From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 27 Nov 2005 13:00:03 +0200
Subject: [TOOL] TFTP Filename Bruteforcer
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20051127120513.C0E075791@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
TFTP Filename Bruteforcer
------------------------------------------------------------------------
SUMMARY
DETAILS
TFTP-bruteforcer is a fast multithreaded TFTP config filename bruteforcer
for Linux.
Tool source:
To download the tool:
<http://www.arhont.com/digitalAssets/214_TFTP-bruteforce.tar.gz>;
http://www.arhont.com/digitalAssets/214_TFTP-bruteforce.tar.gz
#!/usr/bin/perl
use IO::Socket;
use Net::hostent;
use Getopt::Std;
my $VERSION = "0.1";
my $brutefile = $ARGV[1];
if ($brutefile eq "") {
$brutefile="brutefile.txt";
}
my $max_processes = $ARGV[2];
if ($max_processes eq "") {
$max_processes = 150;
}
sub usage { # print a short 'usage` message and exit
print "usage: perl $0 <tftpserver> <filelist> <maxprocesses> \n";
print "example ./tftpbrute.pl 192.168.66.202 brutefile.txt 100 \n";
exit;
}
use vars qw($opt_h ); # command line options
print "$0, $PgmName, V $VERSION \n";
# handle the commandline options
getopts('h'); # look for -h and -c
$opt_h && usage; # -h print usage message and exit
(!$ARGV[0]) && usage; # no server: print usage message and exit
my $server = $ARGV[0];
if ($server =~ /[a-zA-Z]/) {
my $i = gethostbyname($server);
$server = inet_ntoa($i);
}
print "TFTP file word database: $brutefile \n";
print "TFTP server $server \n";
print "Max processes $max_processes \n";
$timeout = 2;
$port = 69;
$retries=2;
my @pids;
my $npids=0;
open( BRUTEFILE, "<$brutefile") || die " Cannot open the word file :
$bruteyfile ! \n";
chomp(@brutefile = <BRUTEFILE>);
close(BRUTEFILE);
foreach $file (@brutefile)
{
my $pid;
$pid=fork();
if($pid>0){
$npids++;
print " Processes are: $npids\n" ;
if($npids>=$max_processes){
for(1..($max_processes)){
my $wait_ret=wait();
if($wait_ret>0){
$npids--;
}
}
}
next;
}elsif(undef $pid){
print " Fork error!\n";
exit(0);
}else{
local $SIG{'ALRM'} = sub { exit(0); };
alarm 0;
eval {
tftp_brute($file);
};
exit(0);
}
}
for(1..$npids){
my $wt=wait();
if($wt==-1){
print " is $!\n";
redo;
}
}
sub tftp_brute {
my $file =shift;
my $MAXLEN=2;
my $op=01;
my $mode = "netascii";
my $count=$retries;
my $pkt = pack("n a* c a* c", $op, $file, 0, $mode, 0);
if ( $count != 0 && $treturn !="03") {
my $sock = IO::Socket::INET->new(Proto => 'udp');
send($sock,$pkt,0,pack_sockaddr_in($port,inet_aton($server)));
undef($treturn);
undef($rpkt);
eval {
local $SIG{ALRM} = \&timed_out;
alarm $timeout;
$sock->recv($rpkt, $MAXLEN);
close $sock;
alarm 0;
} ;
$count--;
@rets = split( //, $rpkt );
foreach $currentret (@rets) { $treturn .= ord($currentret); }
if ($treturn =="03")
{
print "*** Found TFTP server remote filename : $file \n";
return 1;
}
}
$count=$retries;
}
ADDITIONAL INFORMATION
The information has been provided by arhont.com.
To keep updated with the tool visit the project's homepage at:
<http://www.arhont.com/ViewPage7422.html>;
http://www.arhont.com/ViewPage7422.html
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
