changeme

A default credential scanner.

changeme picks up where commercial scanners leave off. It focuses on detecting default and backdoor credentials and not necessarily common credentials. Its default mode is to scan HTTP default credentials but has support for other credentials.

changeme is designed to be simple to add new credentials without having to write any code or modules. changeme keeps credential data separate from the code. All credentials are stored in yaml files so they can be both easily read by humans and processed by changeme. Credential files can be created by using the ./changeme.py –mkcred tool and answering a few questions.

changeme supports the http/https, mssql, mysql, Postgres, ssh, ssh w/key, snmp, mongodb and ftp protocols. Use ./changeme.py –dump to output all of the currently available credentials.

You can load your targets using a variety of methods, single ip address/host, subnet, list of hosts, nmap xml file, and Shodan query. All methods except for Shodan are loaded as a positional argument and the type is inferred.

Changelog v1.2.3

Changes:

• Moving from yaml.load to yaml.safe_load – #91 @Graph-X
• Fixes in http_post scanner by @Graph-X

New Creds:

• Endpoint Protector
• iCatch or LILIN DVRs
• EON SNMP – h4knet
• Zyxel FTP – h4knet

Announcements

Likely the last version supporting python 2.7. A future plan is to move to Python 3 and reworking the scanning engine to take advantage of async.io instead of the current threading implementation.

Installation

changeme has only been tested on Linux and has known issues on Windows and OS X/macOS. Use docker to run changeme on the unsupported platforms.

git clone https://github.com/ztgrace/changeme.git
pip install -r requirements.txt

Usage

Scan a subnet for default creds:

./changeme.py -s 192.168.59.0/24

Scan a single host:

./changeme.py -s 192.168.59.100

Scan using a nmap file

./changeme.py -x subnet.xml

Scan a subnet for Tomcat default creds and set the timeout to 5 seconds:

./changeme.py -s 192.168.59.0/24 -n “Apache Tomcat” –timeout 5

Use Shodan to populate a targets list and check them for default credentials:

./changeme.py –shodan_query “Server: SQ-WEBCAM” –shodan_key keygoeshere -c camera

Scan for SSH and known SSH keys

./changeme.py -s 192.168.59.0/24 –protocols ssh,ssh_key

Copyright (C) ztgrace

Source: https://github.com/ztgrace/