SSH and RDP
In this section,
we’ll execute dictionary attacks against the common SSH and RDP services
using the open-source THC Hydra tool,
which can execute a broad variety of password attacks
against a variety of network services and protocols.
We’ll also use the popular rockyou wordlist,
which contains over 14 million passwords.
Both of these are pre-installed on our Kali machine.
In the first example,
we’ll attack the SSH service on port 2222 on our target machine.
We’ll attempt to determine the password for the user george.
Before we start our dictionary attack,
we should confirm that the target is running an SSH service on port 2222.
The output indicates that SSH is open.
Let’s assume that through the information gathering process
we already discovered the george user.
Next, let’s prepare to use the rockyou wordlist file.
Since the file is compressed to save space we must uncompress it with gzip -d.
Finally, we can run hydra.
We’ll attack a single username with -l george,
indicate our password list with -P
specify the port with -s,
and define our target.
The listing shows that we successfully used Hydra
to discover a valid login for the george user.
The dictionary attack worked
because the password was contained in the rockyou wordlist
and we knew the name of the user we wanted to attack.
However, if we didn’t have valid usernames
we would use enumeration and information gathering techniques to find them.
Alternatively, we could also attack built-in accounts
such as root (on Linux) or Administrator (on Windows).
In this next example,
we will attempt to use a single password against a variety of usernames
in a technique known as password spraying.
Let’s demonstrate this scenario by executing a spray attack
against an RDP service on a Windows target.
We’ll again use hydra,
In this example,
we’ll assume we have already obtained a valid user password,
and we will attempt that password against a variety of potential user account names
with a list with -L.
We’ll use the RDP protocol this time.
In this case, we identified two usernames
with the password we discovered in the database leak.
We should always try to leverage every plaintext password we discover
by spraying them against the target’s systems.
This could reveal users that use the same password across multiple systems.
However, we must also use caution when leveraging broad-range attacks.