渗透测试工具 | LaserCrack：一款可扩展的暴力破解框架

0×01 简单说明

lasercrack是一款爆力破解工具，现如今市面上常见的暴力工具如hydra，medusa都有着不错的破解效率，不过我还没有找到ruby写的，一方面是想从原理上理解下暴力破解漏洞，另一方面练习一下ruby语言。此工具配置成交互式终端界面，服务爆破脚本可自定义。

0×02 工具结构

主目录中lasercrack.rb控制整体流程，接受用户参数并作出响应。

utils目录中framework.rb是框架核心文件，控制与线程池相关，提供了三种方式的爆破，即单用户<=>单密码，单用户<=>多密码，单密码<=>多用户，目前暂不支持的多用户<=>多密码。其余文件是服务爆破相关文件，其中分为service.rb和serviceattack.rb。

0×03 源码说明

初始化函数定义了一些基本变量可以让用户自行设置，同时载入所有可用的服务爆破类。

 def initialize
      @module = "nil" @ip = "nil" @port = 0 @username = "nil" @password = "nil" @user_file = "nil" @pass_file = "nil" @verbose = false @threads = 10 @timeout = 10 @exploithash = { "ftp" => FtpAttack.new, "ssh" => SshAttack.new, "mysql" => MysqlAttack.new, "mssql" => MssqlAttack.new, "smb" => SmbAttack.new, "redis" => RedisAttack.new, "mongo" => MongoAttack.new, "telnet" => TelnetAttack.new, "oracle" => OracleAttack.new, "vnc" => VncAttack.new,
      }
    end

参数校验函数针对用户输入或未输入的信息进行判断可以使用哪种爆破模式，对还未达到利用条件的参数抛出未定义。

 def checkarg flag = true if @user_file == "nil" and @pass_file == "nil" puts "[*] Exploit by ip/ips..".light_blue
        tmphash = {"ip" => @ip, "port" => @port, "username" => @username, "password" => @password}
        tmphash.each {|key, value| if value == "nil" or value == 0 tmpstr = "[-] "+key+" => "+value.to_s+"    ".light_red
            puts tmpstr.light_red
            flag = false end } else return false end return flag end

爆力破解函数载入线程池并批量对服务进行穷举尝试。其中在verbose为false的情况下使用processbar模块动态显示进程条信息。

 def exploit_ips_template $semaphore = Mutex.new
      $COUNTER = 0 $OFFSET = 0 puts "[*] Starting crack the #{@module}..".light_blue
      puts "[*] target ip: "[email protected]_blue
      puts "[*] target port: "[email protected]_blue
      @exploithash.each { |key, value| if key == @module
          iplist = checkcidr_iprange if not iplist.nil?
            pool = ThreadPool.new(@threads)
            exploitips = value
            iplist.each { |item|
              pool.process { if exploitips.attack_once(item, @port.to_i, @username, @password, @timeout)
                    result = "[+] Crack it!"+" "*6+item+" "*6+@username+":"+@password
                    $OFFSET += 1 $semaphore.lock
                    puts result.light_green
                    $semaphore.unlock else if @verbose
                      $semaphore.lock
                      puts "["+getnow+"]".light_white+" "*6+"Not found! ==> "+item.light_red
                      $semaphore.unlock else $semaphore.lock
                      progressbar = ProgressBar.create(:format => 'Processing: |%b>>%i| %p%% %t', :starting_at => $COUNTER, :total => iplist.length-$OFFSET-1)
                      $semaphore.unlock
                      $COUNTER += 1 sleep 0.05 if progressbar.finished?
                        puts "finished".light_blue end end end }
            }
            gets end end } end

服务登录验证函数对用户提供的信息进行验证，返回true或false表明是否可登录成功。用ftp举例，其他服务脚本类似，不做赘述。

 def hit begin ftp = Net::FTP.new ftp.read_timeout = @timeout ftp.open_timeout = @timeout ftp.connect(@ip, @port) ftp.login(@user, @password) result = ftp.lastresp ftp.close if result == "200" return true else return false end rescue return false end end