{"id":194,"date":"2011-08-28T16:00:06","date_gmt":"2011-08-28T16:00:06","guid":{"rendered":"http:\/\/pentestmonkey.net\/?p=194"},"modified":"2011-08-30T08:14:31","modified_gmt":"2011-08-30T08:14:31","slug":"ssh-cheat-sheet","status":"publish","type":"post","link":"https:\/\/pentestmonkey.net\/cheat-sheet\/ssh-cheat-sheet","title":{"rendered":"SSH Cheat Sheet"},"content":{"rendered":"

SSH has several features that are useful during pentesting and auditing. \u00a0This page aims to remind us of the syntax for the most useful features.<\/p>\n

NB: This page does not attempt to replace the man page<\/a> for pentesters, only to\u00a0supplement\u00a0it with some pertinent examples.<\/p>\n

SOCKS Proxy<\/h2>\n

Set up a SOCKS proxy on 127.0.0.1:1080 that lets you pivot through the remote host (10.0.0.1):<\/p>\n

Command line:<\/strong><\/p>\n

ssh -D 127.0.0.1:1080 10.0.0.1<\/pre>\n
~\/.ssh\/config:<\/strong><\/p>\n
Host 10.0.0.1\r\nDynamicForward 127.0.0.1:1080<\/pre>\n
<\/strong>You can then use tsocks or similar to use non-SOCKS-aware tools on hosts accessible from 10.0.0.1:<\/p>\n
tsocks rdesktop 10.0.0.2<\/pre>\n
Local Forwarding<\/h2>\n
Make services on the remote network accessible to your host via a local listener.<\/p>\n
NB: Remember that you need to be root to bind to TCP port <1024. \u00a0Higher ports are used in the examples below.<\/p>\n
Example 1<\/h3>\n
The service running on the remote host on TCP port 1521 is accessible by connecting to 10521 on the SSH client system.<\/p>\n
Command line:<\/strong><\/p>\n
ssh -L 127.0.0.1:10521:127.0.0.1:1521\u00a0user@10.0.0.1<\/pre>\n
~\/.ssh\/config:<\/strong><\/p>\n
LocalForward 127.0.0.1:10521 127.0.0.1:1521<\/pre>\n
Example 2<\/h3>\n
Same thing, but other hosts on the same network as the SSH client can also connect to the remote service (can be insecure).<\/p>\n
Command line:<\/strong><\/p>\n
ssh -L\u00a00.0.0.0:10521:127.0.0.1:1521 10.0.0.1<\/pre>\n
~\/.ssh\/config:<\/strong><\/p>\n
LocalForward 0.0.0.0:10521 127.0.0.1:1521<\/pre>\n
Example 3<\/h3>\n
In this example, 10.0.0.99 is a host that’s accessible from the SSH server. \u00a0We can access the service it’s running on TCP port 1521 by connecting to 10521 on the SSH client.<\/p>\n
Command line:<\/strong><\/p>\n
ssh -L 127.0.0.1:10521:10.0.0.99:1521 10.0.0.1<\/pre>\n
<\/strong>~\/.ssh\/config:<\/strong><\/p>\n
LocalForward 127.0.0.1:10521 10.0.0.99:1521<\/pre>\n
Remote Forwarding<\/h2>\n
Make services on your local system \/ local network accessible to the remote host via a remote listener. \u00a0This sounds like an odd thing to want to do, but perhaps you want to expose a services that lets you download your tools.<\/p>\n
NB: Remember that you need to be root to bind to TCP port <1024. \u00a0Higher ports are used in the examples below.<\/p>\n
Example 1<\/h3>\n
The SSH server will be able to access TCP port 80 on the SSH client by connecting to 127.0.0.1:8000 on the SSH server.<\/p>\n
Command line:<\/strong><\/p>\n
ssh -R\u00a0127.0.0.1:8000:127.0.0.1:80 10.0.0.1<\/pre>\n
<\/strong>~\/.ssh\/config:<\/strong><\/p>\n
RemoteForward 127.0.0.1:8000 127.0.0.1:80<\/pre>\n
Example 2<\/h3>\n
The SSH server will be able to access TCP port 80 on 172.16.0.99 (a host accessible from the SSH client) by connecting to 127.0.0.1:8000 on the SSH server.<\/p>\n
Command line:<\/strong><\/p>\n
ssh -R\u00a0127.0.0.1:8000:172.16.0.99:80 10.0.0.1<\/pre>\n
<\/strong>~\/.ssh\/config:<\/strong><\/p>\n
RemoteForward 127.0.0.1:8000 172.16.0.99:80<\/pre>\n
Example 3<\/h3>\n
The SSH server will be able to access TCP port 80 on 172.16.0.99 (a host accessible from the SSH client) by connecting to TCP port 8000 on the SSH server. \u00a0Any other hosts able to connect to TCP port 8000 on the SSH server will also be able to access 172.16.0.99:80. \u00a0This can sometimes be insecure.<\/p>\n
Command line:<\/strong><\/p>\n
ssh -R\u00a00.0.0.0:8000:172.16.0.99:80\u00a010.0.0.1<\/pre>\n
<\/strong>~\/.ssh\/config:<\/strong><\/p>\n
RemoteForward 0.0.0.0:8000 172.16.0.99:80<\/pre>\n
Configuration Files<\/h2>\n
~\/.ssh\/config<\/h3>\n
It’s sometimes easier to configure options on your SSH client system in ~\/.ssh\/config for hosts you use a lot rather than having to type out long command lines.<\/p>\n
Using ~\/.ssh\/config also makes it easier to use other tools that use SSH (e.g. scp and rsync). \u00a0It’s possible to tell other tools that SSH listens on a different port, but it’s a pain.<\/p>\n
Host 10.0.0.1\r\nPort 2222\r\nUser ptm\r\nForwardX11 yes\r\nDynamicForward 127.0.0.1:1080\r\nRemoteForward 80 127.0.0.1:8000\r\nLocalForward 1521 10.0.0.99:1521<\/pre>\n
The above lines are explained more fully in the other subsection on this page.<\/p>\n
~\/.ssh\/authozied_keys<\/h3>\n
During a pentest or audit, you might want to add an authorized_keys file to let you log in using an SSH key.<\/p>\n
The authorized_keys file lives in a user’s home directory on the SSH server. \u00a0It holds the public keys of the users allowed to log into that user’s account.<\/p>\n
Generate a public\/private key pair like this:<\/p>\n
ssh-keygen -f mykey\r\ncat mykey.pub # you can copy this to authorized_keys<\/pre>\n
If you want to shortest possible key (because your arbitrary-file-write vector is limited), do this:<\/p>\n
ssh-keygen -f mykey -t rsa -b 768\r\ncat mykey.pub # copy to authorized_key. \u00a0Omit the trailing user@host if you need a shorter key.<\/pre>\n
Connect to the target system like this (you need to know the username of the user you added an authorized key for):<\/p>\n
ssh -i mykey user@10.0.0.1<\/pre>\n
Caveat: The authorized_keys file might not work if it’s writable by other users. \u00a0If you already have shell access you can “chmod 600 ~\/.ssh\/authorized_keys”. \u00a0However, if you’re remotely exploiting an arbitrary file-write vulnerability and happen to have a weak umask, you may have problems.<\/p>\n
X11 Forwarding<\/h2>\n
If your SSH client is also an X-Server then you can launch X-clients (e.g. Firefox) inside your SSH session and display them on your X-Server. \u00a0This works well with from Linux X-Servers and from cygwin<\/a>‘s X-server on Windows.<\/p>\n
Command Line:<\/h3>\n
SSH -X 10.0.0.1\r\nSSH -Y 10.0.0.1 # less secure alternative - but faster<\/pre>\n
~\/.ssh\/config:<\/h3>\n
ForwardX11 yes\r\nForwardX11Trusted yes # less secure alternative - but faster<\/pre>\n
SSH Agents<\/h2>\n
SSH agents can be used to hold your private SSH keys in memory. \u00a0The agent will then authenticate you to any hosts that trust your SSH key.<\/p>\n
This has the following advantages:<\/p>\n
    \n
  • You don’t have to keep entering your passphrase (if you chose to encrypt your private key)<\/li>\n
  • But you still get to store your private SSH key in an encrypted format on disk.<\/li>\n<\/ul>\n
    Using an SSH agent is probably more secure than storing your key in cleartext, but agents can be hijacked.<\/p>\n
    Using an SSH Agent<\/h3>\n
    First start your agent:<\/p>\n
    eval `ssh-agent`<\/pre>\n
    Then add your keys to it – you’ll need to enter your passphrase for any encrypted keys:<\/p>\n
    ssh-add ~\/dir\/mykey<\/pre>\n
    Hijacking SSH Agents<\/h3>\n
    If you see SSH agents running on a pentest (process called “ssh-agent”), you might be able to use it to authenticate you to other hosts – or other accounts on that host. \u00a0Check out ~\/.ssh\/known_hosts for some ideas of where you might be able to connect to.<\/p>\n
    You can use any agents running under the account you compromised. \u00a0If you’re root you can use any SSH agent.<\/p>\n
    SSH agents listen on a unix socket. \u00a0You need to figure where this is for each agent (e.g.\u00a0\/tmp\/ssh-tqiEl28473\/agent.28473). You can then use the agent like this:<\/p>\n
    export \u00a0SSH_AUTH_SOCK=\/tmp\/ssh-tqiEl28473\/agent.28473\r\nssh-add -l # lists the keys loaded into the agent\r\nssh user@host # will authenticate you if server trusts key in agent<\/pre>\n
    This command illustrates how you could inspect the environment of every ssh-agent process on a Linux system. \u00a0It should yield a list of unix sockets for SSH agents.<\/p>\n
    ps auxeww | grep ssh-agent | grep SSH_AUTH_SOCK | sed 's\/.*SSH_AUTH_SOCK=\/\/' | cut -f 1 -d ' '<\/pre>\n
    Agent Forwarding<\/h3>\n
    If you enable SSH agent forwarding then you’ll be able to carry on using the SSH agent on your SSH client during your session on the SSH server. \u00a0This is potentially insecure because so will anyone else who is root on the SSH server you’re connected to. \u00a0Avoid using this feature with any keys you care about.<\/p>\n","protected":false},"excerpt":{"rendered":"
    SSH has several features that are useful during pentesting and auditing. \u00a0This page aims to remind us of the syntax for the most useful features. NB: This page does not attempt to replace the man page for pentesters, only to\u00a0supplement\u00a0it with some pertinent examples. SOCKS Proxy Set up a SOCKS proxy on 127.0.0.1:1080 that lets […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":true,"template":"","format":"standard","meta":[],"categories":[39],"tags":[19,59],"_links":{"self":[{"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/posts\/194"}],"collection":[{"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/comments?post=194"}],"version-history":[{"count":20,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/posts\/194\/revisions"}],"predecessor-version":[{"id":241,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/posts\/194\/revisions\/241"}],"wp:attachment":[{"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/media?parent=194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/categories?post=194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/tags?post=194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}