_old)
|
|
if not instruction:
|
|
return False, instruction_old, "该指令暂不执行！","",ext_params
|
|
# 过滤修改后的指令是否需要判重？同样指令再执行结果一致？待定---#？
|
|
|
|
# 第二步：执行指令
|
|
target = ""
|
|
parts = instruction_old.split()
|
|
for i, part in enumerate(parts):
|
|
if part == "-h" and i + 1 < len(parts):
|
|
target = parts[i + 1]
|
|
output = self.test_empty_password_mysql_connection(target)#弱密码攻击如何处理？
|
|
|
|
# 第三步：分析执行结果
|
|
analysis = self.analyze_result(output,instruction,"","")
|
|
# 指令和结果入数据库
|
|
# ？
|
|
return True, instruction, analysis,output,ext_params
|
|
|
|
def analyze_result(self, result,instruction,stderr,stdout):
|
|
#
|
|
return result
|