[TOOL] TFTP Filename Bruteforcer

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  TFTP Filename Bruteforcer
------------------------------------------------------------------------


SUMMARY



DETAILS

TFTP-bruteforcer is a fast multithreaded TFTP config filename bruteforcer 
for Linux.

Tool source:
To download the tool:  
<http://www.arhont.com/digitalAssets/214_TFTP-bruteforce.tar.gz> 
http://www.arhont.com/digitalAssets/214_TFTP-bruteforce.tar.gz

#!/usr/bin/perl
use IO::Socket;
use Net::hostent;
use Getopt::Std;


my $VERSION = "0.1";

my $brutefile = $ARGV[1];
if ($brutefile eq "") {
$brutefile="brutefile.txt";
}

my $max_processes = $ARGV[2];
if ($max_processes eq "") {
$max_processes = 150;
}


sub usage { # print a short 'usage` message and exit
  print "usage: perl $0 <tftpserver> <filelist> <maxprocesses> \n";
  print "example ./tftpbrute.pl 192.168.66.202 brutefile.txt 100 \n";
  exit;
}

use vars qw($opt_h ); # command line options


print "$0, $PgmName, V $VERSION \n";
  # handle the commandline options
  getopts('h');  # look for -h and -c
  $opt_h && usage;  # -h print usage message and exit
  
  (!$ARGV[0]) && usage; # no server: print usage message and exit

  my $server = $ARGV[0];
  
 if ($server =~ /[a-zA-Z]/) {
  my $i = gethostbyname($server);
  $server = inet_ntoa($i);
}
 
  
  print "TFTP file word database: $brutefile \n";
  print "TFTP server $server \n";
  print "Max processes $max_processes \n";
 
$timeout = 2;
$port = 69;
$retries=2;
 

my @pids;
my $npids=0;
 open( BRUTEFILE, "<$brutefile") || die " Cannot open the word file : 
$bruteyfile ! \n";
        chomp(@brutefile = <BRUTEFILE>);
close(BRUTEFILE);

 foreach $file (@brutefile)
 {
 my $pid;
 $pid=fork();
 if($pid>0){
  $npids++;
  print " Processes are: $npids\n" ;
  if($npids>=$max_processes){
   for(1..($max_processes)){
    my $wait_ret=wait();
    if($wait_ret>0){
     $npids--;
    }
   }
  }
  next;
 }elsif(undef $pid){
  print " Fork error!\n";
  exit(0);
 }else{
  local $SIG{'ALRM'} = sub { exit(0); };
  alarm 0;

 eval {
 
  tftp_brute($file);
 };


  exit(0);
 }
}

for(1..$npids){
 my $wt=wait();
 if($wt==-1){
  print " is $!\n";
  redo;
 }
}


 

 


 
sub tftp_brute {
 
 my $file =shift;
 my $MAXLEN=2;
 my $op=01;
 my $mode = "netascii";

 
 
  my $count=$retries;
  my $pkt = pack("n a* c a* c", $op, $file, 0, $mode, 0);
       if ( $count != 0 && $treturn !="03") {
             my $sock = IO::Socket::INET->new(Proto => 'udp');
             
send($sock,$pkt,0,pack_sockaddr_in($port,inet_aton($server)));
             undef($treturn);
       undef($rpkt);
        eval {
    local $SIG{ALRM} = \&timed_out;
    alarm $timeout;
    $sock->recv($rpkt, $MAXLEN);
    close $sock;
    alarm 0;
    
} ;
    $count--;
@rets = split( //, $rpkt );
foreach $currentret (@rets) { $treturn .= ord($currentret); }
         
                 if ($treturn =="03")
                 {
                     
                                                          
       print "*** Found TFTP server remote filename : $file \n";

                 return 1;
                 }
                
       }
     $count=$retries;
 
 
}


ADDITIONAL INFORMATION

The information has been provided by arhont.com.
To keep updated with the tool visit the project's homepage at:  
<http://www.arhont.com/ViewPage7422.html> 
http://www.arhont.com/ViewPage7422.html



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.