In a previous video we discussed SS H and that it's really not always that much of a low hanging fruit.
So we've got SS h here and say we want to attack it.
Now there are three reasons we're going to do this and this is from a realistic perspective.
If we see SS H on an assessment we're going to try to brute force against it or use weak or default
credentials and we're going to do that because one we're going to test password strength too we're going
to see if we can get in with a weak password or default password.
And if we can also attest to password strength correct and 3 we're going to see how well the blue team
performs.
Do they catch us.
Do they see us brute forcing this should be something that should alert when is being performed.
But you would be surprised how often it does not.
So during a pen test I am as loud as possible.
This is not a red team assessment where we're trying to be quiet.
This is a pen test where we are as loud as possible and we are hoping to be caught.
Sometimes just it or just told to tone it down a little bit you know hey we're seeing you.
Can you be more quiet.
And we just want to be caught some time so we can give kudos in a report and say Hey you saw scanning
here and here and kudos to you but you didn't see a scanning here in here.
So this is how we really help fine tune a blue team and help fine tune a client as well is being loud
sometimes.
So we're going to practice being loud today and we're also going to practice brute force attacks and
we have the perfect opportunity to do that with an essay sage port being open on this machine.
So what we're gonna do is we're going to use a tool called the Hydra and then I'll show you the Midas
plate way as well.
So Hydra is a brute force tool.
So the syntax for Hydra is going to be this.
We're gonna say a Hydra and then we're going to give a dash L for the user that we're going to be utilizing
in this case.
I want to attack root and then we're going to give a capital P for the password list.
So if we want to use a password list with L we can just say capital L but here we're going to say capital
P for the password list and then we're just gonna say user share wordless Metis ploy.
And I'm just going to double tab in this folder so you can see how many words are actually in here.
There's quite a bit of wordless and you can space space and it has wordless for all different kinds
of things built in and these are all over Cally.
So it's good to know your folder locations but user shareware list is one that will use quite a bit.
And what we're going to do is we're going to utilize an attack with these Unix passwords here.
We have a Unix users in Unix passwords.
We're going to utilize the Unix password list and just try to brute force with that.
So we'll say Unix passwords something like that and then we're going to need to specify what we're attacking.
So we are attacking SS h like this and our IP address of our machine or attacking port 22 and then we
need to have a certain amount of attempts or threads at once and we're going to limit that to four and
then I'm going to do a capital V for verbosity just because I want to see the user attempts flow through
so that we can actually see what's going on here.
So once you got the syntax ready to go go ahead and hit enter and you're going to see that it's starting
to attempt root log in password with all these weak passwords here and hopefully it might find something.
But let's go ahead and open up a a new terminal here.
And we're going to use make this a little bigger and I'm going to load up Mets played as well.
Yeah we're gonna run the same exact thing in Mets point but I think it's good to know multiple frameworks
and multiple tools to perform the same task.
So here we're going to search for something like SSD age and this is going to be an auxiliary module
so we'll just scroll up and we're going to look for something like SSA to log in perfect log in and
check scanner and make sure we don't have anything else.
And it looks good to me.
Let's go ahead and take this SSA log in and we're gonna go ahead and say use options
and now we have kind of our brute force options here.
Let me make this a little bigger sense prettier so we've got a brute force speed from zero to five five
being the fastest dribbling passwords.
No no no.
We can set a hard password and we could set a hard user name.
We could set a user and password file a user pass user as password file again.
We can have a password file as well.
So we have a lot of different options here that we can utilize but we're gonna go ahead and do the same
kind of thing we're going to say set user name and we're just gonna say room and then we're going to
say set pass file and similar to what we just use.
We're gonna say user share wordless Meadows flight and then we're going to say lyrics
unique sorry Unix passwords and that should set the pass file and then we just seen our host as well
set our host and we'll say 1 9 2 1 6 8 5 7 1 3 4 say options one more time and you can see that we've
got our password file set we've got our our host set we've got our our port on twenty two threads is
one username route and we should be good to go now we can set multiple threads here we could set threads
to like 10 this is really going to amp it up I mean this should be detected in a second but we're gonna
try to run it and we could set actually let me control see let's set verbose to true as well just so
you could see that it's actually working set verbose to true and then we're gonna run this and then
it's going to attempt different credentials here and it'll say Hey I found it in the light up green
and then we'll know it's good.
So this is actually going kind of slow surprisingly and you can see here that we are at attempt 112
116.
So this is out also going slow and we do not have a successful attempt or a log in I actually don't
believe there's going to be one but you never know.
I believe I remember taking this off line and trying to crack the password and wasn't any kind of weak
password.
So you can let your brute brute force run if you want to go with it but I'm going to go ahead and kill
mine and that's it for this video.
So from here we're going to talk about a similar methodology called credential stuffing which we've
already talked about before except we're not brute forcing but we're using common knowledge to our advantage.
So we'll talk about a little bit of Chris stuffing in the next video.