Gracias por tu tiempo =) saludos y pasa un buen dia (Jjj) somos gente de buenas practicas.
(besitos)
(besitos)
Esta sección te permite ver todos los mensajes escritos por este usuario. Ten en cuenta que sólo puedes ver los mensajes escritos en zonas a las que tienes acceso en este momento.
Mostrar Mensajes Menú# nmap --script-updatedb
# nmap -p 21 -sV --script=IIS-FTP 10.0.0.7
Starting Nmap 4.76 ( http://nmap.org ) at 2009-09-01 01:15 CEST
Interesting ports on test-win (10.0.0.7):
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
|_ IIS FTP: IIS Server allow anonymous and mkdir (potentially vulnerable)
Service Info: OS: Windows
--- Checks if a Microsoft FTP server allows anonymous logins + MKDIR
--- If yes, could be vulnerable to the following exploit:
--- http://seclists.org/fulldisclosure/2009/Aug/0443.html
-- @output
-- |_ FTP: IIS Server allow anonymous and mkdir (potentially vulnerable)
--
-- @args ftpuser Alternate user to initiate the FTP session
-- ftppass Alternate password to initiate the FTP session
-- If no arguments are passed, anonymous FTP session is probed
id="IIS FTP"
description="Checks to see if a Microsoft ISS FTP server allows anonymous logins and MKDIR (based on anonftp.nse by team I.S.W <[email protected]>)"
author = "sharon,keymort <UNIVERSIDAD COMPUTENSE DE MADRID>"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"default", "auth", "intrusive"}
require "shortport"
local stdnse = require "stdnse"
---
-- portrule = shortport.port_or_service(21, "ftp")
portrule = function(host,port)
if (port.number == 21 and
(port.state == "open" or port.state == "open|filtered"))
then
return true
else
return false
end
end
---
-- Connects to the ftp server and checks if the server allows
-- anonymous logins or any credentials passed as arguments
action = function(host, port)
local socket = nmap.new_socket()
local result
local status = true
local isAnon = false
local err_catch = function()
socket:close()
end
local try = nmap.new_try(err_catch())
socket:set_timeout(5000)
try(socket:connect(host.ip, port.number, port.protocol))
if (type(nmap.registry.args.ftpuser) == "string" and nmap.registry.args.ftpuser ~= "" and
type(nmap.registry.args.ftppass) == "string" and nmap.registry.args.ftppass ~= "")
then
local struser = "USER " .. nmap.registry.args.ftpuser .. "\r\n"
local strpass = "PASS " .. nmap.registry.args.ftppass .. "\r\n"
try(socket:send(struser))
try(socket:send(strpass))
else
try(socket:send("USER anonymous\r\n"))
try(socket:send("PASS IEUser@\r\n"))
end
while status do
status, result = socket:receive_lines(1);
if string.match(result, "^230") then
try(socket:send("RSTATUS\r\n"))
while status do
status, result = socket:receive_lines(1);
if string.match(result, "^211-Microsoft FTP Service") then
try(socket:send("MKD w00t\r\n"))
while status do
status, result = socket:receive_lines(1);
if string.match(result, "^257") then
isVuln=true
try(socket:send("RMDIR w00t\r\n"))
break;
end
end
end
end
end
end
socket:close()
if(isVuln) then
return "IIS Server allow anonymous and mkdir (potentially vulnerable)"
end
end
#!/usr/bin/perl
# md5crack.pl
# Usage:
# ./md5crack <charset> <mincount> <maxcount> <yourMD5>
# nUm/b0
# Ècrit par *..::Key-M0rt::..* tam I.S.W
$ver = "01";
$dbgtmr = "1"; #Intervall of showing the current speed + lastpassword in seconds.
if ($dbgtmr<=0){ die "Set dbgtmr to a value >=1 !\n";};
use Digest::MD5 qw(md5_hex);
use Time::HiRes qw(gettimeofday);
if ($ARGV[0]=~"a") {
$alpha = "abcdefghijklmnopqrstuvwxyz";}
if ($ARGV[0]=~"A") {
$alpha = $alpha. "ABCDEFGHIJKLMNOPQRSTUVWXYZ";}
if ($ARGV[0]=~"d") {
$alpha = $alpha."1234567890";}
if ($ARGV[0]=~"x") {
$alpha = $alpha. "!\"\$%&/()=?-.:\\*'-_:.;,";}
if ($alpha eq "" or $ARGV[3] eq "") {usage();};
if (length($ARGV[3]) != 32) { die "Désolé, mais il Semble que le MD5 est pas valide!\n";};
print "Selected charset for attack: '$alpha\'\n";
print "Going to Crack '$ARGV[3]'...\n";
for (my $t=$ARGV[1];$t<=$ARGV[2];$t++){
crack ($t);
}
sub usage{
print "\n\nMD5 Hash Bruteforce Kit v_$ver\n";
print "by unix_chro alias backtrack ([email protected])\n";
print "Member in staff leader:elite-members,ubuntu-hackers\n\n";
print "USAGE\n";
print "./md5crack <charset> <mincount> <maxcount> <yourMD5>\n";
print " Charset can be: [aAdx]\n";
print " a = {'a','b','c',...}\n";
print " A = {'A','B','C',...}\n";
print " d = {'1','2','3',...}\n";
print " x = {'!','\"',' ',...}\n";
print "EXAMPLE FOR CRACKING A MD5 HASH\n";
print "./md5crack.pl ad 1 3 900150983cd24fb0d6963f7d28e17f72\n";
print " This example tries to crack the given MD5 with all lowercase Alphas and all digits.\n";
print " MD5 Kit only tries combinations with a length from 1 and 3 characters.\n-------\n";
print "./md5crack.pl aA 3 3 900150983cd24fb0d6963f7d28e17f72\n";
print " This example tries to crack the given MD5 with all lowercase Alphas and all uppercase Alphas.\n";
print " MD5 Kit only tries passwords which length is exactly 3 characters.\n-------\n";
print "./md5crack.pl aAdx 1 10 900150983cd24fb0d6963f7d28e17f72\n";
print " This example tries to crack the given MD5 with nearly every character.\n";
print " MD5 Kit only tries combinations with a length from 1 to 10 characters.\n";
die "Quitting...\n";
}
sub crack{
$CharSet = shift;
@RawString = ();
for (my $i =0;$i<$CharSet;$i++){ $RawString = 0;}
$Start = gettimeofday();
do{
for (my $i =0;$i<$CharSet;$i++){
if ($RawString[$i] > length($alpha)-1){
if ($i==$CharSet-1){
print "Bruteforcing done with $CharSet Chars. No Results.\n";
$cnt=0;
return false;
}
$RawString[$i+1]++;
$RawString[$i]=0;
}
}
################################################## #
$ret = "";
for (my $i =0;$i<$CharSet;$i++){ $ret = $ret . substr($alpha,$RawString[$i],1);}
$hash = md5_hex($ret);
$cnt++;
$Stop = gettimeofday();
if ($Stop-$Start>$dbgtmr){
$cnt = int($cnt/$dbgtmr);
print "$cnt hashes\\second.\tLast Pass '$ret\'\n";
$cnt=0;
$Start = gettimeofday();
}
print "$ARGV[3] != $hash ($ret)\n";
if ($ARGV[3] eq $hash){
die "\n**** Password Cracked! => $ret\n";
}
################################################## #
#checkhash($CharSet)."\n";
$RawString[0]++;
}while($RawString[$CharSet-1]<length($alpha));
}
sub checkhash{
$CharSet = shift;
$ret = "";
for (my $i =0;$i<$CharSet;$i++){ $ret = $ret . substr($alpha,$RawString[$i],1);}
$hash = md5_hex($ret);
$cnt++;
$Stop = gettimeofday();
if ($Stop-$Start>$dbgtmr){
$cnt = int($cnt/$dbgtmr);
print "$cnt hashes\\second.\tLast Pass '$ret\'\n";
$cnt=0;
$Start = gettimeofday();
}
if ($ARGV[3] eq $hash){
die "\n**** Password Cracked! => $ret\n";
}
}