It is time to switch things up a little bit and check out a new type of attack called brute force attack,
unlike the previous attacks, which were vulnerabilities, information, disclosures or misconfiguration.
Right now, we are going to perform something that will be more of a presentation of the attack than
the attack itself, since we're going to cheat a little bit.
But before we tell you how we are going to cheat, let's first explain what our brute force attacks.
Well, brute force attacks is you sending a lot of different information to the target in order to figure
out what information is correct?
Now, you could be wondering, what do I mean by sending information to the target?
Well, this can be anything in 99 percent of cases.
It is usually usernames or passwords.
So we send a lot of user names and a lot of passwords and hope that we by accident hit the correct one
and one.
Is this useful?
Well, you usually perform this attack to see whether the target has default credentials or weak passwords.
These type of attacks will work.
For example, if the target has a password that has a small amount of characters or if it is very easy
to guess, for example, password, password, one, two, three is very easy to guess.
But it is also one of the most used passwords in the world.
In this case, we know that the MSF admin and MSF admin is one account on the target machine, so we
will use those credentials to log in to DSH.
In that sense, this will not be a real attack since we will be putting those credentials into different
lists.
One list will contain user names and other list will contain passwords.
Then we will run the brute force attack and you will see it will automatically go through all of the
usernames and passwords in those lists and it will manage to find the correct ones, which are MSF admin
and MSF admin.
Let's do it.
To perform this using Metsola framework, we are going to use an auxiliary module that is used for S.H.
login.
If we search S.H. right here, we will get a bunch of the results.
But the one that we are interested in is all the way up, I believe.
And it is this one auxillary scanner as Sage-Grouse S.H. Longet.
Let's copy the auxiliary module name.
And let's type down here, use and base the module name.
If we type show options for this module, we can see we have a lot of options available to specify.
Keep in mind that only some of them are required and a lot of them aren't, as we can see by this column
right here.
Let's see what are the things that we need in order for this brute force attack work.
We got the brute force speed, and this is how fast it will try to password's.
We can specify a single password or a password file and we will be going with the password file in our
case, we must specify to our hosts, which is the IP address of the target.
The airport is the S.H. Port on the target machine.
And let's just double check.
It is 22 here and it is also 22 in our scan.
So that is already set correctly here.
We can set the username and this username field is a single user name or we can set the user file,
which will be the file containing a bunch of user names are not a possible option.
That we can do is set user pass file.
And for this user file is is a file containing both usernames and passwords, as it says right here,
a file containing users and passwords separated by space one pair Pearline.
Now, for this particular attack, we're going to be using our passport file and I used to file separately.
So what we must do first is we must create those files, let us open another terminal, navigate to
the desktop of our Mr. Hacker account.
And let's neno user names, Dot.
This will be our list containing user names.
And let's just for the purposes of this tutorial, write a few of them, so admin route.
Test one, two, three.
Let's go with the system and MSF admit we must add the correct one in order for the SSA brute force
to be able to find it.
And after it, let's add one more, let's call this one admin one, two, three.
So this is six usernames.
Of course, in a real life attack, you would be using much bigger list.
But for now, for the purposes of this material, we will create these small lists and see whether it
will work.
So we've got over user names file right here and it has the correct user name specified.
Let's save it now.
We need to do the same thing with the password.
So let's neno passwords.
Dot here, let's tie password.
Password one, two, three.
Hello world.
Let's also type MSF admin, which is the correct password and we know it at the moment.
And at the end let's type test.
One, two, three, four.
So here we have five passwords and one of them is the correct one.
Let's save this file.
And if I type, unless we should have both of the files in our desktop directory.
Let's specify them right here in our options, so the passport file must be the entire path to this
password dot.
So we must specify the entire path to check out the entire path.
I can type working directly inside of desktop directory and copy this.
And inside the government's plate framework, we can typeset, pass, underscore, file.
And then Paiste.
The path at Slash and then Password's dot, the.
This now set the path to the file to be this path right here and we must do the same thing for the user
names.
Let's typeset user underscore file.
Face the same path right here and add instead of passwords not to steal it, said user names dot the
press enter and if we don't show options once again, let's see what else do we need to specify here?
The password file and the user file has already been specified, but we must also specify the our hosts
for this to work.
So let's do it.
If I type set our hosts type the IP address on my anticipatable cleared the screen and they check out
options once again.
All seems to be set, we believe, the brute force speed to be five, which is the fastest.
And one more thing that we want to change is this verbose right here.
This is currently set to follow.
We want to set it to you and this for both means that it will print out even the failed usernames and
passwords.
It will not only print the successful login.
Let me show you right here.
If I set for both to be able to try to clear the screen and from this.
Here it is.
It started our attack.
It is going to try every single combination of usernames and passwords from those two files.
Now, you might notice this isn't going that fast and it will print out all of these failed passwords
until it reaches the combination of massive admin and massive admin as both username and password.
Let's wait for that combination to come.
And here it is, we found the correct S.H. username and password once it prints out this success rate
here.
This means it found the correct username and password and you can just control C this if it didn't stop
in order to stop the brute forcing.
Now I know what you're thinking.
Once again, this is not a troll attack since we added username and password to the list.
But once again, remember that he would do this for the weak credentials and default passwords and of
course, in real attacks, he would be using much bigger lists than these that we created right here.
And many of those bigger lists we can find inside the bubble clinics machine, however, more about
them later.
For now, we just tested it out to make sure that this brute force attack works.
We can also see right here, it opened the comment shell as soon as it found the correct username and
password.
But if you press control, see or you waited for days to finish, it doesn't seem that we can execute
commands anywhere.
We just went back to our auxiliary module right here.
We are not inside of a shell.
Well, once something like this happens, matters, it saves the shell in the background so we can still
enter that shell.
To check out all of the available shells that we currently have established, we can type the command
sessions and here we can see we got one shell.
Overassessed H to the IP address of the matter, split the.
To enter inside of this session, we can type the command sessions, dashi, and then this session ID,
in my case it is one and it will probably be in your case as well.
So if I said here, sessions, I want.
This will start interaction with this shell and it will open our shell right here, and you can now
execute the commands as usual.
Who am I?
Well, tell me the time.
MSF admin, if you want to become the first account I type.
So you type in MSF admin password and I type who am I once again now I'm able to count.
Another way that you can establish a connection once knowing the username and password is like this,
first let's exit out of this exit out of metal framework.
And now that we know the username and password of DSH, we can open our terminal and type as MSF admin,
which is the username at and then the IP address of them anticipatable, which is one.
I just want to state that one, that nine in my case, if I press your enter.
It will ask me this question, are you sure you want to continue connecting, I want to specify.
Yes, right here.
And it will ask me for the password, for this specific account, and we know that password, this massive
cell, type it right here and here it is.
We opened the terminal of them at this point.
If at that point my we are MSF.
And that would be about it for the S.H. brute force attack, don't worry, real brute force attacks
will perform later regarding website login forms and wi fi cracking.
This video was just to introduce you to the concept of brute force.
If you were to exploit a target like this in real life, it would be considered weak credentials or
default credentials, vulnerability.
And you would, of course, write it down as a critical vulnerability.
Great.
That is another vulnerability covered.
Let's go and hunt the next one down in the next video.