All language subtitles for 2. SSH Dictionary Attack

[MUSIC LOGO]

You might be noticing a trend on
these protocols of either port

passwords or port configuration.

That's a lot of what we're
looking for in a pen test.

It's definitely
what we're looking

for in the enumeration part.

And if you want to understand
what the adversary is doing,

they're doing the same thing.

They are enumerating
your network

to see what services they
can take advantage of.

Let's dig in a
little more on SSH

and see how we could, again,
get around some authentication.

First, we'll check
our IP address.

And we're the 192.141.55.2.

Let's ping our victim, the .3.

Getting good returns.

Let's do an nmap.

Let's run that same nmap
with a service on 422.

And that seems to
be working, where

we've got open SSH running
Ubuntu as the operating

system on that machine.

Now, what we'll take advantage
of, and we've done it before,

and we'll use it
again and again,

is the wordlist for rockyou.

And we will plug
that into hydra.

Let's start with the
username student.

We'll pretend like we
knew to expect that.

And we will use that
rockyou wordlist.

[INAUDIBLE] IP and
then the protocol ssh.

And so with the user of
student, try all the passwords

from rockyou.

We have our scan back,
and we see for student,

we have the password of friend.

We could use that.

We could ssh as
student at our target.

Yes.

And then put in
friend, and we're in.

And it doesn't seem like
they have much there.

So maybe student
isn't the most useful.

So what we could look for
is maybe administrator.

And now, let's check for a
login utilizing administrator.

So we're going to use a script.

As you should expect, it's going
to be the ssh-brute script.

And it takes some arguments.

Our arguments are going
to be a user database

because even though
it is just one line,

we still want to use
that single line.

And then, it's got
its own wordlist.

And it will run until
it finds the right word.

That didn't take too long.

It came across sunshine.

So administrator and sunshine.

But what about
the root password?

We can go about
this one other way--

msfconsole.

Just want to give you
a taste and a feel

for what these tools can do.

We're going to use
the auxiliary scanner

for ssh, called ssh_login.

We can always show options.

And it shows what
needs to be filled in.

We're missing our hosts.

There is a username
and password available.

So let's set up what we need.

Set our hosts, and tab
completion works great there.

And then we'll set
a userpass_file,

and we use rockyou.

No.

We use the metasploit
root user passwords.

So usr/share/wordli
sts/metasploit/r

oot_userpass.txt.

We want it to stop
when it finds a thing.

So STOP_ON_SUCCESS is
going to be set to true.

And then, set verbose, true.

And now, another
look at options.

The wordlist screws
up very much.

We've got the right IP address.

We've got the wordlist.

And we've got verbose on,
all things that we wanted.

And STOP_ON_SUCCESS.

That way, it doesn't keep going,
even if it finds what we want.

Since it is only one username,
it should only be one password.

And we say run.

And it's going to
try a few things.

And it came with root attack.

So we could exit msf.

And then ssh root @ our IP.

And it will ask us some things.

And we will say attack.

And we are in.

So we utilized hydra.

We utilized nmap, and
we utilized msfconsole,

all in order to brute
force a dictionary

and see if we could
find passwords.

This may seem elementary,
but it's fairly common.

This is what we will be doing a
lot, especially in enumeration

is taking passwords,
taking potential usernames,

and throwing them at a
service to see if they stick,

to see if they work.

Things that do work, things that
work that we don't even use,

we want to save all that.

We want to record it and
use it somewhere else.

If you are auditing
your own network,

these are all important
things that you should then

track down.

Then, you try to
find the answers

to if you're doing a pen test.

Then, you're going to
write these things up

for your client.

If you're just thinking
like the adversary,

they're doing the
exact same thing.

Cybercriminals out there are
doing these exact same steps

in order to take
advantage of your network.