Violence Cracking Technology of SSH Service Based on Kali-Linux
Total Page：16
File Type：pdf, Size：1020Kb
International Journal of Advanced Network, Monitoring and Controls Volume 04, No.02, 2019 Violence Cracking Technology of SSH Service Based on Kali-Linux Ma Limei Gao Yijun College of Information Technology School of Information Studies Hebei Normal University Dominican University Shijiazhuang, In China River Forest, In USA Key Laboratory of Network and Information e-mail: [email protected] Security in Hebei Province Shijiazhuang, In China School of Information Studies, Dominican University, River Forest, In USA e-mail: [email protected] Zhao Dongmei* Zhao Chen College of Information Technology College of Information Technology Hebei Normal University Hebei Normal University Shijiazhuang, In China Shijiazhuang, In China Key Laboratory of Network and Information Key Laboratory of Network and Information Security in Hebei Province Security in Hebei Province Shijiazhuang, In China Shijiazhuang , In China e-mail: [email protected] e-mail: [email protected] Abstract—In this paper, the current popular SSH password The Kali Linux Penetration Test Platform defaults brute force cracking tool is researched, analyzed and to the SSH service. SSH for remote server management, summarized. The ssh_login module in Metasploit is used to brute force the SSH service to finally obtain the password. The you only need to know the server's IP address, port, Brute Spray tool is used to automatically call Medusa to blast management account and password, you can manage the service, demonstrating SSH. The process of brute force the server, network security follows the principle of cracking has certain reference value for penetration attack wooden barrel, as long as you open a hole through SSH, testing and security defense. this will be for infiltrators It is a new world. Keywords-Component; Violence Cracking; Technology; SSH Service; Kali-Linux I. SSH PROVIDES TWO AUTHENTICATION All SSH is an acronym for Secure Shell, developed METHODS. by the IETF's Network Working Group, SSH is a The first is a key-based security verification that security protocol based on the application layer and relies on a key, which means you have to create a pair transport layer. SSH is a protocol that provides security of keys for yourself and put the public key on the for remote login sessions and other network services. server you need to access. If you are connecting to an The SSH protocol can effectively prevent information SSH server, the client software will make a request to leakage during remote management. SSH was the server for security verification with your key. After originally a program on a UNIX system and later the server receives the request, look for your public key quickly expanded to other operating platforms. SSH in your home directory on the server and compare it to can make up for vulnerabilities in the network when it the public key you sent. If the two keys match, the is used correctly. The SSH client is available on server encrypts the "challenge" with the public key and multiple platforms. SSH can be run on almost all Unix sends it to the client software. After the client software platforms—including hp-Unix, Linux, Aix, Solaris, receives the "challenge", it can decrypt it with your Digital Unix, and others. private key and send it to the server. DOI: 10.21307/ijanmc-2019-045 35 International Journal of Advanced Network, Monitoring and Controls Volume 04, No.02, 2019 The second is password-based security verification, III. THE SPECIFIC STEPS ARE AS FOLLOWS: as long as you know your account and password, you can log in to the remote host. All transmitted data will A. Purpose be encrypted, but there is no guarantee that the server Master the process of brute-breaking the SSH you are connecting to is the one you want to connect to. service through the ssh login module in Metasploit to There may be other servers that impersonate the real finally obtain the password. server, which is attacked by the "middleman". At the same time, if the server has no other security B. Software used restrictions, such as login source IP, account login error Guest operating system: Kali-linux 1.1, IP address times, there may be violent cracking. However, SSH is is 193.168.1.100. not absolutely secure. If you do not restrict the login source IP and do not set the number of attempts to log Server operating system: CentOS 6.5, address in, it will be cracked. 193.168.1.26. Tool software: Metasploit, NMAP. II. SSH PASSWORD BRUTE FORCE APPLICATION AND THOUGHTS C. Steps A. Application 1) Load the kali-linux virtual machine, open the kali system terminal, and use nmap to scan the target The root permission is obtained through remote 193.168.1.26 port. The command is as follows: nmap - command execution such as Structs. v -A -Pn 193.168.1.26, found that open 22 ports, you Get root privileges through web shell can try to brute force. The result is shown in Figure 1. authorization Through the local file contains the vulnerability, you can read all the files locally in linux. Obtain the network access authority, which can access the intranet computer. The SSH port is enabled on the external network (the default or modified port), and SSH access is available. In the previous scenarios, you can get the shadow file and brute force it to get the password of these accounts, but in other scenarios, no loopholes are Figure 1. NMAP scan results available. At this time, you need to brute the SSH account. Parameter Description: -v: enable verbose mode; B. Thoughts -A: Detect the target operating system; brute force the root account -Pn: Do not ping the target host to reduce the use admin as the username to brute force probability of being discovered or blocked by the guard use the admin dictionary for password cracking device. Using mastery information to organize social 2) Open another new command line window, type worker information and generate dictionary ssh [email protected], enter the password brute force cracking arbitrarily, and the access is blocked. Try this process multiple times (3 times or more) and find that you can Comprehensive utilization and recycling of still try to enter the password, the user will not be information locked, as shown in Figure 2, so all the conditions that satisfy the brute force vulnerability can be brute force cracked. 36 International Journal of Advanced Network, Monitoring and Controls Volume 04, No.02, 2019 Explanation of important parameters: RHOST: the target host IP address; PASS_FILE: brute force password dictionary storage path; Figure 2. Trying to log in USERNAME: Specify the username used for brute force attack; 3) Use the ssh_login module in Metasploit to crack STOP_ON_SUCESS: Set to stop brute force attack the crack, open the kali system terminal, and enter immediately after cracking the password. msfconsole, as shown in Figure 3. 7) Set the relevant parameters of the brute force target host, as shown in Figure 7. Figure 7. Set the parameters Figure 3. Start Metasploit 8) Enter the exploit to start brute force cracking, and 4) Enter search ssh_login and search for the successfully obtain the password, which is admin888, ssh_login module, as shown in Figure 4. as shown in Figure 8. Figure 4. Searching for the ssh_login module Figure 8. Execution attack 5) Enter use auxiliary/scanner/ssh/ssh_login to load the ssh_login module, as shown in Figure 5. 9) Open the terminal, enter ssh [email protected], and enter the cracked password to log in to the server, as shown in Figure 9. Figure 5. Loading the ssh_login module 6) Enter show options to display the ssh_login module parameters, as shown in Figure 6. Figure 9. Successful login to the server 10) Enter the command to view server related information, as shown in Figure 10. Figure 10. Execution system command Figure 6. Ssh_login module parameters 37 International Journal of Advanced Network, Monitoring and Controls Volume 04, No.02, 2019 IV. USE BRUTESPRAY TO VIOLENTLY CRACK SSH -T HOSTS, - - hosts HOSTS parameter followed by PASSWORD a value specifying the number of hosts tested at the Brutespray is a gnmap/XML file based on nmap same time scanning output. It calls Medusa automatically to -U USERLIST, --userlist USERLIST parameter explode the service faster than hydra. IBruteSpray calls followed by user dictionary file medusa, which claims to support violent account -P PASSLIST - -- Passlist PASSLIST parameter cracking of ssh, ftp, telnet, vnc, mssql, mysql, followed by password dictionary file postgresql, rsh, imap, nntp, pcanywhere, pop3, rexec, -u USERNAME, -- username USERNAME rlogin, smbnt, smtp, SVN and vmauthd protocols. parameter followed by user name, specify a user name for blasting -P PASSWORD, --password PASSWORD A. Installation under Kali parameter followed by password, specify a password Brutespray is not integrated into Kali Linux by for blasting default. It needs to be installed manually. Some need to - C.-- Continuous blasting after success perform updates in Kali first, and apt-get update before - i --Interactive interaction mode executing the installation command: V. VIOLENT CRACKING OF SSH PASSWORDS Apt-get install brutespray 1) Interactive mode cracking Kali Linux installs its user and password dictionary file location by default: / usr / share / brutespray / Python brutespray. py -- file nmap. XML - I wordlist. After execution, the program automatically identifies the services in the nmap scanning results, B. Manual installation chooses the services that need to be cracked according Git clone to the prompt, the number of threads, the number of https://github.com/x90skysn3k/brutespray.git hosts that are simultaneously violently cracked, CD brutes pray specifies the user and password files, and Brutespray PIP install-r requirements.txt will display the “SUCCESS” information on the screen Note that if Medusa needs to be installed in other after successful cracking.