Bboysoul's Blog

向知识投资

使用SSHScan扫描破解ssh密码

发表于 更新于 分类于

概述

SSHScan是一个枚举SSH密码的测试工具。使用SSHScan，可以轻松检测到弱密码。

工具地址

https://github.com/evict/SSHScan

使用

首先打开kali
之后下载工具
git clone https://github.com/evict/SSHScan.git
给工具添加可执行权限并且运行

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
root@kali:~# cd SSHScan/
root@kali:~/SSHScan# ls
README.md  sshscan.py
root@kali:~/SSHScan# chmod +x sshscan.py 
root@kali:~/SSHScan# python sshscan.py -h

      _____ _____ _    _ _____
     /  ___/  ___| | | /  ___|
     \ `--.\ `--.| |_| \ `--.  ___ __ _ _ __
      `--. \`--. |  _  |`--. \/ __/ _` | '_ \
     /\__/ /\__/ | | | /\__/ | (_| (_| | | | |
     \____/\____/\_| |_\____/ \___\__,_|_| |_|
                                            evict
                
Usage: usage sshscan.py [options]

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit

  Options:
    -t TARGET, --target=TARGET
                        Specify target as 'target' or 'target:port' (port 22
                        is default)
    -l TARGETLIST, --target-list=TARGETLIST
                        File with targets: 'target' or 'target:port' seperated
                        by a newline (port 22 is default)
root@kali:~/SSHScan#

从帮助信息里就可以看出使用这款工具十分简单 -t 后面跟一个目标地址，-l 后面跟一个目标文件文件格式类似下面这样

1
2
3
192.168.1.100:22
192.168.1.101:22
192.168.1.102:22

扫描一个ip列表

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
root@kali:~/SSHScan# python sshscan.py -l bboysoul.ls

      _____ _____ _    _ _____
     /  ___/  ___| | | /  ___|
     \ `--.\ `--.| |_| \ `--.  ___ __ _ _ __
      `--. \`--. |  _  |`--. \/ __/ _` | '_ \
     /\__/ /\__/ | | | /\__/ | (_| (_| | | | |
     \____/\____/\_| |_\____/ \___\__,_|_| |_|
                                            evict
                
[*] List contains 3 targets to scan
[*] Initiating scan for 192.168.1.100 on port 22
[*] Connected to 192.168.1.100 on port 22...
    [+] Target SSH version is: SSH-2.0-OpenSSH_6.7p1 Raspbian-5+deb8u3
    [+] Retrieving ciphers...
    [+] Detected the following ciphers: 
            aes128-ctr                           aes128-gcm@openssh.com               
            aes192-ctr                           aes256-gcm@openssh.com               
            aes256-ctr                           chacha20-poly1305@openssh.com        


    [+] Detected the following KEX algorithms: 
            curve25519-sha256                    ecdh-sha2-nistp256                   
            curve25519-sha256@libssh.org         ecdh-sha2-nistp384                   
            diffie-hellman-group14-sha1          ecdh-sha2-nistp521                   
            diffie-hellman-group-exchange-sha256                                      


    [+] Detected the following MACs: 
            hmac-sha1                            hmac-sha2-256-etm@openssh.com        
            hmac-sha2-256                        hmac-sha2-512-etm@openssh.com        
            hmac-sha2-512                        umac-64-etm@openssh.com              
            umac-64                              umac-128-etm@openssh.com             
            hmac-sha1-etm@openssh.com                                                 


    [+] Detected the following HostKey algorithms: 
            ecdsa-sha2-nistp256                  ssh-rsa                              
            ssh-ed25519                          ssh-dss                              


    [+] No weak ciphers detected!
    [+] Detected the following weak KEX algorithms: 
            diffie-hellman-group14-sha1          ecdh-sha2-nistp384                   
            ecdh-sha2-nistp256                   ecdh-sha2-nistp521                   


    [+] Detected the following weak MACs: 
            hmac-sha1                            hmac-sha1-etm@openssh.com            
            umac-64                              umac-64-etm@openssh.com              


    [+] Detected the following weak HostKey algorithms: 
            ecdsa-sha2-nistp256                  ssh-dss                              


    [+] Compression has been enabled!
[*] Initiating scan for 192.168.1.101 on port 22
    [-] Error while connecting to 192.168.1.101 on port 22

[*] Initiating scan for 192.168.1.102 on port 22
    [-] Error while connecting to 192.168.1.102 on port 22

[*] Scan completed for 1 out of 3 targets!

从上面可以看出只有192.168.1.100开放了ssh端口，openssh的版本是6.7p1的，同样的，只扫描一个ip我就不演示了

上面我们说到这个工具是是枚举ssh密码的工具，那么枚举的密码字典要放在哪里
只要打开你运行的这个python脚本
vim sshscan.py
找到下面这几句话

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
def get_output(rawlist):
	if rawlist:
		ciphers = ['3des-cbc','aes128-cbc','aes192-cbc','aes256-cbc','aes128-ctr','aes192-ctr','aes256-ctr','aes128-gcm@openssh.com','aes256-gcm@openssh.com','arcfour','arcfour128','arcfour256','blowfish-cbc','cast128-cbc','chacha20-poly1305@openssh.com']
		strong_ciphers = ['chacha20-poly1305@openssh.com','aes256-gcm@openssh.com','aes128-gcm@openssh.com','aes256-ctr','aes192-ctr','aes128-ctr']
		weak_ciphers = ['woyaoxuehuilinux']
	   	macs = ['hmac-md5','hmac-md5-96','hmac-ripemd160','hmac-sha1','hmac-sha1-96','hmac-sha2-256','hmac-sha2-512','umac-64','hmac-md5-etm@openssh.com','hmac-md5-96-etm@openssh.com','hmac-ripemd160-etm@openssh.com','hmac-sha1-etm@openssh.com','hmac-sha1-96-etm@openssh.com','hmac-sha2-256-etm@openssh.com','hmac-sha2-512-etm@openssh.com','umac-64-etm@openssh.com','umac-128-etm@openssh.com']
		strong_macs = ['hmac-sha2-512-etm@openssh.com','hmac-sha2-256-etm@openssh.com','umac-128','umac-128-etm@openssh.com','hmac-sha2-512','hmac-sha2-256','umac-128@openssh.com']
		weak_macs = []
		kex = ['curve25519-sha256', 'curve25519-sha256@libssh.org','diffie-hellman-group1-sha1','diffie-hellman-group14-sha1','diffie-hellman-group-exchange-sha1','diffie-hellman-group-exchange-sha256','ecdh-sha2-nistp256','ecdh-sha2-nistp384','ecdh-sha2-nistp521','ecdsa-sha2-nistp256-cert-v01@openssh.com','ecdsa-sha2-nistp384-cert-v01@openssh.com','ecdsa-sha2-nistp521-cert-v01@openssh.com']
		strong_kex = ['curve25519-sha256', 'curve25519-sha256@libssh.org', 'diffie-hellman-group-exchange-sha256']
		weak_kex = []
		hka = ['ecdsa-sha2-nistp256-cert-v01@openssh.com','ecdsa-sha2-nistp384-cert-v01@openssh.com','ecdsa-sha2-nistp521-cert-v01@openssh.com','ssh-ed25519-cert-v01@openssh.com','ssh-rsa-cert-v01@openssh.com','ssh-dss-cert-v01@openssh.com','ssh-rsa-cert-v00@openssh.com','ssh-dss-cert-v00@openssh.com','ecdsa-sha2-nistp256','ecdsa-sha2-nistp384','ecdsa-sha2-nistp521','ssh-ed25519','ssh-rsa','ssh-dss']
		strong_hka = ['ssh-rsa-cert-v01@openssh.com','ssh-ed25519-cert-v01@openssh.com','ssh-rsa-cert-v00@openssh.com','ssh-rsa','ssh-ed25519']
		weak_hka = []
		dmacs = []

这里就是写字典的地方，而密码字典在下面这里
weak_ciphers = ['woyaoxuehuilinux']
你可以把你的字典放在这里
之后扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
root@kali:~/SSHScan# python sshscan.py -t 192.168.1.100

      _____ _____ _    _ _____
     /  ___/  ___| | | /  ___|
     \ `--.\ `--.| |_| \ `--.  ___ __ _ _ __
      `--. \`--. |  _  |`--. \/ __/ _` | '_ \
     /\__/ /\__/ | | | /\__/ | (_| (_| | | | |
     \____/\____/\_| |_\____/ \___\__,_|_| |_|
                                            evict
                
[*] Target 192.168.1.100 specified without a port number, using default port 22
[*] Initiating scan for 192.168.1.100 on port 22
[*] Connected to 192.168.1.100 on port 22...
    [+] Target SSH version is: SSH-2.0-OpenSSH_6.7p1 Raspbian-5+deb8u3
    [+] Retrieving ciphers...
    [+] Detected the following ciphers: 
            aes128-ctr                           aes128-gcm@openssh.com               
            aes192-ctr                           aes256-gcm@openssh.com               
            aes256-ctr                           chacha20-poly1305@openssh.com        


    [+] Detected the following KEX algorithms: 
            curve25519-sha256                    ecdh-sha2-nistp256                   
            curve25519-sha256@libssh.org         ecdh-sha2-nistp384                   
            diffie-hellman-group14-sha1          ecdh-sha2-nistp521                   
            diffie-hellman-group-exchange-sha256                                      


    [+] Detected the following MACs: 
            hmac-sha1                            hmac-sha2-256-etm@openssh.com        
            hmac-sha2-256                        hmac-sha2-512-etm@openssh.com        
            hmac-sha2-512                        umac-64-etm@openssh.com              
            umac-64                              umac-128-etm@openssh.com             
            hmac-sha1-etm@openssh.com                                                 


    [+] Detected the following HostKey algorithms: 
            ecdsa-sha2-nistp256                  ssh-rsa                              
            ssh-ed25519                          ssh-dss                              


    [+] Detected the following weak ciphers: 
            woyaoxuehuilinux                                                          


    [+] Detected the following weak KEX algorithms: 
            diffie-hellman-group14-sha1          ecdh-sha2-nistp384                   
            ecdh-sha2-nistp256                   ecdh-sha2-nistp521                   


    [+] Detected the following weak MACs: 
            hmac-sha1                            hmac-sha1-etm@openssh.com            
            umac-64                              umac-64-etm@openssh.com              


    [+] Detected the following weak HostKey algorithms: 
            ecdsa-sha2-nistp256                  ssh-dss                              


    [+] Compression has been enabled!
root@kali:~/SSHScan#

看下面这里

1
2
[+] Detected the following weak ciphers: 
           woyaoxuehuilinux

探测到密码了

欢迎关注Bboysoul的博客www.bboy.app
Have Fun

欢迎关注我的其它发布渠道