「ncrack」の版間の差分

2014年5月20日 (火) 23:27時点における版

ncrackは、オンラインパスワードクラッキングツールです。ssh, telnet, http(s)のBasic認証、SMB, RDP, VNCなどをクラックできます。ユーザ名の辞書やパスワードの辞書が同梱されています。

読み方

ncrack

えぬくらっく

概要

ncrack は、ハイスピード認証クラッキングツールです。

RDP, ssh, http/https, SMB, pop3/pops, VNC, ftp, telnet などのプロトコルをサポートしています。

インストール

FreeBSDにインストールする場合

ports コレクションからインストールする場合

cd /usr/ports/security/ncrack
sudo make install clean

pkgコマンドでインストールする場合

sudo pkg install ncrack

portmasterコマンドでインストールする場合

sudo portmaster -y -d /usr/ports/security/ncrack

portinstallコマンドでインストールする場合

sudo portinstall /usr/ports/security/ncrack

使い方

コマンドラインオプション

% ncrack -h
Ncrack 0.4ALPHA ( http://ncrack.org )
Usage: ncrack [Options] {target and service specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iX <inputfilename>: Input from Nmap's -oX XML output format
  -iN <inputfilename>: Input from Nmap's -oN Normal output format
  -iL <inputfilename>: Input from list of hosts/networks
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
SERVICE SPECIFICATION:
  Can pass target specific services in <service>://target (standard) notation or
  using -p which will be applied to all hosts in non-standard notation.
  Service arguments can be specified to be host-specific, type of service-specific
  (-m) or global (-g). Ex: ssh://10.0.0.10,at=10,cl=30 -m ssh:at=50 -g cd=3000
  Ex2: ncrack -p ssh,ftp:3500,25 10.0.0.10 scanme.nmap.org google.com:80,ssl
  -p <service-list>: services will be applied to all non-standard notation hosts
  -m <service>:<options>: options will be applied to all services of this type
  -g <options>: options will be applied to every service globally
  Misc options:
    ssl: enable SSL over this service
    path <name>: used in modules like HTTP ('=' needs escaping if used)
TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, unless you append 'ms'
  (miliseconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  Service-specific options:
    cl (min connection limit): minimum number of concurrent parallel connections
    CL (max connection limit): maximum number of concurrent parallel connections
    at (authentication tries): authentication attempts per connection
    cd (connection delay): delay <time> between each connection initiation
    cr (connection retries): caps number of service connection attempts
    to (time-out): maximum cracking <time> for service, regardless of success so far
  -T<0-5>: Set timing template (higher is faster)
  --connection-limit <number>: threshold for total concurrent connections
AUTHENTICATION:
  -U <filename>: username file
  -P <filename>: password file
  --user <username_list>: comma-separated username list
  --pass <password_list>: comma-separated password list
  --passwords-first: Iterate password list for each username. Default is opposite.
OUTPUT:
  -oN/-oX <file>: Output scan in normal and XML format, respectively, to the given filename.
  -oA <basename>: Output in the two major formats at once
  -v: Increase verbosity level (use twice or more for greater effect)
  -d[level]: Set or increase debugging level (Up to 10 is meaningful)
  --nsock-trace <level>: Set nsock trace level (Valid range: 0 - 10)
  --log-errors: Log errors/warnings to the normal-format output file
  --append-output: Append to rather than clobber specified output files
MISC:
  --resume <file>: Continue previously saved session
  -f: quit cracking service after one found credential
  -6: Enable IPv6 cracking
  -sL or --list: only list hosts and services
  --datadir <dirname>: Specify custom Ncrack data file location
  -V: Print version number
  -h: Print this help summary page.
MODULES:
  FTP, SSH, TELNET, HTTP(S), POP3(S), SMB, RDP, VNC
EXAMPLES:
  ncrack -v --user root localhost:22
  ncrack -v -T5 https://192.168.0.1
  ncrack -v -iX ~/nmap.xml -g CL=5,to=1h
SEE THE MAN PAGE (http://nmap.org/ncrack/man.html) FOR MORE OPTIONS AND EXAMPLES

sshのクラッキングの例

rootユーザーに対して、sshのクラッキングの実行例です。

% ncrack -v --user root localhost:22
 
Starting Ncrack 0.4ALPHA ( http://ncrack.org ) at 2013-01-09 06:57 JST
 
ssh://127.0.0.1:22 finished.
 
 
Ncrack done: 1 service scanned in 38499.81 seconds.
Probes sent: 999 | timed-out: 0 | prematurely-closed: 157
 
Ncrack finished.

複数のターゲットを指定する例です。

% ncrack -v --user root 192.168.0.2:22 192.168.0.3:21

HTTPのBasic認証のクラッキング

$ ncrack -v --user test \
-P /usr/local/share/ncrack/top50000.pwd http://127.0.0.1 -g path=/basic
 
Starting Ncrack 0.4ALPHA ( http://ncrack.org ) at 2014-05-20 23:22 JST
 
Discovered credentials on http://127.0.0.1:80 'test' 'admin'
http://127.0.0.1:80 finished.
 
Discovered credentials for http on 127.0.0.1 80/tcp:
127.0.0.1 80/tcp http: 'test' 'admin'
 
Ncrack done: 1 service scanned in 30.08 seconds.
Probes sent: 535 | timed-out: 0 | prematurely-closed: 0
 
Ncrack finished.

関連項目

• hydra
• John the Ripper
• セキュリティ診断ツール
• http://nmap.org/ncrack/ オフィシャルサイト