[ELECTRONIC NOISES]
SSH enumeration-- in this video, we're
going to be taking a look at how to extract
as much information as possible from SSH through the use
of various auxiliary modules.
So first and foremost, what is SSH?
SSH stands for Secure Shell.
It is a remote administration protocol
that offers encryption and is the natural successor
to Telnet.
It is typically used for remote access
to servers and remote systems.
So an example of this-- and I'm pretty
sure you have come across SSH.
Whenever you want to connect to a remote server,
it could be hosted on a cloud platform,
or it just could be offsite.
The protocol of choice is SSH.
And if you are dealing or if you want
to access the target remotely via a graphical user interface,
you'd typically use a protocol like RDP or VNC.
However, when we're talking about SSH and its advantages
over Telnet, one of the key advantages
is that it offers encryption and essentially encrypts
the communication channel between the client
and the server.
So if I was using Telnet, then I would typically again initiate
a connection between myself and the target,
provide the credentials.
However, the communication channel
would be unencrypted, which means that any attacker could
perform a "man in the middle" attack and sniff the traffic
and consequently get information regarding
what commands I'm sending over.
And these commands could be potentially
important or useful.
So this is where SSH comes into play.
It essentially encrypts the channel, the communication
channel, between the client and the server.
And that prevents "man in the middle" attacks.
SSH authentication is performed two ways.
So you can either utilize a clear-text password or what
we've started seeing now is a SSH key-based authentication,
where authentication is handled in the form
of a public and private key pair.
So all of this is very, very important information
that's going to be pertinent to enumeration and exploitation.
Now, SSH uses port 20 TCP by default. However,
like any other service, it can be
configured to use any other TCP port that's open.
So, again, this is something that we have we've
started seeing with companies.
They essentially changed the TCP port
to something else, another port that's
not really recognizable in order to, again, trick attackers
into thinking there isn't an SSH server that's
running on the target.
However, if you perform a full port scan,
you should be able to identify it.
Now, we can utilize auxiliary modules
to enumerate information like the SSH version
or, rather, the version of SSH that's running on the target.
And this information, the version information,
is very important during the vulnerability scanning section.
So again, if you're a bit confused
as to why we're getting the version, all of this
will come into context when we start
using the version information to find inherent exploits
in these services.
However, when we're talking about enumeration,
we again need to get the version of SSH that's running.
And secondly, we can also perform a brute force attack
to identify passwords that can consequently provide
us remote access to the target.
So given that SSH is a remote administration protocol,
if we are able to get the credentials
or get any credentials, then that
means we can establish a direct communication
channel with the target and consequently get remote access
to the target.
So let's take a look at how to do this
within the lab environment.
I'm currently within the lab environment.
The first thing we're going to do
is, of course, identify the target IP, which
can be done really simply by typing in ifconfig, taking
a look at the interface ethernet 1.
And of course, if we get our input address,
we know that the target is going to be on the same subnet
except on the IP address 3.
So let's copy this.
And what we'll do now is, again, just start up the PostgreSQL
Database Service.
That's going to start it up.
And then we can start up the Metasploit framework console.
And, again, just give that a few seconds to start up.
That started up, so the next step
would be to create a workspace.
So I'm going to say workspace add SSH_Enum.
And that's going to be the current, active workspace.
The next thing we want to do is set up our global variables
for rhosts so that we don't have to keep typing in the target IP
whenever we load a module.
So I'm going to say set global, or setg, rhosts
and then paste in the IP we copied.
And again, change it from a 2 to a 3 and hit Enter.
And, again, we can also do that for the rhost variable because
with some modules, the target IP can either be
specified as rhosts or rhost.
So I'm going to say rhost.
And we paste in the IP we copied and, of course,
change it to a 3.
And there we go.
So let's get started with SSH enumeration.
So we can search for SSH modules by saying search.
And then we can limit it to auxiliary modules
because we don't want any exploit modules
or post-exploitation modules.
So we'll say type auxiliary.
And then the name is, of course, going to be SSH.
We hit Enter.
And as you can see, we have quite a few modules.
The one that we're interested in first is the SSH version here.
That's the module, we're interested in.
So let's use that to identify the version of SSH that's
running on the target.
So we've loaded the module.
I'll now say show options.
And as you can see, the target IP has been set.
The target port is set to port 22, which we know
is the default port for SSH.
We can change the threads, but that's not required.
And we can also set up the timeout option here
for the timeout for the SSH probe.
But in this case, we'll leave it as the default.
So we'll hit run.
And as you can see, we're able to detect the version of SSH.
As you can see, it's running SSH--
or rather, OpenSSH 7.9p1.
And we also get the operating system banner,
so we know that it's running Ubuntu.
If we take a look at some of the other information displayed
here, it doesn't give us the exact version.
Well, it actually does.
So we get the version of Ubuntu.
So operating system version is 19.04.
So we know that the target is running Ubuntu 19.04.
Now, as I said, this information will really become pertinent
when we move on to exploitation and vulnerability scanning.
Right now, again, it's not really pertinent.
So for example, if we search for an exploit for OpenSSH,
you can see that they're far and few in between.
And, again, that will all come into context
when we're performing vulnerability scanning.
So really, there isn't much we can do now
in regards to as search enumeration apart
from performing a brute force in order
to obtain credentials that we can
use to authenticate via SSH.
So in order to do that, what we can do is say search.
And, again, we can use our previous search filter.
So let's just go back.
And we are looking for ssh_login.
Now, if the target has been configured
to use password authentication, then we use this module.
If the target has been configured
to use a public or a key-pair authentication,
then we would use this particular module.
But in this case, the target has been configured
to use password authentication, so we'll
use the ssh_login module.
So what we'll do is we will say use, hit Enter, show options.
And as you can see, there's a few options
that we need to configure.
So let me just expand that here.
The first option that we can configure
is the brute force speed.
It's currently set to the highest.
Now, depending on the type of target you're dealing with,
you may want to reduce this to prevent you
from actually tripping any alarms because SSH logs are
usually logged or are usually sent to a syslog server
if the target server that you're targeting has been configured
or rather has some security apparatus behind it.
Now, the other option that we can specify
is the target IP and the target port.
But in this case, because we don't know the username
and password we will need to specify a user
file and a password file.
So we'll start by doing that.
So we'll set the user file.
And in this case, again, we'll use the default Metasploit
Framework wordlist.
So we'll say /usr/share/metasploit-framework
under data and on the wordlists.
Let's try and use common_users because we
have really no idea of what users could be on the system.
And for the password file, we will, again,
use the same Metasploit framework wordlists.
So we'll say /metasploit frameworks/wordlists.
And that's under data, sorry, so /data/wordlists/common.
And yeah, let's try common_passwords
instead of UNIX passwords.
But we can alternate if we aren't able to find one.
The next thing we want to do is we can say stop on success
or we can change the option here to stop when
we've got a successful match.
And we can also enable the verbose option
to show all the attempts.
But in this case, I think that's perfectly fine the way it is.
So we'll hit run.
And depending on the wordlists we've selected,
this is going to take a few seconds
to a few minutes or possibly even hours.
So I'm just going to let this run.
So the module is completed, and we get the credentials here.
So we can see we get the username sysadmin
and the password hailey.
So we've been able to find some legitimate credentials.
And this module will automatically
open up a command shell session here
on the target system via SSH.
So, again, if we type in ls, in this case
we can see that it doesn't actually print out any results.
And that's because the module is still running.
If we terminate it, just take note of the credentials.
However, if we check our sessions because this module
sets up a session for us--
let me just type that in correctly, sessions.
You can see that we have the session 1 here,
and that is via SSH.
And it's using the credentials we were able to identify.
So we can switch to that session by typing in sessions 1.
And we hit Enter, and we currently
have access to the target system primarily
because we were able to gather or we
were able to get the credentials from the brute force.
And as you can see, the target operating system
is indeed Ubuntu 19.04.
So we type in ls, we don't get anything there.
So let's actually try and spawn a bash session here.
So I'm going to say /bin/bash -i,
and that gives us a bash session.
So if we list out the files within this directory,
there currently aren't any particular files.
So, again, we can always check our permissions here.
So we can say whoami.
As you can see, we are sysadmin.
So we've essentially been able to gain access to the target
system via SSH brute forcing.
So, again, I know that this is part of exploitation.
But I just wanted to show you, again,
how powerful these tools are.
So what I'm going to do is I'm just going to exit,
and I'm going to just terminate this particular session.
There we are.
That's terminated.
So if we list out our sessions, we
shouldn't have any active sessions.
I want to show you one other useful module that, again,
can be very, very useful.
And that is the SSH--
let's see, ssh_login.
Or let's just search for-- let's just
utilize the previous search filter that we had utilized.
And I'll actually show you this.
And that is the ssh_enumusers module, which
allows you to enumerate users.
So this can be very useful if your initial brute force isn't
successful.
You can use this module to essentially find
usernames and narrow down your brute force.
So we'll use this module, and I'll show you the options here.
And as you can see, we can provide the target IP, target
port.
And then we can specify a user file.
So, again, if we set the user file--
and let's just use our previous command here--
to the common_users.txt file and we hit run,
this should enumerate users.
And as you can see, we get more than one user that
is currently on the system.
So we get the sysadmin user whose credentials we found.
We also get other users like rooty, demo, auditor, anon,
administrator and diag.
So this can be very, very useful.
So if we had done this before, we
would have targeted or used ssh_login module
and specified the username of sysadmin and then a password
list.
And of course, our brute force would
have been much faster because we're only
performing a brute force with one user as opposed
to multiple users.
So that is how to perform a search enumeration
through the use of the various auxiliary modules afforded
to you by the Metasploit framework.
So that concludes the practical demonstration.
In the next video, we're going to be taking a look at how
to perform SMTP enumeration.
So I'll see you there.