> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/enumeration/ssh.md).

# SSH

#### SSH

* It is used for remote administration.
* It gives us a secure shell, which allows us to interact with a remote machine over on encrypted channel.
* Default port 22

```
ssh user@<IP/domain>
```

**netcat**

* version name

```
nc <IP> <port>
```

```
nmap <IP> -p22 --script ssh2-enum-algos
```

```
nmap <IP> -p22 --script ssh-hostkey --script-args ssh_hostkey=full
```

* to check the user authentication

```
nmap <IP> -p22 --script ssh-auth-methods --script-args="ssh.user=student" 
```

```
nmap <IP> -p22 --script ssh-auth-methods --script-args="ssh.user=admin" 
```

**SSH Dictionary Attack**

* unzip rockyou.txt

```
hydra -l student -P /usr/share/wordlists/rockyou.txt
```

```
nmap <IP> -p22 --script ssh-brute --script-args userdb=/root/user
```

```
msfconsole -q 
> use auxiliary/scanner/ssh/ssh_login
> set rhosts <IP>
> set userpass_file /usr/share/wordlists/metasploit/root_userpass.txt
> set STOP_ON_SUCCESS true
> set verbose true
> exploit
```