Topic: fun fun fun with RDP's
I made this to scan for open RDP's, it's much more efficient to use nmap but perl is nice too^^ when you find one that's open you can use/make a brute force tool to get the password, you have to use a modified version of mstsc.exe or make one (or you'll be banned after some failed logins).
#!/usr/bin/perl
use IO::Socket;
use warnings;
use strict;
if ( @ARGV != 2 ) {
print "Kels RDP scanner usage: \n";
print "KelsRDPScan.pl [valid ip range] e.g: 24.156.128.0 24.156.255.255 \n";
exit 0;
}
my ( $startip, $end ) = map unpack( 'N', pack 'CCCC', split /\./ ),@ARGV;
my $netmask = 0xFFFFFF00; # 255.255.255.0
my $start = unpack 'N', inet_aton( $startip );
my $finish = unpack 'N', inet_aton( $end );
my $host='';
for my $ip ( $start .. $finish ) {
next if ( $ip & $netmask ) == $ip or ( $ip & ~$netmask ) == ~$netmask;
$host = inet_ntoa( pack 'N', $ip );
if (IO::Socket::INET->new(
PeerAddr => $host,
PeerPort => '3389', #Change this if your scanning for any other service.
Proto => 'tcp',
Timeout => "2",
)) {
print "$host RDP [OPEN].\n";
} else {
print "$host RDP [CLOSED].\n";
}
}And never forget, a VPN is your bestest friend!
on RDP since then