1

I'm running an Nmap brute force against metasploitable2 (telnet). The script is stopping on the first found username/password and is not iterating through the entire user/password file i have provided. I have tried using all appropriate args but no luck. Any ideas?

nmap -vv -p 23 --script telnet-brute --script-args userdb=users.txt,passdb=pw.txt --script-args telnet-brute.emptypass=true --script-args telnet-brute.firstonly=false TARGETIP

Improve this question
6
  • Could you try it this way and report back? nmap -p 23 --script telnet-brute --script-args userdb=users.txt,passdb=pw.txt,brute.emptypass=true,brute.firstonly=false <targetip>
    – GreatSeaSpider
    Dec 18, 2015 at 14:49
  • 1
    i think it's because any instance of firstonly causes the condition to be true. just leave it out. the default is to keep bruting
    – atdre
    Dec 18, 2015 at 18:33
  • @duckcake use @username to address people - they will get a notification when you do that
    – schroeder ♦
    Dec 19, 2015 at 5:14
  • @GreatSeaSpider for some reason your command didn't return any positive results, even though the correct words were in the respective files.
    – 16b7195abb140a3929bbc322d1c6f1
    Dec 19, 2015 at 11:03
  • @atdre This is what i tried initially, but it didn't work, which is why i included the telnet-brute.firstonly=false arg.
    – 16b7195abb140a3929bbc322d1c6f1
    Dec 19, 2015 at 11:04

1 Answer 1

Reset to default
2

Solution found. --script-args can only be called once, contrary to the documentation at: https://nmap.org/nsedoc/scripts/telnet-brute.html.

The successful command is:
nmap -d -vv -p 23 --script telnet-brute --script-args "userdb=users.txt,passdb=pass.txt,telnet-brute.emptypass=true,telnet-brute.firstonly=false" TARGETIP

Thanks for your help @GreatSeaSpider, @atdre, @schroeder

Improve this answer
6
  • Thanks for pointing this out. Fixed the documentation in r35530, should propagate to the web docs shortly.
    – bonsaiviking
    Dec 19, 2015 at 15:27
  • Also want to point out: --script-args-file is a handy way to deal with long or complicated arguments, especially since it removes the need to quote stuff for the shell and lets you use newlines instead of commas to separate args.
    – bonsaiviking
    Dec 19, 2015 at 15:30
  • awesome, trying --script-args-file now.
    – 16b7195abb140a3929bbc322d1c6f1
    Dec 20, 2015 at 2:24
  • @bonsaiviking. I think may have found another issue. The args are all being passed correctly but telnet-brute is only brute forcing the first 2 correct instances. Is there a way of making it brute force all instances?
    – 16b7195abb140a3929bbc322d1c6f1
    Dec 20, 2015 at 2:29
  • It shouldn't be doing that. Are you using Nmap 7.01? telnet-brute got an overhaul recently. If so, we can take a look at your logs with -d3 --script-trace to determine the reason. #nmap on freenode IRC or [email protected]
    – bonsaiviking
    Dec 20, 2015 at 4:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .