22 - SSH

Usage

Inline Cmds

ssh user1@10.10.10.10 -p 2222 'ls /home/user1/'

scp

Keys

Auth Methods

Supported authentication methods.

nmap -p22 -script=ssh-auth-methods <IP>

Audit

$ ssh-audit 192.168.0.24
# general
(gen) banner: SSH-1.99-OpenSSH_2.9p2
(gen) protocol SSH1 enabled
(gen) software: OpenSSH 2.9p2
(gen) compatibility: OpenSSH 2.5.0-6.6, Dropbear SSH 0.47-0.52
(gen) compression: enabled (zlib)

<SNIP>

Brute Force

Hydra

hydra -l root -P /usr/share/wordlists/metasploit/unix_passwords.txt ssh://192.168.0.24:22 -t 4

Metasploit

Nmap

PPK to PEM

Convert a Putty user key file (.ppk) to an SSH .pem file.

# Converting PPK to PEM
sudo puttygen key.ppk -O private-openssh -o key.pem
# Assigning the appropriate permissions
sudo chmod 600 key.pem
# Confirming permissions
ls -l key.pem
# Using public key authentication
ssh root@10.10.11.227 -i key.pem

For an example of the above process check Keeper.

Private Keys

1. Convertion

# converting the private key into a hashcat-friendly format
$ ssh2john id_rsa > ssh.hash

2. Formatting

3. Cracking

Key Types

SSH supports multiple key types, each with a default filename, thus, when trying to exfiltrate one don't just search for id_rsa!

Key Type	Private Key File	Public Key File
RSA	~/.ssh/id_rsa	~/.ssh/id_rsa.pub
ECDSA	~/.ssh/id_ecdsa	~/.ssh/id_ecdsa.pub
ED25519	~/.ssh/id_ed25519	~/.ssh/id_ed25519.pub
DSA (old)	~/.ssh/id_dsa	~/.ssh/id_dsa.pub

• ECDSA and ED25519 are newer and generally faster/smaller than RSA.

• ED25519 is currently the recommended default for many systems (ssh-keygen defaults to it now).

• RSA is still widely supported, but 4096-bit keys are preferred now due to security standards.