Welcome to part one of this module.
We're going to kick off this next section with a short one and it's going to be short because there
isn't really a whole lot to say about hex or bass to call it up.
We can either use the terminal and type in hex or bass or we can go to applications database assessment
and clicking on hex or bass
hex or bass is a database application designed for administering and auditing multiple database servers
simultaneously from one centralized location.
It is capable of performing Eskew QoL queries and brute force attacks against common database servers
which you can see here.
My sequel Oracle post CHRIS ASKEW Well Q light and Eskew l server for Microsoft the graphical user interface
is pretty much as simple as they come in as a collection of several database servers where you can apply
brute force attacks against a desired target The catch however is that you need an account with whatever
it is you're trying to brute force.
As always I'm going to be using the Met exploited able to virtual machine that I have running here in
the office as my target never run this or any other tool against a target that you do not personally
own or have written permission to penetration test or you could and you probably will be breaking the
law.
So just don't do it.
So to begin we're going to enter the user name as root because our target will be the.
My S Q Well database running on a split a two will leave the password field blank because there is no
password in this particular case but if your account has a password.
Obviously this is where you would supply it.
We then click lock as default log in.
Now hypothetically speaking you could click directly on the My rescue Q and supply the target and then
log right in.
But let's pretend that we don't already have a perfectly good admin credential and we'll see if we can't
brute force something up.
So we click on brute force database servers
and we're presented with this screen for my S Q Well we make certain that the my s QoL radial button
is selected and keep in mind this process that you're about to see works exactly the same for post press
S Q Well M.S. S Q Well but Oracle requires an API key that is not included with this software so we
supply a target which in this case is going to be the trustee met exploited by machine and we're going
to use the default port which is 3 3 0 6
and now we need to use two sets of word lists.
These are text files which could be as short as a single character or as long as 100 dictionaries for
simplicity's sake.
I'm going to be using very short and simple word lists.
There are many word lists for both usernames and passwords that come prepackaged with Cally Linux.
Check out some of them in your met a spoil folder.
If you're looking for some good ones.
Alternatively you can download word lists online and a bit later we'll be looking at how to generate
our own word lists that are more suited to a specific target using applications like cup and cool will
also be clicking on the use blank password option.
Which means the program will attempt to use no password for each user name before it attempts anything
in the password file.
However we're not going to do this on the first run so we click.
User lists and in my case it's on the desktop.
I've simply named the file user and then we click word lists.
This is for the passwords and again in my case it's on the desktop I've named it passwords and we can
see the file names that have been selected underneath these buttons we have our target information set
and now we just need to click launch the attack
all right.
Of course how long this takes depends on a lot of different factors.
Your word list complexity.
The security of the target the speed of your machine your connection and so on and so forth.
It goes without saying that this process is not in any way shape or form stealthy and without taking
additional steps to ensure anonymity.
Someone attempting this sort of attack would be easily visible to both their ISP and the system administrator
of the target please see the module covering techniques of anonymity.
If this is a consideration so when I first go we can see that it's stopped on MSF ad men MSF ad men
for the user name and password.
Easy peasy.
Now we're going to scan again but this time we're going to check attempt blank password because we know
that there is one other account that uses a blank password will launch the attack.
Now we can see that it found a user name route and password blank.
We already knew that.
But that is what it would look like if any other user names or passwords apart from the primary admin
account had been found.
You would see them listed out in the read out one by one
this time will run the same process.
But we're going to have a look at post grass
so we select the post crest radio button and supply our target
and report
and our user lists
and or word list for our password.
Attack
and we will attempt blank passwords on this try and we will launch the attack
the attack is running.
This may take just a moment.
Again against a real target.
This is going to take a lot longer think days or weeks depending.
All right.
And now we can see that MSF admin MSF admin is still the primary user account but we can also see that
it found user name post grass password post grass so let's go ahead and use those.
We'll close out of here.
We'll click on post grass askew El we'll give it our target.
Oh pardon me.
First we need to change this.
We will unlock the default
post aggressively username progress for the password we'll lock the default again and now
give it our target and we give it our port
click Okay.
And there we go
now from this database interaction window you can execute any rescue l scripts that you might like or
perform whenever other miscellaneous shenanigans that are relevant to your penetration test.
So I'm going to close the connection
and we can also go into the password manager and from here we can add entire sets of log in credentials.
This is really just to make it easier to switch back and forth on the fly so we click insert new log
and credential and we might try route routes if we know already that this is valid
route
password
admin admin and so on and then you would click save changes.
You can also select which credentials you wish to use from the pre-existing list that you create using
this method just by clicking the use selected credentials and you can delete the credentials which I
will do now
right then.
It doesn't get much more straightforward than this but don't be fooled by how quickly this went the
word lists used in this demonstration were quite short and obviously I knew what the passwords were
going to be brute forcing a real target in the real world is going to be painfully slow and should always
be the approach of last resort.
It's noisy time consuming and you will fail a lot.
The paradox of brute forcing is that if your target has security practices that are strong enough to
resist better more subtle approaches chances are they're well-prepared to deal with this sort of an
attack nevertheless against all logic.
This approach still manages to work too often for anyone's comfort.
Hex or bass comes prepackaged with Kelly 2.0 and it will run on just about any version of Linux.
There's also a Windows version.
Keep in mind that it requires updated Python libraries to run although this should not be a problem.
If you're calling installation is up to date for those seeking this program for other operating systems
the source code can be found on github.
I hope you found this helpful and that this tool is of use to you.
Although I hope that you enjoy so much success with your more subtle approaches that you never have
to use this blunt force instrument thank you.