brute force via ssh

fil0r.pl

#!/usr/bin/perl -w

use strict;

use Net::SSH2;

my $alpha = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";

sub brute {
    my $cmd = shift;
    my $CharSet = shift;

    my @RawString = ();

    my $cnt = 0;

    for (my $i = 0; $i < $CharSet; $i++) { $RawString[$i] = 0; }

    do {
        for (my $i = 0; $i < $CharSet; $i++) {
            if ($RawString[$i] > length($alpha) - 1) {
                if ($i == $CharSet-1) { return 0; }
                $RawString[$i+1]++;
                $RawString[$i] = 0;
            }
        }

        my $ret = "";

        for (my $i = 0; $i < $CharSet; $i++) {
            $ret = $ret . substr($alpha, $RawString[$i], 1);
        }

        $cmd->write("license add $ret\nno\n");

	$cnt++;

	if ($cnt eq 1000) {
	    print "$_" while <$cmd>;
	    $cnt = 0;
	}
#	print "$ret\n";

	$RawString[0]++;
    } while($RawString[$CharSet-1] < length($alpha));
}

my $ssh2 = Net::SSH2->new(); #$ssh2->debug(1);

$ssh2->connect('192.168.1.220') or die "$!";

if ($ssh2->auth_password ("root", "geheim")) {

    my $cmd = $ssh2->channel();
    $cmd->blocking(0);
    $cmd->shell();

#    print $cmd "date\n";
    print "LINE : $_" while <$cmd>;

    brute($cmd, 7);

#exit 0;

#    for (my $i = 0; $i < 1000; $i++) {
#	$cmd->write("license\n");
#    }

#    print "$_" while <$cmd>;

    $cmd->close();
} else {
    print "something went wrong.\n"; die "$!";
}