Basic Information

SSH or Secure Shell or Secure Socket Shell, is a network protocol that gives users a secure way to access a computer over an unsecured network.

Default port: 22

22/tcp open  ssh     syn-ack

Enumeration

Banner Grabbing

nc -vn <IP> 22

Automated ssh-audit

ssh-audit is a tool for ssh server & client configuration auditing.

​https://github.com/jtesta/ssh-audit is an updated fork from https://github.com/arthepsy/ssh-audit/​

Features:

• SSH1 and SSH2 protocol server support;

• analyze SSH client configuration;

• grab banner, recognize device or software and operating system, detect compression;

• gather key-exchange, host-key, encryption and message authentication code algorithms;

• output algorithm information (available since, removed/disabled, unsafe/weak/legacy, etc);

• output algorithm recommendations (append or remove based on recognized software version);

• output security information (related issues, assigned CVE list, etc);

• analyze SSH version compatibility based on algorithm information;

• historical information from OpenSSH, Dropbear SSH and libssh;

• runs on Linux and Windows;

• no dependencies

usage: ssh-audit.py [-1246pbcnjvlt] <host>
​
   -1,  --ssh1             force ssh version 1 only
   -2,  --ssh2             force ssh version 2 only
   -4,  --ipv4             enable IPv4 (order of precedence)
   -6,  --ipv6             enable IPv6 (order of precedence)
   -p,  --port=<port>      port to connect
   -b,  --batch            batch output
   -c,  --client-audit     starts a server on port 2222 to audit client
                               software config (use -p to change port;
                               use -t to change timeout)
   -n,  --no-colors        disable colors
   -j,  --json             JSON output
   -v,  --verbose          verbose output
   -l,  --level=<level>    minimum output level (info|warn|fail)
   -t,  --timeout=<secs>   timeout (in seconds) for connection and reading
                               (default: 5)
$ python3 ssh-audit <IP>

​See it in action (Asciinema)​

Public SSH key of server

ssh-keyscan -t rsa <IP> -p <PORT>

Weak Cipher Algorithms

This is discovered by default by nmap. But you can also use sslcan or sslyze.

Shodan

• ssh

Brute force usernames, passwords and private keys

Username Enumeration

In some versions of OpenSSH you can make a timing attack to enumerate users. You can use a metasploit module in order to exploit this:

msf> use scanner/ssh/ssh_enumusers

​Brute force​

Some common ssh credentials here and here and below.

Private/Public Keys BF

If you know some ssh private key that could be used... lets try it. You can use the nmap script:

https://nmap.org/nsedoc/scripts/ssh-publickey-acceptance.html

Or the MSF auxiliary module:

msf> use scanner/ssh/ssh_identify_pubkeys

Known badkeys can be found here:

You should look here in order to search for valid keys for the victim machine.

Kerberos

crackmapexec using the ssh protocol can use the option --kerberos to authenticate via kerberos. For more info run crackmapexec ssh --help.

Default Credentials

Config files

ssh_config
sshd_config
authorized_keys
ssh_known_hosts
known_hosts
id_rsa

Hardening SSH

You can find interesting guides on how to harden SSH in https://www.ssh-audit.com/hardening_guides.html​

SFTP

You can configure SSH to behave as a SFTP server. So, some users will connect to SFTP service (in port 22) instead of to the SSH service.

You can even set a chroot to the SFTP users. A configuration example of SFTP users inside the file /etc/ssh/sshd_config can be seen in the following images.

All the ots-* users will be jailed inside a chroot.

SFTP Tunneling

If you have access to a SFTP server you can also tunnel your traffic through this for example using the common port forwarding:

sudo ssh -L <local_port>:<remote_host>:<remote_port> -N -f <username>@<ip_compromised>

Symlink

The sftp have the command "symlink". Therefor, if you have writable rights in some folder, you can create symlinks of other folders/files. As you are probably trapped inside a chroot this won't be specially useful for you, but, if you can access the created symlink from a no-chroot service (for example, if you can access the symlink from the web), you could open the symlinked files through the web.

For example, to create a symlink from a new file "froot" to "/":

sftp> symlink / froot

If you can access the file "froot" via web, you will be able to list the root ("/") folder of the system.