All language subtitles for 1. SSH

[MUSIC LOGO]

The next protocol we'll
be looking at is SSH.

It is very common.

It's used for remote
administration.

It gives you a
secure shell, which

is what SSH stands for, and
allows you to then interact

with a remote machine
over an encrypted channel.

So let's take a look at
what that looks like.

We have our IP address.

We are 192.244.143.2.

So our victim is going to
be the .3 version event.

And it is up and running.

So let's do a quick
scan with nmap.

And we see that port 22 is open.

And it says it's running ssh.

Let's do a quick service
scan, operating system scan.

And it came back.

It's running OpenSSH
7.2 for Ubuntu.

Using Ubuntu 2.6.

It says Ubuntu Linux.

And the fingerprint also comes
back, well, with a fingerprint.

Doesn't really mean much to me.

So there's no exact OS matches.

But the software is the
Ubuntu version of OpenSSH.

So that's the dead giveaway.

How this works is normally
do ssh and then a user root.

It's almost on
every Linux machine.

Root @ our IP address.

And it says, hey, authentication
can't be established.

Here is the
fingerprint, the SHA256.

Are you sure you want
to continue connecting?

Normally, we would
check that, make sure

that it's what we
expect for that machine.

We'll say yes.

Have to type out yes.

It says, welcome to attack
defense ssh recon lab!!

That is the banner.

We haven't even
authenticated, and it already

told us that it is
what the name of it is.

Now, it's asking
for root's password.

Try, like, password123.

And you get three chances
usually for a password.

We'll just exit out of that.

Now that we've seen
what service is running,

and we've kind of
connected to it-- oh.

Let's Netcat to it.

Rather than using the
ssh tool, we will just

utilize Netcat, which will
connect, and it says 22.

Connect to port 22.

And that gives us
this banner, which

is how it did the
fingerprint scan before.

And it doesn't give us much
more than that with Netcat.

It's a protocol mismatch.

But it still gave
us the banner, which

was useful for
enumeration, which

is what we're doing, really.

Now that we've seen
the banner, and we've

seen the welcome message,
let's do some more enumeration

on the machine, port 22.

We're going to run the script,
ssh2-enum-algos to enumerate

all the algorithms.

And this is useful.

It shows us all
the algorithms that

can be used to create that key.

We're going to want
to write these down.

And if we need them
later, we have them.

What's really helpful
is we want that rsa key.

It's the primary way
that ssh actually

encrypts through the rsa key.

So we'll run the
ssh-hostkey, passing

some arguments, script args,
of ssh hostkey equal to,

and then we'll say full.

And it gives us the
full ssh rsa hostkey.

Definitely want to save this.

That could be very useful later.

A couple more
things we can check.

Let's see if there are any
weak passwords for ssh.

We'll go back to our script.

And what we want
to check for here

is ssh-auth-methods to know what
sort of authorization methods

are being used for, in this
case, ssh.user of student.

It's always the intern.

And we see that there are
no supported authentication

methods for the user of student.

Well, that's dangerous.

Let's try it for admin.

And we see that for
the admin, there's

a public key and a password.

So we saw that student doesn't
actually have a password.

So what we could do is a ssh
student at the IP address.

And we're in.

We didn't have to
tell it a password.

We are student.

And it looks like
it's a restricted user

and doesn't have full controls.

But we can close
that connection,

and we're back on
our own machine.

But generally,
that's how SSH works.

We were able to enumerate
the SSH service,

find out that the administrator
used a password or a key.

We were able to pull
the RSA hostkey.

And we also saw that there
was an unauthenticated user

of student.

That allowed us to actually
pull a file remotely.

So that was enumeration for SSH.

We'll get a little bit deeper.