Ethical Hacking and Penetration Testing Guide

171
Note
: Also, the bug does not always work and at the time of writing, it’s not known under what 
exact conditions the bug works.
Usage
The usage is extremely simple. Here is the basic syntax, which would check if a username with 
root is available or not.
root@root:#./ssh_user_enum.py -user root -Host
Cracking SSH with Medusa
In our previous example, with password cracking, we used Hydra to crack ftp passwords. In this 
example, we will use Medusa to crack SSH accounts. We will issue the following command to get 
the job done:
medusa –h 192.168.75.141 –u root –P password.txt –M ssh
After a few attempts, it managed to find the correct password, which was “rafay”. Now, you 
can log in to the SSH server using your favorite SSH client such as putty.
Note
: Medusa gave us the correct password as it was available in the wordlist, as we put in there 
for a demonstration.
Documentation
:
http://www.foofus.net/~jmk/medusa/medusa.html
Ncrack
Ncrack is one of my favorite tools for password cracking. It is based upon nmap libraries. It comes 
preinstalled with BackTrack. It can be combined with nmap to yield great results. The only disad-
vantage I see with this tool is that it supports very few services, namely, FTP, SSH, Telnet, FTP, 
POP3, SMB, RDP, and VNC.
Basic Syntax
We can execute the “ncrack” command without parameters in the terminal to find out what 
parameters are required for using ncrack.
–u = Username to attack
–P = Password file
–p = Port of the service to attack (lowercase p)
–f = Quit cracking after the first credential is found

---

172
◾ 
Ethical Hacking and Penetration Testing Guide
Cracking an RDP with Ncrack
It’s funny how I always see the question “How do I crack an RDP?” on multiple hacking/security 
forums, as the process is quite simple. RDP stands for remote desktop protocol, which is generally 
used for remote management purposes.
As I have already demonstrated how to crack ftp and ssh with hydra and medusa, we will learn 
to crack an RDP account with ncrack. But before that, let’s take a look at an interesting case study.