All right,
so let's take advantage of some of the stuff that you've
learned with the looping passwords around users and perform a
password spray attack against RDP.
So a Windows 10 machine that's running Remote Desktop Protocol.
So let's give that a try here. You've got hydra ‑u so
that it'll loop around the users.
And then we've got ‑L for our usernames.
And then we've got ‑P for a password of Winter2018. Then we've
got to target by designating the protocol,
which in this case is rdp:// 192.168.30.131, and then let's give this a try.
And here we have four users that have the Winter2018 password.
Let's go ahead and give those a try, or least one of them, Emily Moss at
rdesktop ‑u for Emily.Moss ‑d for globomantics, the domain ‑p.
And then a dash so that we're not storing the password in the history.
And then the target IP, Winter2018.
And as you can see, we are now logged in through RDP on Emily's machine.
Hydra allows you to configure your proxy settings so that it will
route the traffic through a proxy of your choosing.
Now that's useful for many different things, but in this case
we're going to leverage it so that we can send it to a local Burp
Community Edition proxy that's set up.
So we've got export HYDRA_PROXY_HTTP=http://127.0.0.1:8080.
So let's go ahead and add that to our environment.
We can check the environment by grepping it out to
make sure everything went well, and it's in there as we wanted it to.
So let's go ahead and clear this out.
And then I will minimize the terminal here and load up Burp Suite. We can
use the defaults here just to get started. And the very first thing that
I'm going to want to do is go into Proxy here,
turn the Intercept is on to Intercept is off,
then jump into Options and select the proxy listener, and we'll
want to edit this. Go to Request handling,
and then check this box right here,
Support invisible proxy. And we'll click OK. And then let's go to
HTTP history, and we'll have to bounce back over to the terminal
so that we can launch an attack.
Here we go,
and we'll do something simple and we'll leverage one of the commands
that we've already got in here and then modify few things because
basically you just want to send a few packets.
So I've got hydra ‑l for login bee, and then dash ‑p for bug.
And then I've got the 192, etc., address and all of the
other items that we've already talked about.
So let's go ahead and give this a try, and it found a password,
and let's jump back into Burp Suite Community Edition and take
a look at what we've got here.
So here is our POST request, which was expected,
right? So you've got your cookies and you've got password as
bug and security level 0 and login is bee.
So all is well there.
However,
we also have this additional item here. And it seems that Hydra
is sending both a POST and a GET request.
So of course, now we'll have to troubleshoot this a bit.
And let's take a look and see what happens with a failed password.
So we'll jump in here and just look at the password
bugs and see if that's any different.
We'll jump back into Burp Suite, and no,
we get the same thing, there's a GET method and a POST method.
The next step would probably be to jump back into the terminal, and let's
clear our screen here so we have something to work with,
and then we will re‑run this command, and this time we're going to debug.
So ‑d, and we are going to get a lot more information here.
So let's scroll up.
And we've got a POST request, which is what we would have expected to see.
But then if you scroll up here further, you also have a GET request.
Now,
I'm not going to dive into why that's occurring here right now,
but the one takeaway I hope you get is that if you are having
trouble with something and you need to understand more about
what you're dealing with, use the debug option and follow through line by line,
and hopefully that will help you find any errors that you may have made
while you're setting up your brute force session.