Speaker: It is time to switch things up a little bit
and check out a new type of the attack
called brute force attack.
Unlike the previous attacks, which were vulnerabilities,
information disclosures, or misconfigurations,
right now, we are going to perform something
that will be more of a presentation of the attack
than the attack itself.
Since we are going to cheat a little bit.
But before I tell you how we are going to cheat,
let's first explain what are brute force attacks?
Well, brute force attacks is you sending
a lot of different information to the target
in order to figure out what information is correct.
Now, you could be wondering what do I mean
by sending information to the target?
Well, this can be anything.
In 99% of cases, it is usually usernames or passwords.
So we send a lot of usernames and a lot of passwords
and hope that we by accident hit the correct one.
And when is this useful?
Well, you usually perform this attack
to see whether the target has default credentials
or weak passwords.
These type of attacks will work for example,
if the target has a password
that has small amount of characters,
or if it is very easy to guess.
For example, password, password one to three,
is very easy to guess
but it is also one of the most used passwords in the world.
In this case, we know that the MSF admin
and MSF admin is one account on the target machine.
So we will use those credentials to log in to the SSH.
In that sense, this will not be a real attack
since we will be putting those credentials
in two different lists.
One list will contain usernames
and other list will contain passwords.
Then we will run the brute force attack
and you will see it will automatically go through
all of the usernames and passwords in those lists
and it'll manage to find the correct ones
which are MSF admin and MSF admin.
Let's do it.
To perform this using Metasploit framework,
we're going to use an auxiliary module
that is used for sage login.
If we search SSH,
right here,
we will get a bunch of the results.
But the one that we are interested in
is all the way up I believe,
and it is this one,
auxiliary scanner ssh slash SSH login.
Let's go with the auxiliary module name.
And let's type down here
use and pace the module name.
If we type show options,
for this module, we can see we have a lot of options
available to specify.
Keep in mind that only some of them are required
and a lot of them aren't
as we can see by this column right here.
Let's see what the things that we need
in order for this brute force attacked work.
We got the brute force speed
and this is how fast it'll try the passwords.
We can specify a single password
or a password file
and we will be going with the password file in our case,
we must specify the RHOST,
which is the IP address of the target.
The RPORT is the ssh port on the target machine
and let's just double check it is 22 here
and it is also 22 in our scan,
so that is already set correctly.
Here we can also set the username
and this username field is a single username,
or we can set the user file,
which would be the file containing bunch of usernames.
Another possible option that we can do
is set userpass file.
And what this userpass file is
is a file containing both usernames and passwords.
As it says right here,
file containing users and passwords
separated by space one pair per line.
Now for this particular attack,
we are going to be using a password file
and a user file separately.
So what we must do first is we must create those files.
Let us open another terminal,
navigate to the desktop of our mister hacker account
and let's nano usernames.txt
This will be our list containing usernames.
And let's just for the purposes of this tutorial,
write a few of them, so admin root
test123
Let's go with the system and msfadmin.
We must add the correct one in order for the SSH root force
to be able to find it.
And after it, let's add one more.
Let's call this one admin123.
So this is six usernames.
Of course, in a real life attack.
you would be using much bigger lists.
But for now for the purposes of this tutorial,
we will create these small lists and see whether it'll work.
So we got our usernames file right here,
and it has the correct username specified.
Let's save it.
Now we need to do the same thing with the password.
So let's nano passwords.txt
Here, let's type password,
password123,
hello world.
Let's also type msfadmin, which is the correct password
and we know it at the moment
and at the end let's type test1234
So here, we have five passwords
and one of them is the correct one.
Let's save this file.
And if I type LS, we should have both of the files
in our desktop directory.
Let's specify them right here in our options.
So, the password file must be the entire path
to this passwords.txt
So we must specify the entire path.
To check out the entire path,
I can type print working directory
inside of desktop directory and copy this.
And inside of our Metasploit framework
we can type set pass underscore file
and then paste the path, add slash, and then passwords.txt
This now set the path to the pass file
to be this path right here.
And we must do the same thing for the usernames.
Let's type set user underscore file
paste the same path right here
and add instead of passwords.txt
let's add usernames.txxt, press enter.
And if I type show options once again,
let's see what else do we need to specify.
Here, the password file and the user file
has already been specified
but we must also specify the RHOSTS for this work.
So let's do it.
If I type set RHOSTS, type the IP address
on my Metasploitable, clear the screen
and I check out options once again.
All seems to be set.
We will leave the brute force speed to be five,
which is the fastest.
And one more thing that we want to change is this
verbose right here.
This is currently set to false.
We want to set it to true.
And this verbose means that it'll print out
even the failed usernames and passwords.
It will not only print the successful login.
Let me show you right here.
If I set verbose to be equal to true, clear the screen
and run this.
Here it is, it started our attack.
It is going to try every single combination
of usernames and passwords from those two files.
Now you might notice this isn't going that fast.
And it'll print out all of these failed passwords
until it reaches the combination of msfadmin and msfadmin
as both username and password.
Let's wait for that combination to come,
and here it is.
We found the correct ssh username and password.
Once it prints out this success rate here.
This means it found the correct username and password,
and you can just control see this,
if it didn't stop,
in order to stop the brute forcing.
Now I know what you're thinking once again,
this is not a true attack since we added username
and password to the list.
But once again, remember that you will do this
for the week credentials and the default passwords.
And of course in real attacks,
you would be using much bigger lists than these
that we created right here.
And many of those bigger lists,
we can find inside of our Ca Linux machine.
However, more about them later.
For now, we just tested it out to make sure
that this brute force attack works.
We can also see right here it opened the command shell
as soon as it found the correct username and password.
But if you press Ctrl C or you waited for this to finish,
it doesn't seem that we can execute commands anywhere.
We just went back to our auxiliary module right here.
We are not inside of a shell.
Well, once something like this happens,
Metasploit saves the shell in the background
so we can still enter that shell.
To check out all of the available shells
that we currently have established.
We can type the command sessions.
And here we can see we got one shell over ssh
to the IP address of the Metasploitable.
To enter inside of this session,
we can type the command sessions dash I
and then this session ID.
In my case it is one.
And it'll probably be in your case as well.
So if I set here sessions I one,
this will start interaction with this shell
and it'll open our shell right here.
And you can now execute the commands as usual.
Who am I? will tell me the I'm msfadmin.
If I want to become the root account,
I type sudo su, type in msfadmin password,
and I type, who am I once again.
Now I'm root count.
Another way that you can establish ssh connection
once knowing the username and password,
is like this.
First, let's exit out of this,
exit out of Metasploit framework.
And now that you know the username and password of the ssh,
we can open our terminal and type ssh msfadmin,
which is the username at and then the IP address
of the Metasploitable,
which is 192.168.1.9 in my case.
If I press here enter,
it'll ask me this question,
Are you sure you want to continue connecting?
I want to specify yes right here,
and it'll ask me for the password for this specific account.
And we know that the password is msfadmin,
so I will type it right here and here it is.
We opened the terminal of the Metasploitable.
If I type, who am I we are msfadmin.
And that would be about it for the ssh brute force attack.
Don't worry, real brute force attacks will perform later
regarding website logging forms and wifi cracking.
This video was just to introduce you
to the concept of brute forcing.
If you were to exploit a target like this in real life,
it'll be considered weak credentials
or default credentials vulnerability,
and you would of course write it down
as a critical vulnerability.
Great, that is another vulnerability covered.
Let's go and hunt the next one down in the next video.