help with ventrilofp

keven01 · **Joined:** 18 Feb 2009 22:50 **Posts:** 3

hi i i want to know wat the command line that finds out the password for a user in ventrilo and im new to this stuff so any help .....pweezz

keven01 · **Joined:** 18 Feb 2009 22:50 **Posts:** 3

o i mean the admin password :)

aluigi · **Posted:** 20 Feb 2009 17:17

ventrilofp is not a password recovery tool, I think you are confused

keven01 · **Joined:** 18 Feb 2009 22:50 **Posts:** 3

well when i saw the brute forcer i thought it would findout the admin password

aluigi · **Posted:** 20 Feb 2009 23:55

remote brute forcing and wordlist attacks are only for testing and research reasons because there are no "real" chances (for tons of reasons that are too boring to list) to guess the password (otherwise they were considered vulnerabilities)

capped · **Joined:** 19 Apr 2009 08:45 **Posts:** 11

I was interested in this brute force option in ventfp as well. Is there a way to break a ventrilo password?
meaning gain access to a ventrilo server without knowing the password......

aluigi · **Posted:** 19 Apr 2009 11:55

not in a real world for various technical reasons (obviously if the server is a 2.x version, the password is very basic and nobody checks the logs that's possible but choosing a strong password and being a real administrator is a duty of the admin)

Sethioz · **Posted:** 21 Apr 2009 00:16

everything is possible, only that it may take like 10mil years on single computer. bruteforcing a 4 character lower_alpha password remotely, takes about 2-4 days, depending on the lag and your upload. so add 1 more character (5 letter pass) and it would take over 10 days, add one more (6) and its prolly over 30 days. can't bother to do calculations, but its just something out of my head, because ive done this to chatrooms and other web-based things.

However if you use a STRONG wordlist, then you may get admin pass in month or so. strong wordlist is something that has very commonly used words + phrases + words/phrases combined with common numbers.

Luigi you are so very wrong here (cant blame you, because brute forcing and hacking is not your field), 90% of server, game, site..etc admins are using very weak passwords. ive seen that admin on a big forum (over 30000 users) uses 5 letter lower_alpha password. ofcourse forum is other thing, because 99% of sites/forums will lock you out when you try to guess password or simply asks for confirmation, so its quite impossible to brute force it.

How you get strong wordlist ? simple as that, you make it. i used my msn chatlogs, some sites and some openwall wordlists and then mixed it all together with Raptor, XVI32 and few other tools

capped · **Joined:** 19 Apr 2009 08:45 **Posts:** 11

interesting, thanks for the reply though. now i understand the logistics a little more clearly lol.

capped · **Joined:** 19 Apr 2009 08:45 **Posts:** 11

I was fooling around with fp again and was trying to get this to run through sockscap but wont because it is through cmd prompt only from what i understand. I did a search for ventrilofp GUI's found one on the forum here made by jd but the link is dead. Was wondering if anyone had a GUI for the latest version of Ventrilofp?

aluigi · **Posted:** 22 Apr 2009 16:07

in sockscap you can specify all the arguments you want in the "Command Line" entry, example:
Command Line: c:\ventrilofp.exe -p mypass -f 10 -1 127.0.0.1:1234

dor_g · **Joined:** 18 Apr 2008 10:28 **Posts:** 36

If you want a GUI just make your own.
VB6 is a great software to easily make your own GUI.

You can make something like this:

Picture:

Picture Link: http://dor.880mb.com/portscanner.JPG

aluigi · **Posted:** 22 Apr 2009 17:38

another "crazy" idea can be the adding of cmd.exe to sockscap so any network-related tool called from there will automatically use the proxy server

capped · **Joined:** 19 Apr 2009 08:45 **Posts:** 11

ok yeah thats what i did but i didnt know for sure if it was behind proxy or not.

capped · **Joined:** 19 Apr 2009 08:45 **Posts:** 11

Ventrilo Fake Players DoS and brute forcer 0.2.9
by Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org

- target: 76.74.141.133 : 3852
- activated 3.x protocol
- use default 3.0.0 version (protocol 3)

- get server's hash through centralized Ventrilo servers:
. 76.74.141.133:3852
. 72.51.46.31:6100
. 64.34.178.178:6100
. 74.54.61.194:6100
. 70.85.110.242:6100
- Ventrilo 3 server handshake:
14 5b b8 e8 2d 55 1a 23 91 87 db eb 13 e5 fa b1 .[..-U.#........

Player:
Error:

ok i am getting this after putting in ventrilofp.exe -p [password] -f 10 -1 [ip:port]

i have ventrilofp inside my ventrilo directory, that should not matter correct?

aluigi · **Posted:** 23 Apr 2009 02:59

no, that doesn't matter because ventrilofp is a stand-alone tool.

I guess the problem is caused by the different IP used for getting the server handshake (udp) and for connecting to the server (TCP).
for example Tor is a tcp-only socks server network so when your proxified ventrilofp gets the handshake your local IP address is "authorized" but when it connects to the server it reaches it with the proxy server's IP address and so the connection is immediately closed by the server.

you can test this asking to a friend of you to launch proxymini temporary and then using his IP and port 8123 as socks server, if ventrilofp works means that the above explanation is the reason

JD · **Joined:** 08 Jun 2008 07:17 **Posts:** 92

capped here's my GUI: http://www.teamx2x.com/Pages/VEX.html

Proxy's do not work with ventrilo for some reason.. I've tryed all the way's I could think of.
You can still change your IP via cable/modem though.

Dor_G that GUI is major over kill ITS HUGE. :O
I think people nowadays like Neat simple GUIs

Sethioz · **Posted:** 24 Apr 2009 13:10

as far as i know, GUIs always fuck up, at least thats what ive got. ive tried few cmd programs that had GUI version written for it, but GUI never works fine, it gets stuck or lags or simply won't connect at all.
I just don't see the reason why even bother with GUI so much if cmd version works just fine (i mean why even search for it..etc if cmd version is way faster to use) ?
best thing ive seen is the cmd based GUI, not sure how its called, but it has .exe written, which will open cmd window and will ask you to input things. Aircrack has such version.

capped · **Joined:** 19 Apr 2009 08:45 **Posts:** 11

Hey, thanks for the link there. Sorry i have been away.

How would i change my IP, it was my understanding that with cable you couldn't.

Sethioz · **Posted:** 08 May 2009 00:10

maybe this will help you > How to change your External IP
note that i may have made some mistakes in it ... so don't start blaming, instead just correct me if theres any errors.

OR you can search google for open proxy servers that support TCP/UDP, however most likely they all lag quite lot. 300ms is best ive ever got

capped · **Joined:** 19 Apr 2009 08:45 **Posts:** 11

Yeah i have explored open proxies, more hassle then they are worth. I did stumble upon this though
http://www.your-freedom.net/index.php?i ... d_uid=3840