Skip to content

Commit

Permalink
removed hostgroup support: it is better for Ncrack to be able to crac…
Browse files Browse the repository at this point in the history
…k all the specified hosts in parallel
  • Loading branch information
ithilgore committed May 21, 2009
1 parent f5ece26 commit d488699
Show file tree
Hide file tree
Showing 7 changed files with 111 additions and 233 deletions.
2 changes: 1 addition & 1 deletion Target.cc
Original file line number Diff line number Diff line change
Expand Up @@ -237,7 +237,7 @@ void Target::setHostName(char *name) {
}
}

void Target::setTargetName(char *name) {
void Target::setTargetName(const char *name) {
if (targetname) {
free(targetname);
targetname = NULL;
Expand Down
2 changes: 1 addition & 1 deletion Target.h
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@ class Target {
away when you setTargetSockAddr(), so make sure you do th ese in proper
order
*/
void setTargetName(char *name);
void setTargetName(const char *name);

/* Starts the timeout clock for the host running (e.g. you are
beginning a scan). If you do not have the current time handy,
Expand Down
19 changes: 0 additions & 19 deletions TargetGroup.cc
Original file line number Diff line number Diff line change
Expand Up @@ -521,23 +521,4 @@ int TargetGroup::return_last_host() {
return 0;
}

/* Lookahead is the number of hosts that can be
checked (such as ping scanned) in advance. Randomize causes each
group of up to lookahead hosts to be internally shuffled around.
The target_expressions array MUST REMAIN VALID IN MEMORY as long as
this class instance is used -- the array is NOT copied.
*/
HostGroupState::HostGroupState(int lookahead, char *expr[], int numexpr) {
assert(lookahead > 0);
hostbatch = (Target **) safe_zalloc(sizeof(Target *) * lookahead);
max_batch_sz = lookahead;
current_batch_sz = 0;
next_batch_no = 0;
target_expressions = expr;
num_expressions = numexpr;
next_expression = 0;
}

HostGroupState::~HostGroupState() {
free(hostbatch);
}
20 changes: 0 additions & 20 deletions TargetGroup.h
Original file line number Diff line number Diff line change
Expand Up @@ -164,25 +164,5 @@ class TargetGroup {
int namedhost;
};

class HostGroupState {
public:
HostGroupState(int lookahead, char *target_expressions[], int num_expressions);
~HostGroupState();
Target **hostbatch;
int max_batch_sz; /* The size of the hostbatch[] array */
int current_batch_sz; /* The number of VALID members of hostbatch[] */
int next_batch_no; /* The index of the next hostbatch[] member to be given
back to the user */
char **target_expressions; /* An array of target expression strings, passed
to us by the client (client is also in charge
of deleting it AFTER it is done with the
hostgroup_state */
int num_expressions; /* The number of valid expressions in
target_expressions member above */
int next_expression; /* The index of the next expression we have
to handle */
TargetGroup current_expression; /* For batch chunking -- targets in queue */

};

#endif /* TARGETGROUP_H */
190 changes: 78 additions & 112 deletions ncrack.cc
Original file line number Diff line number Diff line change
Expand Up @@ -294,10 +294,8 @@ int main(int argc, char **argv)

o.setaf(AF_INET);

char **host_exp_group;
HostGroupState *hstate;

Target *currenths;
int num_host_exp_groups;
char *host_spec = NULL;
vector <Target *> Targets;

Expand All @@ -314,116 +312,84 @@ int main(int argc, char **argv)
free(exclude_spec);
}

host_exp_group = (char **) safe_malloc(o.max_group_size * sizeof(char *));
num_host_exp_groups = 0;

o.max_group_size = 4096;
unsigned int ideal_scan_group_size = o.max_group_size;

hstate = new HostGroupState(o.max_group_size, host_exp_group, num_host_exp_groups);

while ((host_spec = grab_next_host_spec(inputfd, argc, argv))) {

do {
while (Targets.size() < ideal_scan_group_size) {
currenths = nexthost(hstate, exclude_group, services_cmd);
if (!currenths) {
/* Try to refill with any remaining expressions */
/* First free the old ones */
for(int i = 0; i < num_host_exp_groups; i++)
free(host_exp_group[i]);

num_host_exp_groups = 0;
/* Now grab any new expressions */
while (num_host_exp_groups < o.max_group_size &&
(host_spec = grab_next_host_spec(inputfd, argc, argv))) {
// For purposes of random scan - TODO: see this
host_exp_group[num_host_exp_groups++] = strdup(host_spec);
}
/* preparse and separate host - service < TODO */

if (num_host_exp_groups == 0)
break;
delete hstate;
hstate = new HostGroupState(o.max_group_size, host_exp_group, num_host_exp_groups);
/* Try one last time -- with new expressions */
currenths = nexthost(hstate, exclude_group, services_cmd);
if (!currenths)
break;
}
while ((currenths = nexthost(host_spec, exclude_group))) {
Targets.push_back(currenths);
}
}

if (Targets.size() == 0)
break;

if (o.list_only) {
printf("\n=== Targets ===\n");
for (unsigned int i = 0; i < Targets.size(); i++) {
printf("Host: %s\n", Targets[i]->NameIP());
for (unsigned int j = 0; j < Targets[i]->services.size(); j++) {
printf(" %s:%hu\n",
Targets[i]->services[j]->name,
Targets[i]->services[j]->portno);
}
if (o.list_only) {
printf("\n=== Targets ===\n");
for (unsigned int i = 0; i < Targets.size(); i++) {
printf("Host: %s\n", Targets[i]->NameIP());
for (unsigned int j = 0; j < Targets[i]->services.size(); j++) {
printf(" %s:%hu\n",
Targets[i]->services[j]->name,
Targets[i]->services[j]->portno);
}
} else {
/* Ncrack 'em all! */
ncrack(Targets);
}
} else {
/* Ncrack 'em all! */
ncrack(Targets);
}

/* Free all of the Targets */
while(!Targets.empty()) {
currenths = Targets.back();
while (!currenths->services.empty()) {
free(currenths->services.back());
currenths->services.pop_back();
}
delete currenths;
Targets.pop_back();
}
/* Free all of the Targets */
while(!Targets.empty()) {
currenths = Targets.back();
while (!currenths->services.empty()) {
free(currenths->services.back());
currenths->services.pop_back();
}
delete currenths;
Targets.pop_back();
}

} while (1);

printf("\nNcrack finished.\n");
exit(EXIT_SUCCESS);

}


/*
* It handles module endings
*/
* It handles module endings
*/
void
ncrack_module_end(nsock_pool nsp, nsock_iod nsi, void *mydata)
{
m_data *mdata = (m_data *) mydata;
m_data *mdata = (m_data *) mydata;

if (mdata->attempts < mdata->max_attempts) {
call_module(mdata);
}
if (mdata->attempts < mdata->max_attempts) {
call_module(mdata);
}

}


void
ncrack_read_handler(nsock_pool nsp, nsock_event nse, void *mydata)
{
nsock_iod nsi = nse_iod(nse);
enum nse_status status = nse_status(nse);
enum nse_type type = nse_type(nse);
int nbytes;
char *str;
m_data *mdata = (m_data *) mydata;
nsock_iod nsi = nse_iod(nse);
enum nse_status status = nse_status(nse);
enum nse_type type = nse_type(nse);
int nbytes;
char *str;
m_data *mdata = (m_data *) mydata;

printf("%s: status %s\n", __func__, nse_status2str(status));
printf("%s: status %s\n", __func__, nse_status2str(status));

str = nse_readbuf(nse, &nbytes);
mdata->buf = (char *)malloc(nbytes);
mdata->bufsize = nbytes;
memcpy(mdata->buf, str, nbytes);
str = nse_readbuf(nse, &nbytes);
mdata->buf = (char *)malloc(nbytes);
mdata->bufsize = nbytes;
memcpy(mdata->buf, str, nbytes);

call_module(mdata);
call_module(mdata);

return;
return;
}


Expand All @@ -432,17 +398,17 @@ ncrack_read_handler(nsock_pool nsp, nsock_event nse, void *mydata)
void
ncrack_write_handler(nsock_pool nsp, nsock_event nse, void *mydata)
{
nsock_iod nsi = nse_iod(nse);
enum nse_status status = nse_status(nse);
enum nse_type type = nse_type(nse);
nsock_iod nsi = nse_iod(nse);
enum nse_status status = nse_status(nse);
enum nse_type type = nse_type(nse);

m_data *mdata = (m_data *) mydata;
m_data *mdata = (m_data *) mydata;

printf("%s: status %s\n", __func__, nse_status2str(status));
printf("%s: status %s\n", __func__, nse_status2str(status));

call_module(mdata);
call_module(mdata);

return;
return;
}


Expand All @@ -451,25 +417,25 @@ ncrack_write_handler(nsock_pool nsp, nsock_event nse, void *mydata)
void
ncrack_connect_handler(nsock_pool nsp, nsock_event nse, void *mydata)
{
nsock_iod nsi = nse_iod(nse);
enum nse_status status = nse_status(nse);
enum nse_type type = nse_type(nse);
nsock_iod nsi = nse_iod(nse);
enum nse_status status = nse_status(nse);
enum nse_type type = nse_type(nse);

//m_data *mdata = (m_data *) mydata;
//mdata->protocol = IPPROTO_TCP;
//mdata->state = 0;
//m_data *mdata = (m_data *) mydata;
//mdata->protocol = IPPROTO_TCP;
//mdata->state = 0;

//call_module(mdata);
//call_module(mdata);

return;
return;
}




int
ncrack_probes(nsock_pool nsp, ServiceGroup *SG) {
Service *serv;
Service *serv;
Connection *connection;
struct sockaddr_storage ss;
size_t ss_len;
Expand All @@ -483,33 +449,33 @@ ncrack_probes(nsock_pool nsp, ServiceGroup *SG) {

int i = 0;

while (SG->active_connections < SG->ideal_parallelism
while (SG->active_connections < SG->ideal_parallelism
&& SG->services_finished.size() != SG->total_services) {
serv = *li;
if (serv->target->timedOut(nsock_gettimeofday())) {
// end_svcprobe(nsp, PROBESTATE_INCOMPLETE, SG, svc, NULL); TODO: HANDLE
continue;
}
// end_svcprobe(nsp, PROBESTATE_INCOMPLETE, SG, svc, NULL); TODO: HANDLE
continue;
}

/* Schedule 1 connection for this service */
connection = new Connection();
if ((connection->niod = nsi_new(nsp, serv)) == NULL) {
fatal("Failed to allocate Nsock I/O descriptor in %s()", __func__);
}
fatal("Failed to allocate Nsock I/O descriptor in %s()", __func__);
}
serv->connections.push_back(connection);

serv->target->TargetSockAddr(&ss, &ss_len);
if (serv->proto == IPPROTO_TCP)
nsock_connect_tcp(nsp, connection->niod, ncrack_connect_handler,
DEFAULT_CONNECT_TIMEOUT, serv,
(struct sockaddr *)&ss, ss_len,
serv->portno);
else {
assert(serv->proto == IPPROTO_UDP);
nsock_connect_udp(nsp, connection->niod, ncrack_connect_handler,
serv, (struct sockaddr *) &ss, ss_len,
serv->portno);
}
nsock_connect_tcp(nsp, connection->niod, ncrack_connect_handler,
DEFAULT_CONNECT_TIMEOUT, serv,
(struct sockaddr *)&ss, ss_len,
serv->portno);
else {
assert(serv->proto == IPPROTO_UDP);
nsock_connect_udp(nsp, connection->niod, ncrack_connect_handler,
serv, (struct sockaddr *) &ss, ss_len,
serv->portno);
}

i++; // temporary
if (i == 10)
Expand Down
Loading

0 comments on commit d488699

Please sign in to comment.