Original subtitles

[MUSIC LOGO]

You might be noticing a trend on these protocols of either port

passwords or port configuration.

That's a lot of what we're looking for in a pen test.

It's definitely what we're looking

for in the enumeration part.

And if you want to understand what the adversary is doing,

they're doing the same thing.

They are enumerating your network

to see what services they can take advantage of.

Let's dig in a little more on SSH

and see how we could, again, get around some authentication.

First, we'll check our IP address.

And we're the 192.141.55.2.

Let's ping our victim, the .3.

Getting good returns.

Let's do an nmap.

Let's run that same nmap with a service on 422.

And that seems to be working, where

we've got open SSH running Ubuntu as the operating

system on that machine.

Now, what we'll take advantage of, and we've done it before,

and we'll use it again and again,

is the wordlist for rockyou.

And we will plug that into hydra.

Let's start with the username student.

We'll pretend like we knew to expect that.

And we will use that rockyou wordlist.

[INAUDIBLE] IP and then the protocol ssh.

And so with the user of student, try all the passwords

from rockyou.

We have our scan back, and we see for student,

we have the password of friend.

We could use that.

We could ssh as student at our target.

Yes.

And then put in friend, and we're in.

And it doesn't seem like they have much there.

So maybe student isn't the most useful.

So what we could look for is maybe administrator.

And now, let's check for a login utilizing administrator.

So we're going to use a script.

As you should expect, it's going to be the ssh-brute script.

And it takes some arguments.

Our arguments are going to be a user database

because even though it is just one line,

we still want to use that single line.

And then, it's got its own wordlist.

And it will run until it finds the right word.

That didn't take too long.

It came across sunshine.

So administrator and sunshine.

But what about the root password?

We can go about this one other way--

msfconsole.

Just want to give you a taste and a feel

for what these tools can do.

We're going to use the auxiliary scanner

for ssh, called ssh_login.

We can always show options.

And it shows what needs to be filled in.

We're missing our hosts.

There is a username and password available.

So let's set up what we need.

Set our hosts, and tab completion works great there.

And then we'll set a userpass_file,

and we use rockyou.

No.

We use the metasploit root user passwords.

So usr/share/wordli sts/metasploit/r

oot_userpass.txt.

We want it to stop when it finds a thing.

So STOP_ON_SUCCESS is going to be set to true.

And then, set verbose, true.

And now, another look at options.

The wordlist screws up very much.

We've got the right IP address.

We've got the wordlist.

And we've got verbose on, all things that we wanted.

And STOP_ON_SUCCESS.

That way, it doesn't keep going, even if it finds what we want.

Since it is only one username, it should only be one password.

And we say run.

And it's going to try a few things.

And it came with root attack.

So we could exit msf.

And then ssh root @ our IP.

And it will ask us some things.

And we will say attack.

And we are in.

So we utilized hydra.

We utilized nmap, and we utilized msfconsole,

all in order to brute force a dictionary

and see if we could find passwords.

This may seem elementary, but it's fairly common.

This is what we will be doing a lot, especially in enumeration

is taking passwords, taking potential usernames,

and throwing them at a service to see if they stick,

to see if they work.

Things that do work, things that work that we don't even use,

we want to save all that.

We want to record it and use it somewhere else.

If you are auditing your own network,

these are all important things that you should then

track down.

Then, you try to find the answers

to if you're doing a pen test.

Then, you're going to write these things up

for your client.

If you're just thinking like the adversary,

they're doing the exact same thing.

Cybercriminals out there are doing these exact same steps

in order to take advantage of your network.