diff --git a/patator.py b/patator.py index 18720ec..277d0d4 100755 --- a/patator.py +++ b/patator.py @@ -239,36 +239,23 @@ second before trying again the same payload (--failure-delay defaults to 0.5). {{{ FTP * Brute-force authentication. - (a) Establish a new TCP connection for every login attempt (slow). ---------- (a) -ftp_login host=10.0.0.1 user=FILE0 password=FILE1 0=logins.txt 1=passwords.txt persistent=0 + (a) Do not report wrong passwords. + (b) Do not report everytime the server shuts down the TCP connection (ie. max login attempts + reached), reconnect and retry last login/password. + (c) Reconnect when a valid password is found (need to logoff before testing other passwords). +--------- +ftp_login host=10.0.0.1 user=FILE0 password=FILE1 0=logins.txt 1=passwords.txt + -x ignore:mesg='Login incorrect.' -x ignore,reset,retry:code=500 -x reset:fgrep='Login success' + (a) (b) (c) NB. If you get errors like "too many connections from your IP address", try decreasing the number of threads, the server may be enforcing a maximum number of concurrent connections. -* Same as before, but without persistent=0 in order to re-use the TCP connection (faster). - (a) Establish a new TCP connection after 3 login attempts were done using the same TCP connection. - (b) Do not report wrong passwords. - (c) Reconnect when a valid password is found (need to logoff before testing other passwords). ---------- (a) (b) (c) -ftp_login ... --rate-reset 3 -x ignore:mesg='Login incorrect.' -x reset:fgrep='Login successful' - - -* Same as before, but without --rate-reset as we automatically detect when the server has - closed the connection. - (a) Do not report everytime the server shuts down the TCP connection, reconnect and - retry last login/password. - (b) Exit execution as soon as a valid password is found. ---------- (a) (b) -ftp_login ... -x ignore,reset,retry:code=500 -x quit:fgrep='Login successful' - - * Same as before, but stop testing a user after his password is found. --------- -ftp_login host=10.0.0.1 user=FILE0 password=FILE1 0=logins.txt 1=passwords.txt - -x ignore,reset,retry:code=500 -x reset,free=user:fgrep='Login successful' +ftp_login ... -x reset,free=user:fgrep='Login success' * Find anonymous FTP servers on a subnet. @@ -278,33 +265,28 @@ ftp_login host=NET0 user=anonymous password=test@example.com 0=10.0.0.0/24 }}} {{{ SSH * Brute-force authentication. - (a) Test 3 passwords within the same SSH session before reconnecting. - (b) Reconnect when a valid password is found (need to logoff before testing other passwords). ---------- (a) (b) -ssh_login host=10.0.0.1 user=root password=FILE0 0=passwords.txt --rate-reset 3 -x reset:code=0 + (a) Do not report wrong passwords. + (b) Do not report everytime the server shuts down the TCP connection (ie. max login attempts + reached), reconnect and retry last login/password. + (c) Reconnect when a valid password is found (need to logoff before testing other passwords). +--------- (a) +ssh_login host=10.0.0.1 user=FILE0 password=FILE0 0=logins.txt -x ignore:mesg='Authentication failed.' + -x ignore,reset,retry:mesg='No existing session' -x reset:code=0 + (b) (c) NB. If you get errors like "Error reading SSH protocol banner ... Connection reset by peer", try decreasing the number of threads, the server may be enforcing a maximum number of concurrent connections (eg. MaxStartups in OpenSSH). -* Same as before, but without --rate-reset as we automatically detect when we have reached - the maximum number of login attempts permitted per connection (eg. MaxAuthTries > 3 in OpenSSH). - (a) Do not report wrong passwords. - (b) Do not report everytime the server shuts down the TCP connection, reconnect and - retry last password. ---------- (a) (b) -ssh_login ... -x ignore:mesg='Authentication failed.' -x ignore,reset,retry:mesg='No existing session' - - -* Same as before, but stop testing a host after a valid password is found. +* Brute-force several hosts and stop testing a host after a valid password is found. --------- ssh_login host=FILE0 user=FILE1 password=FILE2 0=hosts.txt 1=logins.txt 2=passwords.txt -x ignore:mesg='Authentication failed.' -x ignore,reset,retry:mesg='No existing session' -x reset,free=host:code=0 -* Same as before, but stop testing a user on a host after his password is found. +* Same as previous, but stop testing a user on a host after his password is found. --------- ssh_login host=FILE0 user=FILE1 password=FILE2 0=hosts.txt 1=logins.txt 2=passwords.txt ... @@ -1466,7 +1448,7 @@ class FTP_login(TCP_Cache): usage_hints = ( """%prog host=10.0.0.1 user=FILE0 password=FILE1 0=logins.txt 1=passwords.txt""" - """ -x ignore:mesg='Login incorrect.' -x ignore,reset,retry:code=500 -x reset:fgrep='Login successful'""", + """ -x ignore:mesg='Login incorrect.' -x ignore,reset,retry:code=500 -x reset:fgrep='Login success'""", ) available_options = (