Fine-Tune Hydra Response Wait Times

Introduction

In this lab, we will explore how to fine-tune Hydra's response wait times when attacking services with potentially slow or unreliable responses. We will focus on SMTP as an example.

The lab involves setting up a simple SMTP server with a delayed response using Python. We'll then run Hydra against this server with the default wait time setting, and subsequently adjust the wait time using the -w option. Finally, we'll test the -c option with a single thread to observe its impact on the attack process.

Skills Graph

Set Up SMTP with Delayed Response

In this step, we will set up a simple SMTP server with a delayed response using Python. This will allow us to simulate a slow or unreliable SMTP server, which is useful for testing Hydra's ability to handle such scenarios.

First, let's create a Python script named delayed_smtp.py in the ~/project directory. This script will listen for SMTP connections and introduce a delay before responding.

nano ~/project/delayed_smtp.py

Now, paste the following Python code into the delayed_smtp.py file:

import smtpd
import asyncore
import time
import sys

class DelayedSMTPServer(smtpd.SMTPServer):
    def process_message(self, peer, mailfrom, rcpttos, data, **kwargs):
        print('Receiving message from:', peer)
        print('From:', mailfrom)
        print('To:', rcpttos)
        print('Message length:', len(data))
        print('Waiting for 5 seconds...')
        sys.stdout.flush()
        time.sleep(5)  ## Simulate a delay
        print('Done waiting!')
        sys.stdout.flush()
        return '250 Message accepted for delivery'

def run():
    port = 1025
    server = DelayedSMTPServer(('0.0.0.0', port), None)
    print(f"Starting SMTP server on port {port}")
    sys.stdout.flush()
    asyncore.loop()

if __name__ == '__main__':
    run()

This script defines a custom SMTP server that introduces a 5-second delay before acknowledging the receipt of an email. It listens on port 1025.

Save the file and exit nano.

Now, let's run the script in the background. We'll use the nohup command to ensure the script continues running even after we close the terminal. We'll also redirect the output to a file named delayed_smtp.log so we can monitor its activity.

nohup python3 ~/project/delayed_smtp.py > ~/project/delayed_smtp.log 2>&1 &

This command starts the delayed_smtp.py script in the background. You can check the delayed_smtp.log file to see the server's output.

To verify that the server is running, you can use netstat or ss to check if port 1025 is listening.

netstat -tulnp | grep 1025

You should see output similar to this:

tcp        0      0 0.0.0.0:1025            0.0.0.0:*               LISTEN      <PID>/python3

This confirms that the SMTP server is running and listening on port 1025. Note that <PID> will be replaced with the actual process ID of the Python script.

Now that we have a delayed SMTP server running, we can use it to test Hydra's performance under adverse network conditions.

Run with Default -w Setting

In this step, we will run Hydra against the delayed SMTP server we set up in the previous step, using the default -w setting. The -w option in Hydra specifies the timeout value, which is the maximum time Hydra will wait for a response from the target service before considering the attempt a failure. The default value for -w is 10 seconds.

First, we need a username and password list. Let's create a simple username list named users.txt and a password list named passwords.txt in the ~/project directory.

nano ~/project/users.txt

Add the following usernames to the users.txt file:

testuser
admin
user

Save the file and exit nano.

Next, create the password list:

nano ~/project/passwords.txt

Add the following passwords to the passwords.txt file:

password
123456
test

Save the file and exit nano.

Now, we will run Hydra against the SMTP server using the default -w setting. We will target the SMTP server running on localhost (127.0.0.1) on port 1025. We'll use the smtp module, the username list users.txt, and the password list passwords.txt.

hydra -L ~/project/users.txt -P ~/project/passwords.txt -vV -t 1 127.0.0.1 smtp -s 1025

Let's break down this command:

• hydra: The Hydra command.
• -L ~/project/users.txt: Specifies the username list file.
• -P ~/project/passwords.txt: Specifies the password list file.
• -vV: Enables verbose mode, showing both valid and invalid login attempts.
• -t 1: Sets the number of threads to 1. We're using a single thread for this step to keep the output clear.
• 127.0.0.1: The target IP address (localhost).
• smtp: The service module to use (SMTP).
• -s 1025: Specifies the port number (1025).

Since our SMTP server has a 5-second delay, and the default -w is 10 seconds, Hydra should be able to successfully test the credentials. You should see Hydra attempting to log in with each username and password combination. The -vV option will show both successful and failed attempts.

The output will show Hydra trying different username/password combinations. Because we are using a single thread (-t 1), the attempts will be sequential.

Set Wait Time to 10 with -w

In this step, we will explicitly set the wait time to 10 seconds using the -w option and run Hydra against our delayed SMTP server. This is the same as the default, but we're explicitly setting it to demonstrate how to use the option.

We will use the same username and password lists (users.txt and passwords.txt) that we created in the previous step.

Now, let's run Hydra again, this time specifying the -w 10 option:

hydra -L ~/project/users.txt -P ~/project/passwords.txt -vV -t 1 -w 10 127.0.0.1 smtp -s 1025

Here's the breakdown of the command, with the key difference highlighted:

• hydra: The Hydra command.
• -L ~/project/users.txt: Specifies the username list file.
• -P ~/project/passwords.txt: Specifies the password list file.
• -vV: Enables verbose mode, showing both valid and invalid login attempts.
• -t 1: Sets the number of threads to 1.
• -w 10: Specifies the wait time as 10 seconds.
• 127.0.0.1: The target IP address (localhost).
• smtp: The service module to use (SMTP).
• -s 1025: Specifies the port number (1025).

Since the wait time is set to 10 seconds, and our SMTP server has a 5-second delay, Hydra should successfully test the credentials. The output will be similar to the previous step, showing Hydra attempting to log in with each username and password combination.

Test -c with Single Thread

In this step, we will use the -c option to specify a single username/password combination directly on the command line, instead of using files. We will also keep the number of threads to 1 (-t 1) for clarity. This is useful for quickly testing a specific credential.

We will continue to use the delayed SMTP server we set up in the first step.

Now, let's run Hydra with the -c option:

hydra -t 1 -c testuser:password -vV 127.0.0.1 smtp -s 1025

Let's break down this command:

• hydra: The Hydra command.
• -t 1: Sets the number of threads to 1.
• -c testuser:password: Specifies the username testuser and password password directly on the command line.
• -vV: Enables verbose mode, showing both valid and invalid login attempts.
• 127.0.0.1: The target IP address (localhost).
• smtp: The service module to use (SMTP).
• -s 1025: Specifies the port number (1025).

In this case, Hydra will only attempt to log in with the username testuser and the password password. If this combination is valid, Hydra will report a successful login. If not, it will report a failure.

The output will show Hydra trying the testuser:password combination.

Summary

In this lab, we begin by setting up a simulated slow SMTP server using a Python script named delayed_smtp.py. This script introduces a 5-second delay before acknowledging email receipt, mimicking an unreliable server. The script listens for connections on port 1025 and logs its activity to delayed_smtp.log.

The delayed_smtp.py script is then executed in the background using nohup, ensuring it continues running even after the terminal is closed. This setup allows us to test Hydra's ability to handle delayed responses from an SMTP server.