OpenSSH is a free opensource version of the SSH connectivity tools. OpenSSH encrypts all traffic (including passwords) to effectively eliminate eavesdropping, connection hijacking, and other attacks unlike Telnet,rlogin or ftp where the data is not encrypted and transmitted in plain text. Additionally, OpenSSH provides secure tunneling capabilities and several authentication methods, and supports all SSH protocol versions.
- SSH (Secure SHell) is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over the secure channel.
- Relationship of configuration files. The SSH server actually reads several configuration files. The sshdconfig file specifies the locations of one or more host key files (mandatory) and the location of authorizedkeys files for users.
Solaris 10 is by default installed with SSH server and the clients. However, if you have chosen to ignore SSH at the time of installation or have started the install with a minimal install then you may need to install OpenSSH manually.
SSH - OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) Ubuntu/Debian: How to brute force SSH – Metasploitable2 How to exploit Predictable PRNG Bruteforce OpenSSH – Metasploitable2 How to login SSH by using private key – Metasploitable2 How to login SSH by using the attacker’s private key – Metasploitable2: 25: SMTP: Ubuntu/Debian. 4 messages in org.freebsd.freebsd-ports Problem with openssh-portable and HPN.
The easiest way to install OpenSSH in Sun Solaris is to use the pre-compiled packages from sunfreeware.
The following are the packages that are required to be installed for OpenSSH to work properly in Solaris 10:
To start of, download the packages from the following sunfreeware.com links for sun solaris 10 Sparc:
gcc
Zlib
OpenSSL
OpenSSH
Once done, upload the files onto the server so we can start to unzip the files and install.
Unzip and install gcc
solaris10# gunzip libgcc-3.4.6-sol9-sparc-local.gz
solaris10# pkgadd -d libgcc-3.4.6-sol9-sparc-local
…
…
Installation of <SMCgcc> was successful.
Unzip and install zlib
solaris10# gunzip zlib-1.2.1-sol9-sparc-local.gz
solaris10# pkgadd -d zlib-1.2.1-sol9-sparc-local
…
…
Installation of <SMCzlib> was successful.
Unzip and install OpenSSL
solaris10# gunzip openssl-0.9.8f-sol9-sparc-local.gz
solaris10# pkgadd -d openssl-0.9.8f-sol9-sparc-local
…
…
Installation of <SMCossl> was successful.
Unzip and install OpenSSH
solaris10# gunzip openssh-4.7p1-sol9-sparc-local.gz
solaris10# pkgadd -d openssh-4.7p1-sol9-sparc-local
The packages are now installed.
Create /var/empty directory
solaris10# mkdir /var/empty
Change directory ownership to Root user and sys group
solaris10# chown root:sys /var/empty
Change permissions
solaris10# chmod 755 /var/empty
Add sshd user & group
solaris10# groupadd ssh
solaris10# # useradd -g sshd -c ‘sshd privsep’ -d /var/empty -s /bin/false sshd
Edit the default /usr/local/sshd_config file and make the following changes: Fnaf 2 for mac.
Replace the line
Subsystem sftp /usr/libexec/sftp-server
with
Subsystem sftp /usr/local/libexec/sftp-server
Generate Keys for the server
solaris10# ssh-keygen -t rsa1 -f /usr/local/etc/ssh_host_key -N “”
solaris10# ssh-keygen -t dsa -f /usr/local/etc/ssh_host_dsa_key -N “”
solaris10# ssh-keygen -t rsa -f /usr/local/etc/ssh_host_rsa_key -N “”
Enable OpenSSH server daemon sshd to run at the system startup
Edit /lib/svc/method/sshd file and change the path for the SSH DIR, KEYGEN & the start daemon as follows:
SSHDIR=/usr/local/etc/ssh
KEYGEN=”/usr/local/bin/ssh-keygen -q”
‘start’)
/usr/local/sbin/sshd
That is it. All done and ready to go. Try connecting to the server using a ssh client like PUTTY.
Foot-printing and Reconnaissance
Scanning
Exploitation| Ports | Services | Operating Systems | How-to |
|---|---|---|---|
| 21 | FTP vsftpd - vsFTPd 2.3.4 | Ubuntu/Debian | How to exploit vsftpd backdoor – Metasploitable2 How to exploit vsftpd backdoor (manually) – Metasploitable2 |
| 22 | SSH - OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) | Ubuntu/Debian | How to brute force SSH – Metasploitable2 How to exploit Predictable PRNG Bruteforce OpenSSH – Metasploitable2 How to login SSH by using private key – Metasploitable2 How to login SSH by using the attacker’s private key – Metasploitable2 |
| 25 | SMTP | Ubuntu/Debian | How to enumerate SMTP user – Metasploitable2 |
| 80 | Apache/2.2.8 (Ubuntu) DAV/2 | Ubuntu/Debian | How to exploit WebDav – Metasploitable2 |
| 80, 8080, 8180 | Apache Tomcat/Coyote JSP engine 1.1 Tomcat/5.5 | Ubuntu/Debian | How to exploit TOMCAT – Metasploitable2 |
| 139, 445 | netbios-ssn | Windows | How to exploit MS_08067netapi using Metasploit Framework GUI |
| 139, 445 | netbios-ssn, SAMBA - smbd 3.X | Ubuntu/Debian | How to exploit SAMBA, usermap_script (CVE-2007-2447) – Metasploitable2 How to exploit Samba Symlink Directory Traversal – Metasploitable2 |
| 512, 513, 514 | 'r' services | Ubuntu/Debian | How to connect “r” services – Metasploitable2 |
| 1099 | Java RMI | Ubuntu/Debian | How to exploit the Java RMI Server – Metasploitable2 |
| 1524 | “ingreslock” backdoor | Ubuntu/Debian | How to connect “ingreslock” backdoor – Metasploitable2 |
| 2049 | NFS | Ubuntu/Debian | How to mount Network File System (NFS) – Metasploitable2 |
| 3260 | Skuzzy | Ubuntu/Debian | How to connect skuzzy without credentials - Ew_Skuzzy |
| 3306 | MySQL | Ubuntu/Debian | Commands: How to brute force MySQL – Metasploitable2 How to read the password file via MySQL – Metasploitable2 How to use Mysqladmin Commands for Database Administration Configurations: How to reset the Mysql Password in Kali linux How to fix MySQL (Can’t connect) in Kali linux2 |
| 3632 | distcc daemon - v1, 2.x | Ubuntu/Debian | How to exploit the distcc daemon – Metasploitable2 |
| 5432 | postgresql | Ubuntu/Debian | How to brute force PostgreSQL – Metasploitable2 How to exploit the OS file system via PostgreSQL – Metasploitable2 |
| 6777 | Unreal ircd - 3.2.8.1 | Ubuntu/Debian | How to exploit the UnrealIRCD (Backdoor Command Execution) – Metasploitable2 How to exploit the UnrealIRCD manually (Backdoor Command Execution) – Metasploitable2 |
| 8787 | Ruby DRb RMI server - 1.8 | Ubuntu/Debian | How to exploit Ruby DRb RMI – Metasploitable2 |
| 80, 7001 | WebLogic Server Application 10.3.6.0.0 12.1.3.0.0 12.2.1.1.0 12.2.1.2.0 | Ubuntu/Docker | How to exploit WebLogic server via Java De-serialization Vulnerabilities |
Openssh 4.7 P1005
| Operating Systems | Versions/Kernel | Vulnerabilities | How-to |
|---|---|---|---|
| Linux | Ubantu 8.04, 2.6.24-16 | udev < 141 | How to escalate the privilege by UDEV < 141 – Metasploitable2 |
| Linux | Ubantu 14.01, 3.13.0-32-generic | Apport/Abrt < 2.17.1 | How to escalate the privilege by Apport (Installed packages) – Sedna |
| Chkrootkit 0.49 | How to escalate the privilege by Chkrootkit 0.49 (Configuration files) – Sedna | ||
| Linux | Ubantu 11.10, 3.0.0-12-generic | SUID | How to find SUID permission – Nebula 00 |
| $PATH | How to modify $PATH (environment variable) - Nebula 01 | ||
| environmental variable + command injection | How to inject command through the environmental variable – Nebula 02 | ||
| crontab + improper permission | How to escalate the privileges through improper contrab implementation – Nebula 03 | ||
| bypass the filename filter + SUID | How to bypass the filename filter to execute the SUID file – Nebula 04 | ||
| hidden backed file + disclosure of private key of SSH | How to find the hidden file and login SSH through private key – Nebula 05 | ||
| hashed password in passwd + crack password hash | How to crack the hash contained in passwd – Nebula 06 | ||
| OS command injection through CGI + improper privilege assignment of web server | How to inject the OS command through CGI – Nebula 07 | ||
| disclosure .pcap file containing the password + improper file permission setting | How to disclose the password through the .pcap file – Nebula 08 | ||
| Windows | https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-014 | MS16-041 | How to escalate the privileges through MS16-041 (Post-exploitation due to non-fully patch Windows platform) |
Password Cracking
Steganography
Openssh 4.7 P1102
Sniff
Protocol
OS
MACOS