rvscan v4-rel

Remote vulnerability scanner for UNIX (v4). (In our honest opinion #1)

eZine lover (@eZine)

Published in 

In our honest opinion

 · 9 months ago

README

 ---  -- 
  --- - 
 e ---  ploit vulnerability scanner [rvscan v4-rel] 
  - --- http://chickenz.net/og || elicit@comic.com 
 --  --- 
     rvscan version four release [rvscan-v4.tgz] 
         unix remote vulnerability scanner 
::::::::::::::::::::::::::::::::::::::::::::::::::::::

INFO:
hopefully this version will be a lot more reliable. several people tested this out for me, and i fixed all the bugs that they found so far. everything should run smoothly, but i don't recommend using the -v (verbose) flag, because its just not pretty. check the 'ChangeLog' file to see whats new in this version. enjoy.

WARNING:
i am in no way responsible for what you do with this tool. It should be considered very dangerous, and is merely for local security testing (NOT HACKING). if you *do* scan things outside of your network, then don't send me hate mail from your jail cell, because it will go straight to my trash can. of course, this is for educational purposes only; the definition of educational is up to you.

REQUIREMENTS:
a *nix system with telnet, rpcinfo, showmount, nmap, and host.

RESOURCES:
email: elicit@comic.com
web: http://chickenz.net/og
irc: elicit at #og on irc.ndrsnet.com

THANKS:
all of #og. shekk, robosok, orbflux, and ka0z for bug testing.

ChangeLog

v4-rel:

• made a whole lot of improvements to make things more efficient.
• added automatic nmap installation.
• no longer requires 'strobe'.
• added an attempt at telnet banner grabbing (works occasionally). =>
• added new checks for vulnerable BIND versions.
• added new checks for vulnerable IMAPD versions.
• rewrote some things in perl for more stability.
• added new checks for vulnerable HTTPD versions. (NCSA 1.3, IIS 4.0, IIS 5.0)
• added new checks for vulnerable FTPD versions. (wu-2.6.0, *bsd glob(), NcFTPD 2.4.2, QVT/Net v4.3).
• added quite a few new cgi checks (223 total now).
• fixed pop3 multiple authentication checking.
• added new checks for vulnerable QPOP and QVT/Net pop3 daemons.
• added new checks for Back Orifice and Netbus.
• added an smtp check for user probing.
• added a basic linux distribution guessing script
• added new checks for vulnerable LPD versions.
• added new checks for vulnerable NTPD versions.
• now attempts to gather finger information from host.

anonftp.pl

#!/usr/bin/perl 
# 
# anonftp.pl by ben-z (http://benz.slacknet.org) 
# written for use in the rvscan package only! 

$ARGC=@ARGV; 
use Socket; 
my($remote,$port,$iaddr,$paddr,$proto,$line); 
$remote=$ARGV[0]; 
$port = "21"; 
$iaddr = inet_aton($remote) or die "asdf"; 
$paddr = sockaddr_in($port, $iaddr) or die "asdf"; 
$proto = getprotobyname('tcp') or die "asdf"; 
socket(SOCK, PF_INET, SOCK_STREAM, $proto) or die "asdf"; 
connect(SOCK, $paddr) or die "asdf";; 
$msg = "USER Anonymous\n"; 
send(SOCK, $msg, 0) or die "asdf"; 
$msg = "PASS root\@cybercrime.gov\n"; 
send(SOCK, $msg, 0) or die "asdf"; 
$msg = "quit\n"; 
send(SOCK, $msg, 0) or die "asdf"; 
while (<SOCK>) { 
   print; 
} 
exit;

banner.pl

#!/usr/bin/perl 
# 
# simple banner logging deal 
#  elicit@execs.com 

use Socket; 
$remote=$ARGV[0]; 
$port=$ARGV[1]; 
$iaddr = inet_aton($remote) or die "0"; 
$paddr = sockaddr_in($port, $iaddr) or die "0"; 
$proto = getprotobyname('tcp') or die "0"; 
socket(sawk,PF_INET,SOCK_STREAM,$proto) or die "0"; 
connect(sawk,$paddr) or die "0"; 
sleep(7); 
recv(sawk,$msg,1024,0) or die "0"; 
shutdown(sawk,2); 
print "$msg\n"; 
exit;

banner.telnet

#!/bin/sh 
# 
# telnet banner grabbing script, elicit@comic.com 

if [ "$1" = "" ]; then 
 exit 0 
fi 

 
telnet $1 1>.telnet.tmp 2>.telnet.tmp

pop3chk.pl

#!/usr/bin/perl 
# 
# pop3chk.pl by ben-z (http://benz.slacknet.org) 
# written for use in the rvscan package only! 
# 
# updated 3/01, elicit@execs.com 

use Socket; 
$remote=$ARGV[0]; 
$port = "110"; 
$iaddr = inet_aton($remote) or die "0"; 
$paddr = sockaddr_in($port, $iaddr) or die "0"; 
$proto = getprotobyname('tcp') or die "0"; 
socket(SOCK, PF_INET, SOCK_STREAM, $proto) or die "0"; 
connect(SOCK, $paddr) or die "0"; 
sleep(2); 
$msg = "USER root\n"; 
send(SOCK, $msg, 0) or die "0"; 
sleep(1); 
$msg = "PASS JIGGA\n"; 
send(SOCK, $msg, 0) or die "0"; 
sleep (2); 
$msg = "USER root\n"; 
send(SOCK, $msg, 0) or die "0"; 
sleep(1); 
$msg = "PASS SLUTTIE\n"; 
send(SOCK, $msg, 0) or die "0"; 
sleep(2); 
$msg = "USER root\n"; 
send(SOCK, $msg, 0) or die "0"; 
sleep(1); 
$msg = "PASS WHORE\n"; 
send(SOCK, $msg, 0) or die "0"; 
sleep(2); 
$msg = "USER root\n"; 
send(SOCK, $msg, 0) or die "0"; 
sleep(1); 
$msg = "PASS h0h0h0\n"; 
send(SOCK,$msg,0) or die "0"; 
sleep(2); 
$quit = "quit\n"; 
send(SOCK, $quit, 0) or die "0"; 
print "it worked! 1";

smtpchk.pl

#!/usr/bin/perl 
# determines if an stmp server allows multiple user guessing 
#  elicit@execs.com - written for rvscan-v4a1 
#  #og @ irc.ndrsnet.com !@#$ 

use Socket; 
$ARGC=@ARGV; 
$target=$ARGV[0]; 
$rmail="root\@cybercrime.gov"; 
$port="25"; 
$iaddr=inet_aton($target) or die "0"; 
$paddr=sockaddr_in($port,$iaddr) or die "0"; 
$proto=getprotobyname('tcp') or die "0"; 
socket(sok,PF_INET,SOCK_STREAM,$proto) or die "0"; 
connect(sok,$paddr) or die "0"; 
sleep(5); 
$helo="HELO cybercrime.gov\n"; 
$muser="MAIL FROM: $rmail\n"; 
send(sok,$helo,0) or die "0"; 
sleep(2); 
send(sok,$muser,0) or die "0"; 
sleep(2); 
recv(sok,$msg,1024,0) or die "0"; 
$msg=''; 
$rpass="RCPT TO: nonexistantuser\n"; 
send(sok,$rpass,0) or die "0"; 
sleep(4); 
recv(sok,$msg,1024,0) or die "0"; 
if(index($msg,"ok") >= 0) { 
 exit; 
} 
print "it worked! 1";