MEDUSA(1)

💖 MEDUSA(1) 💖

okay bestie, listen. this is the manual page for MEDUSA, and yes it lives in the General Commands Manual like the icon it is. no cap, it's a whole personality and it brute-forces logins. let's get into it 🦋

---

🌸 NAME 🌸

MEDUSA — Parallel Network Login Auditor. that's it, that's the name, and honestly? iconic. 💅

---

✨ SYNOPSIS ✨

medusa [-h host|-H file] [-u username|-U file] [-p password|-P file] [-C
file] -M module [OPTIONS]

---

💜 DESCRIPTION 💜

okay so Medusa is here to be a speedy, massively parallel, modular, login brute-forcer. the goal is literally to support as many services that allow remote authentication as possible — like, all of them, bestie. 🫶

the author considers these the key features, and honestly they ate:

• Thread-based parallel testing. brute-force testing can happen against multiple hosts, users or passwords concurrently. it's giving multitasking main character energy. 🔥
• Flexible user input. target info (host/user/password) can be specified in a whole bunch of ways. for example, each item can be either a single entry or a file containing multiple entries. plus there's a combination file format that lets you refine your target listing. so many options, so much power. ✨
• Modular design. each service module exists as an independent .mod file. meaning: no modifications are necessary to the core application in order to extend the supported list of services for brute-forcing. plug and play, periodt. 💅

---

👑 OPTIONS 👑

• -h [TARGET] — target hostname or IP address. where we're going, bestie. 🌈
• -H [FILE] — reads target specifications from the file specified rather than from the command line. the file should contain a list separated by newlines. ✨
• -u [TARGET] — target username. 🎀
• -U [FILE] — reads target usernames from the file specified rather than from the command line. the file should contain a list separated by newlines. 🌸
• -p [TARGET] — target password. 🔐
• -P [FILE] — reads target passwords from the file specified rather than from the command line. the file should contain a list separated by newlines. 🦋
• -C [FILE] — file containing combo entries. combo files are colon separated and in the following format: host:user:password. if any of the three fields are left empty, the respective information should be provided either as a single global value or as a list in a file.

the following combinations are possible in the combo file:

1. foo:bar:fud
2. foo:bar:
3. foo::
4. :bar:fud
5. :bar:
6. ::fud
7. foo::fud

Medusa also supports using PwDump files as a combo file. the format of these files should be user:id:lm:ntlm:::. we look for ::: at the end of the first line to determine if the file contains PwDump output. 👀

• -O [FILE] — file to append log information to. Medusa will log all accounts credentials found to be valid or cause an unknown error. it will also log the start and stop times of an audit, along with the calling parameters. receipts, bestie. 🧾
• -e [n/s/ns] — additional password checks ([n] No Password, [s] Password = Username). if both options are being used, they should be specified together ("-e ns"). if only a single option is being called use either "-e n" or "-e s". ✨
• -M [TEXT] — name of the module to execute (without the .mod extension). 🎀
• -m [TEXT] — parameter to pass to the module. this can be passed multiple times with a different parameter each time and they will all be sent to the module (i.e. -m Param1 -m Param2, etc.) 💫
• -d — dump all known modules. show me what you got. 👑
• -n [NUM] — use for non-default TCP port number. 🔌
• -s — enable SSL. 🔒
• -g [NUM] — give up after trying to connect for NUM seconds (default 3). ⏳
• -r [NUM] — sleep NUM seconds between retry attempts (default 3). 😴
• -R [NUM] — attempt NUM retries before giving up. the total number of attempts will be NUM + 1. 🔁
• -c [NUM] — set the number of usec that are waited during a test of the established network socket. some services (e.g. FTP, IMAP, POP3, and SMTP) may be configured to drop connections after an arbitrary number of failed logon attempts. we try to reuse the established connection to send authentication attempts until this disconnect occurs, at which point the connection is reestablished. to accomplish this, we check the socket to see if it's still alive before authenticating within select modules. the default is perform a 1 usec check. it may be necessary to specify much larger values. for example, a 1000 usec was needed against our test vsftp server to avoid issues with its built-in anti-bruteforce mechanisms. 😭
• -t [NUM] — total number of logins to be tested concurrently. it should be noted that roughly t x T threads could be running at any one time. 381 appears to be the limit on my fairly boring Gentoo Linux host. 💀
• -T [NUM] — total number of hosts to be tested concurrently. 🌐
• -L — parallelize logins using one username per thread. the default is to process the entire username before proceeding. 🧵
• -f — stop scanning host after first valid username/password found. 🛑
• -F — stop audit after first valid username/password found on any host. 🛑🛑
• -b — suppress startup banner. shy era. 🙈
• -q — display module's usage information. this should be used in conjunction with the "-M" option. for example, "medusa -M smbnt -q". ❓
• -v [NUM] — verbose level [0 - 6 (more)]. all messages at or below the specified level will be displayed. the default level is 5.

the following is the breakdown of the verbose levels:

1. EXIT APPLICATION
2. MESSAGE WITHOUT TAG
3. LOG MESSAGE WITHOUT TAG
4. IMPORTANT MESSAGE
5. ACCOUNT FOUND
6. ACCOUNT CHECK
7. GENERAL MESSAGE

• -w [NUM] — error debug level [0 - 10 (more)]. all messages at or below the specified level will be displayed. the default level is 5.

the following is the breakdown of the error levels:

1. FATAL
2. ALERT
3. CRITICAL
4. ERROR
5. WARNING
6. NOTICE
7. INFO
8. DEBUG
9. DEBUG - AUDIT
10. DEBUG - SERVER
11. DEBUG - MODULE

• -V — display version. ⭐
• -Z [TEXT] — allows basic resuming of a previous scan. the supplied parameter describes which hosts were completed, which were partially tested and which had not been started. when Medusa receives a SIGINT, it will calculate and display a "resume map". this map can then be supplied to the next run. for example, "medusa [OPTIONS PREVIOUSLY USED] -Z h6u1u2h8.". in this particular example, hosts 1-5 were completed, host 6 was partially done (user 1 was partially completed and user 2 and beyond had not been started), host 7 was completed and host 8 and beyond had not been started. Medusa will parse this map and skip hosts and users accordingly.

it should be noted that only host and user-level, not password-level, resuming is supported. if a user had been previously started, but was not completed, it will be tested from the start of its respective password list. 😤

---

🫶 AUTHOR 🫶

JoMo-Kun <jmk@foofus.net> and fizzgig <fizzgig@foofus.net> — the legends themselves. 💖

---

🐛 BUGS 🐛

found a bug? feel free to send in a patch. we love a contributor era. ✨

---

and that's the whole page, bestie 🎀 this was MEDUSA(1) straight out of the General Commands Manual — go forth, be parallel, be modular, and slay. 💅🌈⭐