How to Build an FTP Password Cracker 2018

BURST · 05-04-2018, 01:16 AM

Brute force attacks, what are they?

Brute force attacks are actually very simple, but very important. I would like to start this section by saying that brute force attacks shouldnotbe your first choice when executing a hack. These attacks take a lot of processing power and a lot of time, both of which can be hard to come by.

Lets discuss this by setting up a little scenario. Youve been tasked with gaining access to an FTP (FileTransferProtocol) server within the network of a company that has hired you. Youve tried all your other options, the service doesnt appear to have any exploitable vulnerabilities, and the employees arent falling for any social engineering attacks. Youve decided that its time to try a brute force attack and hope for the best.

"First, we need a word list.A word list is simply a long list of possible passwords. Once we have a word list, we can start the attack. In this attack, the tool is going to try and re-try to log into the FTP server until it either finds the correct password or runs out of possible passwords to try."

Simple, right? These attacks are very easy to understand and execute, but that doesnt discredit them. Sometimes, when all else fails, it will come down to brute force as a last resort. As I said before, brute force attacksshould notbe your go-to, they can take a very long time. But, now that weve got the explanation out of the way, lets move on to the code!

Content locked

This content has been locked. Please login or register in order to unlock it.

Building our own FTP brute forcer

Well be building our FTP brute forcer in the Ruby scripting language. Now, without further adieu, lets start coding.

To start our script, were going to require all the libraries that we need and take the users input:

We only need two libraries for this. We need thesocketlibrary to communicate with the FTP server, this is how well be trying our passwords. Thetimeoutlibrary is simply used to set a timeout for the first connection to the server. If the server is unreachable, we dont want to the user to wait five minutes for nothing.

After we get our libraries, we move on to taking input. We start by checking the length of the ARGV list. This list is generated when the script starts, and contains all the command line arguments that the user gives, in the order they are given. So with thisunlessstatement we basically say if the length of ARGV is anything but 3, print the usage line and exit the script. This is so the user knows what arguments go where. Finally, we go through and assign the arguments given by the user in the order you see above. Now that we have our input and libraries, we can move on to making our functions that will perform this attack.

Well start by making the function that will attempt a connection to the server to make sure it is reachable:

So we start by simply making a socket and giving it the server IP address. We then start a ten second timeout loop that attempts to establish a connection to the server. If the connection doesnt complete within the ten second limit, we tell the user that the connection check failed and shut down the script.

Now that we have this basic function, we can make the function to read the word list the user gives us:

This function is also simple. We take a file path as an argument to the function and print that were reading the word list. Then we open the file and read the contents. When we read the file, we also strip the extra newline character off the end and split the file contents at every remaining newline. This will result in a list of passwords that we need to try. After we store this list in a global variable, we close the file and move on. If we fail to read the word list, we tell the user and quit the script.

Now that we have these two functions to prepare for the attack, we can build the function that will actually attempt to log into the server:

This function is very important, as it is the one that will actually crack the password for us. We start by making a new TCP socket and connecting it to the FTP server. We then wait to receive the banner of the FTP server. Once we receive the banner, we send the user name and wait for the password prompt. We then send our password attempt to the server. This time, were going to receive the data from the server and store it in a variable. This data should contain the result of our login attempt.

Now that we have the result from our login attempt, we check it for the string ?230, as this is the FTP response code for a successful login. We return false unless the received data contains ?230 and if it passes this check, we return true. If an error is raised in this function, we just return false.

Now that we have all our functions, its time to use them:

To start our attack, we call our functions to check the target server and read the word list. Once these actions are completed, we tell the user that were starting the attack. We then enter a loop that calls our password cracking function for every password in the list. If the password is correct, we present the credentials to the user and shutdown the script. Thats it, our script is complete. Now its time to test it out.

Content locked

This content has been locked. Please login or register in order to unlock it.

Testing our brute forcer

First, well build our word list. Since this is just an example, our word list will be very short. In a real scenario these word lists will beextremelylong.

Lets take a look at our word list:

Alright, so we have a very basic word list. Now lets run our script with no arguments in order to see the usage line:

Now that we know what arguments we need to use, lets execute our script again and pass our arguments to it. Once we start the script, we should see the output of it checking the server and reading the word list.

Then, after some waiting, we should see the successful brute force of the FTP server password:

Content locked

This content has been locked. Please login or register in order to unlock it.

There we have it, we launched a successful brute force attack!

How to Build an FTP Password Cracker 2018

Submitted by BURST, 05-04-2018, 01:16 AM, Thread ID: 83117