This is a tool that has been around quite some time too, it’s still very useful though and it’s a very niche tool specifically for brute forcing Windows Terminal Server.
TSGrinder is the first production Terminal Server brute force tool, and is now in release 2. The main idea here is that the Administrator account, since it cannot be locked out for local logons, can be brute forced. And having an encrypted channel to the TS logon process sure helps to keep IDS from catching the attempts.
TSGringer is a “dictionary” based attack tool, but it does have some interesting features like “l337″ conversion, and supports multiple attack windows from a single dictionary file. It supports multiple password attempts in the same connection, and allows you to specify how many times to try a
username/password combination within a particular connection.
You can download TSGrinder 2.0.3 here:
Note that the tool requires the Microsoft Simulated Terminal Server Client tool, “roboclient,” which may be found here:
Or read more here.
Subscribe to Darknet RSS Feed Stored in: Hacking Tools, Password Cracking, Windows Hacking
Related Posts:
- TXDNS 2.0.0 Released - DNS Digger for Brute Force
- DNS Brute Force eXtract - WS-DNS-BFX
- SQLBrute - SQL Injection Brute Force Tool
- LCP - A Good FREE Alternative to L0phtcrack (LC5)
- ObiWaN - Web Server Brute Forcing from Phenoelit
- Medusa 1.4 - Parallel Password Cracker Released for Download
| 3,065 views |
Hmm……l337 conversion seems all fancy but it don’t work with multiple threads open :(.
But HOG does have some nice programs like URLScan DTS pack and TSEnum.
Thanx for the link!!
To protect against this kind of attack, you could disable the terminal server, or make sure you have a strong password policy in place. Pretty scary that the attack isent picked up by IDS because of the encryption, would the brute force logins be logged within windows some where?
n0vv u-77 4rv3 t0 734rn 70 5p377 7h1n95 0u7 71k3 7h15 1n5t346:
a=ay, b=bee, c=sea/see/cee, d=dee, etc
@ratza: Having used this before for the hell of it, and to show a client how bad having rdp open to the world is I can tell you that windows will not log it if it is the administrator account. If it is any other user it will. I think you can turn on verbose authentication logging as well.
TSGrinder did get me into this clients server as well, it worked multi-threaded on my box, I think I had about 10 going at once, and it got the pretty simple password in about two hours, with nothing in the security log at all, and nothing on their firewall or IDS.
This is why with windows you are better off disabling or renaming the admin account, and setting the admin accounts that you create to have account lockouts. Or simply don’t open rdp, or do both.
I would like to see something like Denyhosts for RDP as then it would simply block the offending IP at the software level, slowing down majorly any brute force.
While tsgrinder is a neat windows only RDP bruter, for linux users i would suggest the rdesktop brute force patch (http://www.foofus.net/jmk/tools/rdp-brute-force-r805.diff). Although i’ve never used TSgrinder it sounds ridiculously slow..
@Splink: not having used the Rdesktop patch, I can say that from reading here: http://www.foofus.net/jmk/rdesktop.html that they sound very similar. There is a version of rdesktop for windows so maybe tsgrinder uses that as it seems quicker than the built in MSTSC.
As I said I had 10 threads of tsgrinder going at once to a 2k3 box, it would take about 5-10 seconds per thread to check a password, that does make it pretty slow (about 1 password a second), but this is more the server slowing down authentications due to failures.
You can work out that most admins are lazy, most passwords are non-complex, and most are 7 charecters or less, use a dictionary and you only have around a million words, that should only take 10-15 days. Thats pretty bad.
Very good reasons to also have complex passwords, oh btw the one I found oh so long ago was in my dictionary it was very basic, no caps, no numbers, and a dictionary word, they have changed it so it is all good.
Navin/Zupakomputer/Morgan,
i have been trying to get this working and your posts suggest you have it working. I (and many others on forums) have an error when trying to run tsgrinder which is:
“Couldn’t get handle to client window”
I have looked at the dll versions, target machines etc and i am having no joy. Did you have to do anything to get this working and on what platforms?
Thanks in advance!
Sure mate…we’re all here after all to help!!
Ya I did have a similar error quite a few times when I tried to run Tsgrinder from my home PC:
“timed_Event_send_recv: Wait Failed: TIMEOUT
Couldn’t get handle to client window”
But it did work from the office PC
I think the problem tht Ure facing is tht the server U’re trying to bruteforce has disabled remote access…..If its a high profile server then probably its unable to serve any more connection requests
Try a diff server…I’d also suggest tht U read up on wht TSgrinder can do…. http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-mullen.pdf
Do report on how it works out,
Cheers
PS thnks fr the blog appreciation