0

Can Hydra ssh to remote host and attempt a password list against su root?

I am trying to recover the root password to an old device. It is an old Apple jailbroken Apple device, running IOS8.

The device is somewhat slow, but have no rate limit or delays. I am able to run 150 tries/min with hydra for the ssh password.

I can log in as one user, and I could try the passwords much faster (i.e. without SSH handshake every 3 tries) using su root. But it is not possible to run hydra there, i need hydra to login and then try the commands.

Is this possible with hydra? Should I use some other tool?

Improve this question
5
  • Pull the disk and change password? Or boot a live cd, and change the password?
    – vidarlo
    Commented Sep 11, 2020 at 5:04
  • 1
    it's a jailbroken apple device with IOS8. I can't do anything sane with it.
    – gcb
    Commented Sep 11, 2020 at 5:31
  • 1
    I've edited that into the question. Such information should be part of the question, as it's crucial to understanding the problem in the best way possible :)
    – vidarlo
    Commented Sep 11, 2020 at 19:57
  • 1
    Can you run commands via sudo as the user that you are able to login as? If so, is it possible for you to cat the /etc/shadow file?
    – mti2935
    Commented Sep 11, 2020 at 20:40
  • > "can you run commands via sudo". No. I mentioned su root just because that is the quickest way to try root's password
    – gcb
    Commented Sep 12, 2020 at 15:21

2 Answers 2

Reset to default
1

Hydra does not support that mode.

The closest it comes is the Cisco Enable mode, where a telnet connection is used to log into the device and then the enable command is repeated to try different potential enable passwords. It might be possible to write a new module by cribbing code from hydra-cisco-enable.c and hydra-ssh.c to do what you want.

Alternately, if you have expect, you can use that to write a password guessing script.

Improve this answer
-1

Brute force is not a good solution unless you are sure password in your dictionary.

Worth to try:

If you have sudo permission, use it to root shell:

sudo su - root

If you are the host owner, just reboot to single user mode and change root password by passwd:

# passwd

see https://www.google.com/search?q=linux+boot+to+single+user+mode

Improve this answer
1
  • Thanks for the suggestions. I am trying brute force because I do not have sudo acess at all. While I do not have the password, I know myself to know I have certainly used a convenience password. that is, 3 to 6 chars, with only letters and numbers.
    – gcb
    Commented Sep 11, 2020 at 6:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .