All language subtitles for 6. Enumerating SSH

So now let's take a look at SS H.

So from the original scan we saw that it was open and we saw open SS age two point nine P two.

So we're going to copy this and just make a note of that in our notes as well.

I think that's important.

So us say SS age.

We've got the version there.

So let's take this and let's do a little bit of enumeration and talk through it.

So sometimes you're going to get a scan back and your scans that can have really a version here it's

just going to say SS age and we can go and try to find that out ourselves.

And it's always good to attempt that.

What we're gonna do is we're going to attempt to connect to SS H to this specific port and see if it

gives us any information about what's running.

And that's really yet at this point.

It's that's most of the enumeration that we can do anything with SS age.

The second that we attempt to make a log in attempt is going to be exploitation even if we just try

one password.

Guess that's exploitation so we're not going to do that right now.

We're gonna say that for the exploitation part of the course but I do want to show you a connection

and just something funky with this anyway.

So let's go ahead and just go to our terminal and the typical way to SSA.

If you've never done it before is you just say SS age and I want to ask sage to a specific IP address.

So this is the IP address I want to I want to SSA to the issue with this box is this box is old.

So when we go to try to SS H to it it's gonna say this hey we haven't found a matching key exchange.

So they they're giving us a few different offers here.

We're going to have to type in a little bit syntax.

This is not common but this is also useful to have in your notes because this does come up occasionally.

So we can just say a dash Oh we're gonna type Katy X like this and then algorithms

equals plus sine and I'll stall for just a second so you can catch up and then I'm going to copy this

will in here and then I'm going to paste it and you're going to see we're gonna get one more air and

this is going to ask about a cipher so it says there's no cipher found we're going to do a dash C for

a cipher or it's going to copy this and we're going to paste it in this should now provide the opportunity

to connect says the authenticity can't be established we've got RSA fingerprint do you want to connect.

We're gonna type in yes

OK.

And what's happening here is it's asking us for a password there's nothing here for us so I'm going

to hack control C why did we do this.

Why do we even attempt to make this connection.

Well sometimes what happens is a banner is exposed and the banner will say Hey we're running we're running

SSA version x y z and this is built by this person by this company etc. So here we're looking for a

banner.

Unfortunately there was no banner.

So that doesn't give us a lot of information.

But fortunately for us when we had our our scan here we were able to pull down at least the open SDH

two point nine P two.

So that's it.

I told you in the beginning SSA isn't very exciting because there's not a lot of opportunities for remote

code execution.

Really the way we're going to have to do this is hammer it with brute force and we'll talk about the

reasonings why later but we'll have to hammer with brute force and just prey spray and pray as we like

to call it sometimes.

But for now that's it for SSA.

So we're gonna start moving into research different tools we can use to research vulnerabilities and

additional videos on that.

So I'll catch you over in the next video when we start digging into some of what we found.