# 22 \~ SSH

## Password attack

Given that we have a username for a user on the target machine, we can perform a few password-based attack.s If there are no know usernames, we can use the `ssh_enumusers` Metasploit module to enumerate the usernames. Refer to the [hackviser.com](https://hackviser.com/tactics/pentesting/services/ssh) notes in the resources section below.

### Missing password

```sh
$ ssh user@host
```

### Brute force&#x20;

```sh
$ hydra -l user -P /path/to/wordlist.txt ssh://<host_addr> -t 6

# eg.
$ hydra -l user -P /usr/share/wordlists/metasploit/unix_passwords.txt ssh://x.x.x.x -t 6
```

{% embed url="https://www.kali.org/tools/hydra/" %}

## Log poisoning

> CTF example: [https://jarrettgxz-sec.gitbook.io/penetration-testing-ethical-hacking-concepts/write-ups/tryhackme/include](https://jarrettgxz-sec.gitbook.io/penetration-testing-ethical-hacking-concepts/write-ups/tryhackme/include)

Given that we have found a certain vulnerability (eg. LFI) that provides us access to the following files:

```
/var/log/auth.log
/var/log/access.log
/var/log/sshd.log
```

&#x20;SSH may be exploited to allow log poisoning via the following methods, which depending on the server technology and nature of the vulnerability, may provide RCE.&#x20;



1. Username

> Note that this method may not work for the recent versions of SSH if the payload contains certain type of special characters

```sh
$ ssh <payload>@<host>
```



2. SSH identification strings

```sh
$ nc <host> <port>

# eg.
$ nc 10.10.10.10 22
SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.11
<payload> # click enter right after
```



3. Other SSH clients such as Putty

## Persistence

1. Create a private-public key pair
2. Place the generated public key into the `/home/user/.ssh/authorized_keys`  directory on the target machine for the particular user

We can now SSH into the machine using the private key. Refer to the SSH notes for more information:

{% embed url="https://jarrettgxz-sec.gitbook.io/networking-concepts/ssh/ssh-public-key-authentication" %}



## Other capabilities of SSH

SSH have many powerful capabilities such as port forwarding, file transfers, and even to bypass restrictive environments. Refer to the following notes for more information:

{% embed url="https://jarrettgxz-sec.gitbook.io/networking-concepts/ssh/introduction" %}

## Resources

{% embed url="https://hackviser.com/tactics/pentesting/services/ssh" %}
