Luigi Auriemma

well i did

ventrilofp -j -b 10 az server:port

it did this:

- Ventrilo 3 server handshake:
c2 cd 02 d0 aa bf a2 e1 91 77 3f e8 7e 73 f5 70 .........w?.~s.p

Player: 3/50

- password found!!!

where is the password?

that happens usually when the server doesn't use the password (so NOT Auth=1 and password=thepassword).
anyway from ventrilo 3.x have been finally added checks to avoid brute forcing attacks

luigi hey man sup? When I try to crack a servers password after i say about 20-50 passwords i get this error
Player:
- connection interrupted by the server, probably it uses a different protocol

- server full or players_per_IP limit reached or something wrong
- wait to retry:

Anyways I found something odd you know how if you put -m at the end of your ventrilo's target so it be "C:\Program Files\Ventrilo\Ventrilo.exe" -m you can open up multiple vents. Well anyways I be connected to one vent and i be trying to get a pw in another and then I get the above error. I open up another ventrilo window and some how it fixes the problem for the brute forcer it will go on for about the same ammount as before and get the problem again i close out of that ventrilo open another and it fixes it yet again. I just dont understand how opening up a ventrilo window will fix the issue for ventfp to let the brute force go again. Kinda odd just wanted to let ya know and hopefully some how u can resolve the issue :).

if the problem happens with a 3.x server you must try the new version of ventrilofp released yesterday.

the fact that if you open multiple ventrilofp the problem doesn't happen or happens more limited means (or seems to mean) that the cause is a congestion created by too much consecutive connections to the server without a minimal delay which instead is created (manually) if you have other instances of the PoC.

so try to check if with -d 100 or more the problem continues.

I'm curious Luigi,

Is their a way to capture the hash of a ventrilo admin pass so it can be brute forced offline?


I'm not sure if hash is the right word maybe the handshake of the admin password so a attack can be done offline? Instead of people getting banned after I think 3 wrong passwords?


Similar to a WPA/WPA2 attack as their done offline.

uhmmm if you can get the hash of the admin it's a security vulnerability.
then it's not necessary to brute force it, in ventrilo the hash is used as replacement of the password so the hash IS the password when we talk about a ventrilo client-server connection.

ok aluigi i tried that and well just to show ill put up my command line i was using ventfp\ventfp.exe -n Jake -d 100 -j -w C:\ventfp\pw.txt IP:PORT


Player:
- connection interrupted by the server, probably it uses a different protocol

- server full or players_per_IP limit reached or something wrong
- wait to retry:
3

and server isnt full :D