渗透测试笔记（七）——SSH密码被暴力破解及防御

hydra [海德拉]

hydra：希腊神话中的九头蛇，传说有九头，斩一头，生两头

hydra是世界顶级密码暴力破解工具，支持几乎所有协议的在线密码破解，功能强大，密码能否被批结破解取决于字典是否足够强大

指定用户破解

 hydra -l user -P passlist.txt ftp://192.168.0.1
 hydra -L userlist -P imap://192.168.0.1/PLAIN
 hydra -C defaults.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5
 hydra -l admin -p password ftp://[192.168.0.0/24]/
 hydra -L logins.txt -P pws.txt -M targets.txt ssh
 ​
 hydra -l user -P passlist.dic ftp://192.168.0.1 ssh

用户列表破解

 cat userlist.txt
 cat passlist.txt
 hydra -L userlist.txt -P passlist.txt -t 20 192.168.1.1 ssh
 hydra -L userlist.txt -P passlist.txt -M hosts.txt ssh -o ssh-hydra.ok

Medusa [美杜莎]

Medusa速度快，支持大规模并行，模块化，爆破登录

语法参数

 Medusa [-h host|-H file] [-u username|-U file] [-p password|-P file] [-C file] -M module [OPT]
   -h [TEXT]    : Target hostname or IP address
   -H [FILE]    : File containing target hostnames or IP addresses
   -u [TEXT]    : Username to test
   -U [FILE]    : File containing usernames to test
   -p [TEXT]    : Password to test
   -P [FILE]    : File containing passwords to test
   -C [FILE]    : File containing combo entries. See README for more information.
   -O [FILE]    : File to append log information to
   -e [n/s/ns]  : Additional password checks ([n] No Password, [s] Password = Username)
   -M [TEXT]    : Name of the module to execute (without the .mod extension)
   -m [TEXT]    : Parameter to pass to the module. This can be passed multiple times with a
                  different parameter each time and they will all be sent to the module (i.e.
                  -m Param1 -m Param2, etc.)
   -d           : Dump all known modules
   -n [NUM]     : Use for non-default TCP port number
   -s           : Enable SSL
   -g [NUM]     : Give up after trying to connect for NUM seconds (default 3)
   -r [NUM]     : Sleep NUM seconds between retry attempts (default 3)
   -R [NUM]     : Attempt NUM retries before giving up. The total number of attempts will be NUM + 1.
   -c [NUM]     : Time to wait in usec to verify socket is available (default 500 usec).
   -t [NUM]     : Total number of logins to be tested concurrently
   -T [NUM]     : Total number of hosts to be tested concurrently
   -L           : Parallelize logins using one username per thread. The default is to process 
                  the entire username before proceeding.
   -f           : Stop scanning host after first valid username/password found.
   -F           : Stop audit after first valid username/password found on any host.
   -b           : Suppress startup banner
   -q           : Display module's usage information
   -v [NUM]     : Verbose level [0 - 6 (more)]
   -w [NUM]     : Error debug level [0 - 10 (more)]
   -V           : Display version
   -Z [TEXT]    : Resume scan based on map of previous scan

破解SSH密码

 medusa -M ssh -h 192.168.1.1 -u root -P passlist.txt

patator

强大的命令行暴力破解器

可用模块

 + ftp_login     : Brute-force FTP
   + ssh_login     : Brute-force SSH
   + telnet_login  : Brute-force Telnet
   + smtp_login    : Brute-force SMTP
   + smtp_vrfy     : Enumerate valid users using SMTP VRFY
   + smtp_rcpt     : Enumerate valid users using SMTP RCPT TO
   + finger_lookup : Enumerate valid users using Finger
   + http_fuzz     : Brute-force HTTP
   + rdp_gateway   : Brute-force RDP Gateway
   + ajp_fuzz      : Brute-force AJP
   + pop_login     : Brute-force POP3
   + pop_passd     : Brute-force poppassd (http://netwinsite.com/poppassd/)
   + imap_login    : Brute-force IMAP4
   + ldap_login    : Brute-force LDAP
   + dcom_login    : Brute-force DCOM
   + smb_login     : Brute-force SMB
   + smb_lookupsid : Brute-force SMB SID-lookup
   + rlogin_login  : Brute-force rlogin
   + vmauthd_login : Brute-force VMware Authentication Daemon
   + mssql_login   : Brute-force MSSQL
   + oracle_login  : Brute-force Oracle
   + mysql_login   : Brute-force MySQL
   + mysql_query   : Brute-force MySQL queries
   + rdp_login     : Brute-force RDP (NLA)
   + pgsql_login   : Brute-force PostgreSQL
   + vnc_login     : Brute-force VNC
   + dns_forward   : Forward DNS lookup
   + dns_reverse   : Reverse DNS lookup
   + snmp_login    : Brute-force SNMP v1/2/3
   + ike_enum      : Enumerate IKE transforms
   + unzip_pass    : Brute-force the password of encrypted ZIP files
   + keystore_pass : Brute-force the password of Java keystore files
   + sqlcipher_pass : Brute-force the password of SQLCipher-encrypted databases
   + umbraco_crack : Crack Umbraco HMAC-SHA1 password hashes
   + tcp_fuzz      : Fuzz TCP services
   + dummy_test    : Testing module

 (kali㉿kali)-[~]
 └─$ patator ssh_login --help                     2 ⨯
 Patator 0.9 (https://github.com/lanjelot/patator) with python-3.9.8
 Usage: ssh_login <module-options ...> [global-options ...]
 ​
 Examples:
   ssh_login host=10.0.0.1 user=root password=FILE0 0=passwords.txt -x ignore:mesg='Authentication failed.'
 ​
 Module options:
   host          : target host
   port          : target port [22]
   user          : usernames to test
   password      : passwords to test
   auth_type     : type of password authentication to use [password|keyboard-interactive|auto]
   keyfile       : file with RSA, DSA or ECDSA private key to test
   persistent    : use persistent connections [1|0]

BrutesPray

BruteSpray是一款基于nmap扫描输出的gnmap/XML文件，自动调用Medusa对服务进行爆破

Kali端安装

 apt-get update
 apt-get install brutespray
 ​
 rm -rf /var/cache/apt/archieves/lock

nmap扫描

 nmap -v 192.168.1.0/24 -oX nmap.xml
 nmap -A -p22 -v 192.168.1.0/24 -oX 22.xml
 nmap -sP 192.168.1.0/24 -oX nmaplive.xml
 nmap -sV -O 192.168.1.0/24 -oX nmap.xml

字典爆破SSH

 brutespray --file 22.xml -U userlist.txt -P passlist.txt --threads 5 --hosts 5
 cat /root/brutespray-output/ssh-success.txt

MSF

Metasploit Framework (MSF) 是一个编写、测试和使用exploit代码的完善环境。

SSH模块

 msfconsole

暴力破解防御

1、useradd shell

 useradd tyler -s /sbin/nologin

2、密码的复杂性

复杂密码+定期更换

3、修改默认端口

 /etc/ssh/sshd_config
 Port 22222

4、限制登录的用户或组

 #PermitRootLogin yes
 AllowUser tyler
 ​
 man sshd_config
 AllowUsers AllowGroups DenyUsers DenyGroups

5、使用sudo

6、设置允许的IP访问

 /etc/hosts.allow sshd:192.168.1.1:allow

7、使用DenyHosts自动统计，并将其加入到/etc/hosts.deny

8、基于PAM实现登录限制

模块：pam_tally2.so

功能：登录统计

示例：实现防止对sshd暴力破解

 grep tally2 /etc/pam.d/sshd

9、禁用密码改用公钥方式验证

10、保护xshell导出会话

11、GRUB加密