Medusa is intended to be a speedy, massively parallel, modular, login brute-forcer. The goal is to support as many services which allow remote authentication as possible. The author considers following items as some of the key features of this application:
Why create Medusa? Isn't this the same thing as Hydra? Here are some of the reasons for this application:
How do I use this thing? Simply running "medusa" without any options will dump all the parameters it accepts along with their respective description. Here are several example uses:
% medusa -d
Medusa v1.0-rc1 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks
Available modules in "." :
Available modules in "/usr/local/lib/medusa/modules" :
+ mssql.mod :
Brute force module for M$-SQL sessions : version 0.1.0
+ http.mod :
Brute force module for HTTP : version 0.1.1
+ ssh.mod :
Brute force module for SSH v2 sessions : version 0.1.1
+ smbnt.mod :
Brute force module for SMB/NTLMv1 sessions : version 0.1.1
+ telnet.mod :
Brute force module for telnet sessions : version 0.1.4
% medusa -M smbnt -q
Medusa v1.0-rc1 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks
smbnt.mod (0.1.1) JoMo-Kun :: Brute force module for SMB/NTLMv1 sessions
Available module options:
GROUP:? (DOMAIN, LOCAL*, BOTH)
Option sets NetBIOS workgroup field.
DOMAIN: Check credentials against this hosts primary domain controller via this host.
LOCAL: Check local account.
BOTH: Check both. This leaves the workgroup field set blank and then attempts to check
the credentials against the host. If the account does not exist locally on the
host being tested, that host then queries its domain controller.
GROUP_OTHER:?
Option allows manual setting of domain to check against. Use instead of GROUP.
PASS:? (PASSWORD*, HASH, MACHINE)
PASSWORD: Use normal password.
HASH: Use a NTLM hash rather than a password.
MACHINE: Use the machine's NetBIOS name as the password.
NETBIOS
Force NetBIOS Mode (Disable Native Win2000 Mode). Win2000 mode is the default.
Default mode is to test TCP/445 using Native Win2000. If this fails, module will
fall back to TCP/139 using NetBIOS mode. To test only TCP/139, use the following:
medusa -M smbnt -m NETBIOS -n 139
(*) Default value
Usage example: "-M smbnt -m GROUP:DOMAIN -m PASS:HASH"
% medusa -h 192.168.0.20 -u administrator -P passwords.txt -e ns -M smbnt
Medusa v1.0-rc1 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/1) User: administrator (1/1) Password: (1/7)
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/1) User: administrator (1/1) Password: administrator (2/7)
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/1) User: administrator (1/1) Password: password (3/7)
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/1) User: administrator (1/1) Password: pass1 (4/7)
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/1) User: administrator (1/1) Password: pass2 (5/7)
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/1) User: administrator (1/1) Password: pass3 (6/7)
ACCOUNT CHECK: [smbnt] Host: 192.168.0.20 (1/1) User: administrator (1/1) Password: pass4 (7/7)
% medusa -H hosts.txt -U users.txt -P passwords.txt -T 20 -t 10 -L -F -M smbnt
The following combinations are possible in the combo file:
The following example will check each entry in the file combo.txt
% medusa -M smbnt -C combo.txt
The combo.txt file:
192.168.0.20:administrator:password
192.168.0.20:testuser:pass
192.168.0.30:administrator:blah
192.168.0.40:user1:foopass
The following example will check each entry in the file combo.txt against the targets
listed in hosts.txt
% medusa -M smbnt -C combo.txt -H hosts.txt
The combo.txt file:
:administrator:password
:testuser:pass
:administrator:blah
:user1:foopass
Medusa also supports using PwDump files as a combo file. The format of these files should be user:id:lm:ntlm:::. We look for ':::' at the end of the first line to determine if the file contains PwDump output.
The majority of Medusa was written and tested on Linux/Gentoo-based systems. While it has been known to work on variety of operating systems, it is quite possible there may be issues that crop up only on non-Gentoo devices. Of course, there are issues that will probably also show up on Gentoo that have so far been missed...
Medusa should be fairly straight-forward to build: "./configure; make; make install". However,
this may result in a somewhat limited installation. To take full advantage of all the brute-forcing
goodness that Medusa has to offer, several dependencies must be satisfied. The
following table lists out the modules which have additional dependencies. "make" will build each
module regardless of whether the module's dependencies have been satisfied. However, if they have
not been met, the modules only function at runtime will be to display an error message about the
missing dependency. In order for the modules to function, the appropriate header files must be
installed on the system when the modules themselves are compiled. Additional module specific
information is included within the documentation for each module.
Dependency | Homepage | Module | Notes |
OpenSSL | http://www.openssl.org | HTTP, MSSQL, SMBNT, SSL-based connections | |
LibSSH2 | http://www.libssh2.org | SSH | LibSSH2 patch provided to address timing issue. |
NCPFS | ftp://platan.vc.cvut.cz/pub/linux/ncpfs | NCP | Use "make install-dev" to install header files. |
LibPQ | http://www.postgresql.org | PostgreSQL | |
Subversion | http://subversion.tigris.org | SVN |
It should also be noted that, by default, not all of the modules are built. To build all modules, "./configure --enable-untested" should be used. This will build additional modules which should be fully functional, but have not been tested to the same level as the others.
The following ebuilds have been included within this distribution:
The libssh2 ebuild and ncpfs ebuild modifications have been submitted to bugs.gentoo.org. However, at this time, they have not made their way into Portage. The plan is to eventually submit the Medusa ebuild also. In the meantime, all of the ebuilds can be used via Portage Overlay.
Some basic Portage Overlay instructions:
PORTDIR_OVERLAY="/some/directory/"
net-libs/libssh2
net-analyzer/medusa
net-analyzer/medusa ~x86
net-libs/libssh2 ~x86
net-analyzer/medusa ssh2 ssl
Some testing has been preformed on FreeBSD 5.4 and 6.0. Seems to work fine...
Medusa has been compiled on OpenBSD 3.8 and several cursory checks were performed.
Medusa has been compiled on Darwin 8.1 and several cursory checks were performed. It has not been tested on Mac OS X, but it *should* work...
If you are building libssh2 on Darwin, make sure that libssh2.dylib and header files are copied into the appropriate locations. The "make install" didn't seem to do anything.
Medusa has been compiled under Solaris 10. While it doesn't crash, the results are somewhat unpredictable. ~10% of the calls to connect() fail for an unknown reason. Unfortunately, I'm not sure what's going as the call seems straight forward enough. If anyone has any advice, it would be much appreciated.
I have been unable to build the modules under Cygwin. If anyone can figure this out, I'll buy you a beer at the next DefCon.
This fine piece of buggy software was brought to you by the geeks at Foofus.net. JoMo-Kun was the chief dork and wrote the core of Medusa along with several of the modules. Foofus created the initial design for the loadable modules. Fizzgig provided the networking code, several modules, the loadable module implementation along with also fixing a bunch JoMo-Kun's crappy stuff. pMonkey was a crazy module coding fiend. Omi and phenfen provided testing services along with moral and beverage support. Last, but certainly not least, Heidi provided the tool's name.
If you have questions regarding this application, feel free to contact me. If it breaks, please send a detailed bug report. Even better, send in a patch. I make no claims that this program will do what you want it to. I've been using it during our assessments for a while now successfully. Hopefully, others will have similar luck. If you find Medusa useful and want to give something back, please submit new modules, code improvements or just buy any of the Foofus.net goons a beer at the next DefCon.
Joe
© Copyright 2006, Foofus Advanced Security Services
any time. any fucknut.