Remote Password Attacks
Network Services
During our penetration tests, every computer network we encounter will have services installed to manage, edit, or create content. All these services are hosted using specific permissions and are assigned to specific users. Apart from web applications, these services include (but are not limited to) FTP, SMB, NFS, IMAP/POP3, SSH, MySQL/MSSQL, RDP, WinRM, VNC, Telnet, SMTP, and LDAP.
For further reading on many of these services, check out the Footprinting module on HTB Academy.
Let us imagine that we want to manage a Windows server over the network. Accordingly, we need a service that allows us to access the system, execute commands on it, or access its contents via a GUI or the terminal. In this case, the most common services suitable for this are RDP, WinRM, and SSH. SSH is not as common on Windows, but it is the leading service for Linux-based systems.
WinRM - NetExec
As an example, this is what attacking a WinRM endpoint might look like:
eldeim@htb[/htb]$ netexec winrm 10.129.42.197 -u user.list -p password.list
WINRM 10.129.42.197 5985 NONE [*] None (name:10.129.42.197) (domain:None)
WINRM 10.129.42.197 5985 NONE [*] http://10.129.42.197:5985/wsman
WINRM 10.129.42.197 5985 NONE [+] None\user:password (Pwn3d!)The appearance of (Pwn3d!) is the sign that we can most likely execute system commands if we log in with the brute-forced user. Another handy tool that we can use to communicate with the WinRM service is Evil-WinRM, which allows us to communicate with the WinRM service efficiently.Evil-WinRM Usage
eldeim@htb[/htb]$ evil-winrm -i <target-IP> -u <username> -p <password>Evil-WinRM Usage
If the login was successful, a terminal session is initialized using the Powershell Remoting Protocol (MS-PSRP), which simplifies the operation and execution of commands.
Hydra - SSH
We can use a tool like Hydra to brute force SSH. This is covered in-depth in the Login Brute Forcing module.
To log in to the system via the SSH protocol, we can use the OpenSSH client, which is available by default on most Linux distributions.
Hydra - RDP
We can also use Hydra to perform RDP bruteforcing.
Linux offers different clients to communicate with the desired server using the RDP protocol. These include Remmina, xfreerdp, and many others. For our purposes, we will work with xfreerdp.
xFreeRDP
Network Services
Hydra - SMB
However, we may also get the following error describing that the server has sent an invalid reply.
Hydra - Error
This is because we most likely have an outdated version of THC-Hydra that cannot handle SMBv3 replies. To work around this problem, we can manually update and recompile hydra or use another very powerful tool, the Metasploit framework.
Metasploit Framework
Now we can use NetExec again to view the available shares and what privileges we have for them.
NetExec
To communicate with the server via SMB, we can use, for example, the tool smbclient. This tool will allow us to view the contents of the shares, upload, or download files if our privileges allow it.
Smbclient
Lab - Questions
To complete the challenge questions, be sure to download the wordlists from the attached network-services.zip archive.
It is highly recommended to run your attacks from the Pwnboxas some of the tasks take much longer over the VPN
Find the user for the WinRM service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer.
Find the user for the SSH service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer.
Find the user for the RDP service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer.
Find the user for the SMB service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer.
Spraying, Stuffing, and Defaults
Password spraying
Password spraying is a type of brute-force attack in which an attacker attempts to use a single password across many different user accounts. This technique can be particularly effective in environments where users are initialized with a default or standard password. For example, if it is known that administrators at a particular company commonly use ChangeMe123! when setting up new accounts, it would be worthwhile to spray this password across all user accounts to identify any that were not updated.
Depending on the target system, different tools may be used to carry out password spraying attacks. For web applications, Burp Suite is a strong option, while for Active Directory environments, tools such as NetExec or Kerbrute are commonly used.
Credential stuffing
Credential stuffing is another type of brute-force attack in which an attacker uses stolen credentials from one service to attempt access on others. Since many users reuse their usernames and passwords across multiple platforms (such as email, social media, and enterprise systems), these attacks are sometimes successful. As with password spraying, credential stuffing can be carried out using a variety of tools, depending on the target system. For example, if we have a list of username:password credentials obtained from a database leak, we can use hydra to perform a credential stuffing attack against an SSH service using the following syntax:
Default credentials
Many systems—such as routers, firewalls, and databases—come with default credentials. While best practice dictates that administrators change these credentials during setup, they are sometimes left unchanged, posing a serious security risk.
While several lists of known default credentials are available online, there are also dedicated tools that automate the process. One widely used example is the Default Credentials Cheat Sheet, which we can install with pip3.
Once installed, we can use the creds command to search for known default credentials associated with a specific product or vendor.
Router Brand
Default IP Address
Default Username
Default Password
3Com
http://192.168.1.1
admin
Admin
Belkin
http://192.168.2.1
admin
admin
BenQ
http://192.168.1.1
admin
Admin
D-Link
http://192.168.0.1
admin
Admin
Digicom
http://192.168.1.254
admin
Michelangelo
Linksys
http://192.168.1.1
admin
Admin
Netgear
http://192.168.0.1
admin
password
Lab - Questions
Use the credentials provided to log into the target machine and retrieve the MySQL credentials. Submit them as the answer
user "sam" and password "B@tm@n2022!"
Firstly, connect to machine via ssh and then try tod login in mysql server
So I used defaultcreds-cheat-sheet:
And got the creds superdba:admin.
Last updated