today I'm going to be showing you how to make a batch file that fot forces a login on another computer and how to defend yourself against it just a disclaimer that this video is for educational purposes only and you should not be using the things in this video on someone else without their permission so anyway let's get into it so back in my skid days aside from using grabify on a daily basis something that I love doing was making batch files now I would make menus where it's like oh which program do you want to open it it would have all my tools on there I would make prank viruses I would make all all sorts of stuff but anyway one badge file one tool that's specifically stuck with me that I've been wanting to make a video about for quite a while now is the SMB brot forcer now you don't need to install visual you don't need anything for this right all you need is notepad and you can literally make a brute forcer with batch now when it comes to batch file tools this is like the coolest but simplest one and I did come up with this one on my own it just came to me but someone probably you know okay whatever I'm not going to take the credit for this but yeah don't be using this as a malicious tool it's a good exercise for when you're learning cyber security when you're starting out it teaches you about the SMB protocol the attacks how to defend yourself against it very educational so without further Ado let's get straight into it okay so on your computer you want to load up any text editor I'm going to be using notepad plus one cuz you know what so if you're on notepad++ like me head over to language B and then badge and this is just going to highlight badge syntax all right so if if you didn't know you should probably know this if you watch my channel but you start every single badge file with at Echo off no cuz if you open up command prompt uh you see the Microsoft Windows The Prompt and you don't want to be seeing this while you're executing so it just gets rid of the prompt so it's not in the way all right so we need three things while making this brute forcer we need the IP address so you know which host we're going to be connecting to we need the username switch username to run the attack on and number three we need the word list which is going to have the list of the passwords that we're going to cycle through okay so this is the variable name you can call this whatever you want and here's the prompt that we're going to show so we're going to say enter your IP address and then whatever inputed here is going to be saved an IP address so wait let's just test this out and to go Echo IP here we go now let's run it enter IP address okay here so we know that whatever we put in here get saved we know that everything's working fine let's keep going so just copy this twice and for the next one do user or whatever username and over here we're going to input the username and last one is going to be word list enter password list all right so I have my password list right here pass list.txt and it just has a bunch of you know passwords in it and what we want our program to do is to Loop through each one so it's going to attempt this then this then this then this then this so in batch that's going to look like 4-f a and our variable name is W list so in W list we're going to do you know for now let's let's just make sure that it works so Echo a so what this should do is just blind by line show us all the passwords that are here to make sure that it's working so contrl s to save it should be blue and then enter password list and yep that just that looped through all the passwords did it pretty quick so we know that this is working okay so now we're actually going to have to do the logins so let me give you a quick lesson on how SMB works so in command prompt if we wanted to connect to another computer with SMB we'd have to go net use SL slash and then the IP so this could be you know whatever we want I'm just going to do myself to specify the username you want to go Das user and you type in the username and then whatever you type after username is going to be specified as the password so if I go 1 2 3 4 we're basically going to be logging into this IP with this username that's authenticated with this password username or password is incorrect and if we had the correct username and password it would let us in so let's copy this Command right here so that whole net use thing we're not going to do in this loop we're actually going to make another we're going to create a function to call it in so right here attempt this is going to be each attempt and we're going to set the variable pass or you can set it as like I don't know attempt pass equals percentage a it's going to call attempt so over here I'm going to paste the command and for the IP we're just going to go percentage IP percentage for the user same thing and for the password we set it as pass but now how do we check if we're actually logged in or not cuz we can just have the attempts going going and it could log Us in and it could keep going we don't know right so how we do know is by the error level environmental variable so let me show you how that works now we're going to open up command prompt again okay so what an environmental variable is is a variable that's just predefined on your computer um there are many examples like comspec this is where it's the location of your command prompt so see Windows system 32 now I didn't Define this variable this is just an environmental variable that just pre-exists so now there's a variable called error level and this is very useful for what we were trying to do because it basically gives us the error code of the program when it exits so when net use exits when you know finishes executing it basically exits and it leaves us to code so if something went wrong if the login was wrong if the connection wasn't there if you know some other error was happening it it would return something that's not zero and that's how we know that something went wrong so if we Echo error level now it's zero cuz you know there were no errors now let's try going n use connect to myself again this isn't a use my system username or password incorrect we'll go back to Echo error level and now we see that it's two and we can check this in the badge file now if we connect successfully so then the error level should be zero so it's going to try the attempt and if error level is equal to two actually wait if error level is equal to zero so if we want successfully we're going to go to success which is a function that we're going to make in a sec and now if it isn't we're just going to type then we're going to Echo the attempt we're going to say that this actually we should do the attempt before we should be yeah Echo attempt yeah display the attempt okay so now the success function I don't even know if these are called functions so don't flame me in the comments but that's what I call them so whatever so when we're successfully logged in we of course want to you know let the user know we're going to go Echo password found wait let me make this Capital you know let me make this look password found and here we can just Echo pass we're going to pause we're just going to give it a you know press any key to enter and then exit which is going to exit the program okay let's look over the code Echo off gets the IP gets the username gets the password starts looping and calls attempt each time goes for the attempt displays it if error level is zero go to success so if the login was successful go to success um if not it's just going to keep going but if it does it's going to say password found pause exit but let's say hypothetically the password isn't found right so after the for loop we're just going to say um Echo password not found give him a little sad face then pause exit Okay so let's see how this runs we're going to run tool up at and enter password list pass list.txt oh whoa whoa whoa whoa a few things are wrong here uh number one multiple connections to a server by the same resource are not allowed okay so I'm already connected to myself that's why it's giving us this air um and how we get rid of this is that we have to disconnect from ourselves and that command is putting in the ip- d-y and then it's gonna you know get rid of it so we need to add that after the success message so people disconnect after so they don't get that issue so we're just going to put an IP here oh what the so we're just going to put in IP here and another problem is that it's displaying this in the first place we don't want you know the output to be shown to the user like this looks messy so what we would usually do this doesn't fully hide the output cuz it doesn't hide the air so we're going to have to add a two and one now it's not going to show this output and we should also use it here okay so let's try it again here's my password list boom password found password so it works okay yeah okay that's good now let's clean this up a little I'm going to just make a couple of changes to make it look better [Applause] [Music] [Applause] [Music] all right so let me show you the final product we got tool. bat we got o SMB Brute Force by B man you know just like the old days I would always add this to the title enter IP address username password and boom that was quick so yeah I changed the title changed the color added an attempting so you know you can see how many attempts went by and I'll put this code on my GitHub so you know if you want to Skid me then you can our password is only nine password is deep let's try putting it like deeper okay this is the password let's move down like quite a bit yeah this has to be like at least a few hundred uh and let's see how fast it you know does this oo damn yeah that's pretty quick oh it's already at 100 already at 200 okay damn this is password found yeah so we have like zero ping since we're testing this out on ourself um that's another reason why it's going by this fast so let me actually test this out on my brother's laptop see how well it works okay so I just convinced my brother to change the administrator password um and I'm going to you know try this out on him now with his permission of course you should only be doing this with other people's permission as you know educational purposes only now this is his IP username is also administrator we're going to be using the same password list we see it's a little slower but um still going good uh by the way let me know what you think about the new webcam you know kind of feel like kaai SN now it's uh it's wide angle way hold up let me switch it real quick yeah like I feel like a streamer when it's like this you know you can just see my whole room could have people in here on the second Channel I'm probably going to put up like maybe like an Omega video you know those look pretty fun all right there we go so attempt 949 we got the password so my brother's laptop is in the other room you know threw a couple of walls and it took around like how much 30 seconds to go through a th000 attempts which is actually pretty quick you can make it even quicker by like modifying the code and um you know make it look better and stuff this is like I literally just piece this together in a few minutes to defend yourself against this you want to make sure unless you needed that you have SMB disabled that you don't have Network shares open so people you know can earn Brute Force attacks also use complicated passwords so that there's basically no chance that they show up in any of these password lists so your account has a very low chance of getting cracked and there's also a setting in Windows you can limit the number of login attempts in an hour or for a certain time to prevent The Brute forcing in the first place so after you know a few attempts it gets blocked and they cannot brute force it anymore so yeah that's how you prevent this to stay safe and uh help others do that too anyway the code will be in my GitHub if you want to modify it or just skit it let me know what you thought about this video and if you want like more uh you know coding tools follow along this type of stuff definitely let me know in the comments cuz I like making these like and sub to my channel if you enjoy the videos and I'll see see you next time