SSH (22)

Nmap Script

ls /usr/share/nmap/scripts/ssh*

Create SSH Key

If we want to login to other machine, we can generate ssh-keygen, copy public key value .pub to authorized_keys

└─$ ssh-keygen -f theseus
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in theseus
Your public key has been saved in theseus.pub
The key fingerprint is:
SHA256:dbZ/hBR4OAZZ+Qgjl7Zwg6pT0nHMym44tPXFi3+mjf4 pwned@kali
The key's randomart image is:
+---[RSA 3072]----+
|       o ..=.+.  |
|      . B X * .. |
|     o = B.*o=.  |
|    o B  .+o.o.. |
|   . O .So .. . .|
|    * o o .  . . |
|     +   .    . .|
|          .oo  . |
|         .+=E    |
+----[SHA256]-----+


└─$ cat theseus.pub  
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDR10KGNMOMTFEPXzo6dbBh1z0qWqkPi7/lAbY92gnd3t4GLWEQizKaNe/gWpI9g7y9XAD/VFDEKgZG0LcnFgQb0wQ8PZY6oMMr9RCxvnEhbVg7w+tcjJCJQFTI8zkP+tN1b4mwo1OZfsxrIynbMSxsKSaDpel5BICa2BIu3N7l9P20u3+DDxaP2Fn2mky7/ApWC9T82qOE0vbn2Ows2DWCggfxSLMj3YpZdlQez23BpvbMG3PxafOM6L+w0UNTTOq5gFiNyPbEWHSmddqL697cmFIjOuo9hcHgchj22T0uTzIjZdMmdpHWFHaawcVCtG0+VaHABCvfNb8rotzix7kMxwWc9bjRb6ZafqPsPm+XrGQb/cYmgKdAw3wQj1Qp+PA65Ol5y/eftLaGieAnkkAFGQEGupsAggLacap+Mj/1nLcAUUh4O5bvEi0pu91kwo43XnTrg8uUhKv6HVJSQG1XT3xXMAeFUkVj1Mv6Uq1YrnBRP0brDxF7y//Kqb8cbn0= pwned@kali

└─[~/.ssh]$ echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDR10KGNMOMTFEPXzo6dbBh1z0qWqkPi7/lAbY92gnd3t4GLWEQizKaNe/gWpI9g7y9XAD/VFDEKgZG0LcnFgQb0wQ8PZY6oMMr9RCxvnEhbVg7w+tcjJCJQFTI8zkP+tN1b4mwo1OZfsxrIynbMSxsKSaDpel5BICa2BIu3N7l9P20u3+DDxaP2Fn2mky7/ApWC9T82qOE0vbn2Ows2DWCggfxSLMj3YpZdlQez23BpvbMG3PxafOM6L+w0UNTTOq5gFiNyPbEWHSmddqL697cmFIjOuo9hcHgchj22T0uTzIjZdMmdpHWFHaawcVCtG0+VaHABCvfNb8rotzix7kMxwWc9bjRb6ZafqPsPm+XrGQb/cYmgKdAw3wQj1Qp+PA65Ol5y/eftLaGieAnkkAFGQEGupsAggLacap+Mj/1nLcAUUh4O5bvEi0pu91kwo43XnTrg8uUhKv6HVJSQG1XT3xXMAeFUkVj1Mv6Uq1YrnBRP0brDxF7y//Kqb8cbn0= pwned@kali" > authorized_keys

Split Private Key

BruteForce

Crack Weak SSH Key

https://0xdf.gitlab.io/2020/04/08/htb-lame-more.html#weak-ssh-key

SSH Error

Port Knocking

Let knock the port to open with for loop. https://wiki.archlinux.org/title/Port_knocking

Rbash Bypass

https://www.hacknos.com/rbash-escape-rbash-restricted-shell-escape/

https://www.exploit-db.com/docs/english/44592-linux-restricted-shell-bypass-guide.pdf

PreviousFTP (21)NextSMTP (25)

Last updated