Commit 65104002 authored by Devon Kearns's avatar Devon Kearns

Imported Upstream version 0.4a

parents
all: enumiax
include base.mk
install: all
strip enumiax
ienumiaxtall -m 755 enumiax ${BINDIR}
@echo
@echo "enumiax installed!"
@echo
uninstall:
rm -f ${BINDIR}/enumiax
@echo
@echo "enumiax uninstalled!"
@echo
OBJS = charmap.o exit.o inet_hton.o main.o outputs.o worditer.o socket.o usage.o
INCLUDES = enumiax.h charmap.h config.h
# enumiax
enumiax: ${OBJS}
@echo
@echo "Compiling enumiax..."
${CC} ${CFLAGS} ${LINCLUDES} ${LIBS} -o $@ ${OBJS}
${OBJS}: ${INCLUDES}
enumIAX
Dustin D. Trammell <dtrammell (at) tippingpoint.com>
==============================================================================
enumIAX is an Inter Asterisk Exchange protocol username brute-force
enumerator.
Modes of Operation
==================
enumIAX may operate in two distinct modes; Sequential Username Guessing or
Dictionary Attack.
Sequential Username Guessing
------------------------------
In Sequential Username Guessing mode, the tool will auto-construct
usernames sequentially from a range of characters defined in the charmap.h
file. By default, the character map should be the following characters:
"0123456789abcdefghijklmnopqrstuvwxyz "
This character map should be able to guess any alpha-numerically constructed
username with or without space characters. For a more exhaustive search,
expand the character map to include other character sets already defined in
charmap.h, or create your own entirely new and customized character map!
Remember however that the more characters you include in your character map,
the longer the session will take as you will be increasing the potential
passphrase "keyspace" exponentially.
NOTE: VoIP usernames, like email addresses, are usually case-insensitive.
Dictionary Attack
-----------------
enumIAX may also use usernames from a dictionary file rather than construct
usernames itself. "Dict" files are generally just a long list of words or
phrases, one word per line. If you already have a favorite Dict file, you
can use it here.
Building and Installing
=======================
enumIAX should build without issue on most unix-like platforms.
Once enumIAX is built, execute the following commands from the enumIAX
source directory to install the binaries to your system:
make
make install
enumIAX will be installed /usr/local/bin for your use, however you will most
likely want to create and run enumIAX from a working directory where it can
save session state and result information.
Executing a enumIAX Session
===========================
Executing enumIAX
-----------------
enumIAX has many command-line options to tweak it's behavior, however normal
execution can be accomplished with a command-line similar to the following:
enumiax <target>
In the above example, <target> is the target hostname or IP address that you
want to enumerate.
Other command-line options you may include can be found with the "-h" command-
line option:
enumiax -h
Usage: enumiax [options] target
options:
-d <dict> Dictionary attack using <dict> file
-i <count> Interval for auto-save (# of operations, default 1000)
-m # Minimum username length (in characters)
-M # Maximum username length (in characters)
-r # Rate-limit calls (in microseconds)
-s <file> Read session state from state file
-v Increase verbosity (repeat for additional verbosity)
-V Print version information and exit
-h Print help/usage information and exit
By default, enumIAX only prints it's title and version information, and any
successfully found usernames. These results are also appended to a results
file of the format <target>.results in the current working directory. To
make enumIAX more verbose at runtime, use the "-v" command-line option,
which is repeatable for more verbosity.
Resuming a Previous Session
---------------------------
If your session was stopped prematurely, you can resume the session from it's
state file. State files are saved at regular intervals as well as enumIAX
receiving most signals which would cause it to terminate. You can resume a
previous session with commands similar to the following:
enumiax -s <target>.state <target>
enumiax -d <dictfile> -s <target>.state <target>
Rate-Limiting
-------------
By using the -r command-line option, you can rate-limit enumIAX to prevent
flooding of the server. The default is 500000 microseconds, or a half
of a second.
If the server begins to send Lag Requests (LAGRQ packets), enumIAX will
automatically increase it's rate-limit value by 100000 microseconds to
compensate. Conversely, inumIAX is always trying to speed up by decreasing
it's rate-limit value by 1000 microseconds per transaction.
License
=======
enumIAX is released under the GNU General Public License v.2, the text of
which can be found at the following URL:
http://www.gnu.org/copyleft/gpl.html
# Compiler Options
#CC = gcc
CFLAGS = -O2 -Wall ${DEBUG}
DEBUG = -g
# Installation Options
BINDIR = /usr/local/bin
clean:
rm -f core *.o *~ enumiax
for i in `ls -l | grep "^d" | awk '{ print $$8 }'`; do \
cd $$i; \
if [ -e Makefile ]; then \
make clean; \
fi; \
cd ../; \
done
recurse:
for i in `ls -l | grep "^d" | awk '{ print $$8 }'`; do \
cd $$i; \
if [ -e Makefile ]; then \
make; \
fi; \
cd ../; \
done
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include "enumiax.h"
#include "charmap.h"
int charmap_c_to_d( char ch ) {
int d;
for( d = 0; charmap[d] != '\0'; d++ )
if( charmap[d] == ch ) break;
return d;
}
static char charmap[] = \
/* Numbers */
"0123456789" \
/* Lowercase Alpha */
"abcdefghijklmnopqrstuvwxyz" \
/* Uppercase Alpha */
/* "ABCDEFGHIJKLMNOPQRSTUVWXYZ" \ */
/* Special Character Set 1 */
/* "!@#$%^&*()-_+=~`" \ */
/* Special Character Set 2 */
/* "[]{}|\\:;"'<>,.?/" \ */
/* Space */
" " \
/* Tab */
/* "\t" \ */
/* NULL Terminator - DO NOT REMOVE!!! */
"\0" \
;
/* Auto-Generated Passphrase Options */
/* Minimum & maximum default passphrase length in characters */
#define MIN_USER_LEN 1
#define MAX_USER_LEN 8
#define MIN_PASS_LEN 1
#define MAX_PASS_LEN 6
guest
iaxtel
iaxtel2
markster
demo
dynamichost
biggateway
marko
test
#include </usr/include/stdint.h>
#include "config.h"
#define VERSION "0.4a"
/* charmap.c */
int charmap_c_to_d( char ch );
/* exit.c */
void state_exit( int signum );
int save_state( int signum );
/* inet_hton.c */
uint32_t inet_hton( char *host );
/* outputs.c */
void printbin( int buf, int bits );
void printhex( unsigned char *buf, int size );
/* worditer.c */
int nextword();
int nextdict();
/* socket.c */
int socket_build( char *target, int protocol, int port );
/* usage.c */
void version();
void usage( char *prog );
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include "enumiax.h"
#include "charmap.h"
void state_exit( int signum ) {
extern int verbosity;
/* For platforms that reset to SIG_DFL upon signal trap */
signal( signum, state_exit );
/* Save the state */
fprintf( stderr, "Caught signal %d, saving state...\n", signum );
verbosity++;
save_state( signum );
exit(0);
}
int save_state( int signum ) {
FILE *f1;
int x = 0;
char filename[64];
extern int verbosity;
extern char username[256];
extern char *target;
extern char *dict;
extern time_t start, statetime;
time_t now;
now = time(NULL);
if( signum && ! dict ) {
/* If called from a sigtrap, and not dictionary mode, step username back one just in case the current one has not been tested yet */
x = strlen(username) -1;
username[x] = charmap[charmap_c_to_d(username[x]) - 1];
}
/* Create filename and open file */
snprintf( filename, sizeof(filename), "%s.state", target );
if( !(f1 = fopen( filename, "w" )) ) {
fprintf( stderr, "Error opening file %s to save state, manually save the following state line:\n", filename );
fprintf( stderr, "%s:%ld:%s\n", target, ((long)(now - start)) + statetime, username );
exit(0);
}
/* Write to file and close */
fprintf( f1, "%s:%ld:%s\n", target, ((long)(now - start)) + statetime, username );
fclose(f1);
if(verbosity) printf( "State (%s) saved in %s at: %s", username, filename, ctime(&now) );
return(0);
}
/*
* inet_hton.c
* I)ruid <druid@caughq.org>
*
* Function to convert hostname (or IP address) into network byte
* order.
*
*/
#include <stdio.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
uint32_t inet_hton( char *host ) {
struct in_addr addr;
struct hostent *h;
if( (inet_aton( host, &addr )) == 0 ) {
if( ! (h = gethostbyname( host )) ) {
perror(host);
return 0;
}
memcpy( &addr, h->h_addr_list[0], sizeof(addr) );
}
return addr.s_addr;
}
This diff is collapsed.
#include <stdio.h>
void printbin( int buf, int bits ) {
for( ; bits>0 ; bits-- ) {
if( buf & 1 )
printf( "1" );
else
printf( "0" );
buf>>=1;
}
}
void printhex( unsigned char *buf, int size ) {
int x;
for( x=0; x<size; x++ ) {
if( x % 8 == 0 ) printf( " " );
if( x % 16 == 0 ) printf( "\n%04x ", x );
printf( "%02x ", buf[x] );
}
printf( "\n\n" );
}
#include <arpa/inet.h>
#include <errno.h>
#include <netdb.h>
#include <netinet/in.h>
#include <stdio.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <unistd.h>
#include "enumiax.h"
int socket_build( char *target, int protocol, int port ) {
extern int verbosity;
struct protoent *proto;
int sock;
int type;
/* Resolve target */
struct in_addr address;
address.s_addr = inet_hton(target);
/* Create socket based on selected transport */
proto = getprotobynumber(protocol);
if(verbosity) printf( "Connecting to %s via %s on port %d...\n", inet_ntoa(address), proto->p_name, port );
type = SOCK_STREAM;
if( protocol == 6 ) type = SOCK_STREAM;
if( protocol == 17 ) type = SOCK_DGRAM;
if( (sock = socket( PF_INET, type, protocol )) == -1 ) {
fprintf( stderr, "socket: %s\n", strerror(errno) );
return -1;
}
/* Connect the socket */
struct sockaddr_in addr;
addr.sin_family = PF_INET;
addr.sin_addr.s_addr = address.s_addr;
addr.sin_port = htons(port);
if( (connect( sock, (struct sockaddr *)&addr, sizeof(addr) )) == -1 ) {
fprintf( stderr, "connect: %s\n", strerror(errno) );
return -1;
}
if(verbosity>=2) fprintf( stderr, "Connected to: %s\n", inet_ntoa(address));
return sock;
}
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include "enumiax.h"
void version() {
fprintf( stderr, "enumIAX %s\n", VERSION );
fprintf( stderr, "Dustin D. Trammell <dtrammell@tippingpoint.com>\n\n" );
}
void usage( char *prog ) {
version();
fprintf( stderr, "Usage: %s [options] target\n", prog );
fprintf( stderr, " options:\n" );
fprintf( stderr, " -d <dict> Dictionary attack using <dict> file\n" );
fprintf( stderr, " -i <count> Interval for auto-save (# of operations, default 1000)\n" );
fprintf( stderr, " -m # Minimum username length (in characters)\n" );
fprintf( stderr, " -M # Maximum username length (in characters)\n" );
fprintf( stderr, " -r # Rate-limit calls (in microseconds)\n" );
fprintf( stderr, " -s <file> Read session state from state file\n" );
fprintf( stderr, " -v Increase verbosity (repeat for additional verbosity)\n" );
fprintf( stderr, " -V Print version information and exit\n" );
fprintf( stderr, " -h Print help/usage information and exit\n" );
exit(-1);
}
/*
* passcb.c - GPGuess Passphrase Callback Functions
*
* These functions provide usernames for the GPGME crypto
* operations.
*
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include "enumiax.h"
#include "charmap.h"
int nextword() {
int x = 0, y = 0;
extern int lower, upper;
extern int verbosity;
extern int min_user_len, max_user_len;
extern char username[256];
/* If username doesn't exist, build start username */
if( ! username[0] ) {
/* enforce minimum username length requirement */
for( x = 0; x < min_user_len; x++ ) username[x] = charmap[lower];
if(verbosity) printf( "Now working on %d character usernames...\n", min_user_len );
goto ret;
}
/* Determine username's current length and set current char index at last char */
y = x = strlen(username) - 1;
for( ; x >= 0; x-- ) {
if( username[x] != charmap[upper] ) { /* Has current char hit upper bound? */
/* If not, iterate current char to next char in charmap and break */
username[x] = charmap[charmap_c_to_d(username[x]) + 1];
break;
} else {
/* If so, reset current char to lower bound */
username[x] = charmap[lower];
/* Check to see if we're resetting the first char in username */
if( x == 0 ) {
/* If so, check to see if adding another char would exceed max_user_length */
if( y+1 == max_user_len ) {
printf( "Username combinations exausted, exiting...\n" );
exit(-1);
}
/* Add another char to the username length */
y++;
username[y] = charmap[lower];
if(verbosity) printf( "Now working on %d character usernames...\n", y+1 );
}
}
}
ret:
if(verbosity) printf( "\n#################################\n" );
if(verbosity>=1) printf( "Trying username: \"%s\"\n", username );
return 0;
}
int nextdict() {
extern int verbosity;
extern FILE *file;
extern char username[256];
if( !(fgets( username, sizeof(username), file )) ) {
if(verbosity) printf( "End of dictionary file reached, exiting.\n" );
exit(0);
}
username[strlen(username)-1] = '\0';
if(verbosity) printf( "\n#################################\n" );
if(verbosity>=1) printf( "Trying username: \"%s\"\n", username );
return 0;
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment