Original subtitles

[MUSIC LOGO]

The next protocol we'll be looking at is SSH.

It is very common.

It's used for remote administration.

It gives you a secure shell, which

is what SSH stands for, and allows you to then interact

with a remote machine over an encrypted channel.

So let's take a look at what that looks like.

We have our IP address.

We are 192.244.143.2.

So our victim is going to be the .3 version event.

And it is up and running.

So let's do a quick scan with nmap.

And we see that port 22 is open.

And it says it's running ssh.

Let's do a quick service scan, operating system scan.

And it came back.

It's running OpenSSH 7.2 for Ubuntu.

Using Ubuntu 2.6.

It says Ubuntu Linux.

And the fingerprint also comes back, well, with a fingerprint.

Doesn't really mean much to me.

So there's no exact OS matches.

But the software is the Ubuntu version of OpenSSH.

So that's the dead giveaway.

How this works is normally do ssh and then a user root.

It's almost on every Linux machine.

Root @ our IP address.

And it says, hey, authentication can't be established.

Here is the fingerprint, the SHA256.

Are you sure you want to continue connecting?

Normally, we would check that, make sure

that it's what we expect for that machine.

We'll say yes.

Have to type out yes.

It says, welcome to attack defense ssh recon lab!!

That is the banner.

We haven't even authenticated, and it already

told us that it is what the name of it is.

Now, it's asking for root's password.

Try, like, password123.

And you get three chances usually for a password.

We'll just exit out of that.

Now that we've seen what service is running,

and we've kind of connected to it-- oh.

Let's Netcat to it.

Rather than using the ssh tool, we will just

utilize Netcat, which will connect, and it says 22.

Connect to port 22.

And that gives us this banner, which

is how it did the fingerprint scan before.

And it doesn't give us much more than that with Netcat.

It's a protocol mismatch.

But it still gave us the banner, which

was useful for enumeration, which

is what we're doing, really.

Now that we've seen the banner, and we've

seen the welcome message, let's do some more enumeration

on the machine, port 22.

We're going to run the script, ssh2-enum-algos to enumerate

all the algorithms.

And this is useful.

It shows us all the algorithms that

can be used to create that key.

We're going to want to write these down.

And if we need them later, we have them.

What's really helpful is we want that rsa key.

It's the primary way that ssh actually

encrypts through the rsa key.

So we'll run the ssh-hostkey, passing

some arguments, script args, of ssh hostkey equal to,

and then we'll say full.

And it gives us the full ssh rsa hostkey.

Definitely want to save this.

That could be very useful later.

A couple more things we can check.

Let's see if there are any weak passwords for ssh.

We'll go back to our script.

And what we want to check for here

is ssh-auth-methods to know what sort of authorization methods

are being used for, in this case, ssh.user of student.

It's always the intern.

And we see that there are no supported authentication

methods for the user of student.

Well, that's dangerous.

Let's try it for admin.

And we see that for the admin, there's

a public key and a password.

So we saw that student doesn't actually have a password.

So what we could do is a ssh student at the IP address.

And we're in.

We didn't have to tell it a password.

We are student.

And it looks like it's a restricted user

and doesn't have full controls.

But we can close that connection,

and we're back on our own machine.

But generally, that's how SSH works.

We were able to enumerate the SSH service,

find out that the administrator used a password or a key.

We were able to pull the RSA hostkey.

And we also saw that there was an unauthenticated user

of student.

That allowed us to actually pull a file remotely.

So that was enumeration for SSH.

We'll get a little bit deeper.