Can Hydra ssh to remote host and attempt a password list against su root?

I am trying to recover the root password to an old device. It is an old Apple jailbroken Apple device, running IOS8.

The device is somewhat slow, but have no rate limit or delays. I am able to run 150 tries/min with hydra for the ssh password.

I can log in as one user, and I could try the passwords much faster (i.e. without SSH handshake every 3 tries) using su root. But it is not possible to run hydra there, i need hydra to login and then try the commands.

Is this possible with hydra? Should I use some other tool?

  • Pull the disk and change password? Or boot a live cd, and change the password? – vidarlo Sep 11 '20 at 5:04
  • 1
    it's a jailbroken apple device with IOS8. I can't do anything sane with it. – gcb Sep 11 '20 at 5:31
  • I've edited that into the question. Such information should be part of the question, as it's crucial to understanding the problem in the best way possible :) – vidarlo Sep 11 '20 at 19:57
  • Can you run commands via sudo as the user that you are able to login as? If so, is it possible for you to cat the /etc/shadow file? – mti2935 Sep 11 '20 at 20:40
  • > "can you run commands via sudo". No. I mentioned su root just because that is the quickest way to try root's password – gcb Sep 12 '20 at 15:21

Hydra does not support that mode.

The closest it comes is the Cisco Enable mode, where a telnet connection is used to log into the device and then the enable command is repeated to try different potential enable passwords. It might be possible to write a new module by cribbing code from hydra-cisco-enable.c and hydra-ssh.c to do what you want.

Alternately, if you have expect, you can use that to write a password guessing script.


Brute force is not a good solution unless you are sure password in your dictionary.

Worth to try:

If you have sudo permission, use it to root shell:

sudo su - root

If you are the host owner, just reboot to single user mode and change root password by passwd:

# passwd

see https://www.google.com/search?q=linux+boot+to+single+user+mode

  • Thanks for the suggestions. I am trying brute force because I do not have sudo acess at all. While I do not have the password, I know myself to know I have certainly used a convenience password. that is, 3 to 6 chars, with only letters and numbers. – gcb Sep 11 '20 at 6:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.