用于检索远程操作系统信息而不使用nmap的Python脚本

import socket
import struct

def get_remote_os_info(ip):
    try:
        # 创建一个套接字对象
        sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_ICMP)
        sock.settimeout(1)

        # 发送ICMP Echo请求包
        packet = struct.pack('!BBHHH', 8, 0, 0, 0, 0)
        checksum = calculate_checksum(packet)
        packet = struct.pack('!BBHHH', 8, 0, checksum, 0, 0)
        sock.sendto(packet, (ip, 1))

        # 接收响应包并解析
        data, addr = sock.recvfrom(1024)
        icmp_header = data[20:28]
        icmp_type, code, checksum, packet_id, sequence = struct.unpack('!BBHHH', icmp_header)

        # 根据ICMP响应类型判断操作系统
        if icmp_type == 0:
            return "Linux"
        elif icmp_type == 8:
            return "Windows"
        else:
            return "Unknown"

    except socket.error:
        return "Error"

def calculate_checksum(data):
    checksum = 0
    count_to = (len(data) // 2) * 2

    for count in range(0, count_to, 2):
        this_val = data[count + 1] * 256 + data[count]
        checksum += this_val
        checksum &= 0xffffffff

    if count_to < len(data):
        checksum += data[len(data) - 1]
        checksum &= 0xffffffff

    checksum = (checksum >> 16) + (checksum & 0xffff)
    checksum += checksum >> 16
    checksum = ~checksum
    checksum &= 0xffff
    return checksum

# 使用示例
ip_address = "192.168.0.1"
os_info = get_remote_os_info(ip_address)
print("Remote OS Info:", os_info)