Skip to content

SSH_Login: Various improvements#21507

Open
g0tmi1k wants to merge 10 commits into
rapid7:masterfrom
g0tmi1k:ssh_login
Open

SSH_Login: Various improvements#21507
g0tmi1k wants to merge 10 commits into
rapid7:masterfrom
g0tmi1k:ssh_login

Conversation

@g0tmi1k
Copy link
Copy Markdown
Contributor

@g0tmi1k g0tmi1k commented May 26, 2026

This PR does a few things:

  • Handles using options/settings more (PASSWORD vs USER_AS_PASS)
  • Use SSH mixin
  • Able to store SSH key used as loot
  • Cleaner output
  • Added more metadata to the module

Target is Metasploitable 2.

        current  name     hosts  services  vulns  creds  loots  notes
        -------  ----     -----  --------  -----  -----  -----  -----
Before: *        default  1      1         1      2      0      0
After : *        default  1      2         1      2      1      3

Setup

Simple wordlists for users:

$ cat << EOF > /tmp/users.txt
msfadmin
kali
incorrect
EOF
$ 

A SSH key had been pre-setup/configured on the target, skipped in this guide.

Before

  • All testing was done using master branch
  • Have to define a password, even if using USER_AS_PASS
  • Scanning a valid host, but closed port: 0 host
  • Scanning a valid host, open port, but incorrect service: 0 host
  • Scanning a valid host, and valid service: 1 host, 1 service
$ ./msfconsole -q -x 'db_status; workspace -D; setg VERBOSE true;
use auxiliary/scanner/ssh/ssh_login;
setg USER_FILE /tmp/users.txt;
options'
[*] Connected to msf. Connection type: postgresql.
[*] Deleted workspace: default
[*] Recreated the default workspace
VERBOSE => true
USER_FILE => /tmp/users.txt

Module options (auxiliary/scanner/ssh/ssh_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   ANONYMOUS_LOGIN   false            yes       Attempt to login with a blank username and password
   BLANK_PASSWORDS   false            no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   CreateSession     true             no        Create a new session for every successful login
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   DB_SKIP_EXISTING  none             no        Skip existing credentials stored in the current database (Accepted: none, user, user&realm)
   KEY_PASS                           no        Passphrase for SSH private key(s)
   KEY_PATH                           no        Filename or directory of cleartext private keys. Filenames beginning with a dot, or ending in ".pub" will be skipped. Duplicate private keys will be ignored.
   PASSWORD                           no        A specific password to authenticate with
   PASS_FILE                          no        File containing passwords, one per line
   PRIVATE_KEY                        no        The string value of the private key that will be used. If you are using MSFConsole, this value should be set as file:PRIVATE_KEY_PATH. OpenSSH, RSA, DSA, and
                                                ECDSA private keys are supported.
   RHOSTS                             yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT             22               yes       The target port
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads (max one per host)
   USERNAME                           no        A specific username to authenticate as
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE         /tmp/users.txt   no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attempts


View the full module info with the info, or info -d command.

msf auxiliary(scanner/ssh/ssh_login) >
msf auxiliary(scanner/ssh/ssh_login) > run RHOST=10.0.0.10 RPORT=9999
[*] 10.0.0.10:9999        - Starting bruteforce
[-] Msf::OptionValidateError The following options failed to validate:
[-] Invalid option KEY_PATH: At least one of KEY_PATH, PRIVATE_KEY or PASSWORD must be given
[-] Invalid option PASSWORD: At least one of KEY_PATH, PRIVATE_KEY or PASSWORD must be given
[-] Invalid option PRIVATE_KEY: At least one of KEY_PATH, PRIVATE_KEY or PASSWORD must be given
[*] Auxiliary module execution completed
msf auxiliary(scanner/ssh/ssh_login) > run RHOST=10.0.0.10 RPORT=9999 USER_AS_PASS=true
[*] 10.0.0.10:9999        - Starting bruteforce
[-] Msf::OptionValidateError The following options failed to validate:
[-] Invalid option KEY_PATH: At least one of KEY_PATH, PRIVATE_KEY or PASSWORD must be given
[-] Invalid option PASSWORD: At least one of KEY_PATH, PRIVATE_KEY or PASSWORD must be given
[-] Invalid option PRIVATE_KEY: At least one of KEY_PATH, PRIVATE_KEY or PASSWORD must be given
[*] Auxiliary module execution completed
msf auxiliary(scanner/ssh/ssh_login) > run RHOST=10.0.0.10 RPORT=9999 USER_AS_PASS=true PASSWORD=wrong
[*] 10.0.0.10:9999        - Starting bruteforce
[*] 10.0.0.10:9999 SSH - Testing User/Pass combinations
[-] Could not connect: The connection was refused by the remote host (10.0.0.10:9999).
[-] Could not connect: The connection was refused by the remote host (10.0.0.10:9999).
[-] Could not connect: The connection was refused by the remote host (10.0.0.10:9999).
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ssh/ssh_login) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  0      0         0      0      0      0

msf auxiliary(scanner/ssh/ssh_login) >
msf auxiliary(scanner/ssh/ssh_login) > run RHOST=10.0.0.10 RPORT=21 USER_AS_PASS=true PASSWORD=wrong
[*] 10.0.0.10:21          - Starting bruteforce
[*] 10.0.0.10:21 SSH - Testing User/Pass combinations
[-] 10.0.0.10:21          - Could not connect: execution expired
[-] 10.0.0.10:21          - Could not connect: execution expired
[-] 10.0.0.10:21          - Could not connect: execution expired
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ssh/ssh_login) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  0      0         0      0      0      0

msf auxiliary(scanner/ssh/ssh_login) >
msf auxiliary(scanner/ssh/ssh_login) > run RHOST=10.0.0.10 USER_AS_PASS=true PASSWORD=wrong
[*] 10.0.0.10:22          - Starting bruteforce
[*] 10.0.0.10:22 SSH - Testing User/Pass combinations
[-] 10.0.0.10:22          - Failed: 'msfadmin:wrong'
[+] 10.0.0.10:22          - Success: 'msfadmin:msfadmin' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] SSH session 1 opened (10.0.0.1:35683 -> 10.0.0.10:22) at 2026-05-26 21:56:39 +0100
[-] 10.0.0.10:22          - Failed: 'kali:wrong'
[-] 10.0.0.10:22          - Failed: 'kali:kali'
[-] 10.0.0.10:22          - Failed: 'incorrect:wrong'
[-] 10.0.0.10:22          - Failed: 'incorrect:incorrect'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ssh/ssh_login) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      1         1      1      0      0

msf auxiliary(scanner/ssh/ssh_login) > hosts

Hosts
=====

address    mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---  ----  -------  ---------  -----  -------  ----  --------
10.0.0.10             linux

msf auxiliary(scanner/ssh/ssh_login) > services
Services
========

host       port  proto  name  state  info  resource  parents
----       ----  -----  ----  -----  ----  --------  -------
10.0.0.10  22    tcp    ssh   open         {}

msf auxiliary(scanner/ssh/ssh_login) > vulns

Vulnerabilities
===============

Timestamp                Host       Service       Resource  Name                     References
---------                ----       -------       --------  ----                     ----------
2026-05-26 20:56:38 UTC  10.0.0.10  ssh (22/tcp)  {}        SSH Login Check Scanner  CVE-1999-0502,ATT&CK-T1021.004

msf auxiliary(scanner/ssh/ssh_login) > creds
Credentials
===========

id   host       origin     service       public    private   realm  private_type  JtR Format  cracked_password
--   ----       ------     -------       ------    -------   -----  ------------  ----------  ----------------
574  10.0.0.10  10.0.0.10  22/tcp (ssh)  msfadmin  msfadmin         Password

msf auxiliary(scanner/ssh/ssh_login) >
msf auxiliary(scanner/ssh/ssh_login) > run RHOST=10.0.0.10 KEY_PATH=/tmp/metasploitable2_key
[*] 10.0.0.10:22          - Starting bruteforce
[*] 10.0.0.10:22 SSH - Testing Cleartext Keys
[*] 10.0.0.10:22          - Testing 1 key from /tmp/metasploitable2_key
[+] 10.0.0.10:22          - Success: 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[+] 10.0.0.10:22          - msfadmin:-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEAt9NdDr5EFdaTyo1QGLno6XxegrdH/+P9YM/Hp09Ld1HcPEADfSRr
wBL3XUFZZokfMWSvUoylEvNv61e1/DID7MVUUuCYD5PSnvpI9cOJB0T3j1JkiJi8I0VSeE
Kpfa/P9nUvepLjxpPM5ps4nDH8BWgorpYXTeYljaEXgVYBQRIbv2vkeElz4CvRZ9RBcvCV
N8X65/6nFu71zbJBaeRtHsh1bMDxfST2G7IRVhIsgtlwklDzsMm0XsnUiH0z48NN/isJIg
EqXFn+0MCfYSSO5joYdwgdSfkV7cJNgBjErwR4nGMi0s3plha8AfiuPZYb1qA0Vce4by4s
lU7hd8Q6iwAAA8jVmRkM1ZkZDAAAAAdzc2gtcnNhAAABAQC3010OvkQV1pPKjVAYuejpfF
6Ct0f/4/1gz8enT0t3Udw8QAN9JGvAEvddQVlmiR8xZK9SjKUS82/rV7X8MgPsxVRS4JgP
k9Ke+kj1w4kHRPePUmSImLwjRVJ4Qql9r8/2dS96kuPGk8zmmzicMfwFaCiulhdN5iWNoR
eBVgFBEhu/a+R4SXPgK9Fn1EFy8JU3xfrn/qcW7vXNskFp5G0eyHVswPF9JPYbshFWEiyC
2XCSUPOwybReydSIfTPjw03+KwkiASpcWf7QwJ9hJI7mOhh3CB1J+RXtwk2AGMSvBHicYy
LSzemWFrwB+K49lhvWoDRVx7hvLiyVTuF3xDqLAAAAAwEAAQAAAQAENc4S0V7D1UdLQ1NL
Ta688kFD4yi9/p3GAtxCw7kpwXE23Ax4aEYjfwu1UhLXG1rgibrOPDRnq7WrgTXE0exvFt
HomAZDjRIs2/Sh1FmmFflJigyNaFoewK6z3Gr/WvB7Z5Gvz/9xg98UhQeV5DsucIVGAmAE
Q7omdUMRjkO3FsYYlDT+0Tgvs1yxVQKFTlOIElpnoVvh503G9i5QL8cELZd83rUNYV1+OY
HPVQFrFB4dGSS6lp/T42/3AH/vhgsbuYbPPGd4PHVBMkzYaQmenC97gHbB+Z5PLRhbFscp
FYiHoKdgmc4769rtp5oTZVVUQUbyyNSZ+3wE+rqlrp9BAAAAgB9/SWii1nCtP6X8z0UqG+
euEoUNh69ESUi51YJ4Gqhx6SKbe0IQs9IVQR8dglMKbF60Ipx+IbpuABDG9iIgQgJbBA8U
DpPZAU80gkqjXMvUl1xQA+adu0UDckllwehUptytrhT3L3sJMg7UeJC3rJ+V5NeQolh0ir
HlF6+DBgfZAAAAgQDwcLzB2H6PTRik4AGcg5t/PKrBsg4pmIodhUOTYOThC2Bkp4r2tTfA
1csWU7hc/Plr028kGqeZuee8knanDqUg+eEa7/zz/CHB5fazFNpk8TVPEVJLnZ860wu3Nx
80eg902/Jdn2NdRE280RdrlKG4Vs+JBPyN8y3QlcJWitJToQAAAIEAw7i3ZPcUOuNP0t8y
WX8idZfdO0KZwwjZ5g1tnBB8ssyF+CHJsRZPTDJ1jpCfnABpR+gcrl/WTr7uvVKOfdHhhZ
LDReZsz8OqFWhkRC6iKgRm1sD3GLgOFPTzuY7g9gzt6tLUM6z9QHhQnLHl6UpmBhtBimNr
7ntN9e2vDt0JnqsAAAANa2FsaUBiZGVza3RvcAECAwQFBg==
-----END OPENSSH PRIVATE KEY-----
[*] SSH session 2 opened (10.0.0.1:40921 -> 10.0.0.10:22) at 2026-05-26 22:07:34 +0100
[-] 10.0.0.10:22          - Failed: 'kali:-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEAt9NdDr5EFdaTyo1QGLno6XxegrdH/+P9YM/Hp09Ld1HcPEADfSRr
wBL3XUFZZokfMWSvUoylEvNv61e1/DID7MVUUuCYD5PSnvpI9cOJB0T3j1JkiJi8I0VSeE
Kpfa/P9nUvepLjxpPM5ps4nDH8BWgorpYXTeYljaEXgVYBQRIbv2vkeElz4CvRZ9RBcvCV
N8X65/6nFu71zbJBaeRtHsh1bMDxfST2G7IRVhIsgtlwklDzsMm0XsnUiH0z48NN/isJIg
EqXFn+0MCfYSSO5joYdwgdSfkV7cJNgBjErwR4nGMi0s3plha8AfiuPZYb1qA0Vce4by4s
lU7hd8Q6iwAAA8jVmRkM1ZkZDAAAAAdzc2gtcnNhAAABAQC3010OvkQV1pPKjVAYuejpfF
6Ct0f/4/1gz8enT0t3Udw8QAN9JGvAEvddQVlmiR8xZK9SjKUS82/rV7X8MgPsxVRS4JgP
k9Ke+kj1w4kHRPePUmSImLwjRVJ4Qql9r8/2dS96kuPGk8zmmzicMfwFaCiulhdN5iWNoR
eBVgFBEhu/a+R4SXPgK9Fn1EFy8JU3xfrn/qcW7vXNskFp5G0eyHVswPF9JPYbshFWEiyC
2XCSUPOwybReydSIfTPjw03+KwkiASpcWf7QwJ9hJI7mOhh3CB1J+RXtwk2AGMSvBHicYy
LSzemWFrwB+K49lhvWoDRVx7hvLiyVTuF3xDqLAAAAAwEAAQAAAQAENc4S0V7D1UdLQ1NL
Ta688kFD4yi9/p3GAtxCw7kpwXE23Ax4aEYjfwu1UhLXG1rgibrOPDRnq7WrgTXE0exvFt
HomAZDjRIs2/Sh1FmmFflJigyNaFoewK6z3Gr/WvB7Z5Gvz/9xg98UhQeV5DsucIVGAmAE
Q7omdUMRjkO3FsYYlDT+0Tgvs1yxVQKFTlOIElpnoVvh503G9i5QL8cELZd83rUNYV1+OY
HPVQFrFB4dGSS6lp/T42/3AH/vhgsbuYbPPGd4PHVBMkzYaQmenC97gHbB+Z5PLRhbFscp
FYiHoKdgmc4769rtp5oTZVVUQUbyyNSZ+3wE+rqlrp9BAAAAgB9/SWii1nCtP6X8z0UqG+
euEoUNh69ESUi51YJ4Gqhx6SKbe0IQs9IVQR8dglMKbF60Ipx+IbpuABDG9iIgQgJbBA8U
DpPZAU80gkqjXMvUl1xQA+adu0UDckllwehUptytrhT3L3sJMg7UeJC3rJ+V5NeQolh0ir
HlF6+DBgfZAAAAgQDwcLzB2H6PTRik4AGcg5t/PKrBsg4pmIodhUOTYOThC2Bkp4r2tTfA
1csWU7hc/Plr028kGqeZuee8knanDqUg+eEa7/zz/CHB5fazFNpk8TVPEVJLnZ860wu3Nx
80eg902/Jdn2NdRE280RdrlKG4Vs+JBPyN8y3QlcJWitJToQAAAIEAw7i3ZPcUOuNP0t8y
WX8idZfdO0KZwwjZ5g1tnBB8ssyF+CHJsRZPTDJ1jpCfnABpR+gcrl/WTr7uvVKOfdHhhZ
LDReZsz8OqFWhkRC6iKgRm1sD3GLgOFPTzuY7g9gzt6tLUM6z9QHhQnLHl6UpmBhtBimNr
7ntN9e2vDt0JnqsAAAANa2FsaUBiZGVza3RvcAECAwQFBg==
-----END OPENSSH PRIVATE KEY-----
'
[-] 10.0.0.10:22          - Failed: 'incorrect:-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEAt9NdDr5EFdaTyo1QGLno6XxegrdH/+P9YM/Hp09Ld1HcPEADfSRr
wBL3XUFZZokfMWSvUoylEvNv61e1/DID7MVUUuCYD5PSnvpI9cOJB0T3j1JkiJi8I0VSeE
Kpfa/P9nUvepLjxpPM5ps4nDH8BWgorpYXTeYljaEXgVYBQRIbv2vkeElz4CvRZ9RBcvCV
N8X65/6nFu71zbJBaeRtHsh1bMDxfST2G7IRVhIsgtlwklDzsMm0XsnUiH0z48NN/isJIg
EqXFn+0MCfYSSO5joYdwgdSfkV7cJNgBjErwR4nGMi0s3plha8AfiuPZYb1qA0Vce4by4s
lU7hd8Q6iwAAA8jVmRkM1ZkZDAAAAAdzc2gtcnNhAAABAQC3010OvkQV1pPKjVAYuejpfF
6Ct0f/4/1gz8enT0t3Udw8QAN9JGvAEvddQVlmiR8xZK9SjKUS82/rV7X8MgPsxVRS4JgP
k9Ke+kj1w4kHRPePUmSImLwjRVJ4Qql9r8/2dS96kuPGk8zmmzicMfwFaCiulhdN5iWNoR
eBVgFBEhu/a+R4SXPgK9Fn1EFy8JU3xfrn/qcW7vXNskFp5G0eyHVswPF9JPYbshFWEiyC
2XCSUPOwybReydSIfTPjw03+KwkiASpcWf7QwJ9hJI7mOhh3CB1J+RXtwk2AGMSvBHicYy
LSzemWFrwB+K49lhvWoDRVx7hvLiyVTuF3xDqLAAAAAwEAAQAAAQAENc4S0V7D1UdLQ1NL
Ta688kFD4yi9/p3GAtxCw7kpwXE23Ax4aEYjfwu1UhLXG1rgibrOPDRnq7WrgTXE0exvFt
HomAZDjRIs2/Sh1FmmFflJigyNaFoewK6z3Gr/WvB7Z5Gvz/9xg98UhQeV5DsucIVGAmAE
Q7omdUMRjkO3FsYYlDT+0Tgvs1yxVQKFTlOIElpnoVvh503G9i5QL8cELZd83rUNYV1+OY
HPVQFrFB4dGSS6lp/T42/3AH/vhgsbuYbPPGd4PHVBMkzYaQmenC97gHbB+Z5PLRhbFscp
FYiHoKdgmc4769rtp5oTZVVUQUbyyNSZ+3wE+rqlrp9BAAAAgB9/SWii1nCtP6X8z0UqG+
euEoUNh69ESUi51YJ4Gqhx6SKbe0IQs9IVQR8dglMKbF60Ipx+IbpuABDG9iIgQgJbBA8U
DpPZAU80gkqjXMvUl1xQA+adu0UDckllwehUptytrhT3L3sJMg7UeJC3rJ+V5NeQolh0ir
HlF6+DBgfZAAAAgQDwcLzB2H6PTRik4AGcg5t/PKrBsg4pmIodhUOTYOThC2Bkp4r2tTfA
1csWU7hc/Plr028kGqeZuee8knanDqUg+eEa7/zz/CHB5fazFNpk8TVPEVJLnZ860wu3Nx
80eg902/Jdn2NdRE280RdrlKG4Vs+JBPyN8y3QlcJWitJToQAAAIEAw7i3ZPcUOuNP0t8y
WX8idZfdO0KZwwjZ5g1tnBB8ssyF+CHJsRZPTDJ1jpCfnABpR+gcrl/WTr7uvVKOfdHhhZ
LDReZsz8OqFWhkRC6iKgRm1sD3GLgOFPTzuY7g9gzt6tLUM6z9QHhQnLHl6UpmBhtBimNr
7ntN9e2vDt0JnqsAAAANa2FsaUBiZGVza3RvcAECAwQFBg==
-----END OPENSSH PRIVATE KEY-----
'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ssh/ssh_login) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      1         1      2      0      0

msf auxiliary(scanner/ssh/ssh_login) > hosts

Hosts
=====

address    mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---  ----  -------  ---------  -----  -------  ----  --------
10.0.0.10             linux

msf auxiliary(scanner/ssh/ssh_login) > services
Services
========

host       port  proto  name  state  info  resource  parents
----       ----  -----  ----  -----  ----  --------  -------
10.0.0.10  22    tcp    ssh   open         {}

msf auxiliary(scanner/ssh/ssh_login) > vulns

Vulnerabilities
===============

Timestamp                Host       Service       Resource  Name                     References
---------                ----       -------       --------  ----                     ----------
2026-05-26 21:07:21 UTC  10.0.0.10  ssh (22/tcp)  {}        SSH Login Check Scanner  CVE-1999-0502,ATT&CK-T1021.004

msf auxiliary(scanner/ssh/ssh_login) > creds
Credentials
===========

id   host       origin     service       public    private                                          realm  private_type  JtR Format  cracked_password
--   ----       ------     -------       ------    -------                                          -----  ------------  ----------  ----------------
577  10.0.0.10  10.0.0.10  22/tcp (ssh)  msfadmin  msfadmin                                                Password
578  10.0.0.10  10.0.0.10  22/tcp (ssh)  msfadmin  73:46:4c:e3:da:4f:0f:17:40:60:04:4c:5c:06:fb:ed         SSH key

msf auxiliary(scanner/ssh/ssh_login) >

After

$ ./msfconsole -q -x 'db_status; workspace -D; setg VERBOSE true;
use auxiliary/scanner/ssh/ssh_login;
setg USER_FILE /tmp/users.txt;
options'
[*] Connected to msf. Connection type: postgresql.
[*] Deleted workspace: default
[*] Recreated the default workspace
VERBOSE => true
USER_FILE => /tmp/users.txt

Module options (auxiliary/scanner/ssh/ssh_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   ANONYMOUS_LOGIN   false            yes       Attempt to login with a blank username and password
   BLANK_PASSWORDS   false            no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   CreateSession     true             no        Create a new session for every successful login
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   DB_SKIP_EXISTING  none             no        Skip existing credentials stored in the current database (Accepted: none, user, user&realm)
   KEY_PASS                           no        Passphrase for SSH private key(s)
   KEY_PATH                           no        Filename or directory of cleartext private keys. Filenames beginning with a dot, or ending in ".pub" will be skipped. Duplicate private keys will be ignored.
   PASSWORD                           no        A specific password to authenticate with
   PASS_FILE                          no        File containing passwords, one per line
   PRIVATE_KEY                        no        The string value of the private key that will be used. If you are using MSFConsole, this value should be set as file:PRIVATE_KEY_PATH. OpenSSH, RSA, DSA, and
                                                ECDSA private keys are supported.
   RHOSTS                             yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT             22               yes       The target port
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads (max one per host)
   USERNAME                           no        A specific username to authenticate as
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE         /tmp/users.txt   no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attempts


View the full module info with the info, or info -d command.

msf auxiliary(scanner/ssh/ssh_login) >
msf auxiliary(scanner/ssh/ssh_login) > run RHOST=10.0.0.10 RPORT=9999 USER_AS_PASS=true
[*] Starting SSH login sweep
[*] SSH - Testing user/pass combinations
[-] Could not connect: The connection was refused by the remote host (10.0.0.10:9999).
[-] Could not connect: The connection was refused by the remote host (10.0.0.10:9999).
[-] Could not connect: The connection was refused by the remote host (10.0.0.10:9999).
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ssh/ssh_login) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      0         0      0      0      0

msf auxiliary(scanner/ssh/ssh_login) > hosts

Hosts
=====

address    mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---  ----  -------  ---------  -----  -------  ----  --------
10.0.0.10

msf auxiliary(scanner/ssh/ssh_login) >
msf auxiliary(scanner/ssh/ssh_login) > workspace -D
[*] Deleted workspace: default
[*] Recreated the default workspace
msf auxiliary(scanner/ssh/ssh_login) > run RHOST=10.0.0.10 RPORT=21 USER_AS_PASS=true
[*] Starting SSH login sweep
[*] SSH - Testing user/pass combinations
[-] Could not connect: execution expired
[-] Could not connect: execution expired
[-] Could not connect: execution expired
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ssh/ssh_login) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      1         0      0      0      0

msf auxiliary(scanner/ssh/ssh_login) > hosts

Hosts
=====

address    mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---  ----  -------  ---------  -----  -------  ----  --------
10.0.0.10             Unknown                    device

msf auxiliary(scanner/ssh/ssh_login) > services
Services
========

host       port  proto  name  state  info                resource  parents
----       ----  -----  ----  -----  ----                --------  -------
10.0.0.10  21    tcp          open   220 (vsFTPd 2.3.4)  {}

msf auxiliary(scanner/ssh/ssh_login) >
msf auxiliary(scanner/ssh/ssh_login) > workspace -D
[*] Deleted workspace: default
[*] Recreated the default workspace
msf auxiliary(scanner/ssh/ssh_login) > run RHOST=10.0.0.10  USER_AS_PASS=true
[*] Starting SSH login sweep
[*] SSH - Testing user/pass combinations
[+] Success: 'msfadmin:msfadmin' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin)'
[+] Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
[*] SSH session 1 opened (10.0.0.1:42493 -> 10.0.0.10:22) at 2026-05-26 22:00:48 +0100
[-] Failed: 'kali:kali' (Incorrect: Authentication failed for user kali@10.0.0.10)
[-] Failed: 'incorrect:incorrect' (Incorrect: Authentication failed for user incorrect@10.0.0.10)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ssh/ssh_login) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      2         1      1      0      2

msf auxiliary(scanner/ssh/ssh_login) > hosts

Hosts
=====

address    mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---  ----  -------  ---------  -----  -------  ----  --------
10.0.0.10             Linux    Ubuntu     8.04   server

msf auxiliary(scanner/ssh/ssh_login) > services
Services
========

host       port  proto  name  state  info                                   resource  parents
----       ----  -----  ----  -----  ----                                   --------  -------
10.0.0.10  22    tcp    tcp   open                                          {}
10.0.0.10  22    tcp    ssh   open   SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1  {}        tcp (22/tcp)

msf auxiliary(scanner/ssh/ssh_login) > vulns

Vulnerabilities
===============

Timestamp                Host       Service       Resource  Name                  References
---------                ----       -------       --------  ----                  ----------
2026-05-26 21:00:47 UTC  10.0.0.10  ssh (22/tcp)  {}        SSH Weak Credentials  CVE-1999-0502,ATT&CK-T1021.004,ATT&CK-T1110.001

msf auxiliary(scanner/ssh/ssh_login) > creds
Credentials
===========

id   host       origin     service       public    private   realm  private_type  JtR Format  cracked_password
--   ----       ------     -------       ------    -------   -----  ------------  ----------  ----------------
575  10.0.0.10  10.0.0.10  22/tcp (ssh)  msfadmin  msfadmin         Password

msf auxiliary(scanner/ssh/ssh_login) > notes

Notes
=====

 Time                     Host       Service  Port  Protocol  Type       Data
 ----                     ----       -------  ----  --------  ----       ----
 2026-05-26 21:00:47 UTC  10.0.0.10  ssh      22    tcp       ssh.proof  {:credential=>"msfadmin:msfadmin", :id=>"uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audi
                                                                         o),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin)", :uname=>"Linux metasploitable 2.6
                                                                         .24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux"}
 2026-05-26 21:00:47 UTC  10.0.0.10  tcp      22    tcp       ssh.cpe    {:cpe=>"cpe:/o:canonical:ubuntu_linux:8.04"}

msf auxiliary(scanner/ssh/ssh_login) >
msf auxiliary(scanner/ssh/ssh_login) > run RHOST=10.0.0.10 KEY_PATH=/tmp/metasploitable2_key
[*] Starting SSH login sweep
[*] SSH - Testing key combinations
[*] Testing 1 key from /tmp/metasploitable2_key
[+] Success: 'msfadmin:SHA256:4Mfxk2ThtFyvDA3G5bEF28BiwJUqTs4bSZ6ZjLK+TF4' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin)'
[+] Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
[*] SSH session 2 opened (10.0.0.1:40095 -> 10.0.0.10:22) at 2026-05-26 22:05:18 +0100
[-] Failed: 'kali:-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEAt9NdDr5EFdaTyo1QGLno6XxegrdH/+P9YM/Hp09Ld1HcPEADfSRr
wBL3XUFZZokfMWSvUoylEvNv61e1/DID7MVUUuCYD5PSnvpI9cOJB0T3j1JkiJi8I0VSeE
Kpfa/P9nUvepLjxpPM5ps4nDH8BWgorpYXTeYljaEXgVYBQRIbv2vkeElz4CvRZ9RBcvCV
N8X65/6nFu71zbJBaeRtHsh1bMDxfST2G7IRVhIsgtlwklDzsMm0XsnUiH0z48NN/isJIg
EqXFn+0MCfYSSO5joYdwgdSfkV7cJNgBjErwR4nGMi0s3plha8AfiuPZYb1qA0Vce4by4s
lU7hd8Q6iwAAA8jVmRkM1ZkZDAAAAAdzc2gtcnNhAAABAQC3010OvkQV1pPKjVAYuejpfF
6Ct0f/4/1gz8enT0t3Udw8QAN9JGvAEvddQVlmiR8xZK9SjKUS82/rV7X8MgPsxVRS4JgP
k9Ke+kj1w4kHRPePUmSImLwjRVJ4Qql9r8/2dS96kuPGk8zmmzicMfwFaCiulhdN5iWNoR
eBVgFBEhu/a+R4SXPgK9Fn1EFy8JU3xfrn/qcW7vXNskFp5G0eyHVswPF9JPYbshFWEiyC
2XCSUPOwybReydSIfTPjw03+KwkiASpcWf7QwJ9hJI7mOhh3CB1J+RXtwk2AGMSvBHicYy
LSzemWFrwB+K49lhvWoDRVx7hvLiyVTuF3xDqLAAAAAwEAAQAAAQAENc4S0V7D1UdLQ1NL
Ta688kFD4yi9/p3GAtxCw7kpwXE23Ax4aEYjfwu1UhLXG1rgibrOPDRnq7WrgTXE0exvFt
HomAZDjRIs2/Sh1FmmFflJigyNaFoewK6z3Gr/WvB7Z5Gvz/9xg98UhQeV5DsucIVGAmAE
Q7omdUMRjkO3FsYYlDT+0Tgvs1yxVQKFTlOIElpnoVvh503G9i5QL8cELZd83rUNYV1+OY
HPVQFrFB4dGSS6lp/T42/3AH/vhgsbuYbPPGd4PHVBMkzYaQmenC97gHbB+Z5PLRhbFscp
FYiHoKdgmc4769rtp5oTZVVUQUbyyNSZ+3wE+rqlrp9BAAAAgB9/SWii1nCtP6X8z0UqG+
euEoUNh69ESUi51YJ4Gqhx6SKbe0IQs9IVQR8dglMKbF60Ipx+IbpuABDG9iIgQgJbBA8U
DpPZAU80gkqjXMvUl1xQA+adu0UDckllwehUptytrhT3L3sJMg7UeJC3rJ+V5NeQolh0ir
HlF6+DBgfZAAAAgQDwcLzB2H6PTRik4AGcg5t/PKrBsg4pmIodhUOTYOThC2Bkp4r2tTfA
1csWU7hc/Plr028kGqeZuee8knanDqUg+eEa7/zz/CHB5fazFNpk8TVPEVJLnZ860wu3Nx
80eg902/Jdn2NdRE280RdrlKG4Vs+JBPyN8y3QlcJWitJToQAAAIEAw7i3ZPcUOuNP0t8y
WX8idZfdO0KZwwjZ5g1tnBB8ssyF+CHJsRZPTDJ1jpCfnABpR+gcrl/WTr7uvVKOfdHhhZ
LDReZsz8OqFWhkRC6iKgRm1sD3GLgOFPTzuY7g9gzt6tLUM6z9QHhQnLHl6UpmBhtBimNr
7ntN9e2vDt0JnqsAAAANa2FsaUBiZGVza3RvcAECAwQFBg==
-----END OPENSSH PRIVATE KEY-----
' (Incorrect: Authentication failed for user kali@10.0.0.10)
[-] Failed: 'incorrect:-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAQEAt9NdDr5EFdaTyo1QGLno6XxegrdH/+P9YM/Hp09Ld1HcPEADfSRr
wBL3XUFZZokfMWSvUoylEvNv61e1/DID7MVUUuCYD5PSnvpI9cOJB0T3j1JkiJi8I0VSeE
Kpfa/P9nUvepLjxpPM5ps4nDH8BWgorpYXTeYljaEXgVYBQRIbv2vkeElz4CvRZ9RBcvCV
N8X65/6nFu71zbJBaeRtHsh1bMDxfST2G7IRVhIsgtlwklDzsMm0XsnUiH0z48NN/isJIg
EqXFn+0MCfYSSO5joYdwgdSfkV7cJNgBjErwR4nGMi0s3plha8AfiuPZYb1qA0Vce4by4s
lU7hd8Q6iwAAA8jVmRkM1ZkZDAAAAAdzc2gtcnNhAAABAQC3010OvkQV1pPKjVAYuejpfF
6Ct0f/4/1gz8enT0t3Udw8QAN9JGvAEvddQVlmiR8xZK9SjKUS82/rV7X8MgPsxVRS4JgP
k9Ke+kj1w4kHRPePUmSImLwjRVJ4Qql9r8/2dS96kuPGk8zmmzicMfwFaCiulhdN5iWNoR
eBVgFBEhu/a+R4SXPgK9Fn1EFy8JU3xfrn/qcW7vXNskFp5G0eyHVswPF9JPYbshFWEiyC
2XCSUPOwybReydSIfTPjw03+KwkiASpcWf7QwJ9hJI7mOhh3CB1J+RXtwk2AGMSvBHicYy
LSzemWFrwB+K49lhvWoDRVx7hvLiyVTuF3xDqLAAAAAwEAAQAAAQAENc4S0V7D1UdLQ1NL
Ta688kFD4yi9/p3GAtxCw7kpwXE23Ax4aEYjfwu1UhLXG1rgibrOPDRnq7WrgTXE0exvFt
HomAZDjRIs2/Sh1FmmFflJigyNaFoewK6z3Gr/WvB7Z5Gvz/9xg98UhQeV5DsucIVGAmAE
Q7omdUMRjkO3FsYYlDT+0Tgvs1yxVQKFTlOIElpnoVvh503G9i5QL8cELZd83rUNYV1+OY
HPVQFrFB4dGSS6lp/T42/3AH/vhgsbuYbPPGd4PHVBMkzYaQmenC97gHbB+Z5PLRhbFscp
FYiHoKdgmc4769rtp5oTZVVUQUbyyNSZ+3wE+rqlrp9BAAAAgB9/SWii1nCtP6X8z0UqG+
euEoUNh69ESUi51YJ4Gqhx6SKbe0IQs9IVQR8dglMKbF60Ipx+IbpuABDG9iIgQgJbBA8U
DpPZAU80gkqjXMvUl1xQA+adu0UDckllwehUptytrhT3L3sJMg7UeJC3rJ+V5NeQolh0ir
HlF6+DBgfZAAAAgQDwcLzB2H6PTRik4AGcg5t/PKrBsg4pmIodhUOTYOThC2Bkp4r2tTfA
1csWU7hc/Plr028kGqeZuee8knanDqUg+eEa7/zz/CHB5fazFNpk8TVPEVJLnZ860wu3Nx
80eg902/Jdn2NdRE280RdrlKG4Vs+JBPyN8y3QlcJWitJToQAAAIEAw7i3ZPcUOuNP0t8y
WX8idZfdO0KZwwjZ5g1tnBB8ssyF+CHJsRZPTDJ1jpCfnABpR+gcrl/WTr7uvVKOfdHhhZ
LDReZsz8OqFWhkRC6iKgRm1sD3GLgOFPTzuY7g9gzt6tLUM6z9QHhQnLHl6UpmBhtBimNr
7ntN9e2vDt0JnqsAAAANa2FsaUBiZGVza3RvcAECAwQFBg==
-----END OPENSSH PRIVATE KEY-----
' (Incorrect: Authentication failed for user incorrect@10.0.0.10)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ssh/ssh_login) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      2         1      2      1      3

msf auxiliary(scanner/ssh/ssh_login) >
msf auxiliary(scanner/ssh/ssh_login) > hosts

Hosts
=====

address    mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---  ----  -------  ---------  -----  -------  ----  --------
10.0.0.10             Linux    Ubuntu     8.04   server

msf auxiliary(scanner/ssh/ssh_login) > services
Services
========

host       port  proto  name  state  info                                   resource  parents
----       ----  -----  ----  -----  ----                                   --------  -------
10.0.0.10  22    tcp    tcp   open                                          {}
10.0.0.10  22    tcp    ssh   open   SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1  {}        tcp (22/tcp)

msf auxiliary(scanner/ssh/ssh_login) > vulns

Vulnerabilities
===============

Timestamp                Host       Service       Resource  Name                  References
---------                ----       -------       --------  ----                  ----------
2026-05-26 21:00:47 UTC  10.0.0.10  ssh (22/tcp)  {}        SSH Weak Credentials  CVE-1999-0502,ATT&CK-T1021.004,ATT&CK-T1110.001

msf auxiliary(scanner/ssh/ssh_login) > creds
Credentials
===========

id   host       origin     service       public    private                                          realm  private_type  JtR Format  cracked_password
--   ----       ------     -------       ------    -------                                          -----  ------------  ----------  ----------------
575  10.0.0.10  10.0.0.10  22/tcp (ssh)  msfadmin  msfadmin                                                Password
576  10.0.0.10  10.0.0.10  22/tcp (ssh)  msfadmin  73:46:4c:e3:da:4f:0f:17:40:60:04:4c:5c:06:fb:ed         SSH key

msf auxiliary(scanner/ssh/ssh_login) > loot

Loot
====

host       service  type                                name                  content                   info                                                path
----       -------  ----                                ----                  -------                   ----                                                ----
10.0.0.10           host.unix.ssh.msfadmin_rsa_private  msfadmin_rsa.private  application/octet-stream  SHA256:4Mfxk2ThtFyvDA3G5bEF28BiwJUqTs4bSZ6ZjLK+TF4  /home/kali/.msf4/loot/20260526220517_default_10.0.0.10_host.unix.ssh.ms_762574.bin

msf auxiliary(scanner/ssh/ssh_login) > notes

Notes
=====

 Time                     Host       Service  Port  Protocol  Type       Data
 ----                     ----       -------  ----  --------  ----       ----
 2026-05-26 21:00:47 UTC  10.0.0.10  ssh      22    tcp       ssh.proof  {:credential=>"msfadmin:msfadmin", :id=>"uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audi
                                                                         o),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin)", :uname=>"Linux metasploitable 2.6
                                                                         .24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux"}
 2026-05-26 21:00:47 UTC  10.0.0.10  tcp      22    tcp       ssh.cpe    {:cpe=>"cpe:/o:canonical:ubuntu_linux:8.04"}
 2026-05-26 21:05:17 UTC  10.0.0.10  tcp      22    tcp       ssh.proof  {:credential=>"msfadmin:SHA256:4Mfxk2ThtFyvDA3G5bEF28BiwJUqTs4bSZ6ZjLK+TF4", :id=>"uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm
                                                                         ),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msf
                                                                         admin)", :uname=>"Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux"}

msf auxiliary(scanner/ssh/ssh_login) >

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

2 participants