rvscan v4-rel
Remote vulnerability scanner for UNIX (v4). (In our honest opinion #1)
README
--- --
--- -
e --- ploit vulnerability scanner [rvscan v4-rel]
- --- http://chickenz.net/og || elicit@comic.com
-- ---
rvscan version four release [rvscan-v4.tgz]
unix remote vulnerability scanner
::::::::::::::::::::::::::::::::::::::::::::::::::::::
INFO:
hopefully this version will be a lot more reliable. several people tested this out for me, and i fixed all the bugs that they found so far. everything should run smoothly, but i don't recommend using the -v (verbose) flag, because its just not pretty. check the 'ChangeLog' file to see whats new in this version. enjoy.
WARNING:
i am in no way responsible for what you do with this tool. It should be considered very dangerous, and is merely for local security testing (NOT HACKING). if you *do* scan things outside of your network, then don't send me hate mail from your jail cell, because it will go straight to my trash can. of course, this is for educational purposes only; the definition of educational is up to you.
REQUIREMENTS:
a *nix system with telnet, rpcinfo, showmount, nmap, and host.
RESOURCES:
email: elicit@comic.com
web: http://chickenz.net/og
irc: elicit at #og on irc.ndrsnet.com
THANKS:
all of #og. shekk, robosok, orbflux, and ka0z for bug testing.
ChangeLog
v4-rel:
- made a whole lot of improvements to make things more efficient.
- added automatic nmap installation.
- no longer requires 'strobe'.
- added an attempt at telnet banner grabbing (works occasionally). =>
- added new checks for vulnerable BIND versions.
- added new checks for vulnerable IMAPD versions.
- rewrote some things in perl for more stability.
- added new checks for vulnerable HTTPD versions. (NCSA 1.3, IIS 4.0, IIS 5.0)
- added new checks for vulnerable FTPD versions. (wu-2.6.0, *bsd glob(), NcFTPD 2.4.2, QVT/Net v4.3).
- added quite a few new cgi checks (223 total now).
- fixed pop3 multiple authentication checking.
- added new checks for vulnerable QPOP and QVT/Net pop3 daemons.
- added new checks for Back Orifice and Netbus.
- added an smtp check for user probing.
- added a basic linux distribution guessing script
- added new checks for vulnerable LPD versions.
- added new checks for vulnerable NTPD versions.
- now attempts to gather finger information from host.
anonftp.pl
#!/usr/bin/perl
#
# anonftp.pl by ben-z (http://benz.slacknet.org)
# written for use in the rvscan package only!
$ARGC=@ARGV;
use Socket;
my($remote,$port,$iaddr,$paddr,$proto,$line);
$remote=$ARGV[0];
$port = "21";
$iaddr = inet_aton($remote) or die "asdf";
$paddr = sockaddr_in($port, $iaddr) or die "asdf";
$proto = getprotobyname('tcp') or die "asdf";
socket(SOCK, PF_INET, SOCK_STREAM, $proto) or die "asdf";
connect(SOCK, $paddr) or die "asdf";;
$msg = "USER Anonymous\n";
send(SOCK, $msg, 0) or die "asdf";
$msg = "PASS root\@cybercrime.gov\n";
send(SOCK, $msg, 0) or die "asdf";
$msg = "quit\n";
send(SOCK, $msg, 0) or die "asdf";
while (<SOCK>) {
print;
}
exit;
banner.pl
#!/usr/bin/perl
#
# simple banner logging deal
# elicit@execs.com
use Socket;
$remote=$ARGV[0];
$port=$ARGV[1];
$iaddr = inet_aton($remote) or die "0";
$paddr = sockaddr_in($port, $iaddr) or die "0";
$proto = getprotobyname('tcp') or die "0";
socket(sawk,PF_INET,SOCK_STREAM,$proto) or die "0";
connect(sawk,$paddr) or die "0";
sleep(7);
recv(sawk,$msg,1024,0) or die "0";
shutdown(sawk,2);
print "$msg\n";
exit;
banner.telnet
#!/bin/sh
#
# telnet banner grabbing script, elicit@comic.com
if [ "$1" = "" ]; then
exit 0
fi
telnet $1 1>.telnet.tmp 2>.telnet.tmp
pop3chk.pl
#!/usr/bin/perl
#
# pop3chk.pl by ben-z (http://benz.slacknet.org)
# written for use in the rvscan package only!
#
# updated 3/01, elicit@execs.com
use Socket;
$remote=$ARGV[0];
$port = "110";
$iaddr = inet_aton($remote) or die "0";
$paddr = sockaddr_in($port, $iaddr) or die "0";
$proto = getprotobyname('tcp') or die "0";
socket(SOCK, PF_INET, SOCK_STREAM, $proto) or die "0";
connect(SOCK, $paddr) or die "0";
sleep(2);
$msg = "USER root\n";
send(SOCK, $msg, 0) or die "0";
sleep(1);
$msg = "PASS JIGGA\n";
send(SOCK, $msg, 0) or die "0";
sleep (2);
$msg = "USER root\n";
send(SOCK, $msg, 0) or die "0";
sleep(1);
$msg = "PASS SLUTTIE\n";
send(SOCK, $msg, 0) or die "0";
sleep(2);
$msg = "USER root\n";
send(SOCK, $msg, 0) or die "0";
sleep(1);
$msg = "PASS WHORE\n";
send(SOCK, $msg, 0) or die "0";
sleep(2);
$msg = "USER root\n";
send(SOCK, $msg, 0) or die "0";
sleep(1);
$msg = "PASS h0h0h0\n";
send(SOCK,$msg,0) or die "0";
sleep(2);
$quit = "quit\n";
send(SOCK, $quit, 0) or die "0";
print "it worked! 1";
smtpchk.pl
#!/usr/bin/perl
# determines if an stmp server allows multiple user guessing
# elicit@execs.com - written for rvscan-v4a1
# #og @ irc.ndrsnet.com !@#$
use Socket;
$ARGC=@ARGV;
$target=$ARGV[0];
$rmail="root\@cybercrime.gov";
$port="25";
$iaddr=inet_aton($target) or die "0";
$paddr=sockaddr_in($port,$iaddr) or die "0";
$proto=getprotobyname('tcp') or die "0";
socket(sok,PF_INET,SOCK_STREAM,$proto) or die "0";
connect(sok,$paddr) or die "0";
sleep(5);
$helo="HELO cybercrime.gov\n";
$muser="MAIL FROM: $rmail\n";
send(sok,$helo,0) or die "0";
sleep(2);
send(sok,$muser,0) or die "0";
sleep(2);
recv(sok,$msg,1024,0) or die "0";
$msg='';
$rpass="RCPT TO: nonexistantuser\n";
send(sok,$rpass,0) or die "0";
sleep(4);
recv(sok,$msg,1024,0) or die "0";
if(index($msg,"ok") >= 0) {
exit;
}
print "it worked! 1";