bruteforce ssh rsa from wordlist

brute_ssh_key

# wordlist named pass.lst
# encrypted ssh key private.pem (watch out for the permissions 0600 is ok)


from subprocess import PIPE, Popen
import subprocess
import sys


def cmdline(command):
    proc = subprocess.Popen(str(command), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
    (out, err) = proc.communicate()
    return err


def main():
    words = [line.strip() for line in open('pass.lst')]
    print("\n")
    count=0

    for w in words:
        strcmd = "ssh-keygen -y -f private.pem -P "+w
        res=cmdline(strcmd)
        #print(res)
        if 'incorrect' not in res:
                print("\nThe key is: "+w)
                sys.exit()
        print(str(count)+"/"+str(w))
        count=count+1
    print("\n")


if __name__ == '__main__':
    main()