Hydra - Revision history

Unknown user: /* Reality Check */

2022-03-02T17:04:40Z

Reality Check

← Older revision		Revision as of 17:04, 2 March 2022
Line 167:		Line 167:
	service		service
	</pre>		</pre>

	~~===Reality Check===~~

	Quick reality check: brute-forcing SSH logins is very slow (limited by how many SSH connections a victim's SSH server will accept), so if you have access to <code>/etc/shadow</code>, you might as well crack those passwords offline with [[John the Ripper]].

	==Start==		==Start==

Unknown user: /* Reading /etc/shadow */

2022-03-02T17:04:18Z

Reading /etc/shadow

← Older revision		Revision as of 17:04, 2 March 2022
Line 121:		Line 121:
	===Reading /etc/shadow===		===Reading /etc/shadow===

	If you have access to <code>/etc/shadow</code>, you have access to the encrypted passwords. ~~Don~~'~~t use Hydra - use~~ <code>/etc/shadow</code>.		If you have access to <code>/etc/shadow</code>, you have access to the encrypted passwords offline. DON'T USE HYDRA! It is way, way slower to crack passwords online with a live system than it is to crack them offline. If you have <code>/etc/shadow</code>, use [[John the Ripper]] to crack passwords.

	~~For some more info on~~ how to read the <code>/etc/shadow</code> file:		Her's how to read the <code>/etc/shadow</code> file:

	<pre>		<pre>
Line 132:		Line 132:
	</pre>		</pre>

	There are 8 fields ~~here~~:		There are 8 fields per line:
	* Username : It is ~~your~~ login name.		* Username : It is the login name.
	* Password : It is ~~your~~ encrypted password. The password should be minimum 6-8 characters long including special characters/digits and more.		* Password : It is the encrypted password. The password should be minimum 6-8 characters long including special characters/digits and more.
	* Last password change (lastchanged) : Days since Jan 1, 1970 that password was last changed		* Last password change (lastchanged) : Days since Jan 1, 1970 that password was last changed
	* Minimum : The minimum number of days required between password changes ~~i.e. the number of days left before the user is allowed to change his/her password~~		* Minimum : The minimum number of days required between password changes
	* Maximum : The maximum number of days the password is valid (after that user is forced to change his/her password)		* Maximum : The maximum number of days the password is valid (after that user is forced to change his/her password)
	* Warn : The number of days before password is to expire that user is warned that his/her password must be changed		* Warn : The number of days before password is to expire that user is warned that his/her password must be changed
	* Inactive : The number of days after password expires that account is disabled		* Inactive : The number of days after password expires that the account is disabled
	* Expire : days since Jan 1, 1970 that account is disabled i.e. an absolute date specifying when the login may no longer be used.		* Expire : days since Jan 1, 1970 that account is disabled i.e. an absolute date specifying when the login may no longer be used.

	The most important two fields~~, then~~ are the first two:		The most important two fields are the first two:

	<pre>		<pre>

Unknown user: /* Procedure */

2022-03-02T17:00:05Z

Procedure

← Older revision		Revision as of 17:00, 2 March 2022
Line 42:		Line 42:
	* Run Hydra		* Run Hydra

	The ideal scenario is that we can brute force an SSH login for the root user. However, ~~this is typically disabled in SSH~~ servers, ~~so not~~ the ~~way to go~~.		The ideal scenario is that we can brute force an SSH login for the root user. However, many OpenSSH servers disable root login by default. To be successful, we will need to obtain or guess a username or list of users on the system.

	~~To be successful, we will need to obtain or guess a username or list of users on the system.~~ This can be done in a couple of different ways.		This can be done in a couple of different ways.

	Two methods that utilize SQL servers are covered in [[Metasploitable/MySQL]] and [[Metasploitable/Postgres]]. Both pages cover techniques for obtaining <code>/etc/passwd</code> contents with metasploit.		Two methods that utilize SQL servers are covered in [[Metasploitable/MySQL]] and [[Metasploitable/Postgres]]. Both pages cover techniques for obtaining <code>/etc/passwd</code> contents with metasploit.

	Another method that will tell you which users can log in remotely and which cannot is to obtain the <code>/etc/shadow</code> file. However, if you have <code>/etc/shadow</code>, you can just crack the passwords offline with [[John the Ripper]], so...... don't use Hydra if you have <code>/etc/shadow</code>.		Another method that will tell you which users can log in remotely and which cannot is to obtain the <code>/etc/shadow</code> file. However, if you have <code>/etc/shadow</code>, you can just crack the passwords offline with [[John the Ripper]], so...... don't use Hydra if you have <code>/etc/shadow</code>.

			There are other techniques that don't rely on technology - using social engineering, for example, to figure out the schema used for usernames.

	Once you have a list of users, you'll need some wordlists to construct passwords to try.		Once you have a list of users, you'll need some wordlists to construct passwords to try.

Admin: /* Flags */

2017-04-16T21:06:38Z

Flags

← Older revision		Revision as of 21:06, 16 April 2017
Line 260:		Line 260:
	* vmauthd		* vmauthd
	* vnc		* vnc

			=Links=

			Dr. Chaos guide to using Hydra: http://www.drchaos.com/breaking-ssh-vnc-and-other-passwords-with-kali-linux-and-hydra/

	=Flags=		=Flags=

Admin: /* Start */

2017-04-16T21:04:37Z

Start

@@ Line 171: / Line 171: @@
 ==Start==
 <pre>
 # hydra -L users_file -P 500-worst-passwords.txt ssh://10.0.0.27:22
 Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
@@ Line 183: / Line 209: @@
 </pre>
-This is extremely slow when compared to an offline password-cracking method like John the Ripper - if we have the <code>/etc/shadow</code> file, we should probably use that, instead of trying to brute-force SSH logins.
+This is extremely slow when compared to an offline password-cracking method like John the Ripper - online cracking should only be used as a last resort. If it is possible to obtain the password hashes from <code>/etc/shadow</code> or elsewhere, and crack offline, do that instead.
-Brute-forcing SSH logins requires a lot of time, a lot of patience, and a series of very good guesses. In general, it is not terribly practical.
+Brute-forcing SSH logins requires a lot of time, a lot of patience, and a series of very good guesses. In general, it is not a terribly practical way to do it, unless you've got extra/insider information.
 =But Wait, There's More!=

Admin: /* Flags */

2017-04-16T20:58:53Z

Flags

← Older revision		Revision as of 20:58, 16 April 2017
Line 186:		Line 186:

	Brute-forcing SSH logins requires a lot of time, a lot of patience, and a series of very good guesses. In general, it is not terribly practical.		Brute-forcing SSH logins requires a lot of time, a lot of patience, and a series of very good guesses. In general, it is not terribly practical.

			=But Wait, There's More!=

			Hydra is not just for cracking SSH servers. The following is a list of other protocols that can be cracked using Hydra:
			* afp
			* cisco
			* cisco-enable
			* cvs
			* firebird
			* ftp
			* http-get
			* http-head
			* http-proxy
			* https-get
			* https-head
			* https-form-get
			* https-form-post
			* icq
			* imap
			* imap-ntlm
			* ldap2
			* ldap3
			* mssql
			* mysql
			* ncp
			* nntp
			* oracle-listener
			* pcanywhere
			* pcnfs
			* pop3
			* pop3-ntlm
			* postgres
			* rexec
			* rlogin
			* rsh
			* sapr3
			* sip
			* smb
			* smbnt
			* smtp-auth
			* smtp-auth-ntlm
			* snmp
			* socks5
			* ssh2
			* teamspeak
			* telnet
			* vmauthd
			* vnc

	=Flags=		=Flags=

Admin: /* Procedure */

2017-04-16T20:57:03Z

Procedure

← Older revision		Revision as of 20:57, 16 April 2017
Line 51:		Line 51:

	Once you have a list of users, you'll need some wordlists to construct passwords to try.		Once you have a list of users, you'll need some wordlists to construct passwords to try.
			* [[Kali/Wordlists]]
			* [[Cewl]]

	==Step by Step==		==Step by Step==

Admin: /* Procedure */

2017-04-16T20:56:28Z

Procedure

← Older revision		Revision as of 20:56, 16 April 2017
Line 46:		Line 46:
	To be successful, we will need to obtain or guess a username or list of users on the system. This can be done in a couple of different ways.		To be successful, we will need to obtain or guess a username or list of users on the system. This can be done in a couple of different ways.

	Two methods that utilize SQL servers are covered in [[Metasploitable/MySQL]] and [[Metasploitable/Postgres]]. Both pages cover techniques for obtaining <code>/etc/passwd</code> contents with metasploit. However, if you have <code>/etc/~~passwd~~</code>, you can just crack the passwords offline, so...... don't use Hydra if you have <code>/etc/~~passwd~~</code>.		Two methods that utilize SQL servers are covered in [[Metasploitable/MySQL]] and [[Metasploitable/Postgres]]. Both pages cover techniques for obtaining <code>/etc/passwd</code> contents with metasploit.

			Another method that will tell you which users can log in remotely and which cannot is to obtain the <code>/etc/shadow</code> file. However, if you have <code>/etc/shadow</code>, you can just crack the passwords offline with [[John the Ripper]], so...... don't use Hydra if you have <code>/etc/shadow</code>.

	Once you have a list of users, you'll need some wordlists to construct passwords to try.		Once you have a list of users, you'll need some wordlists to construct passwords to try.

Admin: /* Reading /etc/shadow */

2017-04-16T20:54:40Z

Reading /etc/shadow

← Older revision		Revision as of 20:54, 16 April 2017
Line 114:		Line 114:

	===Reading /etc/shadow===		===Reading /etc/shadow===

			If you have access to <code>/etc/shadow</code>, you have access to the encrypted passwords. Don't use Hydra - use <code>/etc/shadow</code>.

	For some more info on how to read the <code>/etc/shadow</code> file:		For some more info on how to read the <code>/etc/shadow</code> file:

Admin: /* Obtaining Usernames */

2017-04-16T20:54:00Z

Obtaining Usernames

← Older revision		Revision as of 20:54, 16 April 2017
Line 111:		Line 111:
	</pre>		</pre>

	Bingo, now you have a list of users. Some of these ~~will probably~~ not be ~~set up with a shell, or~~ set up to log in remotely, ~~so choose wisely~~.		Bingo, now you have a list of users. Some of these may not be set up to log in remotely, but you'd be surprised. Most of the users also have a bash shell set!

	===Reading /etc/shadow===		===Reading /etc/shadow===