galkan / crowbar

Crowbar is brute forcing tool that can be used during penetration tests. It is developed to support protocols that are not currently supported by thc-hydra and other popular brute forcing tools.
MIT License
1.39k stars 316 forks source link

Missing verbose output leads to false negative results #6

Open partopronto opened 9 years ago

partopronto commented 9 years ago

python ./crowbar.py -b openvpn -s 192.168.XXX.YYY/32 -p 8443 -m ./conf.ovpn -k cert.crt -u USER -c PASSt -v 2015-09-13 18:59:32 START 2015-09-13 18:59:32 LOG-OPENVPN: 192.168.XXX.YYY:USER- PASS:/tmp/tmpSckaKi 2015-09-13 18:59:32 STOP No result is found ...

I am certain that the user and password are correct. So I assume the error is in the crt or ovpn file Please give hints for further debuging or the option for more verbose output

cat ./conf.ovpn client dev tap proto tcp remote 192.168.XXX.YYY 8443

auth-user-pass resolv-retry infinite persist-key persist-tun comp-lzo yes verb 3

cat cert.crt

-----BEGIN CERTIFICATE----- SNIP -----END CERTIFICATE-----
dextacy10-13 commented 9 years ago

I think in latest version of openvpn you may need to include certificate in separate file and not in the vpn con file. Don't quote me on this but moving external seemed to work on a bash script I made

Date: Sun, 13 Sep 2015 10:04:21 -0700 From: notifications@github.com To: crowbar@noreply.github.com Subject: [crowbar] Missing verbose output leads to false negative results (#6)

python ./crowbar.py -b openvpn -s 192.168.XXX.YYY/32 -p 8443 -m ./conf.ovpn -k cert.crt -u USER -c PASSt -v

2015-09-13 18:59:32 START

2015-09-13 18:59:32 LOG-OPENVPN: 192.168.XXX.YYY:USER- PASS:/tmp/tmpSckaKi

2015-09-13 18:59:32 STOP

No result is found ...

I am certain that the user and password are correct.

So I assume the error is in the crt or ovpn file

Please give hints for further debuging or the option for more verbose output

cat ./conf.ovpn

client

dev tap

proto tcp

remote 192.168.XXX.YYY 8443

auth-user-pass

resolv-retry infinite

persist-key

persist-tun

comp-lzo yes

verb 3

cat cert.crt

-----BEGIN CERTIFICATE-----

SNIP

-----END CERTIFICATE-----

— Reply to this email directly or view it on GitHub.

g0tmi1k commented 8 years ago

https://github.com/galkan/crowbar/commit/ac7bddb629c391a2f252a7348dfb498b00bbb15c adds a few things to help out: