Want more features on Pastebin? Sign Up, it's FREE!
Guest

f0ne.sh

By: a guest on Aug 22nd, 2010  |  syntax: Bash  |  size: 16.60 KB  |  views: 1,604  |  expires: Never
download  |  raw  |  embed  |  report abuse  |  print
Text below is selected. Please press Ctrl+C to copy to your clipboard. (⌘+C on Mac)
  1. #!/bin/bash
  2. #
  3. ############################################################################
  4. #                    US Phone Number Generator by DERV                     #
  5. ############################################################################
  6. # HELP
  7. #   run the program with -h for help
  8. #
  9. #  ./f0ne.sh -h
  10. #
  11. ############################################################################
  12. #
  13. # USES:
  14. #  wget*
  15. #  awk
  16. #  sort**
  17. #  uniq**
  18. #  tr**
  19. #
  20. #  *internet access is required
  21. #
  22. #  **not necessary, but recommended
  23. #
  24. #
  25. ############################################################################
  26. #
  27. # CHANGE LOG
  28. #
  29. # revision 6 changes: (8/22/10)
  30. #  -command-line arguments!
  31. #   -to run: ./f0ne.sh [city] [style]
  32. #  -outputs only phone numbers instead of a file (so user can pipe to a file or aircrack)
  33. #  -ex: ./f0ne.sh "albuquerque, nm" 2
  34. #   -this will create all alb numbers with style 555-666-1234 (- separators)
  35. #
  36. #
  37. # revision 5 changes: (8/18/10)
  38. #  -can run independent of crunch - slower, but it works if crunch isn't available
  39. #  -saves to 'name_of_city.txt' instead of generic 'phone.txt'
  40. #  -leeto burrito ascii art
  41. #
  42. # revision 4 changes:
  43. #  -removes duplicates for numbers that don't contain the area code (prefix only)
  44. #
  45. # revision 3 changes:
  46. #  -aircrack-ng passthrough for WPA cracking (saves time/space)
  47. #    -key is outputted to aircrack.txt and script stops immediately if key is found
  48. #
  49. # revision 2 changes:
  50. #  -menu system to output certain phone number formats
  51. #  -corrected error for cities with spaces in the name
  52. #
  53. ############################################################################
  54. #
  55. # ToDo
  56. #   receive city, format, aircrack info as arguments to be more linux-like
  57. #    - just have if [[ $1 != ... everywhere!
  58. #
  59. ############################################################################
  60. #
  61. # Note:
  62. #   This script runs MUCH faster if crunch is installed!
  63. #   program looks for crunch in directory /pentest/passwords/crunch/
  64. #   edit the line below if crunch is located elsewhere on your computer:
  65. #
  66. CRUNCH="/pentest/passwords/crunch/./crunch"
  67. #CRUNCH="/derpderp/hurrdurr/./crunch" # for testing if user doesn't have crunch
  68. #
  69. #   crunch can be found here: http://sourceforge.net/projects/crunch-wordlist/
  70. #
  71. ############################################################################
  72.  
  73. # check if the user needs help
  74. if [[ $1 = 'h' ]] || [[ $1 = '--help' ]] || [[ $1 = '-h' ]] || [[ $1 = 'help' ]] || [[ $1 = '-help' ]]; then
  75.   echo ""
  76.   echo -e "\E[32m       /"
  77.   echo -e "\E[32m      /\`\`/        \E[32mf 0 n e"
  78.   echo -e "\E[32m     /__/"
  79.   echo -e "\E[32m    /__/    \E[37mphone number generator"
  80.   echo -e "\E[39m"
  81.   echo ""
  82.   echo -e "\E[37mabout:"
  83.   echo -e "\E[39m"
  84.   echo "  Phone numbers are a common password choice."
  85.   echo "  Generating every 7-digit phone number for an area code leads to 10 million numbers."
  86.   echo "  There is a website that finds only valid numbers (areacode and prefix) for certain cities."
  87.   echo "  This program uses that website to generate customized lists of phone numbers."
  88.   echo ""
  89.   echo ""
  90.   echo -e "\E[37mhow to use:"
  91.   echo -e "\E[39m"
  92.   echo " Enter the U.S. city, for example 'New York'."
  93.   echo ""
  94.   echo "  Then enter what format you want the phone number stored."
  95.   echo "       1) (555)444-####"
  96.   echo "       2) 555-444-####"
  97.   echo "       3) 555444####"
  98.   echo "       4) 444-####"
  99.   echo "       5) 444####"
  100.   echo ""
  101.   echo "  f0ne will ask if you want to passthrough the results to aircrack-ng to crack WPA."
  102.   echo "    This feature is designed to save time and harddisk space."
  103.   echo "    Enter 'y' to select this option."
  104.   echo "       You will be prompted for the .CAP file containing a WPA handshake,"
  105.   echo "       and the name (SSID) of the access point."
  106.   echo ""
  107.   echo "  If you do not select aircrack-ng passthrough, f0ne will save the numbers to a file."
  108.   echo ""
  109.   echo ""
  110.   echo -e "\E[37mnote:"
  111.   echo "  f0ne uses Crunch to generate phone numbers quickly."
  112.   echo "    The script defaults to /pentest/passwords/crunch/ to locate crunch"
  113.   echo "    If needed, edit f0ne.sh to change the crunch path (LINE 66)"
  114.   echo ""
  115.   echo "  If crunch is not found, f0ne.sh uses a built-in script that is much slower than crunch."
  116.   echo ""
  117.   echo "  f0ne also accepts command-line arguments!"
  118.   echo -e "    Usage:    \E[39m./f0ne.sh \E[32m[CITY] [STYLE]\E[37m"
  119.   echo -e "    Example:  \E[39m./f0ne.sh \E[32m\"albuquerque, nm\" 5\E[37m"
  120.   echo "  When using command-line arguments, f0ne will only output the phone numbers and no other data,"
  121.   echo "   so piping to a file is recommened:"
  122.   echo -e "    \E[39m./f0ne.sh \E[32m\"chicago, il\" 5 \E[36m> chicago.txt\E[37m"
  123.   echo "   This will write all the phone numbers to the file 'chicago.txt'"
  124.   echo -e "\E[39m"
  125.  
  126.   exit 0
  127. fi
  128.  
  129. # trap term/keyboard interrupt signals
  130. trap ITSATRAP INT
  131. trap ITSATRAP TERM
  132. ITSATRAP() {
  133.   killall aircrack-ng 2> /dev/null & 1>  /dev/null
  134.   if [[ $# -eq 0 ]]; then
  135.     echo -e "\E[39m"
  136.     echo -e "\E[31m[!] Keyboard interrupt; exiting\E[39m"
  137.   fi
  138.  
  139.   exit 0
  140. }
  141.  
  142. # banner
  143. if [[ $# -eq 0 ]]; then # only print if user supplied no arguments
  144.         echo ""
  145.         echo -e "\E[32m       /"
  146.         echo -e "\E[32m      /\`\`/        \E[32mf 0 n e"
  147.         echo -e "\E[32m     /__/"
  148.         echo -e "\E[32m    /__/    \E[37mphone number generator"
  149.         echo -e "\E[39m"
  150.         echo ""
  151. fi
  152. # check if user has crunch installed
  153. if [[ ! -f "$CRUNCH" ]]; then
  154.   # crunch isn't found; use a built-in shell script instead
  155.  
  156.   # check if user is root; warn about not running as root (chmod!)
  157.   if [[ `users` != 'root' ]] && [[ $# -eq 0 ]]; then
  158.     echo "[+] It is recommened to run this script as root if you do not have crunch installed."
  159.     echo -n "[?] Do you wish to continue? (y/n) "
  160.     read ANSWER
  161.     if [[ "${ANSWER}" = 'n' ]]; then
  162.       exit 0;
  163.     fi
  164.   fi
  165.  
  166.  
  167.   HAS_CRUNCH="0" # variable so we know if we are using CRUNCH or not
  168.  
  169.   if [[ $# -eq 0 ]]; then
  170.         echo ""
  171.         echo -e "\E[31m[!] \E[39mCrunch was not found."
  172.         echo "[-] Creating temporary phone-number-generating script..."
  173.   fi
  174.  
  175.   # create script that generates the last 4 phone numbers to the argument passed
  176.   # as you can see, all this script does is echo (it's harmless)
  177.   echo "#!/bin/bash
  178. trap ITSATRAP INT
  179. trap ITSATRAP TERM
  180. ITSATRAP() {
  181.  exit 0
  182. }
  183. PRE=\$1
  184. COUNT=0
  185. while [ \${COUNT} -lt 10000 ]; do
  186.  TEMP=\${COUNT}
  187.  if [ \${#TEMP} -eq 1 ]; then
  188.    TEMP=\"000\${TEMP}\"
  189.  elif [ \${#TEMP} -eq 2 ]; then
  190.    TEMP=\"00\${TEMP}\"
  191.  elif [ \${#TEMP} -eq 3 ]; then
  192.    TEMP=\"0\${TEMP}\"
  193.  fi
  194.  echo \${PRE}\${TEMP}
  195.  COUNT=\$((COUNT + 1))
  196. done
  197. exit 0" > f0ne-crunch.sh
  198.   # end of script
  199.  
  200.   # change permissions on this temporary script (so we can run it)
  201.   chmod +x f0ne-crunch.sh
  202.  
  203.   # let user know what's up
  204.   if [[ $# -eq 0 ]]; then
  205.     echo -e "\E[33m[-] \E[39mNote: Temporary script f0ne-crunch.sh will be deleted on exit."
  206.   fi
  207.  
  208.   CRUNCH="./f0ne-crunch.sh"
  209.   ## old style would quit ; fuck that!
  210.   ## echo ""
  211.   ## echo "[!] Path to crunch not found! ($CRUNCH)"
  212.   ## echo "[!] Please edit phone.sh Line 40 to the correct path to Crunch"
  213.   ## exit
  214.  
  215. else
  216.   # if crunch is found, use it! (it's much faster than f0ne-crunch.sh)
  217.   HAS_CRUNCH="1"
  218. fi
  219.  
  220.  
  221.  
  222. if [[ $# -eq 0 ]]; then
  223.         echo -n -e "\E[32m[+] \E[39mEnter a U.S. City (e.g. \E[32mchicago, il\E[39m): \E[32m"
  224.        
  225.         read CITY
  226.        
  227.         OUTFILE=$CITY
  228.         # OUTFILE is the output file -- where the data is saved to
  229.         OUTFILE=${OUTFILE// /}            # strip out the spaces
  230.         OUTFILE=${OUTFILE//[^a-zA-Z0-9]/} # leave only alphanumeric characters
  231.         OUTFILE=`echo -n $OUTFILE | tr A-Z a-z`  # convert to lowercase
  232.         OUTFILE="${OUTFILE}.txt"          # make it a txt file
  233.        
  234.         rm -rf ${OUTFILE}                 # remove the output file, just in case; so we don't 'stack' numbers together
  235.        
  236. elif [[ $# -eq 1 ]]; then
  237.         CITY=$1
  238.         STYLE=3    # default to [areacode][prefix][number] without any separators
  239.         OUTFILE=""
  240.        
  241. elif [[ $# -eq 2 ]]; then
  242.         CITY=$1
  243.         STYLE=$2  # user gave us city and separator!
  244.         OUTFILE=""
  245.        
  246. else
  247.         echo -e "\E[33m[+] \E[39mError: invalid amount of arguments"
  248.         echo ""
  249.         echo -e "\E[33m[+] \E[39mProper usage (with examples):"
  250.         echo ""
  251.         echo -e "\E[33m[+] \E[39m./f0ne.sh \E[32m[CITY]"
  252.         echo -e "\E[33m[+] \E[39m   ./f0ne.sh \E[32mchicago"
  253.         echo -e "\E[33m[+] \E[39m   ./f0ne.sh \E[32m\"chicago, il\""
  254.         echo ""
  255.         echo -e "\E[33m[+] \E[39m./f0ne.sh \E[32m[CITY] [STYLE]"
  256.         echo -e "\E[33m[+] \E[39m   ./f0ne.sh \E[32mchicago 3"
  257.         echo -e "\E[33m[+] \E[39m   ./f0ne.sh \E[32m\"chicago, il\" 3"
  258.         echo ""
  259.         exit 0
  260. fi
  261.  
  262. # change format of CITY (used for URL request)
  263. CITY=${CITY// /+}                 # website we use can't have spaces; use plus-signs (+) instead
  264. CITY=${CITY//,/+}                 # convert commas to spaces
  265. CITY=${CITY//[^a-zA-Z0-9+]/}      # only alphanumeric characters (and plus signs!)
  266. CITY=`echo -n $CITY | tr A-Z a-z` # finally, lowercase
  267.  
  268. if [[ $# -eq 0 ]]; then
  269.         # phone number style menu
  270.         echo -e "\E[39m"
  271.         echo -e "[-] Select a phone number format:"
  272.         echo ""
  273.         echo -e "    \E[32m1\E[39m)  (555)555-5555  [13 chars]"
  274.         echo -e "    \E[32m2\E[39m)  555-555-1234   [12 chars]"
  275.         echo -e "    \E[32m3\E[39m)  5555555555     [10 chars]"
  276.         echo -e "    \E[32m4\E[39m)  555-1234       [ 8 chars]"
  277.         echo -e "    \E[32m5\E[39m)  5551234        [ 7 chars]"
  278.         echo ""
  279.         echo -n -e "\E[32m[+]\E[39m Enter a number between \E[32m1\E[39m and \E[32m5\E[39m: \E[32m"
  280.        
  281.         read STYLE
  282. fi
  283.  
  284. # check if style (phone number formatting) is a valid menu option
  285. if [[ "$STYLE" -lt "1" ]] || [[ $STYLE -gt "5" ]]; then
  286. # if they picked something < 1 or > 5
  287.   echo -e "\E[31m[!] \E[39mInvalid menu number ($STYLE). Please use 1-5. \E[31mexiting.\E[39m"
  288.   exit 0
  289. fi
  290.  
  291. # if we're not using command-line arguments...
  292. if [[ $# -eq 0 ]]; then
  293.         # wpa passthrough question
  294.         echo -e "\E[33m[?]\E[39m Do you want to passthrough the phone numbers into "
  295.         echo -n -e "     aircrack-ng to crack a WPA handshake capture file? (\E[32my\E[39m/\E[32mn\E[39m): \E[32m"
  296.        
  297.         read ANS
  298.        
  299.         # if they want to pass through to aircrack-ng...
  300.         if [[ "$ANS" == "y" ]]; then
  301.                 # get .cap path
  302.                 echo ""
  303.                 echo -n -e "[+] Enter the \E[32mpath to the .cap file\E[39m containing a WPA handshake: \E[32m"
  304.                 read CAP
  305.                 echo -e "\E[39m"
  306.                 if [[ ! -f "$CAP" ]]; then
  307.                         # if the .cap file does not exist, gtfo
  308.                         CAP=""
  309.                         echo -e "\E[31m[!] \E[39mCAP file \E[31m\'${CAP}\' \E[39mnot found; defaulting output to \E[32m${OUTFILE}\E[39m"
  310.                 else
  311.                         # cap file exists, get the ESSID
  312.                         echo -n -e "[+] Enter the \E[32mESSID\E[39m of the access point: \E[32m"
  313.                         read ESSID
  314.                 fi
  315.                
  316.                 # remove aircrack.txt now -- will contain if/when WPA key is found
  317.                 rm -f aircrack.txt
  318.                
  319.         else
  320.                 # if CAP="", then we will only output phone numbers to the OUTFILE; no passthrough
  321.                 CAP=""
  322.         fi
  323.        
  324. else
  325.         CAP=""
  326. fi
  327.  
  328. # delete temporary files
  329. rm -rf /tmp/page1.txt
  330. rm -rf /tmp/page2.txt
  331.  
  332. # get html from site
  333. if [[ $# -eq 0 ]]; then
  334.         echo -e "\E[39m"
  335.         echo -e "\E[32m[+] \E[39mGathering area-code and prefix information using wget; please wait..."
  336. fi
  337.  
  338. wget -q -O /tmp/page1.txt http://www.melissadata.com/lookups/phonelocation.asp?number=${CITY}
  339.  
  340. # if wget returned invalid data or nothing at all...
  341. if [[ $(cat /tmp/page1.txt) = "" ]] || [[ ! -f /tmp/page1.txt ]]; then
  342.   echo ""
  343.   echo -e "\E[31m[!]\E[39m Unable to download phone numbers for city '${CITY}'; exiting"
  344.   echo -e "\E[31m[!]\E[39m Unexpected errors occurred while accessing the following site:"
  345.   echo -e "\E[31mhttp://www.melissadata.com/lookups/phonelocation.asp?number=${CITY}\E[39m"
  346.   echo -e "\E[31m[!]\E[39m Check to make sure your internet connection is working and this URL provides relevant data."
  347.  
  348.   exit 0
  349. fi
  350.  
  351. # echo "[-] Prefixes gathered.  Parsing..."
  352.  
  353. # the next few lines are pretty ugly
  354. # i don't know much about awk, so I basically juggled the data between two files (page1.txt and page2.txt)
  355. # this is horrible code and I'm sure there's a one-line awk solution to this, but I wasn't able to find it...
  356.  
  357. # grab the beginning of the phone numbers from page1, store in page2
  358. awk ' BEGIN {FS = "?number=" } {print $2} ' /tmp/page1.txt >> /tmp/page2.txt
  359. rm /tmp/page1.txt
  360.  
  361. # strip the end of the number (ignoring the trailing '0000' for each #)
  362. awk ' BEGIN {FS = "0000\"" } {print $1} ' /tmp/page2.txt >> /tmp/page1.txt
  363. rm /tmp/page2.txt
  364.  
  365. # remove blank lines 'cause I suck at awk
  366. awk '$0!~/^$/ {print $0}' /tmp/page1.txt >> /tmp/page2.txt
  367. rm /tmp/page1.txt
  368.  
  369. # if the user selected a menu item larger than 3...
  370. if [[ "${STYLE}" -gt "3" ]]; then
  371.   # we don't need area code!
  372.   while read Lines
  373.   do
  374.         # remove areacode from each line
  375.     echo ${Lines:3} >> /tmp/page1.txt
  376.   done < /tmp/page2.txt
  377.   rm /tmp/page2.txt
  378.  
  379.   # remove duplicates -- this is possible for large cities where different areacodes have the same prefix!
  380.   cat /tmp/page1.txt | sort | uniq > /tmp/page2.txt
  381.   rm /tmp/page1.txt
  382. fi
  383.  
  384. # at this point, /tmp/page2.txt contains all of the [area codes and] prefixes for the city
  385.  
  386. # the following lines/loop counts how many prefixes there are
  387. # this is purely to let the user know how much longer the process will take
  388. COUNT=0                # COUNT will be the total amount of prefixes to generate
  389. CURRENT=0              # CURRENT keeps track of which prefix we are currently working on
  390. while read Line; do    # go through every line in the prefix file
  391.   COUNT=$((COUNT + 1)) # increment counter
  392. done < /tmp/page2.txt  # stop at the end of the file
  393.  
  394.  
  395.  
  396. # loop through every areacode/prefix
  397. while read Line
  398. do
  399.   # if we are passing through to aircrack and we've cracked it, stop!
  400.   if [[ ! "$CAP" == "" ]] && [[ -f "aircrack.txt" ]]; then
  401.     break
  402.   fi
  403.  
  404.   # sometimes the website returns only 3 digits (invalid numbers)
  405.   # i hit this error briefly, might have been isolated, but still gonna check for it!
  406.   if [[ "${STYLE}" -lt "4" ]] && [[ ${#Line} -eq 3 ]]; then
  407.     continue # move onto the next one
  408.   fi
  409.  
  410.   CURRENT=$((CURRENT + 1)) # increment counter of how many prefixes we've done
  411.  
  412.   # format the line to fit the style
  413.   if [ $STYLE = '1' ]; then
  414.     # Style: (###)###-@@@@
  415.     Line="(${Line:0:3})${Line:3}-"
  416.     LEN=13
  417.  
  418.   elif [ $STYLE = '2' ]; then
  419.     # Style: ###-###-@@@@
  420.     Line="${Line:0:3}-${Line:3}-"
  421.     LEN=12
  422.  
  423.   elif [ $STYLE = '3' ]; then
  424.     # Style: ######@@@@
  425.     Line=${Line} #nothing changes
  426.     LEN=10
  427.  
  428.   elif [ $STYLE = '4' ]; then
  429.     # Style: ###-@@@@
  430.     Line="${Line}-"
  431.     LEN=8
  432.  
  433.   elif [ $STYLE = '5' ]; then
  434.     # Style: ###@@@@
  435.     LEN=7
  436.   fi
  437.  
  438.   # now that we know the format, see if we are passing through to aircrack or OUTFILE
  439.   if [[ ! "$CAP" == "" ]]; then
  440.     # cap file exists, need to pass through to aircrack
  441.    
  442.     echo -e "\E[32m[+] \E[39mPassing through to aircrack-ng: \E[32m${Line}####\E[39m..."
  443.    
  444.     if [[ HAS_CRUNCH = '1' ]]; then
  445.       ${CRUNCH} $LEN $LEN 0123456789 -t ${Line}@@@@ | aircrack-ng -l aircrack.txt -w - -e ${ESSID} ${CAP}
  446.      
  447.     else
  448.       ${CRUNCH} "${Line}" | aircrack-ng -l aircrack.txt -w - -e ${ESSID} ${CAP}
  449.     fi
  450.    
  451.   else
  452.     # no cap file, just output to OUTFILE
  453.    
  454.     # if user didn't supply any arguments (we're in verbose mode)
  455.     if [[ $# -eq 0 ]]; then
  456.         echo -e "\E[32m[+] \E[39mGenerating phone numbers: \E[32m${Line}####\E[39m... (${CURRENT}/${COUNT})"
  457.    
  458.         if [[ HAS_CRUNCH -eq 1 ]]; then
  459.                 ${CRUNCH} $LEN $LEN 0123456789 -t ${Line}@@@@ >> "${OUTFILE}"
  460.        
  461.         else
  462.                 ${CRUNCH} "${Line}" >> "${OUTFILE}"
  463.         fi
  464.        
  465.     else
  466.         # user supplied arguments, ONLY OUTPUT VALID NUMBERS!
  467.         if [[ HAS_CRUNCH -eq 1 ]]; then
  468.                 ${CRUNCH} $LEN $LEN 0123456789 -t ${Line}@@@@
  469.        
  470.         else
  471.                 ${CRUNCH} "${Line}"
  472.         fi
  473.     fi
  474.    
  475.   fi
  476. done < /tmp/page2.txt
  477.  
  478. # at this point, we're done generating!
  479.  
  480. # delete temporary file containing area codes/prefixes
  481. rm /tmp/page2.txt
  482.  
  483. if [[ ! "$CAP" == "" ]]; then
  484. # if we were trying to passthrough
  485.   echo -n -e "\E[32m[!]\E[39m Finished! "
  486.  
  487.   if [[ -f "aircrack.txt" ]]; then
  488. # if we cracked it
  489.     echo -e "\E[32mPassword found: " + $(cat aircrack.txt)
  490.     echo -e "\E[32m[!] Saved to 'aircrack.txt'"
  491.   else
  492. # if we didn't crack it
  493.     echo -e "\E[31mPassword not found."
  494.   fi
  495.  
  496. else
  497. # if we were just generating phone numbers
  498.   if [[ $# -eq 0 ]]; then
  499.         echo ""
  500.         echo -e "\E[32m[!] Finished;\E[39m results are saved in \E[32m${OUTFILE}\E[39m"
  501.   fi
  502. fi
  503.  
  504. # if we used the crunch script, delete it
  505. if [[ $HAS_CRUNCH -eq 0 ]]; then
  506.   rm -rf f0ne-crunch.sh
  507. fi
  508.  
  509. # print out a single white line so the next lines the user types/sees will be white (normal)
  510. if [[ $# -eq 0 ]]; then
  511.         echo -e "\E[39m"
  512. fi
  513.  
  514. exit 0
clone this paste RAW Paste Data