[MUSIC PLAYING]
Exploiting SSH-- now that we have taken a look at how
to exploit the Shellshock vulnerability as well as FTP,
let's turn our attention to SSH.
All right, so what is SSH?
SSH stands for Secure Shell.
It is a remote administration protocol
that offers encryption and is the natural successor
to Telnet.
So whenever you have a Linux system,
or more specifically a Linux server set up primarily
in a server farm maybe halfway across the world,
how do you access that system?
Well, that access is facilitated through the use
of a protocol called SSH.
So this is something that you will find pretty much
on I would say 90% of Linux systems or Linux servers,
for that matter, and it is typically
used for remote access to servers and systems.
And it's frequently used for that matter.
Now, SSH utilizes TCP port 22 by default.
However, like other services, it can be configured
to use any other open TCP port.
So many administrators have actually
been changing the default TCP port
and have been running SSH on different ports in a bid
to actually prevent attackers from exploiting the service
or from performing a brute-force attack.
Now, in order to understand the types of attack vectors
in regards to SSH that we can utilize in order
to gain access, we need to understand
the actual forms of authentication in terms of SSH.
All right, so SSH authentication can be configured in two ways.
Number one is the standard username and password
authentication, whereby you can authenticate to the system
by providing legitimate user account credentials, so
the username and password.
And then, you have key-based authentication,
which essentially requires you to have a private key.
And, of course, key-based authentication
involves the use of two key pairs
or rather a key pair of a public key and a private key,
whereby the public key is on the server
and the private key is given to the person who
is going to essentially remotely access the system via SSH.
And within key-based authentication,
there is no username and password.
You essentially log in to the target system
by providing the actual private key,
and only one person has the private key.
So this is something that really isn't
feasible to attack unless you get
your hands on a private key, so we
are going to be focusing on the process of performing
a brute-force.
Now, the great thing about SSH is
because it is a remote administration
protocol or a remote access protocol,
it means that if we get legitimate credentials
through a brute-force, we can essentially
gain access to the target system and obtain a full blown shell.
So we don't really need to get a Meterpreter session.
You can if you want to, but this will actually
give us access to the target system,
of course, with the privileges associated with the user
account that we are able to obtain through the brute-force.
All right, now, as I said, SSH really
can be configured to be really, really secure,
and that typically will involve key-based authentication.
But in most cases, many individuals and small companies
still utilize username and password authentication,
so this attack is very, very feasible.
Now, I have covered the process of exploiting
inherent vulnerabilities within the specific version of SSH
that's running on a target in my Metasploit course,
so you can actually check that out for yourself.
In this case, we are going to be focusing on performing
a brute-force attack.
All right, so let's get started with the practical side
of this video.
This lab or this video already has a lab environment attached
to it, so all you need to do is fire it up,
and you can follow along with the techniques
that I'm about to highlight.
So I'll see you within the lab environment.
All right, so I'm back within the lab environment.
And within this lab environment, you
will not be provided with a graphical user interface.
You will just be provided with the terminal.
So the first step will involve identifying the target IP
address, which, of course, you can identify
by typing in ifconfig and taking a look at the IP
or the subnet attached to the interface ethernet1.
And, of course, in your case, this subnet will be different.
The target IP is always on the third IP
address within the subnet, so all you need to do
is just change the 2 into a 3.
So I'm just going to copy this here, and there we are.
And we can then clear that out, and we
can perform an Nmap scan in order
to identify or to confirm whether or not we
have SSH running on the target.
So I'll paste in the target IP, and remember
to change the 2 into a 3.
And I'll hit Enter.
There we are.
We can see the scan is complete in a relatively short amount
of time.
And we can see that we have SSH running on port 22.
That's very important, so it has been configured
to run on the default port.
And the service version is OpenSSH 7.9p1 Ubuntu,
so we have gotten a basic or generic idea as to what
distribution is running on the target.
And this specific version of OpenSSH really isn't vulnerable
to any inherent vulnerability or rather cannot be exploited
directly, so we will have to perform a brute-force attack.
So in order to perform the brute-force attack,
we are again just going to utilize Hydra,
so I'm going to say hydra.
And, of course, as we did with the FTP brute-force,
I'm just going to zoom in here.
And we can specify the actual word
list that contains the usernames that we want to perform
the brute-force with.
In this case, the word list is under user, share, Metasploit
framework.
And, of course, in your case or whenever
you're performing a penetration test, feel free to change this
or to use whichever ones are actually
applicable to your particular case.
So user share Metasploit framework data
wordlists and common underscore users dot txt.
And then, for the password or the password list,
that is again going to be under user share Metasploit framework
data wordlists, and we are going to say
common passwords dot txt.
And we will set the threads to four, maybe.
And we can then specify the target IP, which, again,
you should have copied by now.
So we'll just say threads of four.
And we can then specify the target IP right
over there, which I need to copy,
so let me actually obtain the target IP.
All right, so I've got the target IP,
and I'll just paste it in there.
And then, we can set the threads to maybe four threads.
Again, be very careful when performing
a brute-force attack, as it may actually cause the service
to go down or to be overwhelmed with the number of requests
you're sending.
So we'll limit it to four threads.
And then, we specify the protocol.
In this case, it is SSH.
And we can then hit Enter.
That's going to begin the brute-force.
So I'm going to give this a couple of seconds
to a couple of minutes, and let's see what credentials we
are able to identify.
All right, so the brute-force has
been going for a couple of minutes,
and I've been able to identify a few interesting accounts
that we can use to gain access to the target.
The most interesting of all is the sysadmin account,
and we, of course, get the password, which in this case
is "hailey."
So what we can do is-- let me just stop the brute force
here--
and, again, Hydra will automatically
save a file called hydra dot restore,
which means you can always resume your brute force using
the hydra -R command to resume the session.
In this case, we are just going to use the credentials that we
have been able to gather so far, and we
can log in to the target system via SSH by saying SSH.
And then, we say sysadmin at the target IP,
so we can actually just copy and paste in the target IP.
There we are.
Just going to copy that there.
And we can say sysadmin at, and it's
going to ask us whether we want to continue connecting.
I'm going hit yes.
The password is "hailey."
There we go.
And we've logged into the target system as the user sysadmin.
We can perform some basic enumeration like whoami.
There we are.
And, of course, we can display the groups
that the sysadmin is a part of, so groups sysadmin.
You can see that it's not part of the pseudo group, which
means we don't have any elevated privileges.
And, of course, you can try out the other accounts
right over here to see whether they'll provide you
with root access or whether they are accounts that
are part of the pseudo group.
And, of course, we can enumerate the actual distribution release
version, so we can say cat etc issue or cat etc release.
In this case, it's running Ubuntu 19.04.
And we can get the kernel version by saying uname -r.
There we are, so it's running the kernel version 5.4.0.
And, of course, you can enumerate the users
on the system by getting the contents of the password file.
And you can see we have a few other accounts here.
So we have the root user, and then, of course,
we have demo, auditor, anon, administrator, et cetera; all
of the accounts that we were able to identify
through the brute-force.
So there are a few flags that you can actually
gather with file list of the contents of my current working
directory.
I don't have any flags in there, so I'm
going to let you find the flags that are on the system,
and you can complete the challenge associated
with this particular lab.
All right, so that is going to conclude
the practical demonstration side of this video.
All right, so now that we've taken a look
at how to exploit SSH through a brute force attack,
we can now turn our attention to the open source implementation
of SMB for Linux, which is Samba.
So I'll see you in the next video.