SPLOIT: How to Make an SSH Brute-Forcer in Python « Null Byte :: WonderHowTo

NOTICE: Ciuffy will be answering questions related to my articles on my behalf as I am very busy. Hope You Have Fun !!!As much as I love other SSH bruteforcing tools likeNcrack,Metasploit,THC-Hydra, ... ( Just to mention a few ). I prefer using my own script. The tools above have efficiency, good performance, accuracy and other fine abilities but Python makes it fun and easy to build simple and similar tools and scripts that facilitates automation. My scripts may not be perfect but Errmm ... At least they get the job done.Today's tutorial is basically a short one since I bet anyone reading this article or post knows what SSH is ? ....... ( A brief intro on SSH ).SSH - Secure ShellSecure Shell, or SSH, is a cryptographic ( encrypted ) network protocol for initiating text-based shell sessions on remote machines in a secure way.This allows a user to run commands on a machine's command prompt without them being physically present near the machine. It also allows a user to establish a secure channel over an insecure network in a client-server architecture, connecting an SSH client application with an SSH server.The most visible application of the protocol is for access to shell accounts on Unix-like operating systems, but it can also be used in a similar fashion on Windows.SSH was designed as a replacement for Telnet and other insecure remote shell protocols such as the Berkeley rsh and rexec protocols, which send information, notably passwords, in plaintext, rendering them susceptible to interception and disclosure using packet analysis. The encryption used by SSH is intended to provide confidentiality and integrity of data over an unsecured network, such as the Internet, although files leaked byEdward Showdenindicate that the National Security Agency can sometimes decrypt SSH.BUILDING A BRUTEFORCER FOR SSH IN PYTHONBruteforcing is basically trying passwords until the right one is found.Its a friend or lets say the same as dictionary attack.Before we start writing our script, We first need to check if the service i.e SSH is running and especially on its default port.Our Custom Python Port ScannerWe made a customPython Port Scannersome time ago and I think we could finally use its help here. Lets scan !!!NmapWe all know Nmap and if you don't -Use This Fine Link To Find Tutorials By OTW and OthersHEADS UPThe domain addresssecret.database.whitehouse.comis not an actual address, Just playing around my/etc/hostsfile as you can see the IP is10.0.2.21which is one of my internal NAT Virtual Machine Addresses ( Ubuntu ). Don't go scanning ghost addresses.STEP 0: INTRODUCTIONOK !!, So the entire work is going to be based on a Python Library -Paramiko. Paramiko is a Python (2.6+, 3.3+) implementation of the SSHv2 protocol, Providing both client and server functionality. While it leverages a Python C extension for low level cryptography ( PyCrypto ), Paramiko itself is a pure Python interface around SSH networking concepts.- Paramiko WebsiteSTEP 1: Importing ModulesWe import 4 modules -Paramiko,Sys,OS,SocketParamiko - SSH Library ( 10 / 10 )Sys - Exits the script and returns codes ( 2 / 10 )OS - ( Optional ) Checks if password file path is correct. ( 1 / 10 )Socket - ( Optional ) Makes sure our script does not mess up. ( 2 / 10 )STEP 2: Declaring Program VariablesIn Python, Global variables are simply variables that are accessible any where in a program. A variable is assigned global by passing the variable name to the global object.Eg. global knife- ( Variable knife is global and can be accessed anywhere in the program.We defined multiple global variables - host, username, line, input_fileline - Has been assigned a string, Actually this string will help differentiate the right credentials during the bruteforcing process which we will tackling in a moment.STEP 3: Collecting Program InformationVariablehost- Holds the target addressVariableusername- Holds the ssh username to be bruteforcedVariableinput_file- Holds the file path stringWe may attempt bruteforcing the user's passwords when we know the user's username. For a successful bruteforce, One needs to have a correct username and i guess a password list i.e One that contains the password.We basically need 3 information i.e the host address, username and the password file path. After the information is received, We check if the password file path is correct since the entire process is based on it and we can't afford wrong file paths, After that, we use theos.path.existsfunction to check if the file exists, If it doesn't, then we printFile Path Does Not Exist !!!and exit the script returning an integer of 4 to the caller.Except KeyboardInterruptThis handles keyboard interrupts ( Ctrl + C ) should the user want to close the script for whatever purposes. This prevents python from stopping our program execution and spilling its Keyboard Interrupt exception code to the screen. ( Kind-off seems unprofessional ). Like this ..Image viawonderhowto.comLet's see what our program does when a user hits the interrupt command.Nicely done !!!STEP 4: ssh_connect() FunctionFunctions are best placed below the import statements and above the program codes, This makes it accessible to all below it.This function accepts an argument - password ( Another argumentcodeis optional and has been set to0)What this function basically does is to set up the ssh client, connect, close and return an integer.We make our script return0to its caller should the credentials used to connect to the SSH server be correct.We make our script also return1to its caller should the credentials used to connect to the SSH server be wrong.We finally make our script return2to its caller should the connection fail i.e Host is down, Internet Connectivity or any error with the connectionNOTICE:On line 12, the port was specified ( I know SSH uses port 22 by default), Because some servers change the service configuration port to invade bruteforcing and other port based attacks.STEP 5: FINAL MAGICThe first line opens the file streamA newline is added to the terminal screenFor each line i.e word ( password ) in the filestream: Do this ...Assign the line to a variablepassword.Execute thessh_connect()function passing the variable password to it and then assign the return code to a new variable calledresponseIf the response variable holds integer0, then we know the password was found, the print statement issuesUser: <user> Pass Found: <password>to the terminalIf the response variable holds integer1, then we know the login is wrong, We print our wrong login error, the script then takes off and tries the process again until the last lineof the password file.If the response variable holds integer2, then we know the connection is a dead end i.e Host is not available ( down ), We then immediately exit the script with a print statement issuingConnection Could Not Be Established To Address: <address>After every line or word or password is tried, Close the password file stream. Ladies and Gentlemen !!!, This is the end of the magic ....STEP 6: EXECUTING SCRIPTThe user we are going to try bruteforcing isBoband his password issergeantbut this tutorial assumes we do not know the password, only the username.A peek into our password file:/root/Desktop/password.txtLet's test our program execution.HOW TO REDUCE BRUTE-FORCE LOGIN ATTEMPTSTry switching your SSH service to a non-standard port from the default 22Install an auto-ban script such asfail2ban-apt-get install fail2banInstall firewalls that can stop such attacksDon't allow root to loginDon't allow ssh passwords ( use private key authentication )Don't listen on every interfaceCreate a network interface for SSH (e.g eth1), which is different to the interface you serve requests from (e.g eth0)Don't use common usernamesUse an allow list, and only allow users that require SSH AccessIf you require Internet Access...Restrict Access to a finite set of IPs. One static IP is ideal, however locking it down to x.x.0.0/16 is better than 0.0.0.0/0If possible find a way to connect without Internet Access, that way you can deny all internet traffic for SSH (e.g with AWS you can get a direct connection that bypasses the Internet, it's called Direct Connect)Make sure OS is always up to date, in particular security and ssh packages -StackOverflowCONCLUSIONThis method is quite loud on the server I think and the server could easily blacklist us.Take precaution and don't end up in 9 step to and fro cell.Hope someone had fun today because am completely and happily bored. This post will be one for a very long time. Nice community.PeaceImage viawonderhowto.com# SergeantWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Automate Brute-Force Attacks for Nmap ScansHow To:Brute-Force Nearly Any Website Login with HatchHow To:Brute-Force SSH, FTP, VNC & More with BruteDumHow To:Use variables and strings when programming in Python 2How To:Discover & Attack Services on Web Apps or Networks with SpartaHow To:Perform Network-Based Attacks with an SBC ImplantSPLOIT:How to Find the Exact Location of Any Internet Address ( GUI - Linux )How To:Hack WPA WiFi Passwords by Cracking the WPS PINHow To:Spy on SSH Sessions with SSHPry2.0How To:Create Custom Wordlists for Password Cracking Using the MentalistHow To:Run Your Favorite Graphical X Applications Over SSHHow To:Use SSH Local Port Forwarding to Pivot into Restricted NetworksHow To:Locate & Exploit Devices Vulnerable to the Libssh Security FlawHow To:Use Beginner Python to Build a Brute-Force Tool for SHA-1 HashesHow To:Push and Pull Remote Files Securely Over SSH with PipesHow To:Generate Word-Lists with Python for Dictionary AttacksHow To:Safely Log In to Your SSH Account Without a PasswordHow To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreHow To:Remotely Control Computers Over VNC Securely with SSHHow To:Create an SSH Tunnel Server and Client in LinuxNews:Learning Python 3.x as I go (Last Updated 6/72012)How To:Code Your Own Twitter Client in Python Using OAuthWeekend Homework:How to Become a Null Byte Contributor (2/10/2012)News:Ball PythonsHow To:Make a Gmail Notifier in PythonHow To:Enable Code Syntax Highlighting for Python in the Nano Text EditorNews:Monty Python's World Cup - In case you haven't seen itHow To:Make a Change-of-IP Notifier in PythonPet Portrait Challenge:FranklinPygame:All You Need to Start Making Games in PythonNews:Learn to Code in Python, Part One: Variables, Input and Output