In this video, we will take a look at Kraken as
a seach access.
I hope you're excited. So, let's Dive In.
To get started with this exercise. Please ensure
you boot up your Kali lancs virtual machine and also
power on the metasploitable to Virtual
Machine.
As you can see my metasploitable to virtual machine
is running in the background.
To get started. Let's open the terminal
on Kali Linux like so
and firstly let's perform a ping scan
on our virtual Network to determine the IP address
of our Target system, which is metasploitable, too.
Let's type and map -
SN followed by the network ID and
we will exclude our Kali Linux IP
address hit enter.
Which are a few seconds this kind will complete and currently
we can see that our Target system, which
is 172 tt1 t87 is
online. So let's copy that
IP address next. Let's determine if
SSH is running on
the target system to do this. Let's type
and map.
like so
- P followed by the port which is
Port 22 Versace followed by
the IEP address of the target system hit enter.
Currently we can see Port 22 is
open and SSH is running on the
target system.
So great. Now let's use Metasploit
to perform on SSH Brute
Force attack on the target system.
To start Metasploit. We are going
to use a command msf console like so and this
will start Metasploit exploitation development framework.
This will take a few seconds to loot. But once it's loaded,
we will have access to the Metasploit user
interface.
Great, so Metasploit is looted.
The thing I want metal Floyd is it contains so
many modules and these modules could be auxiliary modules
such as scanners. It could be exploits
P loads even and quarters to
help us find the SSH modular we
are looking for we can simply use a search
feature like so let's type switch
then SSH space login
and hit enter.
Currently it found a lot of different modules, which
is excellent. However, we are looking
for a specific module which is
the auxiliary scanner.
SSH ssh underscore logging
so let's copy this particular module.
And let's use it type use followed by
the actual model name, which is auxiliary scanner
SSH logging and
hit enter.
Now that your selected the module, let's type
options to see what options or what
parameters we need to set on this model
before we can launch it against a Target.
On the output it shows various settings
such as we have blank passwords
whether it is set or what it
is a value what it is required or even
not required on a description.
Firstly let's set our Target IP
address. So we will need to set
the rhost settings. Let's
type set.
our host like so
And let's specify the IP address of our Target
system.
Great.
The next thing we need to do is let's select a
username.
now we can see like
a wordless that contains a lot of usernames and
also a word list that contains a lot of passwords.
The downside is with a Brute Force attack.
It takes really really long to complete. However, you
are feel free to set a password
list or a word list for either the username or password.
However, just for this exercise will
be setting
the username and a list
of possible passwords. So let's set the username. Let's
do set.
Username like so let's set the
username to be administrator. Great.
In a previous video, we have created a word lists within
our present working directory that contains some very
simple passwords. I think it was about three or
four passwords. Let's check. Let's open a new
terminal like so I'll drag this to the side.
And let's type ls-l.
And here we can see we have weird list number one.
Let's type cut.
We listen number one and we have a few entries. Excellent.
So let's use this Wheelis. And
let's see if the password is actually found what we are
doing is simply proof of concept simply because brute force
and usually takes a very very long time to actually
complete.
So let's use our word list that you have created and
set it with the Metasploit.
We can use set.
pass
underscore
file like so and then
we can specify the directory for our wordless. Let's
just type wordless one the txc
like so and hit enter.
Now that we are set a single username and we
have set a password list or
it would list out contains fossil passwords. Let's execute
this module and see whether it possible
user credentials actually found let's
diaper on and hit enter.
Currently starting the Brute Force attack and it
is using the username administrator, but
check it against the different passwords within
the system.
So far it completed, but it
didn't say what it was
able to log in or not. So most likely this attack has
field.
since our attackers feel
let's actually amend or modify our
wordless file.
So let's open the text editor like so
let's click on file.
Let's click on open.
And let's head over to our home directory and
let's select all woodless one like so and simply click
on ubon.
Now that we have the wordless file loop on let's insert
msf. Admin.
As a fifth entry and let's see it like
so.
Let's close.
Great.
Let's type options one more time and currently we
can see the username is set to administrative.
Let's change your username.
Let's do set.
Username like so let's type
msf. Admin.
Great, let's type options one more
time. Currently. We are using a different
username to test against our woodless.
Let's diaper on one more time and let's see what happens.
So great. We have it different type of result this
time. It says successful and I
provide us with the username and password combination
that actually work that allow us to gain access
into the system.
Additionally, it shows certain as a
seed Session 1 was upon from our system,
which is khalidanox onto the target system.
So this is a simple proof of concept technique that you can use to
actually identify and even retrieve possible
user news on passwords. Keep in mind that you could
use additional paths with lists that is found on
the internet or those are to actually pre-install on
Kali Linux. We use this simple exercise simply
because you want to reduce the time to demonstrate
how this attack is very
practical but on the downside is with a
real Brute Force attack, it can take hours to
even these two months to even years to be
completed.
In this video you have learn how to crack SSH
access On Target vulnerable system.
In the next video, we'll be starting Section 5. I
hope this video has been informative for you and thank
you for viewing.