0

I am experimenting with ssh bruteforce over my home network using the ssh-brute nse script. I have a short list of usernames (just 12) but a long list of passwords (1M).

I can't seem to get the ssh-brute script to run longer than 900 seconds before it terminates and reports:

PORT   STATE SERVICE
22/tcp open  ssh
| ssh-brute:
|   Accounts: No valid accounts found
|_  Statistics: Performed 1556 guesses in 900 seconds, average tps: 1.9

Nmap done: 1 IP address (1 host up) scanned in 903.62 seconds

I've read the docs for ssh-brute, and for the brute, creds, and unpwdb nse libraries, but I can't see any options or information that might be relevant (though I might have missed something). I have also searched man nmap, the online docs and googled for information as to why it might be terminating after 900 seconds/15 minutes, but the closest I could find is the description of the -T5 timing template, which times out an individual host after 15 minutes without reporting any results for that host, which didn't seem to match my problem. Nonetheless, I tried to manually set --host-timeout 48h, but that doesn't change the behaviour.

Any clues as to what's causing this, and how to get the script to run longer than 900 seconds?

1

The documentation for ssh-brute.nse mentions:

unpwdb.timelimit

https://nmap.org/nsedoc/lib/unpwdb.html#script-args

unpwdb.timelimit

The maximum amount of time that any iterator will run before stopping. The value is in seconds by default and you can follow it with ms, s, m, or h for milliseconds, seconds, minutes, or hours. For example, unpwdb.timelimit=30m or unpwdb.timelimit=.5h for 30 minutes. The default depends on the timing template level (see the module description). Use the value 0 to disable the time limit.

  • unpwdb.timelimit seems to be it, I could have saved myself a lot of time by noticing that myself! Tested with unpwdb.timelimit=1m and it ran for 1 minute and showed results exactly as above. Thank you. – Johnny Oct 21 '18 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.