概述
SSHScan是一个枚举SSH密码的测试工具。使用SSHScan，可以轻松检测到弱密码。
工具地址
https://github.com/evict/SSHScan
使用
首先打开kali
之后下载工具
git clone https://github.com/evict/SSHScan.git
给工具添加可执行权限并且运行
[email protected]:~# cd SSHScan/
[email protected]:~/SSHScan# ls
README.md sshscan.py
[email protected]:~/SSHScan# chmod +x sshscan.py
[email protected]:~/SSHScan# python sshscan.py -h
_____ _____ _ _ _____
/ ___/ ___| | | / ___|
\ `--.\ `--.| |_| \ `--. ___ __ _ _ __
`--. \`--. | _ |`--. \/ __/ _` | '_ \
/\__/ /\__/ | | | /\__/ | (_| (_| | | | |
\____/\____/\_| |_\____/ \___\__,_|_| |_|
evict
Usage: usage sshscan.py [options]
Options:
--version show program's version number and exit
-h, --help show this help message and exit
Options:
-t TARGET, --target=TARGET
Specify target as 'target' or 'target:port' (port 22
is default)
-l TARGETLIST, --target-list=TARGETLIST
File with targets: 'target' or 'target:port' seperated
by a newline (port 22 is default)
[email protected]:~/SSHScan#
从帮助信息里就可以看出使用这款工具十分简单 -t 后面跟一个目标地址，-l 后面跟一个目标文件文件格式类似下面这样
192.168.1.100:22
192.168.1.101:22
192.168.1.102:22
扫描一个ip列表
[email protected]:~/SSHScan# python sshscan.py -l bboysoul.ls
_____ _____ _ _ _____
/ ___/ ___| | | / ___|
\ `--.\ `--.| |_| \ `--. ___ __ _ _ __
`--. \`--. | _ |`--. \/ __/ _` | '_ \
/\__/ /\__/ | | | /\__/ | (_| (_| | | | |
\____/\____/\_| |_\____/ \___\__,_|_| |_|
evict
[*] List contains 3 targets to scan
[*] Initiating scan for 192.168.1.100 on port 22
[*] Connected to 192.168.1.100 on port 22...
[+] Target SSH version is: SSH-2.0-OpenSSH_6.7p1 Raspbian-5+deb8u3
[+] Retrieving ciphers...
[+] Detected the following ciphers:
aes128-ctr [email protected]
aes192-ctr [email protected]
aes256-ctr [email protected]
[+] Detected the following KEX algorithms:
curve25519-sha256 ecdh-sha2-nistp256
[email protected] ecdh-sha2-nistp384
diffie-hellman-group14-sha1 ecdh-sha2-nistp521
diffie-hellman-group-exchange-sha256
[+] Detected the following MACs:
hmac-sha1 [email protected]
hmac-sha2-256 [email protected]
hmac-sha2-512 [email protected]
umac-64 [email protected]
[email protected]
[+] Detected the following HostKey algorithms:
ecdsa-sha2-nistp256 ssh-rsa
ssh-ed25519 ssh-dss
[+] No weak ciphers detected!
[+] Detected the following weak KEX algorithms:
diffie-hellman-group14-sha1 ecdh-sha2-nistp384
ecdh-sha2-nistp256 ecdh-sha2-nistp521
[+] Detected the following weak MACs:
hmac-sha1 [email protected]
umac-64 [email protected]
[+] Detected the following weak HostKey algorithms:
ecdsa-sha2-nistp256 ssh-dss
[+] Compression has been enabled!
[*] Initiating scan for 192.168.1.101 on port 22
[-] Error while connecting to 192.168.1.101 on port 22
[*] Initiating scan for 192.168.1.102 on port 22
[-] Error while connecting to 192.168.1.102 on port 22
[*] Scan completed for 1 out of 3 targets!
从上面可以看出只有192.168.1.100开放了ssh端口，openssh的版本是6.7p1的，同样的，只扫描一个ip我就不演示了
上面我们说到这个工具是是枚举ssh密码的工具，那么枚举的密码字典要放在哪里
只要打开你运行的这个python脚本
vim sshscan.py
找到下面这几句话
def get_output(rawlist):
if rawlist:
ciphers = ['3des-cbc','aes128-cbc','aes192-cbc','aes256-cbc','aes128-ctr','aes192-ctr','aes256-ctr','[email protected]','[email protected]','arcfour','arcfour128','arcfour256','blowfish-cbc','cast128-cbc','[email protected]']
strong_ciphers = ['[email protected]','[email protected]','[email protected]','aes256-ctr','aes192-ctr','aes128-ctr']
weak_ciphers = ['woyaoxuehuilinux']
macs = ['hmac-md5','hmac-md5-96','hmac-ripemd160','hmac-sha1','hmac-sha1-96','hmac-sha2-256','hmac-sha2-512','umac-64','[email protected]','[email protected]','[email protected]','[email protected]','[email protected]','[email protected]','[email protected]','[email protected]','[email protected]']
strong_macs = ['[email protected]','[email protected]','umac-128','[email protected]','hmac-sha2-512','hmac-sha2-256','[email protected]']
weak_macs = []
kex = ['curve25519-sha256', '[email protected]','diffie-hellman-group1-sha1','diffie-hellman-group14-sha1','diffie-hellman-group-exchange-sha1','diffie-hellman-group-exchange-sha256','ecdh-sha2-nistp256','ecdh-sha2-nistp384','ecdh-sha2-nistp521','[email protected]','[email protected]','[email protected]']
strong_kex = ['curve25519-sha256', '[email protected]', 'diffie-hellman-group-exchange-sha256']
weak_kex = []
hka = ['[email protected]','[email protected]','ecdsa-sha2-nistp521-ce[email protected]','[email protected]','[email protected]','[email protected]','[email protected]','[email protected]','ecdsa-sha2-nistp256','ecdsa-sha2-nistp384','ecdsa-sha2-nistp521','ssh-ed25519','ssh-rsa','ssh-dss']
strong_hka = ['[email protected]','[email protected]','[email protected]','ssh-rsa','ssh-ed25519']
weak_hka = []
dmacs = []
这里就是写字典的地方，而密码字典在下面这里
weak_ciphers = ['woyaoxuehuilinux']
你可以把你的字典放在这里
之后扫描
[email protected]:~/SSHScan# python sshscan.py -t 192.168.1.100
_____ _____ _ _ _____
/ ___/ ___| | | / ___|
\ `--.\ `--.| |_| \ `--. ___ __ _ _ __
`--. \`--. | _ |`--. \/ __/ _` | '_ \
/\__/ /\__/ | | | /\__/ | (_| (_| | | | |
\____/\____/\_| |_\____/ \___\__,_|_| |_|
evict
[*] Target 192.168.1.100 specified without a port number, using default port 22
[*] Initiating scan for 192.168.1.100 on port 22
[*] Connected to 192.168.1.100 on port 22...
[+] Target SSH version is: SSH-2.0-OpenSSH_6.7p1 Raspbian-5+deb8u3
[+] Retrieving ciphers...
[+] Detected the following ciphers:
aes128-ctr [email protected]
aes192-ctr [email protected]
aes256-ctr [email protected]
[+] Detected the following KEX algorithms:
curve25519-sha256 ecdh-sha2-nistp256
[email protected] ecdh-sha2-nistp384
diffie-hellman-group14-sha1 ecdh-sha2-nistp521
diffie-hellman-group-exchange-sha256
[+] Detected the following MACs:
hmac-sha1 [email protected]
hmac-sha2-256 [email protected]
hmac-sha2-512 [email protected]
umac-64 [email protected]
[email protected]
[+] Detected the following HostKey algorithms:
ecdsa-sha2-nistp256 ssh-rsa
ssh-ed25519 ssh-dss
[+] Detected the following weak ciphers:
woyaoxuehuilinux
[+] Detected the following weak KEX algorithms:
diffie-hellman-group14-sha1 ecdh-sha2-nistp384
ecdh-sha2-nistp256 ecdh-sha2-nistp521
[+] Detected the following weak MACs:
hmac-sha1 [email protected]
umac-64 [email protected]
[+] Detected the following weak HostKey algorithms:
ecdsa-sha2-nistp256 ssh-dss
[+] Compression has been enabled!
[email protected]:~/SSHScan#
看下面这里
[+] Detected the following weak ciphers:
woyaoxuehuilinux
探测到密码了
欢迎关注我的博客www.bboy.app Have Fun