Playing with SSH

Today we are going to show a few simple ways you can attack SSH during your pentests. There are three utilities we are going to use: ssh, scp, ssh-keygen and ssh-agent.

directories:

.rhosts 
.shosts
/etc/host.equiv
/etc/known_hosts
~/.ssh/known_hosts
/etc/ssh_host_key
/etc/sshd_config

First we need to know where to look for the files we seek. here is a list of possible directories where the ssh keys could be stored.

/etc/known_hosts
~/.ssh/known_hosts

To find out which entry is for a known hostname in known_hosts:

ssh-keygen -H -F

sam@asus:~/.ssh% ssh-keygen -H -F 192.168.0.114
|1|aP8X7rqELFIt1E+CCZAydtyEk6Y=|10zWG8d41M4chq+dWCeYl478K44= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGYiocw4QQHtt3o3fWtQukbtNSEdJ/hVqdZloOEDr/sPfPTMtuMrZrqZUJPcFCNKq8fruQuNz69TuQvtPtKpPoU=
sam@asus:~/.ssh% 

sam@asus:~/.ssh% ssh-keygen -H -F 192.168.0.133
|1|YZz3ABZMj6+Jfjsr0EkD69NAJ24=|xereMKxRccSiiwD/H6XFjwJIpiY= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBu6FvLNdLBgBK65PUi5cvDNWGid18FRubq2GtAnzGi47AO8TgotV9oEHVoVRJxZrtbEu0Ub3ueoBkWGsC46XLE=
sam@asus:~/.ssh% 

ssh-keyscan is a utility for gathering the public ssh host keys of a number of hosts.

sam@asus:~/.ssh% ls -la /usr/bin/ssh-keyscan 
-rwxr-xr-x 1 root root 411888 Nov  5 04:26 /usr/bin/ssh-keyscan
sam@asus:~/.ssh% 

we got exec perm's so lets run a simple scan on the hosts file to see what we can find.

sam@asus:~/.ssh% ssh-keyscan -t rsa,dsa -f known_hosts
getaddrinfo |1|aP8X7rqELFIt1E+CCZAydtyEk6Y=|10zWG8d41M4chq+dWCeYl478K44=: Name or service not known
getaddrinfo |1|aP8X7rqELFIt1E+CCZAydtyEk6Y=|10zWG8d41M4chq+dWCeYl478K44=: Name or service not known
getaddrinfo |1|8h12/1DU2Hlo17sZMNgIah3GPIE=|Fvd464UQOihOv/HpFvnLeLNYU8E=: Name or service not known
getaddrinfo |1|8h12/1DU2Hlo17sZMNgIah3GPIE=|Fvd464UQOihOv/HpFvnLeLNYU8E=: Name or service not known
getaddrinfo |1|YZz3ABZMj6+Jfjsr0EkD69NAJ24=|xereMKxRccSiiwD/H6XFjwJIpiY=: Name or service not known
getaddrinfo |1|YZz3ABZMj6+Jfjsr0EkD69NAJ24=|xereMKxRccSiiwD/H6XFjwJIpiY=: Name or service not known
sam@asus:~/.ssh% 

Enumerating ssh known_hosts via /etc/hosts

we can search the /etc/host file for other possible leads.

sam@asus:~/.ssh% ls -la /etc/hosts;cat /etc/hosts
-rw-r--r-- 1 root root 251 Jan  7 15:23 /etc/hosts
127.0.0.1 localhost
127.0.1.1 asus
192.168.0.114 debian9.acme.com


# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
sam@asus:~/.ssh% 

lets extract our ipv4 addresses from /etc/hosts and redirect the output to a file

root@asus:~/pentest_notes% cat /etc/hosts | awk 'BEGIN{FS="\t"} {print $2}' | sed -e '/^$/d' -e '/localhost/d'
asus
debian9.acme.com
root@asus:~/pentest_notes% 

once we have an enumeration list we can write a shell script using `ssh-keygen` to verify the key with a specific host in our list.

#!/usr/bin/env bash

hosts=( debian.acme.com taurus.acme.com nemo.acme.com 192.168.0.114 firewall.acme.com 192.168.0.133 )

for host in "${hosts[@]}"
do
    result=`ssh-keygen -H -F ${host} | awk '/|1|/ {print 1}'`
    if [[ ${result} == "1" ]]
    then
        echo "${hosts} found for key in known_hosts"
    fi
done

root@asus:~/pentest_notes% ./ssh.sh 
debian.acme.com found for key in known_hosts
root@asus:~/pentest_notes%

As you can see we got one entry: `debian.acme.com`. Now we have a list of other hosts on the network we have shell access to for further testing.

Get and display hosts public key

If you have not yet connected to ssh.example.com, run ssh-keyscan ssh.example.com to retrieve it and ssh-keygen -F ssh.example.com to display it. Ideally, you would double-check with the owner of ssh.example.com that it is indeed the server’s public key and not the key of a spoofed instance of ssh.example.com.

Get hosts public key

sam@asus:~% ssh-keyscan 192.168.0.25
# 192.168.0.25:22 SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u4
192.168.0.25 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKyD1nuUcW8olAYwHDIwBT57W1/dm6uvsis598HePVl8
sam@asus:~% 

once we get the hosts public key, we can display it like so:

Display hosts public key

sam@asus:~% ssh-keygen -F 192.168.0.25
# Host 192.168.0.25 found: line 5 
|1|AgJUJ1s82ZKx2XJVCWbtbpdUwrA=|1uhVzOOjW5CArQIXOwego4n7ux0= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLucsnK25OOWpAyH4ki4Ome576pVuqxjs39KAcxIuWXbNTboPy3Y+jO8nuxUfLCsBDXGDp0xHdGuhO5g28Vzfkg=
sam@asus:~%