Inside GoBruteforcer AI-generated server defaults, weak pass...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2026/inside-gobruteforcer-ai-generated-server-defaults-weak-passwords-and-crypto-focused-campaigns/
• Blog Title: Inside GoBruteforcer: AI-generated server defaults, weak passwords, and crypto-focused campaigns
• Suggested Section: HackTricks Main → Pentesting Web (Web shells / post-exploitation one-liners) and/or Generic Hacking → Brute Force - CheatSheet / Exfiltration; plus Linux Privilege Escalation/Post-Exploitation notes for cron persistence and process masquerading (prctl PR_SET_NAME, argv overwrite) and single-instance mutex via localhost port bind

🎯 Content Summary

This post analyzes GoBruteforcer (GoBrut), a modular Go-based Linux botnet toolkit that turns compromised servers into random-public-IP scanners and password brute-forcers. It is not a CVE/0-day exploit chain; it primarily succeeds via weak/default credentials and misconfigurations across FTP (21/tcp), MySQL (3306/tcp), PostgreSQL (5432/tcp), and phpMyAdmin over HTTP/80. The observed 2025 wave includes a rewritten/obfuscated IRC bot (control plane) plus a downloaded bruteforcer (scan plane), and...

🔧 Technical Details

Brute-forcing at scale can be implemented as an architecture-tuned worker pool where each worker selects a random public IPv4 target, filters out reserved/private/high-risk ranges, probes the relevant port with a short timeout, then attempts plaintext logins using a shuffled credential list; successful credentials can be exfiltrated via lightweight HTTP GET beacons (e.g., a /pst endpoint) containing service identifiers and any extra metadata such as discovered admin paths.

If an attacker gains FTP credentials on stacks where FTP root maps to a web server document root (e.g., common XAMPP/ProFTPD deployments), they can upload a web shell into the webroot and use it to execute one-liner download-and-execute stagers (e.g., wget -qO - URL || curl URL) that fetch an architecture-specific payload. A simple stager can enforce update semantics using checksum validation (e.g., MD5) and fall back to /tmp if the current directory is not writable/executable.

An IRC-based C2 can reduce hijacking/...

🤖 Agent Actions

Summary:

• Added an internet-scale bruteforce workflow to the Brute Force cheatsheet (architecture-tuned worker pools, IP filtering, probe-first logic, PMA path/version-aware auth, lightweight hit beacons) and included references.
• Documented the XAMPP FTP-to-webroot web shell pivot and architecture-aware stager usage in the FTP pentesting page, with references.
• Enriched Linux post-exploitation with cron-based persistence + loopback mutex patterns and process masquerading via prctl and argv overwrites, and updated references.

Tests:

• Not run (documentation-only changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2026/inside-gobruteforcer-ai-generated-server-defaults-weak-passwords-and-crypto-focused-campaigns/

Content Categories: Based on the analysis, this content was categorized under "HackTricks Main → Pentesting Web (Web shells / post-exploitation one-liners) and/or Generic Hacking → Brute Force - CheatSheet / Exfiltration; plus Linux Privilege Escalation/Post-Exploitation notes for cron persistence and process masquerading (prctl PR_SET_NAME, argv overwrite) and single-instance mutex via localhost port bind".

Repository Maintenance:

• MD Files Formatting: 936 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0