Method 1::
We need to set a few things in order for this to work properly. First, RHOSTS is the IP address of our target.
Method 2::
Hydra
The next tool we will use is Hydra, a powerful login cracker which is very fast and supports a number of different protocols. To show the help and some basic usage options, simply type hydra in the terminal. (Note, if you were previously in the msf console, make sure you cd out of it before using Hydra.)
Perhaps one of the easiest things to do is change the port number which SSH operates on. Although this will dissuade the most rudimentary brute-force attempts, it is trivial to scan for SSH running on alternate ports.
A better method is to implement a service like Fail2ban, DenyHosts, or iptables to block brute-force attempts at the host level. This, combined with using private key authentication instead of passwords, will put you out of the reach of most attackers. If password-based authentication is absolutely necessary, use strong passwords and follow best practices.
Metasploit
The first method we will try out today involves one of Metasploit's auxiliary scanners. First, start the PostgreSQL database with the following command.
Now, we can fire up Metasploit by typing msfconsole in the terminal. You should see "msf" appear, though, for me, it's "msf5" since I'm using the most recent version, Metasploit 5, which can be upgraded by running the latest version of Kali. It's always a good idea to stay updated in order to take advantage of the latest exploits and tools. Here is the command I use to update:
Next, after being greeted by the welcome banner for msfconsole, we can find the appropriate module with the search command.
Then we can type options to display the available settings for the scanner
We need to set a few things in order for this to work properly. First, RHOSTS is the IP address of our target.
Next, STOP_ON_SUCCESS will stop after finding valid credentials.
Then, USER_FILE is a list of usernames.
And PASS_FILE is a list of passwords.
Finally, there's VERBOSE, which will display all attempts.
Since we set the verbose option, we can see all the attempts as they take place. Depending on the number of username and password combinations, this can take quite some time to run.
When valid credentials are found, a success message is displayed and a command shell is opened. It does not automatically drop us in, though, so we can display the current active sessions with the sessions command.
Now we are connected to the target via SSH and can run commands like normal.
Hydra
The next tool we will use is Hydra, a powerful login cracker which is very fast and supports a number of different protocols. To show the help and some basic usage options, simply type hydra in the terminal. (Note, if you were previously in the msf console, make sure you cd out of it before using Hydra.)
hydra
- The -L flag, which specifies a list of login names.
- The -P flag, which specifies a list of passwords.
- ssh://172.16.1.102 — our target and protocol.
- The -t flag set to 4, which sets the number of parallel tasks to run.
After a period of time, it will complete and show us the number of successful logins found.
Method 3:
Nmap Scripting Engine
The last method of brute forcing SSH credentials we will try out today
involves the use of the Nmap Scripting Engine. NSE contains a script
which will attempt to brute-force all possible combinations of a
username and password pair. To perform this attack, we can run a simple
Nmap scan from a fresh terminal just like before, but with a few extra
options tacked on:
--script ssh-brute specifies the script to use.
--script-args will set the arguments for the script, separated by a comma.
userdb=users.txt is the list of usernames we wish to use.
passdb=passwords.txt is the list of passwords we wish to use.
Now, we are ready to start the scan:
Nmap Scripting Engine
The last method of brute forcing SSH credentials we will try out today
involves the use of the Nmap Scripting Engine. NSE contains a script
which will attempt to brute-force all possible combinations of a
username and password pair. To perform this attack, we can run a simple
Nmap scan from a fresh terminal just like before, but with a few extra
options tacked on:
--script ssh-brute specifies the script to use.
--script-args will set the arguments for the script, separated by a comma.
userdb=users.txt is the list of usernames we wish to use.
passdb=passwords.txt is the list of passwords we wish to use.
Now, we are ready to start the scan:
NSE will display the brute-force attempts and which credentials are being tried. Be patient — depending on the number of usernames and passwords being used, this can take some time.
After a while, the scan will finish and a report will be shown in the terminal.
Above, we can see it discovered three valid login credentials. This script is useful because it will iterate through all possible pairs of usernames and passwords, which will sometimes yield more results.
Method 4:
NCRACK
~# ncrack -p 22 --user root -P 500-worst-passwords.txt 10.10.10.10
Starting Ncrack 0.4ALPHA ( http://ncrack.org ) at 2011-05-05 16:50 EST
Stats: 0:00:18 elapsed; 0 services completed (1 total)
Rate: 0.09; Found: 0; About 6.80% done; ETC: 16:54 (0:04:07 remaining)
Stats: 0:01:46 elapsed; 0 services completed (1 total)
Rate: 3.77; Found: 0; About 78.40% done; ETC: 16:52 (0:00:29 remaining)
Discovered credentials for ssh on 10.10.10.10 22/tcp:
10.10.10.10 22/tcp ssh: 'root' 'toor'
Ncrack done: 1 service scanned in 138.03 seconds.
Ncrack finished.
Method 5::
medusa
medusa -u root -P 500-worst-passwords.txt -h 10.10.10.10 -M ssh
Medusa v2.0 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks
ACCOUNT CHECK: [ssh] Host: 10.10.10.10 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 123456 (1 of 500 complete)
ACCOUNT CHECK: [ssh] Host: 10.10.10.10 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: password (2 of 500 complete)
<< --- SNIP --->>>
ACCOUNT CHECK: [ssh] Host: 10.10.10.10 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: billy (498 of 500 complete)
ACCOUNT CHECK: [ssh] Host: 10.10.10.10 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: toor (499 of 500 complete)
ACCOUNT FOUND: [ssh] Host: 10.10.10.10 User: root Password: toor [SUCCESS]
How to Prevent SSH Brute-Forcing
The reality is that if you have a server facing the internet, there are going to be loads of SSH brute-force attempts daily, many of which are automated. But don't fret, there are some simple solutions to help protect against this and cut down on the number of login attempts.
Perhaps one of the easiest things to do is change the port number which SSH operates on. Although this will dissuade the most rudimentary brute-force attempts, it is trivial to scan for SSH running on alternate ports.
A better method is to implement a service like Fail2ban, DenyHosts, or iptables to block brute-force attempts at the host level. This, combined with using private key authentication instead of passwords, will put you out of the reach of most attackers. If password-based authentication is absolutely necessary, use strong passwords and follow best practices.
Comments
Post a Comment