#include "hydra-mod.h"
#ifdef LIBOPENSSL
#include <openssl/aes.h>
#include <openssl/des.h>
#include <openssl/hmac.h>
#include <openssl/md5.h>
#include <openssl/sha.h>
#endif
extern int32_t hydra_data_ready_timed(int32_t socket, long sec, long usec);
extern char *HYDRA_EXIT;
extern int32_t child_head_no;
char snmpv3buf[1024], *snmpv3info = NULL;
int32_t snmpv3infolen = 0, snmpversion = 1, snmpread = 1, hashtype = 1, enctype = 0;
unsigned char snmpv3_init[] = {0x30, 0x3e, 0x02, 0x01, 0x03, 0x30, 0x11, 0x02, 0x04, 0x08, 0x86, 0xdd, 0xf0, 0x02, 0x03, 0x00, 0xff, 0xe3, 0x04, 0x01, 0x04, 0x02, 0x01, 0x03, 0x04, 0x10, 0x30, 0x0e, 0x04, 0x00, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x04, 0x00, 0x04, 0x00, 0x04, 0x00, 0x30, 0x14, 0x04, 0x00, 0x04, 0x00, 0xa0, 0x0e, 0x02, 0x04, 0x3f, 0x44, 0x5c, 0xbc, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x30, 0x00};
unsigned char snmpv3_get1[] = {0x30, 0x77, 0x02, 0x01, 0x03, 0x30, 0x11, 0x02, 0x04, 0x08, 0x86, 0xdd, 0xef, 0x02, 0x03, 0x00, 0xff, 0xe3, 0x04, 0x01, 0x05, 0x02, 0x01, 0x03};
unsigned char snmpv3_get2[] = {0x30, 0x2e, 0x04, 0x0c, 0x80, 0x00, 0x00, 0x09, 0x03, 0x00, 0x00, 0x1f, 0xca, 0x8d, 0x82, 0x1b, 0x04, 0x00, 0xa0, 0x1c, 0x02, 0x04, 0x3f, 0x44, 0x5c, 0xbb, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00, 0x30, 0x0e, 0x30, 0x0c, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x02, 0x01, 0x01, 0x01, 0x00, 0x05, 0x00};
unsigned char snmpv3_nouser[] = {0x04, 0x00, 0x04, 0x00, 0x04, 0x00};
struct SNMPV1_A {
char ID;
char len;
char ver[3];
char comid;
char comlen;
};
struct SNMPV1_A snmpv1_a = {.ID = '\x30',
.len = '\x00',
.ver = "\x02\x01\x00", /* \x02\x01\x01 for snmpv2c, \x02\x01\x03 for snmpv3 */
.comid = '\x04',
.comlen = '\x00'};
struct SNMPV1_R {
unsigned char type[2];
unsigned char identid[2];
unsigned char ident[4];
unsigned char errstat[3];
unsigned char errind[3];
unsigned char objectid[2];
unsigned char object[11];
unsigned char value[3];
} snmpv1_r = {
.type = "\xa0\x1b", /* GET */
.identid = "\x02\x04",
.ident = "\x1a\x5e\x97\x00", /* random crap :) */
.errstat = "\x02\x01\x00", /* no error */
.errind = "\x02\x01\x00", /* error index 0 */
.objectid = "\x30\x0d",
.object = "\x30\x0b\x06\x07\x2b\x06\x01\x02\x01\x01\x01", /* sysDescr */
.value = "\x05\x00" /* we just read, so value = 0 */
};
struct SNMPV1_W {
unsigned char type[2];
unsigned char identid[2];
unsigned char ident[4];
unsigned char errstat[3];
unsigned char errind[3];
unsigned char objectid[2];
unsigned char object[12];
unsigned char value[8];
} snmpv1_w = {
.type = "\xa3\x21", /* SET */
.identid = "\x02\x04",
.ident = "\x1a\x5e\x97\x22", /* random crap :) */
.errstat = "\x02\x01\x00", /* no error */
.errind = "\x02\x01\x00", /* error index 0 */
.objectid = "\x30\x13", /* string */
.object = "\x30\x11\x06\x08\x2b\x06\x01\x02\x01\x01\x05\x00",
.value = "\x04\x05Hydra" /* writing hydra :-) */
};
#ifdef LIBOPENSSL
void password_to_key_md5(u_char *password, /* IN */
u_int passwordlen, /* IN */
u_char *engineID, /* IN - pointer to snmpEngineID */
u_int engineLength, /* IN - length of snmpEngineID */
u_char *key) { /* OUT - pointer to caller 16-octet buffer */
MD5_CTX MD;
u_char *cp, password_buf[80], *mypass = password, bpass[17];
u_long password_index = 0, count = 0, i, mylen, myelen = engineLength;
if (strlen(password) > passwordlen)
passwordlen = strlen(password);
if (passwordlen > sizeof(bpass) - 1)
passwordlen = sizeof(bpass) - 1;
mylen = passwordlen;
if (mylen < 8) {
memset(bpass, 0, sizeof(bpass));
strncpy(bpass, password, sizeof(bpass) - 1);
while (mylen < 8) {
strcat(bpass, password);
mylen += passwordlen;
}
mypass = bpass;
}
if (myelen > 32)
myelen = 32;
MD5_Init(&MD); /* initialize MD5 */
/* Use while loop until we've done 1 Megabyte */
while (count < 1048576) {
cp = password_buf;
for (i = 0; i < 64; i++) {
/* Take the next octet of the password, wrapping */
/* to the beginning of the password as necessary. */
*cp++ = mypass[password_index++ % mylen];
}
MD5_Update(&MD, password_buf, 64);
count += 64;
}
MD5_Final(key, &MD); /* tell MD5 we're done */
/* Now localize the key with the engineID and pass */
/* through MD5 to produce final key */
/* May want to ensure that engineLength <= 32, */
/* otherwise need to use a buffer larger than 64 */
memcpy(password_buf, key, 16);
memcpy(password_buf + 16, engineID, myelen);
memcpy(password_buf + 16 + myelen, key, 16);
MD5_Init(&MD);
MD5_Update(&MD, password_buf, 32 + myelen);
MD5_Final(key, &MD);
return;
}
void password_to_key_sha(u_char *password, /* IN */
u_int passwordlen, /* IN */
u_char *engineID, /* IN - pointer to snmpEngineID */
u_int engineLength, /* IN - length of snmpEngineID */
u_char *key) { /* OUT - pointer to caller 20-octet buffer */
SHA_CTX SH;
u_char *cp, password_buf[80], *mypass = password, bpass[17];
u_long password_index = 0, count = 0, i, mylen = passwordlen, myelen = engineLength;
if (mylen < 8) {
memset(bpass, 0, sizeof(bpass));
strcpy(bpass, password);
while (mylen < 8) {
strcat(bpass, password);
mylen += passwordlen;
}
mypass = bpass;
}
if (myelen > 32)
myelen = 32;
SHA1_Init(&SH); /* initialize SHA */
/* Use while loop until we've done 1 Megabyte */
while (count < 1048576) {
cp = password_buf;
for (i = 0; i < 64; i++) {
/* Take the next octet of the password, wrapping */
/* to the beginning of the password as necessary. */
*cp++ = mypass[password_index++ % mylen];
}
SHA1_Update(&SH, password_buf, 64);
count += 64;
}
SHA1_Final(key, &SH); /* tell SHA we're done */
/* Now localize the key with the engineID and pass */
/* through SHA to produce final key */
/* May want to ensure that engineLength <= 32, */
/* otherwise need to use a buffer larger than 72 */
memcpy(password_buf, key, 20);
memcpy(password_buf + 20, engineID, myelen);
memcpy(password_buf + 20 + myelen, key, 20);
SHA1_Init(&SH);
SHA1_Update(&SH, password_buf, 40 + myelen);
SHA1_Final(key, &SH);
return;
}
#endif
int32_t start_snmp(int32_t s, char *ip, int32_t port, unsigned char options, char *miscptr, FILE *fp) {
char *empty = "\"\"", *ptr, *login, *pass, buffer[1024], buf[1024], hash[64], key[256] = "", salt[8] = "";
int32_t i, j, k, size, off = 0, off2 = 0;
unsigned char initVect[8], privacy_params[8];
int32_t engine_boots = 0;
#ifdef LIBOPENSSL
DES_key_schedule symcbc;
#endif
if (strlen(login = hydra_get_next_login()) == 0)
login = empty;
if (strlen(pass = hydra_get_next_password()) == 0)
pass = empty;
if (snmpversion < 3) {
/* do we attack snmp v1 or v2c? */
if (snmpversion == 2) {
snmpv1_a.ver[2] = '\x01';
}
if (snmpread) {
size = sizeof(snmpv1_r);
} else {
size = sizeof(snmpv1_w);
}
snmpv1_a.comlen = (char)strlen(pass);
snmpv1_a.len = snmpv1_a.comlen + size + sizeof(snmpv1_a) - 3;
i = sizeof(snmpv1_a);
memcpy(buffer, &snmpv1_a, i);
strcpy(buffer + i, pass);
i += strlen(pass);
if (snmpread) {
memcpy(buffer + i, &snmpv1_r, size);
i += sizeof(snmpv1_r);
} else {
memcpy(buffer + i, &snmpv1_w, size);
i += sizeof(snmpv1_w);
}
} else { // snmpv3
if (enctype == 0) {
memcpy(buffer, snmpv3_get1, sizeof(snmpv3_get1));
i = sizeof(snmpv3_get1);
} else {
memcpy(buffer + 1, snmpv3_get1, sizeof(snmpv3_get1));
buffer[0] = buffer[1];
memset(buffer + 1, 0x81, 2);
i = sizeof(snmpv3_get1) + 1;
off2 = 1;
}
memcpy(buffer + i, snmpv3info, snmpv3infolen);
if (hashtype > 0) {
off = 12;
#ifdef LIBOPENSSL
if (hashtype == 1) {
password_to_key_md5(pass, strlen(pass), snmpv3info + 6, snmpv3info[5], key);
} else {
password_to_key_sha(pass, strlen(pass), snmpv3info + 6, snmpv3info[5], key);
}
#endif
if (enctype > 0) {
off += 8;
buffer[20 + off2] = 7;
}
} else {
ptr = login;
login = pass;
pass = ptr;
buffer[20] = 4;
}
buffer[i + 1] = 4 + snmpv3infolen + off + strlen(login);
buffer[i + 3] = 2 + snmpv3infolen + off + strlen(login);
if (enctype == 0)
buffer[1] = 48 + sizeof(snmpv3_get1) + buffer[i + 1];
i += snmpv3infolen;
// printf("2 + %d + %d + %d = 0x%02x\n", off, snmpv3infolen, strlen(login),
// buffer[1]);
buffer[i] = 0x04;
buffer[i + 1] = strlen(login);
memcpy(buffer + i + 2, login, strlen(login));
i += 2 + strlen(login);
buffer[i] = 0x04;
if (hashtype > 0) {
buffer[i + 1] = 12;
memset(buffer + i + 2, 0, 12);
off = i + 2;
i += 2 + 12;
} else {
buffer[i + 1] = 0;
i += 2;
}
buffer[i] = 0x04;
if (enctype == 0) {
buffer[i + 1] = 0x00;
i += 2;
} else {
buffer[i + 1] = 8;
memcpy(buffer + i + 2, salt, 8); // uninitialized and we don't care
i += 10;
}
if (enctype == 0) {
memcpy(buffer + i, snmpv3_get2, sizeof(snmpv3_get2));
i += sizeof(snmpv3_get2);
} else {
buffer[i] = 4;
buffer[i + 1] = 0x30;
#ifdef LIBOPENSSL
/*
//PrivDES::encrypt(const unsigned char *key,
// const uint32_t key_len,
// const unsigned char *buffer,
// const uint32_t buffer_len,
// unsigned char *out_buffer,
// uint32_t *out_buffer_len,
// unsigned char *privacy_params,
// uint32_t *privacy_params_len,
// const unsigned long engine_boots,
// const unsigned long engine_time)
// last 8 bytes of key are used as base for initialization vector */
k = 0;
memcpy((char *)initVect, key + 8, 8);
// put salt in privacy_params
j = htonl(engine_boots);
memcpy(privacy_params, (char *)&j, 4);
memcpy(privacy_params + 4, salt, 4); // ??? correct?
// xor initVect with salt
for (i = 0; i < 8; i++)
initVect[i] ^= privacy_params[i];
DES_key_sched((const_DES_cblock *)key, &symcbc);
DES_ncbc_encrypt(snmpv3_get2 + 2, buf, sizeof(snmpv3_get2) - 2, &symcbc, (const_DES_cblock *)(initVect), DES_ENCRYPT);
#endif
/* for (i = 0; i <= sizeof(snmpv3_get2) - 8; i += 8) {
DES_ncbc_encrypt(snmpv3_get2 + i, buf + i, 8,
(const_DES_cblock*)(initVect), DES_ENCRYPT);
}
// last part of buffer
if (buffer_len % 8) {
unsigned char tmp_buf[8];
unsigned char *tmp_buf_ptr = tmp_buf;
int32_t start = buffer_len - (buffer_len % 8);
memset(tmp_buf, 0, 8);
for (uint32_t l = start; l < buffer_len; l++)
*tmp_buf_ptr++ = buffer[l];
DES_ncbc_encrypt(tmp_buf, buf + start, 1, &symcbc,
(const_DES_cblock*)(initVect), DES_ENCRYPT); *out_buffer_len =
buffer_len + 8 - (buffer_len % 8); } else *out_buffer_len = buffer_len;
*/
// dummy
k = ((sizeof(snmpv3_get2) - 2) / 8);
if ((sizeof(snmpv3_get2) - 2) % 8 != 0)
k++;
memcpy(buffer + i + 2, buf, k * 8);
i += k * 8 + 2;
}
i++; // just to conform with the snmpv1/2 code
#ifdef LIBOPENSSL
if (hashtype == 1) {
HMAC((EVP_MD *)EVP_md5(), key, 16, buffer, i - 1, hash, NULL);
memcpy(buffer + off, hash, 12);
} else if (hashtype == 2) {
HMAC((EVP_MD *)EVP_sha1(), key, 20, buffer, i - 1, hash, NULL);
memcpy(buffer + off, hash, 12);
}
#endif
}
j = 0;
do {
if (hydra_send(s, buffer, i - 1, 0) < 0)
return 3;
j++;
} while (hydra_data_ready_timed(s, 1, 0) <= 0 && j < 3);
if (hydra_data_ready_timed(s, 5, 0) > 0) {
i = hydra_recv(s, (char *)buf, sizeof(buf));
if (snmpversion < 3) {
/* stolen from ADMsnmp... :P */
for (j = 0; j < i; j++) {
if (buf[j] == '\x04') { /* community name */
for (j = j + buf[j + 1]; j + 2 < i; j++) {
if (buf[j] == '\xa2') { /* PDU Response */
for (; j + 2 < i; j++) {
if (buf[j] == '\x02') { /* ID */
for (j = j + (buf[j + 1]); j + 2 < i; j++) {
if (buf[j] == '\x02') {
if (buf[j + 1] == '\x01') { /* good ! */
hydra_report_found_host(port, ip, "snmp", fp);
hydra_completed_pair_found();
if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
return 3;
return 1;
}
}
}
}
}
}
}
}
}
} else { // snmpv3 reply
off = 0;
if (buf[0] == 0x30) {
if (buf[4] == 0x03 && buf[5] == 0x30)
off = 4;
if (buf[5] == 0x03 && buf[6] == 0x30)
off = 6;
if (buf[6] == 0x03 && buf[7] == 0x30)
off = 6;
}
if (off == 0)
return 3;
if (debug)
printf("[DEBUG] buf[%d + 15] %d\n", off, buf[off + 15]);
k = 3 + off + buf[2 + off];
if ((j = hydra_memsearch(buf + k, buf[k + 3], snmpv3_nouser, sizeof(snmpv3_nouser))) < 0)
if ((j = hydra_memsearch(buf + k, buf[k + 3], login, strlen(login))) >= 0) {
if (snmpv3info[j - 2] == 0x04)
j -= 2;
else
j = -1;
}
if (j >= 0) {
i = buf[k + 3] + 4;
if (i > sizeof(snmpv3info))
i = sizeof(snmpv3info);
memcpy(snmpv3info, buf + k, i);
snmpv3infolen = j;
if (debug)
hydra_dump_asciihex(snmpv3info, snmpv3infolen);
}
if ((buf[off + 15] & 1) == 1) {
if (hashtype == 0)
hydra_report_found_host(port, ip, "snmp3", fp);
else
hydra_report_found_host(port, ip, "snmp", fp);
hydra_completed_pair_found();
if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
return 3;
return 1;
} else if ((buf[off + 15] & 5) == 4 && hydra_memsearch(buf, i, snmpv3_nouser,
sizeof(snmpv3_nouser)) >= 0) { // user does not exist
if (verbose)
printf("[INFO] user %s does not exist, skipping\n", login);
hydra_completed_pair_skip();
if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
return 3;
return 1;
}
}
}
hydra_completed_pair();
if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
return 3;
return 1;
}
void service_snmp(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname) {
int32_t run = 1, next_run = 1, sock = -1, i = 0;
int32_t myport = PORT_SNMP;
char *lptr;
if (miscptr != NULL) {
lptr = strtok(miscptr, ":");
while (lptr != NULL) {
if (strcasecmp(lptr, "1") == 0)
snmpversion = 1;
else if (strcasecmp(lptr, "2") == 0)
snmpversion = 2;
else if (strcasecmp(lptr, "3") == 0)
snmpversion = 3;
else if (strcasecmp(lptr, "PLAIN") == 0)
hashtype = 0;
else if (strcasecmp(lptr, "MD5") == 0)
hashtype = 1;
else if (strncasecmp(lptr, "R", 1) == 0)
snmpread = 1;
else if (strncasecmp(lptr, "W", 1) == 0)
snmpread = 0;
else if (strncasecmp(lptr, "SHA", 3) == 0)
hashtype = 2;
else if (strcasecmp(lptr, "DES") == 0)
enctype = 1;
else if (strcasecmp(lptr, "AES") == 0)
enctype = 2;
else {
fprintf(stderr, "[ERROR] unknown optional parameter: %s\n", lptr);
hydra_child_exit(2);
}
lptr = strtok(NULL, ":");
}
}
if (hashtype == 0)
enctype = 0;
if (port != 0)
myport = port;
sock = hydra_connect_udp(ip, myport);
port = myport;
if (debug)
printf("[DEBUG] snmpv%d, isread %d, hashtype %d, enctype %d\n", snmpversion, snmpread, hashtype, enctype);
hydra_register_socket(sp);
if (sock < 0) {
hydra_report(stderr, "[ERROR] Child with pid %d terminating, no socket available\n", (int32_t)getpid());
hydra_child_exit(1);
}
if (snmpversion == 3) {
next_run = 0;
while (snmpv3info == NULL && next_run < 3) {
hydra_send(sock, snmpv3_init, sizeof(snmpv3_init), 0);
if (hydra_data_ready_timed(sock, 5, 0) > 0) {
if ((i = hydra_recv(sock, (char *)snmpv3buf, sizeof(snmpv3buf))) > 30) {
if (snmpv3buf[4] == 3 && snmpv3buf[5] == 0x30) {
snmpv3info = snmpv3buf + 7 + snmpv3buf[6];
snmpv3infolen = snmpv3info[3] + 4;
if (snmpv3info + snmpv3infolen <= snmpv3buf + sizeof(snmpv3buf)) {
while (snmpv3info[snmpv3infolen - 2] == 4 && snmpv3info[snmpv3infolen - 1] == 0 && snmpv3infolen > 1)
snmpv3infolen -= 2;
if (debug)
hydra_dump_asciihex(snmpv3info, snmpv3infolen);
if (snmpv3info[10] == 3 && child_head_no == 0)
printf("[INFO] Remote device MAC address is "
"%02x:%02x:%02x:%02x:%02x:%02x\n",
(unsigned char)snmpv3info[12], (unsigned char)snmpv3info[13], (unsigned char)snmpv3info[14], (unsigned char)snmpv3info[15], (unsigned char)snmpv3info[16], (unsigned char)snmpv3info[12]);
}
}
}
}
next_run++;
}
if (snmpv3info == NULL || i < snmpv3info + snmpv3infolen - snmpv3buf) {
hydra_report(stderr, "No valid reply from snmp server, exiting!\n");
hydra_child_exit(2);
}
}
if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
run = 3;
while (1) {
switch (run) {
case 1: /* connect and service init function */
next_run = start_snmp(sock, ip, port, options, miscptr, fp);
break;
case 3: /* clean exit */
if (sock >= 0)
sock = hydra_disconnect(sock);
hydra_child_exit(2);
return;
default:
hydra_report(stderr, "[ERROR] Caught unknown return code, exiting!\n");
hydra_child_exit(2);
}
run = next_run;
}
}
int32_t service_snmp_init(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname) {
// called before the childrens are forked off, so this is the function
// which should be filled if initial connections and service setup has to be
// performed once only.
//
// fill if needed.
//
// return codes:
// 0 all OK
// -1 error, hydra will exit, so print a good error message here
return 0;
}
void usage_snmp(const char *service) {
printf("Module snmp is optionally taking the following parameters:\n"
" READ perform read requests (default)\n"
" WRITE perform write requests\n"
" 1 use SNMP version 1 (default)\n"
" 2 use SNMP version 2\n"
" 3 use SNMP version 3\n"
" Note that SNMP version 3 usually uses both login and "
"passwords!\n"
" SNMP version 3 has the following optional sub parameters:\n"
" MD5 use MD5 authentication (default)\n"
" SHA use SHA authentication\n"
" DES use DES encryption\n"
" AES use AES encryption\n"
" if no -p/-P parameter is given, SNMPv3 noauth is performed, "
"which\n"
" only requires a password (or username) not both.\n"
"To combine the options, use colons (\":\"), e.g.:\n"
" hydra -L user.txt -P pass.txt -m 3:SHA:AES:READ target.com snmp\n"
" hydra -P pass.txt -m 2 target.com snmp\n");
}
