github/thc-hydra
1
0
Fork 0
mirror of https://github.com/vanhauser-thc/thc-hydra.git synced 2025-07-05 12:36:09 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

more pre-8.0 fixes

Browse source
This commit is contained in:
vanhauser-thc 2014-04-28 11:45:11 +02:00
parent ebbd664e07
commit 163a499bfe
18 changed files with 74 additions and 76 deletions
Download patch file Download diff file Expand all files Collapse all files

8
hydra-asterisk.c
View file

@ -28,8 +28,8 @@ int start_asterisk(int s, char *ip, int port, unsigned char options, char *miscp
memset(buffer, 0, sizeof(buffer));
sprintf(buffer, "Action: Login\r\nUsername: %.250s\r\nSecret: %.250s\r\n\r\n", login, pass);
if (verbose || debug)
hydra_report(stderr, "[VERBOSE] C: %s\n", buffer);
if (debug)
hydra_report(stderr, "[DEBUG] C: %s\n", buffer);
if (hydra_send(s, buffer, strlen(buffer), 0) < 0) {
return 1;
@ -37,8 +37,8 @@ int start_asterisk(int s, char *ip, int port, unsigned char options, char *miscp
if ((buf = hydra_receive_line(s)) == NULL)
return 1;
if (verbose || debug)
hydra_report(stderr, "[VERBOSE] S: %s\n", buf);
if (debug)
hydra_report(stderr, "[DEBUG] S: %s\n", buf);
if (buf == NULL || (strstr(buf, "Response: ") == NULL)) {
hydra_report(stderr, "[ERROR] Asterisk Call Manager protocol error or service shutdown: %s\n", buf);

2
hydra-cisco-enable.c
View file

@ -107,6 +107,8 @@ void service_cisco_enable(char *ip, int sp, unsigned char options, char *miscptr
}
if (miscptr != NULL) {
if (buf != NULL)
free(buf);
while ((buf = hydra_receive_line(sock)) != NULL && strstr(buf, "assw") == NULL) {
if (hydra_strcasestr(buf, "ress ENTER") != NULL)
hydra_send(sock, "\r\n", 2, 0);

7
hydra-cisco.c
View file

@ -25,7 +25,8 @@ int start_cisco(int s, char *ip, int port, unsigned char options, char *miscptr,
}
sleep(1);
do {
buf = hydra_receive_line(s);
if ((buf = hydra_receive_line(s)) == NULL)
return 3;
if (buf[strlen(buf) - 1] == '\n')
buf[strlen(buf) - 1] = 0;
if (buf[strlen(buf) - 1] == '\r')
@ -49,7 +50,9 @@ int start_cisco(int s, char *ip, int port, unsigned char options, char *miscptr,
return 1;
}
do {
buf = hydra_receive_line(s);
free(buf);
if ((buf = hydra_receive_line(s)) == NULL)
return 3;
if (buf[strlen(buf) - 1] == '\n')
buf[strlen(buf) - 1] = 0;
if (buf[strlen(buf) - 1] == '\r')

1
hydra-http-proxy-urlenum.c
View file

@ -116,6 +116,7 @@ int start_http_proxy_urlenum(int s, char *ip, int port, unsigned char options, c
return 1;
//receive challenge
free(buf);
buf = hydra_receive_line(s);
while (buf != NULL && (pos = hydra_strcasestr(buf, "Proxy-Authenticate: NTLM ")) == NULL) {
free(buf);

1
hydra-http-proxy.c
View file

@ -53,6 +53,7 @@ int start_http_proxy(int s, char *ip, int port, unsigned char options, char *mis
if (debug)
hydra_report(stderr, "S:%s\n", http_proxy_buf);
free(http_proxy_buf);
http_proxy_buf = hydra_receive_line(s);
while (http_proxy_buf != NULL && hydra_strcasestr(http_proxy_buf, "Proxy-Authenticate:") == NULL) {
free(http_proxy_buf);

4
hydra-imap.c
View file

@ -198,14 +198,14 @@ int start_imap(int s, char *ip, int port, unsigned char options, char *miscptr,
from64tobits((char *) buffer, buf);
free(buf);
if (verbose)
if (debug)
hydra_report(stderr, "DEBUG S: %s\n", buffer);
fooptr = buffer2;
sasl_digest_md5(fooptr, login, pass, buffer, miscptr, "imap", NULL, 0, NULL);
if (fooptr == NULL)
return 3;
if (verbose)
if (debug)
hydra_report(stderr, "DEBUG C: %s\n", buffer2);
hydra_tobase64((unsigned char *) buffer2, strlen(buffer2), sizeof(buffer2));
sprintf(buffer, "%s\r\n", buffer2);

2
hydra-irc.c
View file

@ -145,7 +145,7 @@ void service_irc(char *ip, int sp, unsigned char options, char *miscptr, FILE *
}
buffer[0] = 0;
if ((ret = hydra_recv(sock, buffer, sizeof(buffer))) >= 0)
if ((ret = hydra_recv(sock, buffer, sizeof(buffer) - 1)) >= 0)
buffer[ret] = 0;
/* ERROR :Bad password */

2
hydra-mysql.c
View file

@ -55,7 +55,7 @@ char *hydra_mysql_receive_line(int socket) {
}
if (i <= 0) {
if (debug)
hydra_report_debug(stderr, "DEBUG_RECV_BEGIN|%s|END\n", buff);
hydra_report_debug(stderr, "DEBUG_RECV_BEGIN||END\n");
free(buff);
return NULL;
}

4
hydra-nntp.c
View file

@ -169,14 +169,14 @@ int start_nntp(int s, char *ip, int port, unsigned char options, char *miscptr,
from64tobits((char *) buffer, buf + 4);
free(buf);
if (verbose)
if (debug)
hydra_report(stderr, "DEBUG S: %s\n", buffer);
fooptr = buffer2;
sasl_digest_md5(fooptr, login, pass, buffer, miscptr, "nntp", NULL, 0, NULL);
if (fooptr == NULL)
return 3;
if (verbose)
if (debug)
hydra_report(stderr, "DEBUG C: %s\n", buffer2);
hydra_tobase64((unsigned char *) buffer2, strlen(buffer2), sizeof(buffer2));
sprintf(buffer, "%s\r\n", buffer2);

15
hydra-pcanywhere.c
View file

@ -140,7 +140,7 @@ int start_pcanywhere(int s, char *ip, int port, unsigned char options, char *mis
return 1;
}
ret = hydra_recv(s, buffer, sizeof(buffer));
ret = hydra_recv(s, buffer, sizeof(buffer) - 1);
if (ret == -1) {
return 1;
}
@ -148,17 +148,21 @@ int start_pcanywhere(int s, char *ip, int port, unsigned char options, char *mis
if (i == 3) {
if (ret == 3) {
/*one more to get the login prompt */
ret = hydra_recv(s, buffer, sizeof(buffer));
ret = hydra_recv(s, buffer, sizeof(buffer) - 1);
}
}
if (ret >= 0)
buffer[ret] = 0;
if (i == 0 || i == 3)
clean_buffer(buffer, ret);
/*show_buffer(buffer,ret); */
if (debug) show_buffer(buffer, ret);
if (i == 2) {
clean_buffer(buffer, ret);
buffer[sizeof(buffer) - 1] = 0;
if (strstr(buffer, server[i + 2]) != NULL) {
fprintf(stderr, "[ERROR] PC Anywhere host denying connection because you have requested a lower encrypt level\n");
return 3;
@ -176,10 +180,11 @@ int start_pcanywhere(int s, char *ip, int port, unsigned char options, char *mis
if (send_cstring(s, clogin) < 0) {
return 1;
}
ret = hydra_recv(s, buffer, sizeof(buffer));
if (ret == -1) {
ret = hydra_recv(s, buffer, sizeof(buffer) - 1);
if (ret < 0) {
return 1;
}
buffer[ret] = 0;
clean_buffer(buffer, ret);
/*show_buffer(buffer,ret); */
if (strstr(buffer, "Enter password:") == NULL) {

8
hydra-pop3.c
View file

@ -301,16 +301,16 @@ int start_pop3(int s, char *ip, int port, unsigned char options, char *miscptr,
from64tobits((char *) buffer, buf);
free(buf);
if (verbose)
hydra_report(stderr, "[VERBOSE] S: %s\n", buffer);
if (debug)
hydra_report(stderr, "[DEBUG] S: %s\n", buffer);
fooptr = buffer2;
sasl_digest_md5(fooptr, login, pass, buffer, miscptr, "pop", NULL, 0, NULL);
if (fooptr == NULL)
return 3;
if (verbose)
hydra_report(stderr, "[VERBOSE] C: %s\n", buffer2);
if (debug)
hydra_report(stderr, "[DEBUG] C: %s\n", buffer2);
hydra_tobase64((unsigned char *) buffer2, strlen(buffer2), sizeof(buffer2));
sprintf(buffer, "%s\r\n", buffer2);
}

2
hydra-rexec.c
View file

@ -32,7 +32,7 @@ int start_rexec(int s, char *ip, int port, unsigned char options, char *miscptr,
return 1;
}
ret = hydra_recv(s, buffer, sizeof(buffer));
ret = hydra_recv(s, buffer, sizeof(buffer) - 1);
if (ret > 0 && buffer[0] == 0) {
hydra_report_found_host(port, ip, "rexec", fp);

7
hydra-rlogin.c
View file

@ -38,13 +38,14 @@ int start_rlogin(int s, char *ip, int port, unsigned char options, char *miscptr
if (hydra_send(s, buffer2, 4 + strlen(login) + strlen(login) + strlen(TERM), 0) < 0) {
return 4;
}
ret = hydra_recv(s, buffer, sizeof(buffer));
buffer[0] = 0;
ret = hydra_recv(s, buffer, sizeof(buffer) - 1);
/* 0x00 is sent but hydra_recv transformed it */
if (strlen(buffer) == 0) {
ret = hydra_recv(s, buffer, sizeof(buffer) - 1);
if (ret >= 0)
buffer[ret] = 0;
}
if (ret >= 0)
buffer[ret] = 0;
if (ret > 0 && (strstr(buffer, "rlogind:") != NULL))
return 1;

2
hydra-rsh.c
View file

@ -37,7 +37,7 @@ int start_rsh(int s, char *ip, int port, unsigned char options, char *miscptr, F
}
buffer[0] = 0;
if ((ret = hydra_recv(s, buffer, sizeof(buffer))) >= 0)
if ((ret = hydra_recv(s, buffer, sizeof(buffer) - 1)) >= 0)
buffer[ret] = 0;
/* 0x00 is sent but hydra_recv transformed it */
if (strlen(buffer) == 0)

66
hydra-s7-300.c
View file

@ -6,26 +6,13 @@
extern char *HYDRA_EXIT;
unsigned char p_cotp[] =
"\x03\x00\x00\x16\x11\xe0\x00\x00\x00\x17"
"\x00\xc1\x02\x01\x00\xc2\x02\x01\x02\xc0"
"\x01\x0a";
unsigned char p_cotp[] = "\x03\x00\x00\x16\x11\xe0\x00\x00\x00\x17" "\x00\xc1\x02\x01\x00\xc2\x02\x01\x02\xc0" "\x01\x0a";
unsigned char p_s7_negotiate_pdu[] =
"\x03\x00\x00\x19\x02\xf0\x80\x32\x01\x00"
"\x00\x02\x00\x00\x08\x00\x00\xf0\x00\x00"
"\x01\x00\x01\x01\xe0";
unsigned char p_s7_negotiate_pdu[] = "\x03\x00\x00\x19\x02\xf0\x80\x32\x01\x00" "\x00\x02\x00\x00\x08\x00\x00\xf0\x00\x00" "\x01\x00\x01\x01\xe0";
unsigned char p_s7_read_szl[] =
"\x03\x00\x00\x21\x02\xf0\x80\x32\x07\x00"
"\x00\x03\x00\x00\x08\x00\x08\x00\x01\x12"
"\x04\x11\x44\x01\x00\xff\x09\x00\x04\x01"
"\x32\x00\x04";
unsigned char p_s7_read_szl[] = "\x03\x00\x00\x21\x02\xf0\x80\x32\x07\x00" "\x00\x03\x00\x00\x08\x00\x08\x00\x01\x12" "\x04\x11\x44\x01\x00\xff\x09\x00\x04\x01" "\x32\x00\x04";
unsigned char p_s7_password_request[] =
"\x03\x00\x00\x25\x02\xf0\x80\x32\x07\x00"
"\x00\x00\x00\x00\x08\x00\x0c\x00\x01\x12"
"\x04\x11\x45\x01\x00\xff\x09\x00\x08";
unsigned char p_s7_password_request[] = "\x03\x00\x00\x25\x02\xf0\x80\x32\x07\x00" "\x00\x00\x00\x00\x08\x00\x0c\x00\x01\x12" "\x04\x11\x45\x01\x00\xff\x09\x00\x08";
int start_s7_300(int s, char *ip, int port, unsigned char options, char *miscptr, FILE * fp) {
@ -43,7 +30,7 @@ int start_s7_300(int s, char *ip, int port, unsigned char options, char *miscptr
memset(context, 0, sizeof(context));
if (strlen(pass) < S7PASSLEN) {
strncpy(context, pass, strlen(pass));
strncat(context, spaces, S7PASSLEN - strlen(pass) );
strncat(context, spaces, S7PASSLEN - strlen(pass));
} else {
strncpy(context, pass, S7PASSLEN);
}
@ -52,65 +39,66 @@ int start_s7_300(int s, char *ip, int port, unsigned char options, char *miscptr
encoded_password[0] = context[0] ^ 0x55;
encoded_password[1] = context[1] ^ 0x55;
int i;
for (i = 2; i < S7PASSLEN; i++) {
encoded_password[i] = context[i] ^ encoded_password[i-2] ^ 0x55 ;
encoded_password[i] = context[i] ^ encoded_password[i - 2] ^ 0x55;
}
// send p_cotp and check first 2 bytes of answer
if (hydra_send(s, (char *) p_cotp, 22, 0) < 0)
return 1;
memset(buffer, 0, sizeof(buffer));
ret=hydra_recv_nb(s, buffer, sizeof(buffer));
ret = hydra_recv_nb(s, buffer, sizeof(buffer));
if (ret <= 0)
return 3;
if (ret > 2 && (buffer[0] != 0x03 && buffer[1] != 0x00) )
if (ret > 2 && (buffer[0] != 0x03 && buffer[1] != 0x00))
return 3;
// send p_s7_negotiate_pdu and check first 2 bytes of answer
if (hydra_send(s, (char *) p_s7_negotiate_pdu, 25, 0) < 0)
return 1;
memset(buffer, 0, sizeof(buffer));
ret=hydra_recv_nb(s, buffer, sizeof(buffer));
ret = hydra_recv_nb(s, buffer, sizeof(buffer));
if (ret <= 0)
return 3;
if (ret > 2 && (buffer[0] != 0x03 && buffer[1] != 0x00) )
if (ret > 2 && (buffer[0] != 0x03 && buffer[1] != 0x00))
return 3;
// send p_s7_read_szl and check first 2 bytes of answer
if (hydra_send(s, (char *) p_s7_read_szl, 33, 0) < 0)
return 1;
memset(buffer, 0, sizeof(buffer));
ret=hydra_recv_nb(s, buffer, sizeof(buffer));
ret = hydra_recv_nb(s, buffer, sizeof(buffer));
if (ret <= 0)
return 3;
if (ret > 2 && (buffer[0] != 0x03 && buffer[1] != 0x00) )
if (ret > 2 && (buffer[0] != 0x03 && buffer[1] != 0x00))
return 3;
// so now add encoded_password to p_s7_password_request and send
memset(buffer, 0, sizeof(buffer));
memcpy(buffer, p_s7_password_request, 29);
memcpy(buffer + 29, encoded_password, S7PASSLEN);
if (hydra_send(s, buffer, 29 + S7PASSLEN , 0) < 0)
if (hydra_send(s, buffer, 29 + S7PASSLEN, 0) < 0)
return 1;
memset(buffer, 0, sizeof(buffer));
ret=hydra_recv_nb(s, buffer, sizeof(buffer));
ret = hydra_recv_nb(s, buffer, sizeof(buffer));
if (ret <= 0)
return 3;
// now check answer
// 0x0000 - valid password
// 0xd605 - no password
// 0xd602 - wrong password
if (ret > 30 ) {
if (ret > 30) {
if (buffer[27] == '\x00' && buffer[28] == '\x00') {
hydra_report_found_host(port, ip, "s7-300", fp);
hydra_completed_pair_found();
@ -175,7 +163,7 @@ void service_s7_300(char *ip, int sp, unsigned char options, char *miscptr, FILE
}
}
int service_s7_300_init(char *ip, int sp, unsigned char options, char *miscptr, FILE *fp, int port) {
int service_s7_300_init(char *ip, int sp, unsigned char options, char *miscptr, FILE * fp, int port) {
// called before the childrens are forked off, so this is the function
// which should be filled if initial connections and service setup has to be
// performed once only.
@ -219,7 +207,7 @@ int service_s7_300_init(char *ip, int sp, unsigned char options, char *miscptr,
encoded_password[0] = context[0] ^ 0x55;
encoded_password[1] = context[1] ^ 0x55;
for (i = 2; i < S7PASSLEN; i++) {
encoded_password[i] = context[i] ^ encoded_password[i-2] ^ 0x55 ;
encoded_password[i] = context[i] ^ encoded_password[i - 2] ^ 0x55;
}
// send p_cotp and check first 2 bytes of answer
@ -237,7 +225,6 @@ int service_s7_300_init(char *ip, int sp, unsigned char options, char *miscptr,
fprintf(stderr, "[ERROR] invalid reply to init packet\n");
return 3;
}
// send p_s7_negotiate_pdu and check first 2 bytes of answer
if (hydra_send(sock, (char *) p_s7_negotiate_pdu, 25, 0) < 0) {
fprintf(stderr, "[ERROR] can not send data to service (2)\n");
@ -253,7 +240,6 @@ int service_s7_300_init(char *ip, int sp, unsigned char options, char *miscptr,
fprintf(stderr, "[ERROR] invalid reply to init packet (2)\n");
return 3;
}
// send p_s7_read_szl and check first 2 bytes of answer
if (hydra_send(sock, (char *) p_s7_read_szl, 33, 0) < 0) {
fprintf(stderr, "[ERROR] can not send data to service (3)\n");
@ -265,27 +251,25 @@ int service_s7_300_init(char *ip, int sp, unsigned char options, char *miscptr,
return 3;
}
if (ret > 2 && (buffer[0] != 0x03 && buffer[1] != 0x00) ) {
if (ret > 2 && (buffer[0] != 0x03 && buffer[1] != 0x00)) {
fprintf(stderr, "[ERROR] invalid reply to init packet (3)\n");
return 3;
}
// so now add encoded_password to p_s7_password_request and send
memset(buffer, 0, sizeof(buffer));
memcpy(buffer, p_s7_password_request, 29);
memcpy(buffer + 29, encoded_password, S7PASSLEN);
if (hydra_send(sock, buffer, 29 + S7PASSLEN , 0) < 0) {
if (hydra_send(sock, buffer, 29 + S7PASSLEN, 0) < 0) {
fprintf(stderr, "[ERROR] can not send data to service (4)\n");
return 3;
}
memset(buffer, 0, sizeof(buffer));
if ((ret = hydra_recv_nb(sock, buffer, sizeof(buffer))) <= 0) {
fprintf(stderr, "[ERROR] did not received data from the service (4)\n");
return 3;
}
// now check answer
// 0x0000 - valid password
// 0xd605 - no password

13
hydra-sip.c
View file

@ -75,8 +75,9 @@ int start_sip(int s, char *ip, char *lip, int port, int lport, unsigned char opt
while (try < 2 && !has_sip_cred) {
try++;
if (hydra_data_ready_timed(s, 3, 0) > 0) {
i = hydra_recv(s, (char *) buf, sizeof(buf));
buf[sizeof(buf) - 1] = '\0';
i = hydra_recv(s, (char *) buf, sizeof(buf) - 1);
if (i > 0)
buf[i] = '\0';
if (strncmp(buf, "SIP/2.0 404", 11) == 0) {
hydra_report(stdout, "[ERROR] Get error code 404 : user '%s' not found\n", login);
return 2;
@ -124,7 +125,7 @@ int start_sip(int s, char *ip, char *lip, int port, int lport, unsigned char opt
hydra_report(stderr, "[ERROR] no www-authenticate header found!\n");
return -1;
}
if (verbose)
if (debug)
hydra_report(stderr, "[INFO] S: %s\n", buf);
char buffer2[512];
@ -139,7 +140,7 @@ int start_sip(int s, char *ip, char *lip, int port, int lport, unsigned char opt
"Call-ID: 1337@%s\n" "CSeq: %i REGISTER\n" "Authorization: Digest %s\n" "Content-Length: 0\n\n", host, lip, lport, login, host, login, host, host, cseq, buffer2);
cseq++;
if (verbose)
if (debug)
hydra_report(stderr, "[INFO] C: %s\n", buffer);
if (hydra_send(s, buffer, strlen(buffer), 0) < 0) {
return 3;
@ -152,9 +153,9 @@ int start_sip(int s, char *ip, char *lip, int port, int lport, unsigned char opt
try++;
if (hydra_data_ready_timed(s, 5, 0) > 0) {
memset(buf, 0, sizeof(buf));
if ((i = hydra_recv(s, (char *) buf, sizeof(buf))) >= 0)
if ((i = hydra_recv(s, (char *) buf, sizeof(buf) - 1)) >= 0)
buf[i] = 0;
if (verbose)
if (debug)
hydra_report(stderr, "[INFO] S: %s\n", buf);
sip_code = get_sip_code(buf);
if (sip_code >= 200 && sip_code < 300) {

2
hydra-smb.c
View file

@ -978,7 +978,7 @@ unsigned long SMBSessionSetup(int s, char *szLogin, char *szPassword, char *misc
ret = HashLM(&LMhash, (unsigned char *) szPassword, (unsigned char *) challenge);
if (ret == -1) {
free(LMv2hash);
free(LMhash);
return -1;
}

4
hydra-smtp.c
View file

@ -125,7 +125,7 @@ int start_smtp(int s, char *ip, int port, unsigned char options, char *miscptr,
from64tobits((char *) buffer, buf + 4);
free(buf);
if (verbose)
if (debug)
hydra_report(stderr, "DEBUG S: %s\n", buffer);
fooptr = buffer2;
@ -133,7 +133,7 @@ int start_smtp(int s, char *ip, int port, unsigned char options, char *miscptr,
if (fooptr == NULL)
return 3;
if (verbose)
if (debug)
hydra_report(stderr, "DEBUG C: %s\n", buffer2);
hydra_tobase64((unsigned char *) buffer2, strlen(buffer2), sizeof(buffer2));
sprintf(buffer, "%s\r\n", buffer2);