Metasploitable/SSH/Exploits - Revision history

Admin: /* Getting a Shell */

2017-10-26T02:45:05Z

Getting a Shell

← Older revision		Revision as of 02:45, 26 October 2017
Line 227:		Line 227:

	We could also get busy with post-exploit activities.		We could also get busy with post-exploit activities.

			See https://www.offensive-security.com/metasploit-unleashed/scanner-ssh-auxiliary-modules/

	=Flags=		=Flags=

Admin: /* Private Key ssh_login_pubkey */

2017-10-26T02:44:46Z

Private Key ssh_login_pubkey

← Older revision		Revision as of 02:44, 26 October 2017
Line 93:		Line 93:
	If you manage to get your hands on the victim's private key, the <code>auxiliary/scanner/ssh/ssh_login_pubkey</code> module is for you!		If you manage to get your hands on the victim's private key, the <code>auxiliary/scanner/ssh/ssh_login_pubkey</code> module is for you!

	This ~~will allow you~~ to ~~get root.~~		This module uses the private key to do two things:
			* Get access to the victim machine
			* Get access to any machines that trust the victim's private key (must be listed in the SSH files of the victim machine)

	==Obtaining Private Key==		==Obtaining Private Key==
Line 102:		Line 104:

	(Note that you could also plant your keys on the target, by adding your public SSH keys onto the target machine's list of trusted machines, but this technique would restrict you to a particular machine, wile the Metasploit method is portable and less intrusive.)		(Note that you could also plant your keys on the target, by adding your public SSH keys onto the target machine's list of trusted machines, but this technique would restrict you to a particular machine, wile the Metasploit method is portable and less intrusive.)

	~~===Snatching Private Keys===~~

	To snatch the target's private key:		To snatch the target's private key:
Line 115:		Line 115:
	</pre>		</pre>

	Now you have a copy of the <code>msfadmin</code> account's private SSH key. We'll use Metasploit to turn this into access to the remote machine. ~~(Note that it~~ is also useful for impersonating the target when connecting to OTHER remote machines.)		Now you have a copy of the <code>msfadmin</code> account's private SSH key.

			Metasploit We'll use Metasploit to turn this into access to the remote machine.

			This key is also useful for impersonating the target when connecting to OTHER remote machines.

	===Planting Private Keys===		===Planting Private Keys===

	To plant your private keys on the remote machine, you'll need write access to the target user's home directory. You'll generate a public SSH key from the ~~command-and-control server~~, the machine you want to have access WITH, and add it to the other machine's <code>~/.ssh/authorized_keys</code>.		An alternative method to gain access, although it is not useful for gaining access to any machines other than the victim machine, is to GENERATE a public/private SSH key pair from the attacker machine, and copy the PRIVATE key over to the remote machine. (Using the public key and the above-mentioned technique would be easier, but it's worth mentioning at least.)

			To plant your private keys on the remote machine, you'll need write access to the target user's home directory. You'll generate a public SSH key from the attacker machine, the machine you want to have access WITH, and add it to the other machine's <code>~/.ssh/authorized_keys</code>.

	This presumes the <code>.ssh</code> directory exists. If it doesn't exist, you can make it, and tamper with the filesystem.		This presumes the <code>.ssh</code> directory exists. If it doesn't exist, you can make it, and tamper with the filesystem.

Admin: /* Private Key ssh_login_pubkey */

2017-10-26T02:36:37Z

Private Key ssh_login_pubkey

← Older revision		Revision as of 02:36, 26 October 2017
Line 91:		Line 91:
	=Private Key ssh_login_pubkey=		=Private Key ssh_login_pubkey=

	If you manage to get your hands on a private key, the <code>auxiliary/scanner/ssh/ssh_login_pubkey</code> module is for you!		If you manage to get your hands on the victim's private key, the <code>auxiliary/scanner/ssh/ssh_login_pubkey</code> module is for you!

	This will allow you to get root.		This will allow you to get root.

Admin: /* Links with Background Info */

2017-10-26T02:34:17Z

Links with Background Info

← Older revision		Revision as of 02:34, 26 October 2017
Line 14:		Line 14:
	This server isn't using the 1.0 protocol, which is hopelessly broken and easy to defeat. This means getting past SSH will be (at least) mildly challenging.		This server isn't using the 1.0 protocol, which is hopelessly broken and easy to defeat. This means getting past SSH will be (at least) mildly challenging.

	==~~Links with Background Info~~==		==Metasploit SSH Exploits==

	~~Here is some good background info two~~ SSH attacks: ~~https://www.offensive-security.com/metasploit-unleashed/scanner-ssh-auxiliary-modules/~~		Two SSH attacks using metasploit:
			* ssh_login
			* ssh_login_pubkey

			===Metasploit ssh_login===

	The first attack is ssh_login, which allows you to use metasploit to brute-force guess SSH login credentials.		The first attack is ssh_login, which allows you to use metasploit to brute-force guess SSH login credentials.
	* Module name is <code>auxiliary/scanner/ssh/ssh_login</code>		* Module name is <code>auxiliary/scanner/ssh/ssh_login</code>

	The second attack requires a private key. If you do gain access to the private SSH keys on a machine, you can attempt to authenticate with a large number of hosts and services using that private key.		Link: https://www.offensive-security.com/metasploit-unleashed/scanner-ssh-auxiliary-modules/

			===Metasploit ssh_login_pubkey===

			The second attack requires a private key. If you do gain access to the private SSH keys on a victim machine, you can attempt to authenticate with a large number of hosts and services using that private key.
	* Module name is <code>auxiliary/scanner/ssh/ssh_login_pubkey</code>		* Module name is <code>auxiliary/scanner/ssh/ssh_login_pubkey</code>

			Link: https://www.offensive-security.com/metasploit-unleashed/scanner-ssh-auxiliary-modules/

	=Brute Force ssh_login=		=Brute Force ssh_login=

Admin: /* Setting Up the Attack */

2016-03-31T17:00:36Z

Setting Up the Attack

@@ Line 36: / Line 36: @@
 <pre>
 msf > use auxiliary/scanner/ssh/ssh_login
 </pre>

Admin: /* Setting Up the Attack */

2016-03-31T17:00:23Z

Setting Up the Attack

@@ Line 146: / Line 146: @@
 <pre>
 msf > use auxiliary/scanner/ssh/ssh_login_pubkey
 </pre>

Admin: /* Getting a Shell */

2016-03-31T17:00:07Z

Getting a Shell

← Older revision		Revision as of 17:00, 31 March 2016
Line 246:		Line 246:
	We could create more mischief, by copying everyone else's private SSH keys and SSH connection histories, potentially giving us passwordless access to additional machines.		We could create more mischief, by copying everyone else's private SSH keys and SSH connection histories, potentially giving us passwordless access to additional machines.

	We could also get busy with ~~the~~ post-exploit activities.		We could also get busy with post-exploit activities.

	=Flags=		=Flags=

Admin: /* Private Key ssh_login_pubkey */

2016-03-31T16:59:38Z

Private Key ssh_login_pubkey

← Older revision		Revision as of 16:59, 31 March 2016
Line 107:		Line 107:
	To carry out this attack, you will need to have access to the file system, and/or be able to mount the remote file system (which, on Metasploitable, happens to be possible!): see [[Metasploitable/NFS]]		To carry out this attack, you will need to have access to the file system, and/or be able to mount the remote file system (which, on Metasploitable, happens to be possible!): see [[Metasploitable/NFS]]

	Once you've got access to the file system, you ~~can either plant your keys on the target (add your public SSH keys onto the target machine~~'~~s list of trusted machines, allowing you to log on without~~ a ~~password), or you can steal their private keys (~~copy ~~a user~~'s private ~~SSH~~ keys ~~from their home directory~~, ~~giving you passwordless~~ access to ~~any machines that~~ the ~~target user has passwordless access to~~.)		Once you've got access to the file system, you'll grab a copy of the remote machine's private keys, and use them together with Metasploit to obtain access to the machine.

	~~===Planting Private Keys===~~		(Note that you could also plant your keys on the target, by adding your public SSH keys onto the target machine's list of trusted machines, but this technique would restrict you to a particular machine, wile the Metasploit method is portable and less intrusive.)

	To plant your private keys on the remote machine, you'll need write access to the target user's home directory. You'll generate a public SSH key from the command-and-control server, the machine you want to have access WITH, and add it to the other machine's <code>~/.ssh/authorized_keys</code>.		===Snatching Private Keys===

	~~This presumes~~ the ~~<code>.ssh</code> directory exists. If it doesn~~'~~t exist, you can make it, and tamper with the filesystem.~~		To snatch the target's private key:

	<pre>		<pre>
Line 119:		Line 119:
	# mkdir /tmp/target		# mkdir /tmp/target
	# mount -t nfs 10.0.0.27:/ /temp/target		# mount -t nfs 10.0.0.27:/ /temp/target
	# cd /tmp/target/home/msfadmin~~/ && mkdir .ssh/~~		# cp /tmp/target/home/msfadmin/.ssh/id_rsa /tmp/r00tprivatekey
	~~# echo ~~~/.ssh/id_rsa >> /tmp/~~target/home/msfadmin/.ssh/authorized_keys~~
	# umount /tmp/target		# umount /tmp/target
	</pre>		</pre>

	===~~Snatching~~ Private Keys===		Now you have a copy of the <code>msfadmin</code> account's private SSH key. We'll use Metasploit to turn this into access to the remote machine. (Note that it is also useful for impersonating the target when connecting to OTHER remote machines.)

			===Planting Private Keys===

			To plant your private keys on the remote machine, you'll need write access to the target user's home directory. You'll generate a public SSH key from the command-and-control server, the machine you want to have access WITH, and add it to the other machine's <code>~/.ssh/authorized_keys</code>.

	~~To snatch~~ the ~~target~~'~~s private key:~~		This presumes the <code>.ssh</code> directory exists. If it doesn't exist, you can make it, and tamper with the filesystem.

	<pre>		<pre>
Line 132:		Line 135:
	# mkdir /tmp/target		# mkdir /tmp/target
	# mount -t nfs 10.0.0.27:/ /temp/target		# mount -t nfs 10.0.0.27:/ /temp/target
	# cp /tmp/target/home/msfadmin/.ssh/id_rsa /tmp/~~r00tprivatekey~~		# cd /tmp/target/home/msfadmin/ && mkdir .ssh/
			# echo ~/.ssh/id_rsa >> /tmp/target/home/msfadmin/.ssh/authorized_keys
	# umount /tmp/target		# umount /tmp/target
	</pre>		</pre>

	Now you have a copy of the <code>msfadmin</code> account's private SSH key. Note that this isn't useful for gaining access to the remote machine - it's only useful for impersonating the target when connecting to OTHER remote machines.

	==Setting Up the Attack==		==Setting Up the Attack==

	Here's ~~how it works. We'll use~~ the <code>auxiliary/scanner/ssh/ssh_login_pubkey</code> module to carry out ~~this~~ attack.		Here's info on the <code>auxiliary/scanner/ssh/ssh_login_pubkey</code> module in Metasploit, which will carry out the attack:

	<pre>		<pre>
Line 164:		Line 166:
	</pre>		</pre>

	Set some options, such as the private key file, the username to ~~try and remotely~~ log in to, and the host ~~of the machine to attempt to log in to using the private key~~:		Set some options, such as the private key file, the username to log in with, and the remote host:

	<pre>		<pre>
Line 178:		Line 180:
	==Running the Attack==		==Running the Attack==

	~~Now it~~'s ~~go time~~:		Execute the attack, to use the remote machine's private key to gain access to the remote machine:

	<pre>		<pre>
Line 242:		Line 244:
	</pre>		</pre>

	We ~~can~~ create more mischief, ~~and make copies of~~ everyone's private SSH keys:		We could create more mischief, by copying everyone else's private SSH keys and SSH connection histories, potentially giving us passwordless access to additional machines.

	~~<pre>~~		We could also get busy with the post-exploit activities.
	~~cat /home/user/~~.~~ssh/id_dsa~~
	~~-----BEGIN DSA PRIVATE KEY-----~~
	~~MIIBugIBAAKBgQDVoHGx78RdmEV9IE4s8qGWs8x4lOfut4ShTocyXIfHWUKRVOYB~~
	~~pA5Gd9KwuI6zaglzQzedEQOMpXDbTu/AfyOPuWAmd/X2kolyKC34vLTlVrU7YN5Z~~
	~~Lr93kldM7khnqmTxzLXqeoos0AOcqApZAso/LMFx/nDwRubkT4l2C/ddawIVAMv6~~
	~~kqsvLq/L0cLLBdZn+Nw+k8cRAoGAILfnDd3w09UUQmM/1Zqn1LKluI7WdOpL8dy/~~
	~~Nk9mdWFXl3u/dvSVnrvXdzgfjXhPBKKTIlmk2U9FiPjpM8UgBsrk7JLnuJ7xgn8Z~~
	~~w6+fMWtaWXEjuukeYwkgETB1OlgViHdzGM7CTWakzeLqEWuLSBcDPF/fStFFFZi7~~
	~~zWzwchACgYBNfKRDwM/QnEpdRTTsRBh9rALq6eDbLNbu/5gozf4Fv1Dt1Zmq5Zxt~~
	~~XeQtW5BYyorILRZ5/Y4pChRa01bxTRSJah0RJk5wxAUPZ282N07fzcJyVlBojMvP~~
	~~lbAplpSiecCuLGX7G04Ie8SFzT+wCketP9Vrw0PvtUZU3DfrVTCytgIUcihlgVO0~~
	~~XcyqKVITUMZyayEOuIE=~~
	~~-----END DSA PRIVATE KEY-----~~
	~~</pre>~~

	=Flags=		=Flags=

Admin: /* Stealing Private Keys */

2016-03-31T16:50:28Z

Stealing Private Keys

← Older revision		Revision as of 16:50, 31 March 2016
Line 124:		Line 124:
	</pre>		</pre>

	===~~Stealing~~ Private Keys===		===Snatching Private Keys===

	To ~~run through~~ the ~~steps again quickly~~:		To snatch the target's private key:

	~~<pre>~~
	<pre>		<pre>
	# service rpcbind start		# service rpcbind start
Line 137:		Line 136:
	</pre>		</pre>

	Now we have a copy of the <code>msfadmin</code> account's private SSH key.		Now you have a copy of the <code>msfadmin</code> account's private SSH key. Note that this isn't useful for gaining access to the remote machine - it's only useful for impersonating the target when connecting to OTHER remote machines.

	==Setting Up the Attack==		==Setting Up the Attack==

Admin: /* Houston, We Have A Shell */

2016-03-31T16:48:08Z

Houston, We Have A Shell

← Older revision		Revision as of 16:48, 31 March 2016
Line 84:		Line 84:
	==Houston, We Have A Shell==		==Houston, We Have A Shell==

	At this point, we can create a session with the machine that we compromised. ~~Here we execute some commands~~ as user msfadmin~~, to see what groups we're in~~:		At this point, we can create a session with the machine that we compromised. Logged in as user msfadmin:

	<pre>		<pre>