[AUDIO LOGO]
Exploiting a Vulnerable SSH Server.
In this video, we are going to be exploring
the process of exploiting a vulnerable SSH server running
on a Linux target.
Now, during the enumeration section of this course,
we explored the process of enumerating
as much information as possible from an SSH server
and we also explored the process of performing a brute force
attack in order to gain access to the target system via SSH.
However, in this case, instead of focusing on a brute force
attack or performing an attack that essentially takes
advantage of a misconfiguration, we
are going to be exploring the process of exploiting
an inherent vulnerability within an SSH server running
on a Linux target.
So first and foremost, what is SSH?
SSH stands for Secure Shell.
It is a remote administration protocol
that offers encryption and is the successor to Telnet.
So it's typically used for remote access
to servers and systems, and, of course,
we explored what SSH was during the enumeration section.
So again, we don't need to get into that right now.
The only thing that you need to know
is that SSH utilizes TCP port 22 by default. However,
like other services, it can be configured
to use any other open TCP port, and that's something
that you need to be cognizant or aware of.
Now, in this particular video, we
are going to be targeting or exploiting
an SSH server running libSSH.
All right, so libSSH is a multi-platform C library
that implements the SSH version 2 protocol on the client
and server side.
Now, libSSH version 0.6.0 to 0.8.0
is vulnerable to an authentication bypass
vulnerability in the libSSH server
code that can be exploited to execute commands
on the target server.
And in this case, we'll be taking a look
at how to exploit libSSH running on the Linux target.
And furthermore, we'll also be exploring
the process of obtaining a meterpreter
session on the target system by utilizing
an exploit module that allows us to exploit
this particular vulnerability.
So let's get started with the lab environment.
So again, you can follow along with the techniques highlighted
within this particular video by starting up your lab
environment, and I'll start up mine,
and I'll see you within the lab environment.
All right, so I'm back within the lab environment.
And the first step that we need to perform
is, of course, obtaining the target IP address, which can
be done by typing in ifconfig.
You then want to head over to the ethernet1 interface.
And in this particular subnet here, this
is the subnet that the target server or the target system
is currently on.
So this is the Kali Linux IP address,
which means that the target IP address is going to be
192.40.32.3.
So it's going to be the next IP address within this subnet.
So once you've copied that IP address, what we need to do
is start up the PostgreSQL Database Service, which
will essentially allow us to interact
with the MySQL or the Metasploit framework database.
So we'll say service Postgres start we then
start up the Metasploit framework console.
So we'll give that a few seconds.
We then want to create a workspace
that we will be utilizing in this particular scenario.
And in this case, we'll just call
it libSSH because we're going to be exploiting libSSH.
The next step that we need to perform
is, of course, setting up the global variable
for RHOSTS option, which we are going to set to the target IP.
So we changed the 2 into a 3, and this will essentially
prevent us or save us the time or save us
time for essentially putting in or typing in the target IP
address whenever we load a module.
So I'm going to set the global variable for the RHOSTS value
there.
We can then perform a Nmap scan on the target system
to verify that SSH is indeed running on the target system
and that libSSH is also running as well.
So we'll perform a SYN scan, as well as a service version
detection scan and an operating system detection scan.
We'll paste in the target IP.
So make sure to change the 2 to a 3
and the db_nmap command again allows
us to perform an Nmap scan from within the Metasploit framework
console and consequently saves the Nmap scan results
into the Metasploit framework database
within our current workspace.
So we'll hit Enter.
And I'm just going to wait for this Nmap scan to complete.
All right, so the Nmap scan is complete
and we can see that SSH is indeed running on the target
system on port 22.
And right over here from the banner,
we can see that we have libSSH running
and it is version 0.8.3.
So again, we can target this system or this SSH service
to see if it's vulnerable.
And again, you can always access these services
by typing in the services command.
And as you can see, it says it's running SSH,
but it doesn't give us that exact banner.
So in order to test or to check whether the system
or the actual SSH service is vulnerable, what we can do
is search for the actual module that we're
going to be utilizing, and the module
is the libSSH auth bypass module.
So we're just going to search for it directly.
And this is the module here.
So we can copy it.
As you can see, that's an auxiliary module.
And we can then say use, paste in the module name there.
We can then show the options required
by this particular module.
So within this particular module,
we need to specify the RHOSTS option, which
is done for us because we set up the global variable
for the RHOSTS option.
And then RPORT option, which, again, you'll
need to change if SSH is running on another port
apart from the default. In this case, it's running on port 22.
So we don't need to change that, and we can also, again,
execute or change a few options here.
The option that we want to change is the
or that we want to set is the SPAWN_PTY option,
which will allow us to spawn a terminal session.
So we can say set SPAWN_PTY.
And because that requires a Boolean setting,
we're going to set it to True, which is the opposite of false,
and we can hit run.
As you can see, it says right over here,
attempting authentication bypass.
It's then going to say command shell session 1 opened,
and it then provides us with the actual session.
If we list out our sessions, you can
see that it opens up the command shell
session in the background.
So we've successfully been able to, again,
exploit the SSH server, and we get a shell session
on the target system.
There we are.
So we can essentially enumerate the user
that we currently are by either typing in whoami, which
will tell us that we are root.
So we currently have administrative privileges
on the target system.
We can also enumerate the actual distribution release version
by typing in cat/etc/*release.
And as you can see, the target is running Arch Linux.
We can also get or enumerate the kernel version
by typing in uname -r.
And in this case, it's running the kernel version 5.4.0.
So the next step will, of course,
involve the process of upgrading our command shell
or our shell session into a meterpreter session, which
we can do first and foremost by putting this current session
in the background using the keyboard combination Control
and z, and then hitting Yes.
We can then search for the post exploitation module
shell_to_meterpreter.
And that's the module there.
This will help us upgrade our shell session
into a meterpreter session as we've done previously.
So we show the options.
We then need to set the LHOST option, which is
going to be the Kali Linux IP.
So to do that, we'll just say set LHOST
to the ethernet1 IP address or the ethernt1 interface IP
address.
And as you can see, it sets that up for us.
The LPORT option we'll leave as four 4433.
We then need to set the session ID, which in this case
is going to be SESSION 1 because we only got one session,
and then we type in run.
All right, so when it completes, as you can see,
it looks like we have an error here.
So again, we don't need to worry at this particular point
in time.
However, when we type in sessions,
you can see that we have the meterpreter session,
and we can switch to it by typing in sessions 2,
and we have the meterpreter session.
There we are.
We type in sysinfo, we get the same information
that we were able to get.
Get user ID tells us that we currently
have root privileges, which consequently means
that we do not need to elevate our privileges on the target
system.
So that concludes the practical demonstration.
All right, so that is how to exploit a vulnerable SSH
server.
In the next video, we will be exploring
the process of exploiting a vulnerable SMTP server running
on a Linux target.
So I'll see you there.