ritredteam / streetcred

Tool created for Red Team to test default credentials on SSH and WinRM and then execute scripts with those credentials before the password can be changed by Blue Team.

StreetCred

Tool created for Red Team to test default credentials on SSH and WinRM and then execute scripts with those credentials before the password can be changed by Blue Team.

Setup

The configuration file is located at config/config.yml. This is what will be looked for when the -c option is utilized.

If using the command line, just supply options as noted in the section below.

Using Docker

If you plan on using Docker, a config file must be used.

docker build -t default .
docker run default

Using the command line

go run main.go [options]
OR
go build main.go then ./main [options]

Example command

go run main.go -o output.txt -p password123 -u users.txt -b boxes.txt -s script.ps1

All Options

  -c
      If using a config file, use of this arg will set to bool value to true. Other arguments do not have to be provided.
  -b string
      Path to file containing list of boxes.
  -o string
      Output file name for successful responses. (default "output.txt")
  -p string
      Password to attempt on users and boxes.
  -s string
      Path to a script that should be executed on successful SSH/WinRM logon. If this option is not set, a script will not be executed.
  -u string
      Path to file containing list of users.

streetcred's Issues

create config file

Add functionality to BruhDotZip by creating a config file alternative.
The tool would read the config and substitute in the variables to the program at run time
Variables could be assigned in the config or via the command line.
Additionally, you can add an option -c/-configFile for the config file, which allows you to build multiple, separate configs for linux and windows

Add 'locksmith' mode - on logon w/ default creds, change all back to default

separate windows + linux functionality

make OS-specific functions contained within files (only run winrm on windows targets, ssh on linux, etc.)

Rewrite Config Parsing + CLI Arg Intake

From @mav8557
If need be we can use a struct - I have a repo somewhere doing this for an example. The idea then would be to read in the config file to a Config struct, then read in the arguments (so they overrule config file options) and then pass that parse configuration struct around where it's needed, as part of an application context. I can work on that later, but an example of what I mean is here: https://github.com/carolynvs/emote/blob/master/config/config.go#L23

Thread Pool

Right now three goroutines are spawned per user, per box. This is a lot and will get slow with a large network.

A thread pool architecture can help. A certain number of threads, passed as configuration, are spawned at the beginning, and pull Jobs from the same channel. Each Job represents a connection attempt against a particular box, including the Username, IP, and protocol (SSH, SMB, winrm, etc).

Docker

This seems like it would be very simple to Dockerize and it would make it simpler to deploy for future red teams

Name

Please change the name of this project (for the love of god)

Webhook Support

Add webhook support for Discord/Slack/etc, potentially as a reusable interface for logging passwords in general.