terça-feira, 30 de junho de 2015

Jameh - Brute Force em Hash de Senhas /etc/shadow

Galera de boa?
Estava caminhando por ai, quando vi no github do Ricardo Longatto o programa que ele fez em C para realizar um brute-force em senhas em hash que ficam no /etc/shadow. 

https://github.com/ricardolongatto/loncrack

Então, resolvi fazer o mesmo em python, achei que seria interessante medir a velocidade de quebra em C e em Python, mas eu não consegui fazer rodar o programa em C do Longatto (Sim sou um LOSER), caso alguém consiga e realize o teste, me manda que posto aqui.

Mas enfim, fiz em python, segue abaixo o README dele e o link para testarem.

LINK: https://github.com/danilovazb/jameh

Jameh

Danilo Vaz - UNK
danilovazb@gmail.com
http://unk-br.blogspot.com
https://twitter.com/unknownantisec

DESCRIPTION

Jameh, que na verdade se escreve e se lê 'Jamé' que do Tupi Guarani significa oculto, 
misterioso, tem como objetivo realizar um brute-force em hash de senhas contidas no /etc/shadow,
passando o salt do hash e a senha criptografada ele tenta por meio de dicionário quebrar a 
senha.

REQUERIMENTS

 ----------------------------------------------------------
Import:
threading
time
crypt
argparse
sys
subprocess

permission          Reading & Writing
User                root privilege, or is in the sudoers group
Operating system    LINUX
Python              2.7
 ----------------------------------------------------------

INSTALL

git clone http://github.com/danilovazb/jameh

HELP

usage: jameh.py [-h] [-t 10] -f word_list.txt -s '$6$DgAOLzvU' -ha
                '$xw5oqFEZw30SSCdgD9KOiK2BG1J.O135BowUgdsUZB3ErEeZii6s1vC07BcBoPY06iNcJpxhQYTwzBpjVj7oq.'

optional arguments:
  -h, --help        show this help message and exit
  -t 10, --threads 10
                    Threads
  -f word_list.txt, --file word_list.txt
                    Opens file with passwords
  -s '$6$DgAOLzvU', --salt '$6$DgAOLzvU'
                    Salt, '$6$DgAOLzvU'
  -ha '$xw5oqFEZw30SSCdgD9KOiK2BG1J.O135BowUgdsUZB3ErEeZii6s1vC07BcBoPY06iNcJpxhQYTwzBpjVj7oq.', --hash '$xw5oqFEZw30SSCdgD9KOiK2BG1J.O135BowUgdsUZB3ErEeZii6s1vC07BcBoPY06iNcJpxhQYTwzBpjVj7oq.'
                    hash, '$xw5oqFEZw30SSCdgD9KOiK2BG1J.O135BowUgdsUZB3ErEeZii
                    6s1vC07BcBoPY06iNcJpxhQYTwzBpjVj7oq.'

EXAMPLE

SENHA: s3nh42015!@#

~# cat /etc/shadow
root:!:16440:0:99999:7:::
daemon:*:16273:0:99999:7:::
bin:*:16273:0:99999:7:::
sys:*:16273:0:99999:7:::
sync:*:16273:0:99999:7:::
games:*:16273:0:99999:7:::
man:*:16273:0:99999:7:::
lp:*:16273:0:99999:7:::
mail:*:16273:0:99999:7:::
news:*:16273:0:99999:7:::
uucp:*:16273:0:99999:7:::
proxy:*:16273:0:99999:7:::
www-data:*:16273:0:99999:7:::
backup:*:16273:0:99999:7:::
list:*:16273:0:99999:7:::
irc:*:16273:0:99999:7:::
gnats:*:16273:0:99999:7:::
nobody:*:16273:0:99999:7:::
libuuid:!:16273:0:99999:7:::
syslog:*:16273:0:99999:7:::
messagebus:*:16273:0:99999:7:::
usbmux:*:16273:0:99999:7:::
dnsmasq:*:16273:0:99999:7:::
avahi-autoipd:*:16273:0:99999:7:::
kernoops:*:16273:0:99999:7:::
rtkit:*:16273:0:99999:7:::
saned:*:16273:0:99999:7:::
whoopsie:*:16273:0:99999:7:::
speech-dispatcher:!:16273:0:99999:7:::
avahi:*:16273:0:99999:7:::
lightdm:*:16273:0:99999:7:::
colord:*:16273:0:99999:7:::
hplip:*:16273:0:99999:7:::
pulse:*:16273:0:99999:7:::
danilo:$6$DgAOLzvU$Mt0WllW7AFJt5eFk0HPzjQNes/vvPkHaVmPIaWEb7K64uayPJ3CrEW8gjlBinh9Dzqj4RZXfRAN45XxrpWYjX.:16440:0:99999:7:::


~# python jameh.py --file wl.txt --threads 10 --salt '$6$DgAOLzvU' --hash '$Mt0WllW7AFJt5eFk0HPzjQNes/vvPkHaVmPIaWEb7K64uayPJ3CrEW8gjlBinh9Dzqj4RZXfRAN45XxrpWYjX.'


       _                      _     
      | |                    | |    
      | | __ _ _ __ ___   ___| |__  
  _   | |/ _` | '_ ` _ \ / _ \ '_ \ 
 | |__| | (_| | | | | | |  __/ | | |
  \____/ \__,_|_| |_| |_|\___|_| |_|

[+] Author: Danilo Vaz a.k.a. UNK
[+] http://github.com/danilovazb
[+] http://unk-br.blogspot.com.br

PASS: s3nh42015!@#
Terminado

quarta-feira, 10 de junho de 2015

SAWEF - Crawler de e-mail e de links

E ai galera, tranquilo?
A alguns dias atrás eu criei uma ferramenta chamada SAWEF que realiza algumas funções em HTTP, tais como, enviar POST e GET, porém, vi uma oportunidade de expandir algumas funcionalidades dela a caráter de teste, então adicionei as funções abaixo, breve gravo um vídeo demonstrando.

- Email Crawler in sites
- Crawler forms on the page
- Crawler links on web pages
- Sending POST and GET
- Support for USER-AGENT
- Support for THREADS
- Support for COOKIES

GITHUB: https://github.com/danilovazb/sawef

EXEMPLOS:

PEGANDO EMAIL DAS PAGINAS
$:> python sawef.py --url "http://pastebin.com/ajaYnLYc" --response emails
[...]
[+] EMAIL = manothradevi@yahoo.com
[+] EMAIL = fantaghiroaziera@yahoo.com
[+] EMAIL = naqibjohari@yahoo.com
[+] EMAIL = azliey3036@yahoo.com
[+] EMAIL = azlin_4531@yahoo.com.my
[+] EMAIL = urshawal96@yahoo.com
[+] EMAIL = weeta_aida88@yahoo.com.my
FOUND = 3065

PEGANDO LINKS DAS PAGINAS
$:> python sawef.py --url "http://terra.com.br" --response links
[...]
[+] LINK = http://uol.com.br/https://pagseguro.uol.com.br/vender
[+] LINK = http://www.uolhost.com.br/registro-de-dominio.html
[+] LINK = http://noticias.uol.com.br/arquivohome/
[+] LINK = http://noticias.uol.com.br/erratas/
[+] LINK = http://uol.com.br/#

[+] FOUND = 360



Abaixo a descrição da ferramenta e como baixar:

DESCRIPTION

The purpose of this tool is to be a Swiss army knife 
for anyone who works with HTTP, so far it she is basic, 
bringing only some of the few features that want her to have, 
but we can already see in this tool:

- Email Crawler in sites
- Crawler forms on the page
- Crawler links on web pages
- Sending POST and GET
- Support for USER-AGENT
- Support for THREADS
- Support for COOKIES

REQUERIMENTS

 ----------------------------------------------------------
Import:
threading
time
argparse
requests
json
re
BeautifulSoup

permission          Reading & Writing
User                root privilege, or is in the sudoers group
Operating system    LINUX
Python              2.7
 ----------------------------------------------------------

INSTALL

git clone http://github.com/danilovazb/SAWEF

sudo apt-get install python-bs4 python-requests

HELP

usage: tool [-h] --url http://url.com/
            [--user_agent '{"User-agent": "Mozilla/5.0 Windows; U; Windows NT 5.1; hu-HU; rv:1.7.8 Gecko/20050511 Firefox/1.0.4"}"]
            [--threads 10] [--data '{"data":"value","data1":"value"}']
            [--qtd 5] [--method post|get]
            [--referer '{"referer": "http://url.com"}']
            [--response status_code|headers|encoding|html|json|form]
            [--cookies '{"__utmz":"176859643.1432554849.1.1.utmcsr=direct|utmccn=direct|utmcmd=none"}']

optional arguments:
  -h, --help        show this help message and exit
  --url http://url.com/
                    URL to request
  --user_agent '{"User-agent": "Mozilla/5.0 (Windows; U; Windows NT 5.1; hu-HU; rv:1.7.8) Gecko/20050511 Firefox/1.0.4"}"
                    For a longer list, visit:
                    http://www.useragentstring.com/pages/useragentstring.php
  --threads 10      Threads
  --data '{"data":"value","data1":"value"}'
                    Data to be transmitted by post
  --qtd 5           Quantity requests
  --method post|get
                    Method sends requests
  --referer '{"referer": "http://url.com"}'
                    Referer
  --response status_code|headers|encoding|html|json|form
                    Status return
  --cookies '{"__utmz":"176859643.1432554849.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)"}'
                    Cookies from site

EXAMPLE

*Send 1 SMS anonymous to POST [in BR]:
-------------
$:> python sawef.py --url "https://smsgenial.com.br/forms_teste/enviar.php" --data '{"celular":"(11) XXXX-XXXXX","mensagem":"Teste","Testar":"Enviar"}' --threads 10 --qtd 1 --user_agent '{"User-agent":"Mozilla/5.0 Windows; U; Windows NT 5.1; hu-HU; rv:1.7.8) Gecko/20050511 Firefox/1.0.4"}'

*List Form attributes:
-------------
$:> python sawef.py --url "https://smsgenial.com.br/" --method post --response form
OUTPUT:

--------------------------------
NOME_FORM[None]
URL[http://paineldeenvios.com/painel/app/login/login.php]
METHOD[post]

email:Digite Seu Login        (text)
passwd:Senha        (password)
Entrar:Entrar        (submit)

--------------------------------
NOME_FORM[form1]
URL[/forms_teste/criaruser.php]
METHOD[post]

action:criarconta        (hidden)
nome:        (text)
celular:        (text)
email:        (text)
Testar:Criar        (submit)
Testar:Enviar        (hidden)

--------------------------------
NOME_FORM[None]
URL[/forms_teste/enviar.php]
METHOD[post]

celular:        (text)
Testar:Enviar        (submit)

* Get email web pages
$:> python sawef.py --url "http://pastebin.com/ajaYnLYc" --response emails
[...]
[+] EMAIL = manothradevi@yahoo.com
[+] EMAIL = fantaghiroaziera@yahoo.com
[+] EMAIL = naqibjohari@yahoo.com
[+] EMAIL = azliey3036@yahoo.com
[+] EMAIL = azlin_4531@yahoo.com.my
[+] EMAIL = urshawal96@yahoo.com
[+] EMAIL = weeta_aida88@yahoo.com.my
FOUND = 3065

* Get links on web pages
$:> python sawef.py --url "http://terra.com.br" --response links
[...]
[+] LINK = http://uol.com.br/https://pagseguro.uol.com.br/vender
[+] LINK = http://www.uolhost.com.br/registro-de-dominio.html
[+] LINK = http://noticias.uol.com.br/arquivohome/
[+] LINK = http://noticias.uol.com.br/erratas/
[+] LINK = http://uol.com.br/#
[+] FOUND = 360

SCREENSHOT

Screenshot

segunda-feira, 1 de junho de 2015

Send Attack Web Forms - Tool

Hey guys, all beauty?
Lately I've been using many scripts to test some parameters in POST and GET, this demand grew a bit, i decided to craft this tool, it is available on Github in GPL license.

Basically it does POST with some basic parameters, and change the HEADER, COOKIES and NUMBER OF SUBMISSIONS.

[EDIT] Consult attributes of a form in an HTML page and set the POST or GET request method [/EDIT]

Tool:
https://github.com/danilovazb/SAWEF

SAWEF - Send Attack Web Forms

Danilo Vaz - UNK
danilovazb@gmail.com
http://unk-br.blogspot.com
https://twitter.com/unknownantisec
  • REQUERIMENTS
 ----------------------------------------------------------
threading
time
argparse
requests
json
BeautifulSoap
permission          Reading & Writing
User                root privilege, or is in the sudoers group
Operating system    LINUX
Python              2.7
 ----------------------------------------------------------
  • INSTALL
git clone http://github.com/danilovazb/SAWEF

sudo apt-get install python-bs4 python-requests
  • HELP
usage: tool [-h] --url http://url.com/
            [--user_agent '{"User-agent": "Mozilla/5.0 Windows; U; Windows NT 5.1; hu-HU; rv:1.7.8 Gecko/20050511 Firefox/1.0.4"}"]
            [--threads 10] [--data '{"data":"value","data1":"value"}']
            [--qtd 5] [--method post|get]
            [--referer '{"referer": "http://url.com"}']
            [--response status_code|headers|encoding|html|json|form]
            [--cookies '{"__utmz":"176859643.1432554849.1.1.utmcsr=direct|utmccn=direct|utmcmd=none"}']

optional arguments:
  -h, --help        show this help message and exit
  --url http://url.com/
                    URL to request
  --user_agent '{"User-agent": "Mozilla/5.0 (Windows; U; Windows NT 5.1; hu-HU; rv:1.7.8) Gecko/20050511 Firefox/1.0.4"}"
                    For a longer list, visit:
                    http://www.useragentstring.com/pages/useragentstring.php
  --threads 10      Threads
  --data '{"data":"value","data1":"value"}'
                    Data to be transmitted by post
  --qtd 5           Quantity requests
  --method post|get
                    Method sends requests
  --referer '{"referer": "http://url.com"}'
                    Referer
  --response status_code|headers|encoding|html|json|form
                    Status return
  --cookies '{"__utmz":"176859643.1432554849.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)"}'
                    Cookies from site

  • EXAMPLE
*Send 1 SMS anonymous to POST [in BR]:
-------------
$:> python sawef.py --url "https://smsgenial.com.br/forms_teste/enviar.php" --data '{"celular":"(11) XXXX-XXXXX","mensagem":"Teste","Testar":"Enviar"}' --threads 10 --qtd 1 --user_agent '{"User-agent":"Mozilla/5.0 Windows; U; Windows NT 5.1; hu-HU; rv:1.7.8) Gecko/20050511 Firefox/1.0.4"}'

*List Form attributes:
-------------
$:> python sawef.py --url "https://smsgenial.com.br/ --method post --response form
OUTPUT:

--------------------------------
NOME_FORM[None]
URL[http://paineldeenvios.com/painel/app/login/login.php]
METHOD[post]

email:Digite Seu Login        (text)
passwd:Senha        (password)
Entrar:Entrar        (submit)

--------------------------------
NOME_FORM[form1]
URL[/forms_teste/criaruser.php]
METHOD[post]

action:criarconta        (hidden)
nome:        (text)
celular:        (text)
email:        (text)
Testar:Criar        (submit)
Testar:Enviar        (hidden)

--------------------------------
NOME_FORM[None]
URL[/forms_teste/enviar.php]
METHOD[post]

celular:        (text)
Testar:Enviar        (submit)


  • SCREENSHOT Screenshot