A host discovery and password bruteforce-over-SSH tool, by gigadeleo.
Follow @gigadeleo on Twitter.
To run this tool you need to do the following:
- Copy 'keyboard_walk.sh' file to a Linux host of your choice.
- Give 'keyboard_walk.sh' execute rights.
- Copy 'subnets' in the same directory; 'subnets' is a list of CIDR Subnet Mask notation IPs (such as: 10.0.0.0/24) for host discovery.
- Copy 'unames' in the same directory; 'unames' is a list of possible usernames to try.
- Copy 'pwords' in the same directory; 'pwords' is a list of possible passwords to try.
The script expects four (4) arguments:
- [FILE] subnet file
- [FILE] username file
- [FILE] password file
- [FLAG] Force Rescan Flag (0 to force host-discovery (longer); 1 to use previously identified hosts (quicker but less accurate)).
Usage Example:
./keyboard_walk.sh subnets unames pwords 0
The script requires 2 tools:
- nmap - for host discovery
- medusa - for password bruteforcing
The script will perform the following:
- Check whether all necessary files are available.
- Extract the subnets file and attempt to find live hosts by using a very fast nmap scan on the SSH Port (tcp/22), all extracted files are persistently stored to a 'livehost_list' file (for future use).
- Attempt a brutefore attack of username/password combinations on all live hosts.
- Report results in the log subdirectory