SSH Penetration Testing Tools

Paramiko (Python)

Paramiko is a Python implementation of the SSHv2 protocol, providing both client and server functionality.

# Install Paramiko
pip install paramiko

# Basic SSH client
import paramiko

ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect('hostname', username='user', password='password')
stdin, stdout, stderr = ssh.exec_command('ls -l')
print(stdout.read().decode())
ssh.close()

Official Website

libssh (C)

libssh is a C library implementing the SSHv2 protocol on client and server side.

// Basic SSH client
#include <libssh/libssh.h>
#include <stdlib.h>

int main() {
    ssh_session my_ssh_session = ssh_new();
    if (my_ssh_session == NULL) {
        exit(-1);
    }

    ssh_options_set(my_ssh_session, SSH_OPTIONS_HOST, "hostname");
    ssh_options_set(my_ssh_session, SSH_OPTIONS_USER, "username");

    int rc = ssh_connect(my_ssh_session);
    if (rc != SSH_OK) {
        fprintf(stderr, "Error connecting to host: %s\n", ssh_get_error(my_ssh_session));
        ssh_free(my_ssh_session);
        exit(-1);
    }

    rc = ssh_userauth_password(my_ssh_session, NULL, "password");
    if (rc != SSH_AUTH_SUCCESS) {
        fprintf(stderr, "Error authenticating with password: %s\n", ssh_get_error(my_ssh_session));
        ssh_disconnect(my_ssh_session);
        ssh_free(my_ssh_session);
        exit(-1);
    }

    ssh_disconnect(my_ssh_session);
    ssh_free(my_ssh_session);

    return 0;
}

Official Website

Go SSH

Go SSH is a Go package that implements SSH client and server functionality.

// Basic SSH client
package main

import (
    "fmt"
    "golang.org/x/crypto/ssh"
    "io/ioutil"
    "log"
)

func main() {
    // Create SSH client config
    config := &ssh.ClientConfig{
        User: "username",
        Auth: []ssh.AuthMethod{
            ssh.Password("password"),
        },
        HostKeyCallback: ssh.InsecureIgnoreHostKey(),
    }

    // Connect to SSH server
    client, err := ssh.Dial("tcp", "hostname:22", config)
    if err != nil {
        log.Fatalf("Failed to dial: %s", err)
    }
    defer client.Close()

    // Create a session
    session, err := client.NewSession()
    if err != nil {
        log.Fatalf("Failed to create session: %s", err)
    }
    defer session.Close()

    // Run command
    output, err := session.CombinedOutput("ls -l")
    if err != nil {
        log.Fatalf("Failed to run command: %s", err)
    }

    fmt.Printf("%s\n", output)
}

Package Documentation

Metasploit Framework

Metasploit Framework provides a platform for developing and executing exploit code against remote target machines.

# Basic Metasploit module structure
require 'msf/core'

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'SSH Scanner',
      'Description'    => 'This module scans for SSH servers.',
      'Author'         => ['Your Name'],
      'License'        => MSF_LICENSE
    ))

    register_options(
      [
        Opt::RPORT(22)
      ], self.class)
  end

  def run_host(ip)
    begin
      connect
      banner = sock.get_once(-1, 5)
      if banner
        print_good("#{ip}:#{rport} - SSH server banner: #{banner}")
        report_service(
          :host => ip,
          :port => rport,
          :name => "ssh",
          :info => banner
        )
      end
    rescue ::Rex::ConnectionError
      print_error("#{ip}:#{rport} - Connection failed")
    ensure
      disconnect
    end
  end
end

Metasploit Wiki

Impacket

Impacket is a collection of Python classes for working with network protocols, including SSH.

GitHub Repository

Scapy

Scapy is a powerful Python-based interactive packet manipulation program and library.

Official Website