Re: [NSE] new scripts and libraries: brute library

[Ron <ron () skullsecurity net>]

On Wed, 11 Aug 2010 20:20:11 -0600 David Fifield
<david () bamsoftware com> wrote:
> On Wed, Aug 11, 2010 at 08:16:46PM -0600, David Fifield wrote:
> > > description = ""
> > > categories = {}
> > >
> > > require("brute")
> > > require("stdnse")
> > >
> > > function portrule(host, port)
> > >   return port.number == 4000
> > > end
> > >
> > > local brute_driver = {
> > >   new = function(self, host, port)
> > >     local o = {}
> > >     setmetatable(o, self)
> > >     self.__index = self
> > >     o.host = host
> > >     o.port = port
> > >     return o
> > >   end,
> > >   connect = function(self)
> > >     self.socket = nmap.new_socket()
> > >     return self.socket:connect(self.host.ip, self.port.number,
> > > "tcp") end,
> > >   disconnect = function(self)
> > >     return self.socket:close()
> > >   end,
> > >   check = function(self)
> > >     return true
> > >   end,
> > >   login = function(self, username, password)
> > >     local status, err, reply
> > >     status, err = self.socket:send(username .. ":" .. password ..
> > > "\n") if not status then
> > >       -- What?
> > >     end
> > >     status, reply = self.socket:receive_bytes(1)
> > >     if not status then
> > >       -- What?
> > >     end
> > >     if reply == "YES\n" then
> > >       return true, brute.Account:new(username, password, "OPEN")
> > >     else
> > >       return false, brute.Error:new("login failed")
> > >     end
> > >   end
> > > }
> > >
> > > function action(host, port)
> > >   local status, accounts
> > >   status, accounts = brute.Engine:new(brute_driver, host,
> > > port):start() if not status then
> > >     return accounts
> > >   else
> > >     return stdnse.format_output(true, accounts)
> > >   end
> > > end
>
> This is a question for Ithilgore and Ron, mainly. How does this model
> (connect/disconnect/check/login) compare to what you created for
> Ncrack and smb-brute?
>
> I know that Ncrack in particular is designed to support several
> different protocols within a uniform framework.
>
> David Fifield
I haven't looked at Patrik's code yet, but I suspect it'll be a lot better than what I did for smb-brute.nse. In terms 
of actual bruteforce, smb-brute.nse is rather naive. But it's extremely domain-specific in terms of how it does checks 
(case sensitivity, enumerating users, maintaining open connections, etc). 

I'd like to have a look and see if smb-brute.nse can be made to work with Patrik's code. Having a framework would be 
great!

-- 
Ron Bowes
http://www.skullsecurity.org
http://www.twitter.com/iagox86

Attachment: _bin
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/