Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Kill-Router

 Kill-Router

Talk ministrada no SecurityTricks #1 sobre a ferramenta Kill-Router

07080351150c53efa399856330e4fa19?s=128

Matheus Fidelis

January 30, 2018
Tweet

Transcript

  1. Kill-Router- “De um trabalho da faculdade a 2000 dispositivos hackeados”

    @fidelissauro https://github.com/msfidelis/Kill-Router-
  2. $ whoami_ Matheus Fidelis Developer / Cloud / DevOps Superlógica

    / PJBank Github: /msfidelis Twitter: @fidelissauro Email: matheus@nanoshots.com.br Blog: http://nanoshots.com.br
  3. $ Kill-Router • Mineração e brute force em massa em

    dispositivos • Trabalho de faculdade • Quebrar senhas dos roteadores dos prédios • Desbloquear Ah Negão, Não Salvo e etc (foda) https://github.com/msfidelis/Kill-Router-
  4. $ Kill-Router • KISS (Keep it Simple, Stupid…) • HTTP,

    SSH, FTP Attack • Mode: Standalone (Target) • Mode: Shodan Dork Search Engine (API) • Minerar dispositivos conectados a internet • Weak Passwords • Roteadores, Câmeras, Switches, Painéis e lalala
  5. $ Stand Alone ./kill-router.py -t 192.168.0.1 -u admin -l passlist.txt

    ./kill-router.py -t 192.168.0.1 -u root -l passlist.txt -p 22 -m ssh
  6. $ Default Passlists • Top 10 Passwords • Top 100

    Passwords • Stupid Passwords • Ashley Madison ( ͡° ͜ʖ ͡°)
  7. $ SHODAN • Indexador de dispositivos conectados a internet. •

    Fingerprint de serviços, versões e portas • Banners HTTP, FTP, SSH, Telnet, SNMP, SIP, etc • Dork Search • API Aberta https://www.shodan.io/
  8. $ SHODAN

  9. None
  10. $ SHODAN 0.0.0.0/0

  11. $ SHODAN

  12. None
  13. $ Searchs • RomPager/4.07 UPnP/1.0 —– router • uc-httpd 1.0.0

    —– CCTV camera • DVRDVS-Webs —– CCTV camera • microhttpd —– router • Webs —– CCTV camera • Hikvision-Webs —– CCTV • camera iBall-Baton —– CCTV camera
  14. $ Dorks • Nginx Servers in São Paulo nginx country:

    "São Paulo" • Apache Server in Subnet Range apache net:“216.219.143.0/24” • Google Servers "Server: gws"
  15. Kill-Router- ./kill-router.py --shodan geovision

  16. None
  17. None
  18. None
  19. None
  20. OBRIGADO!