Metasploitable/SSH/Brute Force - Revision history

Admin: /* Metasploitable */

2017-10-26T02:35:57Z

Metasploitable

← Older revision		Revision as of 02:35, 26 October 2017
Line 221:		Line 221:
	==Metasploitable==		==Metasploitable==

	~~We already covered how to brute force the login with Hydra, [[Metasploitable/SSH/Brute Force]]~~		You can also brute force an SSH login with Metasploitable - use the <code>auxiliary/scanner/ssh/ssh_login</code> module.

	~~Did you know you~~ can also brute force an SSH login with Metasploitable~~? Use~~ the <code>auxiliary/scanner/ssh/ssh_login</code> module.

	See [[Metasploitable/SSH/Exploits#Brute_Force_ssh_login]]		See [[Metasploitable/SSH/Exploits#Brute_Force_ssh_login]]

Admin: /* John the Ripper */

2017-10-26T02:35:38Z

John the Ripper

← Older revision		Revision as of 02:35, 26 October 2017
Line 218:		Line 218:

	See [[Metasploitable/John_Shadow_File]]		See [[Metasploitable/John_Shadow_File]]

			==Metasploitable==

			We already covered how to brute force the login with Hydra, [[Metasploitable/SSH/Brute Force]]

			Did you know you can also brute force an SSH login with Metasploitable? Use the <code>auxiliary/scanner/ssh/ssh_login</code> module.

			See [[Metasploitable/SSH/Exploits#Brute_Force_ssh_login]]

	=Flags=		=Flags=

Admin at 02:21, 26 October 2017

2017-10-26T02:21:50Z

← Older revision		Revision as of 02:21, 26 October 2017
Line 153:		Line 153:
	</pre>		</pre>

	=~~Using Hydra~~=		=Passwords=

	~~Once we have a list of users, e.g., from <code>/etc/passwd</code>, we can use~~ Hydra ~~to try and crack passwords via brute force.~~		==Hydra==

	==Usage==		Hydra is a brute-force SSH tool. It works by trying usernames/passwords remotely. It is very slow and should only be used as a last-ditch attempt.

			===Usage===

	If we just type hydra, we can see the basic usage:		If we just type hydra, we can see the basic usage:
Line 178:		Line 180:
	service the service to crack (see below for supported protocols)		service the service to crack (see below for supported protocols)
	OPT some service modules support additional input (-U for module help)		OPT some service modules support additional input (-U for module help)
			</pre>

			From the help message, you can see Hydra supports cracking many more services than just SSH:

			<pre>
	Supported services: asterisk cisco cisco-enable cvs firebird ftp ftps http[s]-{head\|get} http[s]-{get\|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram\|digest}md5][s] mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres rdp redis rexec rlogin rsh s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey teamspeak telnet[s] vmauthd vnc xmpp		Supported services: asterisk cisco cisco-enable cvs firebird ftp ftps http[s]-{head\|get} http[s]-{get\|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram\|digest}md5][s] mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres rdp redis rexec rlogin rsh s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey teamspeak telnet[s] vmauthd vnc xmpp

	~~Hydra is a tool to guess/crack valid login/password pairs. Licensed under AGPL~~
	~~v3.0. The newest version is always available at http://www.thc.org/thc-hydra~~
	~~Don't use in military or secret service organizations, or for illegal purposes.~~

	~~Example: hydra -l user -P passlist.txt ftp://192.168.0.1~~
	</pre>		</pre>

	==Reality Check==		===Reality Check===

	Quick reality check: brute-forcing SSH logins is very slow (limited by how many SSH connections a victim's SSH server will accept), so if you have access to <code>/etc/shadow</code>, you might as well crack those passwords offline with [[John the Ripper]].		Quick reality check: brute-forcing SSH logins is very slow (limited by how many SSH connections a victim's SSH server will accept), so if you have access to <code>/etc/shadow</code>, you might as well crack those passwords offline with [[John the Ripper]].

	==Using Hydra to Crack SSH Credentials==		===Using Hydra to Crack SSH Credentials===

	Once we have a list of users, we can put that in a file and pass it to Hydra using the -L flag. We then pass a list of passwords to try using the -P flag. Here's a sample command:		Once we have a list of users, we can put that in a file and pass it to Hydra using the -L flag. We then pass a list of passwords to try using the -P flag. Here's a sample command:
Line 211:		Line 211:
	Brute-forcing SSH logins requires a lot of time, a lot of patience, and a series of very good guesses. In general, it is not terribly practical.		Brute-forcing SSH logins requires a lot of time, a lot of patience, and a series of very good guesses. In general, it is not terribly practical.

			==John the Ripper==
	=John the Ripper=

	If we are able to obtain a list of users and their password hashes, e.g., from <code>/etc/shadow</code>, we can use John to try and crack passwords via brute force offline.		If we are able to obtain a list of users and their password hashes, e.g., from <code>/etc/shadow</code>, we can use John to try and crack passwords via brute force offline.

	==Use John to Crack Credentials==		===Use John to Crack Credentials===

	See [[Metasploitable/John_Shadow_File]]		See [[Metasploitable/John_Shadow_File]]

Admin: /* Background */

2017-10-26T02:19:48Z

Background

← Older revision		Revision as of 02:19, 26 October 2017
Line 3:		Line 3:
	Aslo see [[Hydra]].		Aslo see [[Hydra]].

	~~=Background=~~		=Procedure=

	~~There are two ways to brute-force SSH logins:~~
	* If we have a list of usernames, e.g., from the <code>/etc/passwd</code> file, try cracking their credentials via brute force using the Hydra tool
	* If we have a list of usernames and password hashes, e.g., from the <code>/etc/shadow</code> file, try cracking their credentials offline (also via brute force) using John the Ripper

	It would be great if we could log in via SSH as root, but this is usually disabled. To be successful, we will need a list of users on the system. This can be obtained many ways, but two methods using SQL servers are covered in [[Metasploitable/MySQL]] and [[Metasploitable/Postgres]]. Both pages cover techniques for obtaining <code>/etc/passwd</code> contents with metasploit.

	==Procedure==

	The first challenge, when cracking SSH credentials via brute force, is to find usernames. There are two methods to do this:		The first challenge, when cracking SSH credentials via brute force, is to find usernames. There are two methods to do this:
	* Guess usernames from services		* Guess usernames from services
	* Obtain usernames from a file on the machine		* Obtain usernames from a file on the machine

			It would be great if we could log in via SSH as root, but this is usually disabled. To be successful, we will need a list of users on the system. This can be obtained many ways, but two methods using SQL servers are covered in [[Metasploitable/MySQL]] and [[Metasploitable/Postgres]]. Both pages cover techniques for obtaining <code>/etc/passwd</code> contents with metasploit.

	Once we find usernames, we can try and crack the passwords.		Once we find usernames, we can try and crack the passwords.
Line 22:		Line 16:
	* If we have usernames and password hashes, use John the Ripper to brute-force credentials		* If we have usernames and password hashes, use John the Ripper to brute-force credentials

	==Usernames==		=Usernames=

	===Finding Usernames via Services===		==Finding Usernames via Services==

	Oftentimes services will create users and will not disable SSH for those accounts. If you're lucky, the security will be lower for these service usernames. For example, if a server is running Postgresql, there should be a "postgres" username, it may allow you to log in, and it may even have the password "postgres".		Oftentimes services will create users and will not disable SSH for those accounts. If you're lucky, the security will be lower for these service usernames. For example, if a server is running Postgresql, there should be a "postgres" username, it may allow you to log in, and it may even have the password "postgres".

	===Finding Usernames via MySQL===		==Finding Usernames via MySQL==

	Hydra can be used to brute-force the SSH credentials. If you have a good guess for the username and password, then use Hydra.		Hydra can be used to brute-force the SSH credentials. If you have a good guess for the username and password, then use Hydra.

Admin: /* Procedure */

2017-10-26T02:18:53Z

Procedure

← Older revision		Revision as of 02:18, 26 October 2017
Line 13:		Line 13:
	==Procedure==		==Procedure==

	===SSH via MySQL===		The first challenge, when cracking SSH credentials via brute force, is to find usernames. There are two methods to do this:
			* Guess usernames from services
			* Obtain usernames from a file on the machine

			Once we find usernames, we can try and crack the passwords.
			* For password wordlists, use SecLists from Daniel Miessler on Github: https://github.com/danielmiessler/SecLists
			* If we have usernames only, use Hydra to brute-force credentials
			* If we have usernames and password hashes, use John the Ripper to brute-force credentials

			==Usernames==

			===Finding Usernames via Services===

			Oftentimes services will create users and will not disable SSH for those accounts. If you're lucky, the security will be lower for these service usernames. For example, if a server is running Postgresql, there should be a "postgres" username, it may allow you to log in, and it may even have the password "postgres".

			===Finding Usernames via MySQL===

	Hydra can be used to brute-force the SSH credentials. If you have a good guess for the username and password, then use Hydra.		Hydra can be used to brute-force the SSH credentials. If you have a good guess for the username and password, then use Hydra.

	However, if you don't know what username to use, and you know there is a MySQL serer listening, you can crack the MySQL server's password, and use the load_file() function in SQL to obtain the <code>/etc/passwd</code> or <code>/etc/shadow</code> file, and use those to obtain usernames and possibly password hashes. These may in turn lead to SSH usernames and passwords. It's a bit cumbersome, but who knows, you might get lucky and find some low-hanging fruit.		However, if you don't know what username to use, and you know there is a MySQL serer listening, you can crack the MySQL server's password, and use the load_file() function in SQL to obtain the <code>/etc/passwd</code> or <code>/etc/shadow</code> file, and use those to obtain usernames and possibly password hashes. These may in turn lead to SSH usernames and passwords. It's a bit cumbersome, but who knows, you might get lucky and find some low-hanging fruit.

	~~To try and crack passwords, use SecLists from Daniel Miessler on Github: https://github.com/danielmiessler/SecLists~~

	===Obtaining Usernames Using SQL load_file Function===		===Obtaining Usernames Using SQL load_file Function===

Admin: /* Background */

2017-10-26T02:10:11Z

Background

@@ Line 5: / Line 5: @@
 =Background=
-We will use Hydra to brute-force SSH logins.
+There are two ways to brute-force SSH logins:
-==Usage==
+It would be great if we could log in via SSH as root, but this is usually disabled. To be successful, we will need a list of users on the system. This can be obtained many ways, but two methods using SQL servers are covered in [[Metasploitable/MySQL]] and [[Metasploitable/Postgres]]. Both pages cover techniques for obtaining <code>/etc/passwd</code> contents with metasploit.
 ==Procedure==
 ===SSH via MySQL===
@@ Line 49: / Line 20: @@
 To try and crack passwords, use SecLists from Daniel Miessler on Github: https://github.com/danielmiessler/SecLists
 ===Obtaining Usernames Using SQL load_file Function===
@@ Line 177: / Line 146: @@
 </pre>
-===Reality Check===
+=Using Hydra=
 Quick reality check: brute-forcing SSH logins is very slow (limited by how many SSH connections a victim's SSH server will accept), so if you have access to <code>/etc/shadow</code>, you might as well crack those passwords offline with [[John the Ripper]].
-==Cracking SSH Credentials==
+==Using Hydra to Crack SSH Credentials==
 Once we have a list of users, we can put that in a file and pass it to Hydra using the -L flag. We then pass a list of passwords to try using the -P flag. Here's a sample command:
@@ Line 202: / Line 204: @@
 Brute-forcing SSH logins requires a lot of time, a lot of patience, and a series of very good guesses. In general, it is not terribly practical.
-Assuming we've lost our patience for Hydra, or have the contents of <code>/etc/shadow</code> and never had the patience to begin with, we can use John the Ripper to crack the password hashes found in the shadow file:
+=John the Ripper=
 See [[Metasploitable/John_Shadow_File]]

Admin: /* Use Hydra to Crack Credentials */

2017-10-26T02:04:28Z

Use Hydra to Crack Credentials

← Older revision		Revision as of 02:04, 26 October 2017
Line 181:		Line 181:
	Quick reality check: brute-forcing SSH logins is very slow (limited by how many SSH connections a victim's SSH server will accept), so if you have access to <code>/etc/shadow</code>, you might as well crack those passwords offline with [[John the Ripper]].		Quick reality check: brute-forcing SSH logins is very slow (limited by how many SSH connections a victim's SSH server will accept), so if you have access to <code>/etc/shadow</code>, you might as well crack those passwords offline with [[John the Ripper]].

	==Use Hydra to Crack Credentials==		==Cracking SSH Credentials==

			===Use Hydra to Crack Credentials===

			Once we have a list of users, we can put that in a file and pass it to Hydra using the -L flag. We then pass a list of passwords to try using the -P flag. Here's a sample command:

	<pre>		<pre>
Line 194:		Line 198:
	</pre>		</pre>

	This is extremely slow when compared to an offline password-cracking method like John the Ripper - if we have the <code>/etc/shadow</code> file, we should probably use that, instead of trying to brute-force SSH logins.		This is ''extremely slow'' when compared to an offline password-cracking method like John the Ripper - if we have the <code>/etc/shadow</code> file, we should probably use that, instead of trying to brute-force SSH logins.

	Brute-forcing SSH logins requires a lot of time, a lot of patience, and a series of very good guesses. In general, it is not terribly practical.		Brute-forcing SSH logins requires a lot of time, a lot of patience, and a series of very good guesses. In general, it is not terribly practical.

			===Use John to Crack Credentials===

			Assuming we've lost our patience for Hydra, or have the contents of <code>/etc/shadow</code> and never had the patience to begin with, we can use John the Ripper to crack the password hashes found in the shadow file:

			See [[Metasploitable/John_Shadow_File]]

	=Flags=		=Flags=

Admin: /* Start */

2017-10-26T02:02:18Z

Start

← Older revision		Revision as of 02:02, 26 October 2017
Line 181:		Line 181:
	Quick reality check: brute-forcing SSH logins is very slow (limited by how many SSH connections a victim's SSH server will accept), so if you have access to <code>/etc/shadow</code>, you might as well crack those passwords offline with [[John the Ripper]].		Quick reality check: brute-forcing SSH logins is very slow (limited by how many SSH connections a victim's SSH server will accept), so if you have access to <code>/etc/shadow</code>, you might as well crack those passwords offline with [[John the Ripper]].

	==~~Start~~==		==Use Hydra to Crack Credentials==

	<pre>		<pre>

Admin: /* Reading /etc/shadow */

2017-10-26T02:01:36Z

Reading /etc/shadow

← Older revision		Revision as of 02:01, 26 October 2017
Line 132:		Line 132:
	===Reading /etc/shadow===		===Reading /etc/shadow===

	We can also grab the <code>/etc/shadow</code> file, which contains password hashes:		We can also grab the <code>/etc/shadow</code> file, which contains password hashes. Some sample lines:

	<pre>		<pre>

Admin: /* Reading /etc/shadow */

2017-10-26T02:01:09Z

Reading /etc/shadow

← Older revision		Revision as of 02:01, 26 October 2017
Line 132:		Line 132:
	===Reading /etc/shadow===		===Reading /etc/shadow===

	~~For some more info on how to read~~ the <code>/etc/shadow</code> file:		We can also grab the <code>/etc/shadow</code> file, which contains password hashes:

	<pre>		<pre>