1 00:00:00,000 --> 00:00:02,600 Greyhat SSH shenanigans. 2 00:00:03,300 --> 00:00:09,020 This talk is going to be about all of the cool offensively focused things you can do with SSH. 3 00:00:09,020 --> 00:00:20,240 If you are a red teamer or a pen tester and you don't have SSH in your toolbox already, hopefully you'll see why you should have it in your toolbox and all the cool fun things you can do with it. 4 00:00:22,980 --> 00:00:34,500 And if you're advanced, you've already been using SSH, hopefully there's a tip or a trick or two that you can pick up here as we go through all of this. 5 00:00:36,420 --> 00:00:39,080 So how is this talk going to go? 6 00:00:40,980 --> 00:00:43,780 We're going to start off with the basics, because you have to start at the beginning. 7 00:00:44,400 --> 00:01:01,540 Then we're going to start looking at all of the interesting things you can do with port forwards, how you can use those to get past firewalls, hide your traffic, make it look like you're accessing systems from other systems, and a bunch of cool things. 8 00:01:02,580 --> 00:01:06,640 Next we'll look at the configurations, so fun with the configs. 9 00:01:07,120 --> 00:01:13,800 SSH has a bunch of different ways you can modify its behavior and make it do things that users are probably not intending. 10 00:01:14,460 --> 00:01:22,980 Leaks a bunch of information about what users are accessing, how they're accessing them, where they're accessing them, etc. 11 00:01:23,480 --> 00:01:27,380 And then lastly we'll look at stealing creds. 12 00:01:27,500 --> 00:01:38,140 So SSH, as we'll see, has access to credential material, and we would like to get access to that, and we will show a couple different successful strategies in doing so. 13 00:01:39,360 --> 00:01:40,920 First, who am I? 14 00:01:40,920 --> 00:01:42,220 My name is Evan. 15 00:01:42,220 --> 00:01:45,020 I'm also Syndrome on Twitter. 16 00:01:45,320 --> 00:01:50,000 I am the Director of Offense at a company called Randori. 17 00:01:51,300 --> 00:01:53,820 I've been Redding forever. 18 00:01:53,820 --> 00:01:55,080 I'm into CTFs. 19 00:01:55,080 --> 00:01:58,360 I do CCEC, all that kind of stuff. 20 00:01:58,360 --> 00:01:59,980 So check me out. 21 00:02:01,860 --> 00:02:03,020 Let's get into it. 22 00:02:03,020 --> 00:02:04,560 So the basics. 23 00:02:05,360 --> 00:02:07,660 Starting off, what is SSH? 24 00:02:07,660 --> 00:02:10,660 So SSH stands for Secure Shell. 25 00:02:10,860 --> 00:02:24,480 It is a replacement for the original plaintext protocols of Telnet and RSH, which were both used to get shell access onto Unix systems and administer those remotely. 26 00:02:26,680 --> 00:02:30,980 SSH can be used to refer to both the daemon and the client. 27 00:02:30,980 --> 00:02:33,960 So you will hear someone say SSH to that box. 28 00:02:33,960 --> 00:02:45,600 That means that they use the SSH client to connect to a server that was running the SSH daemon and logged into it that way, got a prompt, and did whatever. 29 00:02:46,340 --> 00:02:50,840 The most common versions of SSH that you're going to run into are OpenSSH. 30 00:02:53,580 --> 00:03:01,880 OpenSSH runs on pretty much everything now, and there are a few other ones that we'll go over, server and client, coming up. 31 00:03:02,920 --> 00:03:06,080 Like I said, it's used to remotely administer systems. 32 00:03:06,080 --> 00:03:08,000 You can upload and download files. 33 00:03:08,000 --> 00:03:11,720 You can run commands on the shell, etc. 34 00:03:11,820 --> 00:03:26,020 And then SSH also provides encrypted channels, which are little tunnels that you can make in the SSH session that will let you do port forwarding that we'll see here in a minute, X11 forwarding, and get your shell. 35 00:03:27,980 --> 00:03:31,980 So why is SSH useful for an attacker? 36 00:03:32,960 --> 00:03:37,980 Really, SSH can be thought of as a Swiss army knife for red teams. 37 00:03:38,620 --> 00:03:43,640 This lets me accomplish anything I need to do with a system if I can get SSH access. 38 00:03:43,640 --> 00:03:46,140 So I can download files. 39 00:03:46,140 --> 00:03:47,300 I can upload files. 40 00:03:47,300 --> 00:03:48,520 I can run commands. 41 00:03:48,520 --> 00:03:50,700 I can maintain access to a system. 42 00:03:51,220 --> 00:03:56,160 I can configure the system such that it does things differently than the user is expecting. 43 00:03:57,280 --> 00:03:59,280 I can get credentials out of it. 44 00:03:59,280 --> 00:04:05,780 All of the things that I need to be able to do to get systems and get into systems and pivot around inside a network. 45 00:04:05,780 --> 00:04:08,600 And it's all encrypted by default for me. 46 00:04:15,940 --> 00:04:20,840 So the common SSH clients and tools that you'll run into. 47 00:04:21,260 --> 00:04:27,700 Like I said, on most Unixes, the common SSH implementation is OpenSSH. 48 00:04:28,720 --> 00:04:37,480 On embedded systems, sometimes you'll run into DropBear, which is just a very small implementation of SSH. 49 00:04:37,480 --> 00:04:47,280 And just the difference here is some of the functionality that we go over here might not work in DropBear or some of the other SSH servers. 50 00:04:47,280 --> 00:04:56,540 There's actually just SSH.com has an SSH server and there's a few different ones, but most of the time you're run into SSH and most of the stock is geared towards that. 51 00:04:56,740 --> 00:05:03,640 On Windows, you can obviously drop into WSL, WSL2, and then you're just at a Linux prompt. 52 00:05:03,640 --> 00:05:05,680 So you'll have the SSH client. 53 00:05:06,160 --> 00:05:11,540 There's a GUI that's called Putty, which is from way back when. 54 00:05:11,540 --> 00:05:18,820 And then there's Plink, which is the CLI implementation that uses the same SSH stuff under the hood that Putty's using. 55 00:05:18,820 --> 00:05:27,440 And then additionally on Windows 10, after 1809, OpenSSH is available in the Windows app store. 56 00:05:27,440 --> 00:05:30,920 So you can get the SSH server and the SSH client. 57 00:05:31,100 --> 00:05:46,300 And then lastly, another tool that's super common that we're going to take a look at a little bit here is Paramiko, which is a Python library that implements the entire protocol, the entire SSH protocol, both client and server in Python. 58 00:05:46,300 --> 00:05:55,380 Super useful for being able to write scripts to do either like log into systems for you and do stuff, or as we'll see later, make a server. 59 00:05:58,640 --> 00:06:03,220 Another reason SSH is super useful here, it's really simple to enumerate. 60 00:06:03,220 --> 00:06:06,940 So by default, SSH is port 22. 61 00:06:07,180 --> 00:06:09,700 That's the port that it has registered. 62 00:06:09,700 --> 00:06:18,080 You can move it to different ports, but all of the servers, if they're installed, just by like with the app or whatever, it's SSH. 63 00:06:18,540 --> 00:06:23,460 Here you can just use netcat and just grab the banner. 64 00:06:23,800 --> 00:06:25,420 Really simple banner up front. 65 00:06:25,420 --> 00:06:30,320 It tells you that it's SSH 2.0 is the protocol of SSH that it's speaking. 66 00:06:30,320 --> 00:06:38,320 The version is, you can see this is an OpenSSH server, 8.3.1, and then it's running on a Debian system. 67 00:06:38,320 --> 00:06:51,820 So just with netcat, I can tell what version of SSH is installed, or what version of SSH protocol the SSH daemon speaks, what version of SSH is installed, and the operating system. 68 00:06:53,060 --> 00:06:56,020 There's even more stuff that you can figure out. 69 00:06:56,020 --> 00:07:03,280 So with Nmap or a bunch of other, there's a bunch of other tools that can do this, but lots of people know how to use Nmap. 70 00:07:03,280 --> 00:07:12,120 When you run the discovery scripts, it will do that banner grab for you, and it will also enumerate all the algorithms that the SSH is using. 71 00:07:12,340 --> 00:07:15,100 So SSH is a pretty old protocol. 72 00:07:15,380 --> 00:07:22,660 You'll run into systems that have older, more insecure algorithms and potentially vulnerable SSH versions. 73 00:07:22,660 --> 00:07:29,000 So there are some versions of SSH that are vulnerable to user enumeration and command injection and all sorts of stuff. 74 00:07:29,000 --> 00:07:34,080 So that it is so easy to enumerate is pretty nice. 75 00:07:37,340 --> 00:07:42,220 So continuing on with the basics here, just running a command on the remote system. 76 00:07:42,220 --> 00:07:45,980 There's two strategies here, essentially. 77 00:07:45,980 --> 00:07:52,240 The first is I'm going to connect to the remote system and request a interactive shell. 78 00:07:52,440 --> 00:07:56,140 So the first command is just SSH. 79 00:07:56,140 --> 00:08:01,980 That's going to launch the command line, bob at, and then the IP address is 10.10.10.10. 80 00:08:01,980 --> 00:08:06,920 So that's saying login to 10.10.10.10 as the user bob. 81 00:08:07,720 --> 00:08:09,380 I cut out some stuff here. 82 00:08:09,380 --> 00:08:10,480 It'll prompt you for a password. 83 00:08:10,700 --> 00:08:16,480 And then you can just run commands interactively like you're sitting at a console on that system. 84 00:08:16,480 --> 00:08:18,640 So here you can see you can run the command, who am I? 85 00:08:18,640 --> 00:08:19,660 And you see that you're bob. 86 00:08:20,720 --> 00:08:24,080 The other way you do this is to run a single command at a time. 87 00:08:24,080 --> 00:08:27,980 So I say SSH bob at 10.10.10.10. 88 00:08:27,980 --> 00:08:28,940 Who am I? 89 00:08:28,940 --> 00:08:30,360 It says bob. 90 00:08:30,980 --> 00:08:35,320 This is super useful if the system is being actively defended. 91 00:08:35,320 --> 00:08:41,960 So say one of the blue team or someone is actually on the system watching for connections and seeing who's logged in. 92 00:08:42,160 --> 00:08:48,440 They'd have to catch that and run that command while the who am I command is running or whatever command you want to run. 93 00:08:48,440 --> 00:08:49,760 This is just an example. 94 00:08:50,180 --> 00:08:54,000 But they'd have to actually see that to see that you're logged in. 95 00:08:54,240 --> 00:09:12,340 This will still show up in last and in all of the logs and everything, but if someone's just sitting there trying to see if someone's actually logged in and watching for SSH processes to start, this will let you have a little race where you can run your command hopefully before they actually catch you doing whatever the thing is that you want to do. 96 00:09:15,800 --> 00:09:19,640 Like I said earlier, you can use SSH to copy files. 97 00:09:19,640 --> 00:09:27,200 So I can copy a file from my system to the remote system, or I can copy a file from the remote system to my system. 98 00:09:27,200 --> 00:09:29,220 There's two ways to actually do this. 99 00:09:29,220 --> 00:09:35,040 The first one that I've laid out here is SCP, so secure copy. 100 00:09:35,860 --> 00:09:42,880 And in the first example here, I'm going to upload a file from my computer to the remote system. 101 00:09:43,080 --> 00:09:55,900 So what that looks like is I do SCP, the file that I want to copy up, and then I'm just like before we saw, I'm going to do the username at that system, and then I'm going to give it the path that I want to copy it to. 102 00:09:55,940 --> 00:10:02,180 So here I want to say in the user's home directory in the bin folder, name my file not malware. 103 00:10:02,180 --> 00:10:06,820 So I'm going to copy my malware up there and hopefully they won't catch it because I called it not malware. 104 00:10:06,820 --> 00:10:10,480 And that is super secret and they will totally never be able to figure that out. 105 00:10:12,880 --> 00:10:16,180 Next, say I want to download a file from their remote system. 106 00:10:16,180 --> 00:10:23,660 So I've been looking around and I see that there is this Etsy secret sauce that I'd like to get from my local system. 107 00:10:23,940 --> 00:10:32,620 Just like before, it's source and destination, but I want the source now to be the file on the remote system, and then the destination to be the file on my system. 108 00:10:32,640 --> 00:10:37,900 So SCP, Bob, at the remote system, the path that the file is at. 109 00:10:37,900 --> 00:10:39,820 So here it's Etsy secret sauce. 110 00:10:40,300 --> 00:10:43,180 And then finally my loot folder. 111 00:10:43,220 --> 00:10:50,660 So every good hacker kid should have a loot folder and I'm going to copy that secret sauce into that folder. 112 00:10:51,940 --> 00:10:55,880 Additionally with SCP, I can recursively copy. 113 00:10:55,880 --> 00:10:58,720 So say I just want to grab everything in that secret folder. 114 00:10:58,720 --> 00:10:59,440 I don't know what it is. 115 00:10:59,440 --> 00:11:00,660 I'll look at it later. 116 00:11:00,660 --> 00:11:05,800 I'm going to go ahead and use the minus R for recursive flag here to SCP. 117 00:11:05,800 --> 00:11:14,760 So SCP minus R, Bob at 10.10.10.10, the Etsy secret folder down into my loot folder. 118 00:11:17,040 --> 00:11:21,300 The next way you can copy files is with the SFTP command. 119 00:11:21,300 --> 00:11:23,320 So this is secure FTP. 120 00:11:23,320 --> 00:11:30,860 Uh, this is actually a completely different implemented or different, um, part of the protocol to copy those files. 121 00:11:30,860 --> 00:11:38,460 So SCP and SFTP, while they accomplish the same thing are actually doing different stuff under the hood, but functionally it's the same. 122 00:11:38,460 --> 00:11:41,960 And if you're familiar with FTP, hopefully this makes sense. 123 00:11:41,960 --> 00:11:46,380 You SFTP as Bob to 10.10.10.10. 124 00:11:46,380 --> 00:11:49,140 And then the first command I want to download a file. 125 00:11:49,140 --> 00:11:50,340 So I get that file. 126 00:11:50,340 --> 00:11:55,700 I say, get from slash secret sauce to my loot folder, secret sauce. 127 00:11:56,280 --> 00:11:59,620 Um, and then next example, I want to upload a, upload a file. 128 00:11:59,620 --> 00:12:03,600 So SFTP Bob at 10.10.10.10. 129 00:12:03,600 --> 00:12:09,520 I'm going to put from my artifacts folder, the malware, and I'm just going to put it into not malware. 130 00:12:09,600 --> 00:12:13,400 Uh, once again, super secret, no one will ever catch that. 131 00:12:13,400 --> 00:12:14,120 Totally not malware. 132 00:12:14,120 --> 00:12:14,720 Don't look at it. 133 00:12:14,720 --> 00:12:15,540 It's fine. 134 00:12:15,540 --> 00:12:22,760 Uh, and similar to SCP SFTP has a recursive option for the get command. 135 00:12:22,980 --> 00:12:27,240 So get minus R slash temp secret from the remote side. 136 00:12:27,240 --> 00:12:28,140 So say that's a folder. 137 00:12:28,160 --> 00:12:32,820 And then I'm just going to download it into my temp folder until I can figure out what to do with it. 138 00:12:32,960 --> 00:12:36,320 Uh, and you can see, uh, what happened there. 139 00:12:36,500 --> 00:12:45,360 So, uh, kind of the basics there as SSH lets you, uh, log into a remote system, get a shell on that system. 140 00:12:45,360 --> 00:12:49,460 If you want, you can, uh, run commands singularly. 141 00:12:49,460 --> 00:12:51,200 So you don't even have an interactive session. 142 00:12:51,200 --> 00:12:52,760 So it's a lot harder to find. 143 00:12:52,760 --> 00:12:54,540 You can copy files down. 144 00:12:54,540 --> 00:12:56,840 You can copy or you can download files. 145 00:12:56,840 --> 00:12:58,220 You can upload files. 146 00:12:58,220 --> 00:13:16,300 Um, even that just alone is super useful to an attacker just in and of itself, but let's go ahead and move on forward to, uh, fun with port forwards and we'll see kind of the more advanced stuff you can do and how you can use this, uh, SSH in your tool belt to get around, 147 00:13:16,300 --> 00:13:20,740 uh, common firewall setups and that kind of, kind of thing. 148 00:13:21,800 --> 00:13:25,980 Uh, so first here, we're going to do look at local forwarding. 149 00:13:27,260 --> 00:13:33,480 So in this scenario, I have access to the 10.10.10.10 system. 150 00:13:33,480 --> 00:13:35,540 Hopefully that was enough 10s. 151 00:13:36,100 --> 00:13:39,160 And I happen to know that that is sitting on a boundary. 152 00:13:39,360 --> 00:13:46,200 So here in this, um, this slide, I'm showing you that I have this box, which I'm going to call my jump box. 153 00:13:46,200 --> 00:13:56,100 So 10.10.10, or you'll also hear this called a bounce node and I'll probably go back and forth, but I happen to know that this is sitting on a, like a security boundary here. 154 00:13:56,100 --> 00:13:59,660 And there are other systems back in here that I'd like to get access to. 155 00:14:02,020 --> 00:14:07,640 I can use SSH to forward ports from my system through that system. 156 00:14:07,840 --> 00:14:10,500 Uh, look at a, look a little bit like this. 157 00:14:10,500 --> 00:14:16,420 So I'll have port 8080 on my local system. 158 00:14:16,420 --> 00:14:23,520 We'll jump through that 10.10.10.10 system and then point at one of the systems on the other side. 159 00:14:24,080 --> 00:14:26,560 All of that will go over the SSH tunnel. 160 00:14:27,100 --> 00:14:32,720 So that traffic is encrypted from, uh, my laptop here to this system. 161 00:14:32,840 --> 00:14:38,420 And then it comes out of here and we'll wind up over on looking at the system. 162 00:14:39,380 --> 00:14:46,100 Uh, what that looks like on the command line is you use the minus capital L for local forward. 163 00:14:46,320 --> 00:14:57,920 Um, and you want to tell it the port on your system that you want to listen on the host that you want that connection to go to on the far side and the host port on the far side that you would like to go to. 164 00:14:58,720 --> 00:14:59,240 Okay . 165 00:14:59,900 --> 00:15:03,700 So in practice, what this looks like is SSH minus capital L. 166 00:15:03,700 --> 00:15:07,760 I want to listen on my host on port 8080 on my laptop. 167 00:15:08,060 --> 00:15:16,020 I want that traffic when I go to port 8080 to go out the other side to 192.168.1.10 on port 80. 168 00:15:16,020 --> 00:15:19,060 So say there's a web server on that system that I'm trying to get access to. 169 00:15:19,280 --> 00:15:27,460 And then I'm logging in as Bob to that, that bounce node, 10.10.10.10, 10.10.10.10. 170 00:15:27,460 --> 00:15:29,000 Different IP addresses. 171 00:15:29,340 --> 00:15:32,760 Um, and then interestingly here, I'm going to give it minus N. 172 00:15:32,920 --> 00:15:35,200 So that tells it not to request a shell. 173 00:15:35,440 --> 00:15:37,160 And then I'm going to background it. 174 00:15:37,320 --> 00:15:40,220 What that does is now I have 8080 listening. 175 00:15:40,220 --> 00:15:42,340 I can now go onto my next command. 176 00:15:42,340 --> 00:15:44,860 I didn't request a shell on the remote system. 177 00:15:44,860 --> 00:15:55,240 So once again, if there's a defender watching that system and trying to see like run a who or see who's logged into it, all they'll actually see is that there's an SSH D process. 178 00:15:55,240 --> 00:15:57,720 It doesn't actually spawn a shell or anything. 179 00:15:57,800 --> 00:16:01,860 And then if they're really on the ball, they'll look at net stat and see the network connection. 180 00:16:01,860 --> 00:16:05,120 But most of the time they just won't realize that there's somebody logged in. 181 00:16:05,560 --> 00:16:08,260 And then, uh, like I said, that's backgrounded. 182 00:16:08,260 --> 00:16:12,840 So on my local system now I can point curl at local host on port 8080. 183 00:16:12,920 --> 00:16:18,320 And so there's a HTTP server there that happens to be serving a file called secret that I need to get. 184 00:16:18,320 --> 00:16:22,020 And I, I get it and it looks like I won. 185 00:16:24,920 --> 00:16:34,380 Uh, that's super fun and all being able to do a local forward, but I don't want to do that one by one by one through all of these systems on this network. 186 00:16:34,620 --> 00:16:41,540 Uh, thankfully SSH was nice enough to think of the, this, the, the kind developers of open SSH. 187 00:16:42,080 --> 00:16:45,220 They implemented this thing called dynamic port forwarding. 188 00:16:46,440 --> 00:16:57,340 So what this does is this lets me open up on my system, a port that will forward over that SSH tunnel, uh, either SOCKS4 or SOCKS5 proxy. 189 00:16:57,340 --> 00:17:01,540 And then I'm essentially using that SSH server as a proxy server. 190 00:17:01,760 --> 00:17:08,540 And I can get to any of the systems behind that network, as long as whatever I'm using speaks that SSH protocol. 191 00:17:08,600 --> 00:17:23,440 So if I point my, if I use this proxy port, then I can get proxy that through this system and just get to any of the systems that are behind here in the way this kind of basic network example is laid out. 192 00:17:24,640 --> 00:17:32,600 Uh, and, um, kind of counterintuitively here, it's actually easier to do this than the just singular local forward. 193 00:17:32,820 --> 00:17:34,780 So at least on the SSH side. 194 00:17:34,780 --> 00:17:40,960 So, um, all I'm doing here is minus capital D for dynamic and that does a dynamic forward. 195 00:17:40,960 --> 00:17:44,780 I'm telling it port 1080, just common SOCKS port. 196 00:17:44,780 --> 00:17:49,020 Um, and then same thing, Bob at 10.10.10.10. 197 00:17:49,380 --> 00:17:51,320 I think I got that right this time. 198 00:17:52,000 --> 00:17:54,920 Uh, and super nice and easy. 199 00:17:54,920 --> 00:17:57,220 Once I run that command, I've successfully logged in. 200 00:17:57,220 --> 00:18:00,540 I now have a proxy server. 201 00:18:00,620 --> 00:18:04,200 I've turned that SSH system into a proxy server. 202 00:18:04,300 --> 00:18:08,660 So what I can do with that is I can point a web browser at that proxy server. 203 00:18:08,660 --> 00:18:22,840 So for instance, here, Firefox, uh, some Firefox, go preferences, network settings, manual, manual proxy conf here, and then, or click the manual proxy conf button and then do, um, SOCKS host. 204 00:18:22,840 --> 00:18:26,640 And here I've picked SOCKS five, and then I just tell it my port 1080. 205 00:18:26,640 --> 00:18:32,220 Now, anything my browser tries to go to is going to forward over that SOCKS proxy and come out in that other network. 206 00:18:34,060 --> 00:18:37,200 Um, additionally, you can use, I like to use proxy chains. 207 00:18:37,200 --> 00:18:41,820 There's actually a couple of different tools to do this, but proxy chains is the one that I know how to use. 208 00:18:41,820 --> 00:18:50,100 So it's pretty easy for me is, um, you can use proxy chains here and you just configure it to tell it where the proxy host is. 209 00:18:50,160 --> 00:18:54,620 And then, um, you use the command proxy chains here. 210 00:18:54,620 --> 00:19:13,280 I'm just going to drop in a bash and what proxy chains does is it hijacks the, um, the libc calls to socket, uh, operations, and then forwards them over that, uh, for TCP operations, forwards them over that SOCKS protocol, speaks the SOCKS protocol, and then forwards the traffic gomer. 211 00:19:13,340 --> 00:19:17,620 So anything in that bash session gets forwarded over that proxy. 212 00:19:17,840 --> 00:19:26,420 You can do one-off commands, but I like to drop in a bash here a lot because you can do curl and a bunch of other, um, nmap and netcat and all that kind of stuff. 213 00:19:26,420 --> 00:19:36,500 You have to use the right options because nmap needs to be on layer two sometimes, but, um, depending on how you're trying to scan, but for TCP scans, uh, super useful. 214 00:19:36,500 --> 00:19:52,640 Uh, and so you've essentially just used that SSH host to bounce, uh, into that network that you probably didn't have access to necessarily, but thankfully just to thank, thankfully you got access to that one SSH host and you got in. 215 00:19:54,800 --> 00:20:01,600 Um, the next way you can port forward is kind of the opposite of the local forward, which is the remote forward. 216 00:20:01,880 --> 00:20:11,680 So say I am sitting on my laptop and I would like a port on that SSH server to open up and forward that port back to my system. 217 00:20:12,520 --> 00:20:24,520 So I'll do this with SSH a lot to get from a system out to the network and then be able to do all of that same forwarding and tunneling and stuff just in the opposite way. 218 00:20:25,440 --> 00:20:30,120 So say I'm actually on, I'd have to be, I have to be on both systems in this scenario. 219 00:20:30,120 --> 00:20:37,620 So I'm on my laptop and then I also have access to this system in the network and I'm, say I'm trying to exfil some data or something. 220 00:20:37,680 --> 00:20:42,780 I can't get out because they're blocking the internet, but I have access to this and I have access to my laptop. 221 00:20:42,820 --> 00:20:56,080 So what I do is I SSH and I set up a remote forward from here that says, Hey, listen on two, two, two, two here and forward that back to me on port 22, which is SSH. 222 00:20:57,240 --> 00:21:08,620 Then from this system, I can just use any of those SSH commands provided I have the SSH command line and I can do stuff like copy files to here, but it's really forwarding to here. 223 00:21:08,900 --> 00:21:13,740 So anyone looking at the network traffic, nothing's actually going out over the firewall or anything. 224 00:21:13,740 --> 00:21:16,120 It's just traffic going to here. 225 00:21:16,120 --> 00:21:23,460 And then there's a secure connection to here from, from the bounce host to my laptop. 226 00:21:24,300 --> 00:21:29,400 So nothing actually, unless you're really on the ball, looks like it's coming from this to my laptop. 227 00:21:29,400 --> 00:21:31,700 It's routing through this other system. 228 00:21:33,880 --> 00:21:39,220 So what that looks like here is you use the dash R command for remote. 229 00:21:39,800 --> 00:21:47,740 I'm going to tell it what port to listen on and I'm going to tell it the host port that I want it to, or the host that I want it to listen on. 230 00:21:47,740 --> 00:21:50,600 And then the host port that I want it to forward to. 231 00:21:51,940 --> 00:21:57,240 So I say, listen on 2222, open that up on any. 232 00:21:57,240 --> 00:22:00,300 So 0.0.0.0 is the any address. 233 00:22:00,320 --> 00:22:03,420 And then forward that traffic back to me on port 22. 234 00:22:03,480 --> 00:22:06,680 I log in as Bob to that 10.10.10.10. 235 00:22:06,800 --> 00:22:11,340 I do minus N again, because I don't want to actually get a shell here. 236 00:22:12,180 --> 00:22:20,580 Importantly, to be able to do this, listen on 0.0.0.0, the SSH server that I'm logging into. 237 00:22:20,580 --> 00:22:26,780 So this guy 10.10.10.10 has to have gateway ports enabled, or else you won't be able to do this by default. 238 00:22:27,360 --> 00:22:28,880 Luckily, it's a pretty easy change. 239 00:22:28,880 --> 00:22:31,520 You just update Etsy SSHD config. 240 00:22:31,600 --> 00:22:36,220 We'll look at config stuff a little bit later, but you can just change this. 241 00:22:36,220 --> 00:22:38,460 It is no by default, but you just change it to yes. 242 00:22:38,460 --> 00:22:40,140 And then you restart SSH. 243 00:22:40,180 --> 00:22:45,140 Your connection stays alive, everything keeps working, and then you can do this. 244 00:22:46,240 --> 00:22:54,140 And then from that system that's inside the network that can't get out, I SSH to the 10.10.10.10 on port 22. 245 00:22:54,140 --> 00:22:58,040 So this minus P tells it to go different than the default port. 246 00:22:58,080 --> 00:22:59,500 I log in. 247 00:22:59,500 --> 00:23:03,060 I can either log in or I can copy files or do whatever I want. 248 00:23:04,520 --> 00:23:20,000 Important thing to point out is if I'm on a system that I don't control, oops, if I'm on a system that I don't control and I SSH into my system, I am potentially giving up credentials or a password or something to my system. 249 00:23:20,000 --> 00:23:22,000 So be careful with this. 250 00:23:22,000 --> 00:23:36,240 Make sure that this system, this user that they're logging into is something that they they're not too worried about and that that user is locked down and that they can get everything or you're kind of letting them into your system and getting hacked yourself and you do not want to be that person. 251 00:23:39,460 --> 00:23:42,920 So that's cool, but it's a lot to type. 252 00:23:42,960 --> 00:23:47,820 Say I want to do this same scenario where I have a tunnel and I want to log into that. 253 00:23:47,820 --> 00:23:51,280 I want to log in through my jump box or my bounce node. 254 00:23:51,280 --> 00:23:53,600 I want to land over here. 255 00:23:53,860 --> 00:24:01,260 So I would have to SSH to here, do a port forward to tell it to go over here, and then SSH to that port forward and go over here. 256 00:24:01,260 --> 00:24:03,820 And that's a lot of work and I'm a lazy hacker. 257 00:24:03,820 --> 00:24:05,040 I don't want to do that. 258 00:24:05,440 --> 00:24:08,720 Thankfully, the people that implement SSH are not lazy. 259 00:24:08,720 --> 00:24:12,100 So they think of all of these things and have it done ahead of time. 260 00:24:12,660 --> 00:24:16,480 SSH has this cool option called a proxy command. 261 00:24:17,360 --> 00:24:22,160 The proxy command is the old way to do this and they've actually since implemented a new version. 262 00:24:22,200 --> 00:24:26,320 But proxy command is still super useful and we'll see another use of this in just a second. 263 00:24:26,320 --> 00:24:29,040 But what you do is you say minus O is option. 264 00:24:29,040 --> 00:24:30,800 You say proxy command. 265 00:24:30,800 --> 00:24:35,260 I want my proxy command to be SSHing to that remote system again. 266 00:24:35,400 --> 00:24:40,020 And then here percent H and percent P get replaced with the system that you're trying to log into. 267 00:24:40,020 --> 00:24:42,260 So it would be a remote and the port. 268 00:24:46,460 --> 00:24:49,120 Like I said, this is kind of the old way to do it. 269 00:24:49,120 --> 00:24:53,280 The SSH developers were nice enough to realize that this is also a lot to type. 270 00:24:53,780 --> 00:25:02,940 So they made this thing called proxy jump, which you can do minus J and tell it, Bob, this is essentially doing the same thing as this. 271 00:25:02,940 --> 00:25:12,040 And then you're just logged in and like we saw, you now have this set up where you're actually SSHing through this system to here. 272 00:25:12,040 --> 00:25:21,680 Anybody monitoring this boundary for access to this system won't actually see that because you're actually going through here and to here. 273 00:25:21,680 --> 00:25:23,300 You're not going straight to it. 274 00:25:23,300 --> 00:25:31,660 So that is a pretty useful way to get around some kind of common network monitoring and popping through some boundaries. 275 00:25:31,660 --> 00:25:42,960 You can actually do some really cool stuff with this where you set up like different jump boxes and have them go through different layers and it starts to get pretty fun. 276 00:25:42,960 --> 00:25:44,820 You can do some pretty crazy stuff. 277 00:25:45,780 --> 00:25:52,620 So like I said, though, that proxy command is super interesting and shout out to SubT for kind of prompting me to look at this. 278 00:25:52,620 --> 00:26:05,080 Here, I'm actually using a proxy command to configure my SSH to use an HTTP proxy to get to wherever I'm trying to go. 279 00:26:07,280 --> 00:26:08,660 So I'll say that again. 280 00:26:08,660 --> 00:26:14,680 I'm using a proxy command to use an HTTP proxy to get to where I'm trying to go. 281 00:26:14,680 --> 00:26:24,780 So anybody looking at this traffic is going to see a connection to an HTTP proxy and not even realize that I'm SSHing through that proxy out to the other side. 282 00:26:25,100 --> 00:26:34,520 This is super useful when you're in a network that's very locked down and is only letting certain things through and you have to use an HTTP proxy to get out. 283 00:26:36,340 --> 00:26:39,020 Or if you just want to blend in. 284 00:26:44,020 --> 00:26:53,000 Another thing that is very useful here is so now I have all of these tunnels and this forwarding and all of this cool stuff that I want to set up but SSH is a TCP protocol. 285 00:26:53,000 --> 00:26:59,680 So if anything happens in this connection, any of the routers or something timeout, something weird happens, that connection will die. 286 00:27:00,240 --> 00:27:07,900 Maybe I want this tunnel to be set up really long-lived and how I accomplish this is with a command called auto SSH. 287 00:27:07,900 --> 00:27:20,380 And what I like to do with this is I will set up auto SSH to log into my laptop and forward port 2222 on my laptop back to the host. 288 00:27:20,380 --> 00:27:22,960 So I apologize the arrow is backwards here. 289 00:27:22,960 --> 00:27:30,380 But it would actually forward from 2222 back to my host on 22 and funnel that traffic. 290 00:27:30,380 --> 00:27:32,780 So I connect here and it goes out here. 291 00:27:33,000 --> 00:27:36,180 So there's an auto SSH connection out. 292 00:27:36,220 --> 00:27:40,540 It sets up that remote port forward to come back. 293 00:27:40,600 --> 00:27:46,080 And if that connection dies, auto SSH will restart it for me, monitor that process and restart it for me. 294 00:27:46,080 --> 00:27:54,040 That effectively lets me maintain access to this and I don't have to do anything once it's set up. 295 00:27:54,640 --> 00:27:57,980 And what that looks like is you use the auto SSH command. 296 00:27:57,980 --> 00:27:59,700 It's just a tool that you can install. 297 00:27:59,700 --> 00:28:05,900 I'm giving it some options here, the server alive interval, server alive max count. 298 00:28:05,900 --> 00:28:09,780 So this will wait 30 seconds and it will max try three times. 299 00:28:09,960 --> 00:28:16,920 And then I'm telling it to remote forward on 2222 to port 22 on my local host. 300 00:28:16,920 --> 00:28:20,200 And then I log into my laptop, aka Hackbox. 301 00:28:20,820 --> 00:28:29,240 And then on Hackbox, I can SSH minus P to 2222 and tell it, Bob, because that's the user that I have at local host. 302 00:28:29,240 --> 00:28:32,940 And that's actually going to go through that tunnel back in through the network. 303 00:28:32,940 --> 00:28:35,260 And then I'm just logged into that victim system. 304 00:28:36,360 --> 00:28:45,540 Once again, this is super cool, because like all someone monitoring this network would see is someone logging into a system remotely. 305 00:28:46,300 --> 00:28:55,200 So say you're here, this boundary is monitored, all you see is an SSH out, you don't actually see me tunneling back in. 306 00:28:55,200 --> 00:28:59,680 So it looks like someone who already is logged into this just logged into something on the internet. 307 00:29:00,620 --> 00:29:02,120 And that is what happened. 308 00:29:02,220 --> 00:29:05,220 But then additionally, I'm logging back into that system here. 309 00:29:05,220 --> 00:29:10,240 So I actually have shell access that they might not be wanting me to have. 310 00:29:14,180 --> 00:29:25,880 So a bunch of fun stuff you can do with port forwarding, super useful for kind of crossing those security boundaries and getting into networks that you're not necessarily supposed to have access to. 311 00:29:26,260 --> 00:29:29,600 With auto SSH, you can maintain that access. 312 00:29:30,200 --> 00:29:37,200 And to get creative with it, you can jump around and get to a bunch of different network segments and really make it confusing. 313 00:29:37,200 --> 00:29:43,300 With all the port forwarding, you can make it look like someone's connecting from a different system as long as you have access to connect all through. 314 00:29:43,300 --> 00:29:53,000 So someone that's trying to trace that back through network logs, or system logs, it's going to have a rough time because you're essentially using a proxy to get through a bunch of stuff. 315 00:29:53,000 --> 00:29:59,520 And you can proxy, proxy, proxy and jump around and good clean fun to be had by all. 316 00:30:02,840 --> 00:30:04,200 So configuration. 317 00:30:04,220 --> 00:30:18,400 So what we're going to talk about here is a bunch of different ways that you can configure SSH to do things that are kind of unexpected, or just interesting configurations that are useful, kind of in operations or in the in the process of doing things. 318 00:30:18,960 --> 00:30:23,560 First up, I want to point out that we have these escape sequences. 319 00:30:23,580 --> 00:30:36,700 So if I've SSH into a system, and I have an interactive shell, SSH actually has this kind of hidden shell that you send a special character sequence, it's like a cheat code almost. 320 00:30:36,700 --> 00:30:38,760 And it gives me all of this functionality. 321 00:30:38,760 --> 00:30:45,720 So what I did here is my prompt, I did new line tilde question mark, just in quick succession without anything else going on. 322 00:30:46,520 --> 00:30:50,760 And that's showing me the help for this escape sequence prompt. 323 00:30:51,620 --> 00:30:56,740 Probably the most useful, the ones I use all the time, is the terminate connection. 324 00:30:57,000 --> 00:31:12,820 So if something messes up with that SSH session, and my term, my shell is hung, and I can't get it to work anymore, instead of having to drop into another prompt and find the SSH process and kill it, you can just do this tilde, new line tilde dot and it kills the kills the SSH session. 325 00:31:13,280 --> 00:31:19,280 Also super useful if your friends let you sit at a prompt for their SSH and you want to mess with them. 326 00:31:19,360 --> 00:31:21,220 Just do that real quick. 327 00:31:22,520 --> 00:31:31,480 The other one that is super useful here is the background, or sorry, the command line. 328 00:31:32,260 --> 00:31:37,140 And that's the capital C. 329 00:31:37,380 --> 00:31:39,840 So why is this useful? 330 00:31:39,840 --> 00:31:42,580 You already saw you can just do this with the command line, right? 331 00:31:42,580 --> 00:31:48,960 You can SSH minus L and open up the port, or minus R and open up the port and all that kind of stuff. 332 00:31:50,100 --> 00:31:56,280 So this is one of those things that's really useful, but not very often. 333 00:31:56,280 --> 00:32:11,360 So the most use I have out of this is when I have access to SSH on a system, someone's actively trying to defend it, and they've changed the password on me, or gotten rid of my SSH key that we'll see here in a minute, or whatever. 334 00:32:11,360 --> 00:32:15,720 I can't log back into that prompt, or that SSH session. 335 00:32:15,720 --> 00:32:23,160 So I can't log out to port forward, but I want to port forward through that because I still have access and they haven't noticed that my actual shell exists. 336 00:32:23,160 --> 00:32:25,420 They just noticed that the account was compromised. 337 00:32:25,520 --> 00:32:29,020 So I can still scan the network and do a bunch of stuff from there. 338 00:32:29,020 --> 00:32:34,560 I just need to be able to change some of the port configs and I can't log out and log back in. 339 00:32:34,720 --> 00:32:37,140 That is when this is the most useful. 340 00:32:37,380 --> 00:32:46,780 So just like all of the other commands, minus L, minus R, minus D, lets you set up all of those port forwards. 341 00:32:46,780 --> 00:32:52,780 And then it's minus KL to cancel them or kill them. 342 00:32:54,900 --> 00:32:58,320 Once again, super useful, kind of keep it in your back pocket. 343 00:32:58,320 --> 00:33:05,240 It's not really common that I run into this, but when I have needed this, it was invaluable. 344 00:33:07,000 --> 00:33:11,080 So I talked a little bit about authorized key there. 345 00:33:11,080 --> 00:33:20,520 So one of the things you can do with SSH is trying to log in and put your username and your password all the time isn't very much fun. 346 00:33:20,520 --> 00:33:21,940 It's kind of insecure. 347 00:33:21,940 --> 00:33:24,740 We'll see a little bit later why that is pretty insecure. 348 00:33:25,560 --> 00:33:28,560 So SSH came up with this concept of an authorized key. 349 00:33:28,920 --> 00:33:32,420 So this is just public key cryptography. 350 00:33:32,680 --> 00:33:37,460 I generate a public private key pair. 351 00:33:37,460 --> 00:33:46,700 I put the public key on the remote system that I want to log into in a configuration file and say anyone that has the private key for this public key is allowed to log in. 352 00:33:47,380 --> 00:33:52,760 So this is very, very useful when you run into SSH for a couple of different things. 353 00:33:53,120 --> 00:34:02,140 One is if you can get access to someone's private key, you can log into any of the systems as them that they log into. 354 00:34:02,940 --> 00:34:10,880 Because of that, you actually generally, you're prompted to put a password in to password protect that private key. 355 00:34:10,880 --> 00:34:14,960 So when you try to use it, you have to decrypt the private key before you can use it. 356 00:34:15,820 --> 00:34:27,040 Most of the time or still a lot of the time, sadly, people that are generating these keys just hit enter twice and then you get an SSH or a private key that is not protected. 357 00:34:27,640 --> 00:34:31,820 And by sadly, I mean awesomely because it's great and you find this all the time. 358 00:34:33,800 --> 00:34:38,440 So where that file is stored is generally there's two places. 359 00:34:39,440 --> 00:34:51,870 SSH is either or the SSH stuff is either in Etsy SSH, which is the global configuration, or here where we're looking at it in the user's configuration, which is the dot SSH folder in their home directory. 360 00:34:52,840 --> 00:34:55,960 So here specifically, this is in Roots home directory. 361 00:34:55,960 --> 00:34:59,460 We've generated a key pair. 362 00:34:59,460 --> 00:35:03,440 The default for the RSA keys is just ID under RSA. 363 00:35:03,440 --> 00:35:06,120 And then you'll have ID under RSA.pub. 364 00:35:06,120 --> 00:35:21,580 If you copy that ID under RSA.pub to the dot SSH authorized keys file for any user, you can log in to that user account without a password. 365 00:35:22,660 --> 00:35:31,560 So this is also super useful in the case where I land on a system and I don't know the user's password, so I can't change their password. 366 00:35:32,320 --> 00:35:35,140 But I'd like to be able to SSH in as them. 367 00:35:35,140 --> 00:35:48,020 I can add this key and then I can SSH into that account as them and have a full PTY shell that lets me do all of the things you would do with a full PTY shell, edit files, run sudo, all that kind of stuff. 368 00:35:49,600 --> 00:35:52,460 And essentially, this lets you maintain access. 369 00:35:52,460 --> 00:35:55,940 I don't need to know the user's password as long as that file exists. 370 00:35:56,300 --> 00:36:10,200 So this is also super useful for um like hack the box style challenges where you get a web shell or just if you have a web shell as a user and you want to upgrade to that user level access. 371 00:36:10,280 --> 00:36:18,360 If you have the ability to write to this file, then you just add an SSH key in here and you can log in. 372 00:36:18,580 --> 00:36:28,700 SSH by default will check the permissions of that file and not use it if they aren't correct, but sometimes it is configured to not do that. 373 00:36:28,700 --> 00:36:30,200 So it's always worth checking. 374 00:36:31,140 --> 00:36:39,900 Kind of the meta here is it's always worth looking in the SSH folder because there is a bunch of different stuff and we'll see more of that here coming up. 375 00:36:40,240 --> 00:36:43,760 So next is the known hosts file. 376 00:36:44,140 --> 00:36:47,940 So this file is a list of all of the systems that a user is logged into. 377 00:36:48,140 --> 00:36:55,920 For anybody familiar with SSH, when you SSH out to a system the first time, it'll say, hey, I don't recognize this system. 378 00:36:55,920 --> 00:36:57,140 This is the public key. 379 00:36:57,140 --> 00:36:58,280 Do you accept this? 380 00:36:58,280 --> 00:37:02,360 When you do that, it saves that into this file called the known hosts. 381 00:37:03,680 --> 00:37:12,020 That known hosts file will have one entry per line and then it has the IP address or the host name and then the public key information. 382 00:37:12,140 --> 00:37:13,300 So this is super useful. 383 00:37:13,300 --> 00:37:30,760 If I can see this and I'm the user, say I now have access to their unencrypted private key and then I also have access to all of the IP addresses that they're logging into, a pretty easy way to pivot around the network and find other systems that I have access to. 384 00:37:32,580 --> 00:37:37,800 The next file here that is super interesting is the SSH config. 385 00:37:37,980 --> 00:37:49,220 So all that stuff that we've been going over, all of the port forwards, all of the different things are super great, but typing all of that's horrible and I'm a lazy hacker. 386 00:37:49,220 --> 00:37:55,720 And once again, the SSH developers, they know that, I guess, and they came up with a solution for it. 387 00:37:55,720 --> 00:37:57,660 So that's this SSH config. 388 00:37:58,060 --> 00:38:10,500 Like all, most of the other SSH stuff, the default or the kind of system-wide configuration is an Etsy SSH and then the user configuration is in .ssh in the user's home directory. 389 00:38:11,620 --> 00:38:13,800 That config file looks like this. 390 00:38:13,800 --> 00:38:18,520 So here someone has set up a host called bounce. 391 00:38:18,520 --> 00:38:20,020 The username is bob. 392 00:38:20,020 --> 00:38:22,620 They're logging into 10.10.10.10. 393 00:38:22,620 --> 00:38:28,760 They would like to do a local forward of port 8080 to 192.168.1.10.80. 394 00:38:28,780 --> 00:38:38,420 They're going to do a dynamic forward for 1080 and they're going to do a remote forward for 8080 on 192.168.1.10.80. 395 00:38:38,960 --> 00:38:45,920 On the command line, you can just do ssh bounce and then all of those configs will get set in the command line. 396 00:38:45,920 --> 00:38:47,760 You don't have to do anything at all anymore. 397 00:38:47,760 --> 00:38:49,080 It's just ssh bounce. 398 00:38:49,080 --> 00:38:51,360 It'll tab complete if you have bash completion. 399 00:38:51,360 --> 00:38:52,500 Super awesome. 400 00:38:54,280 --> 00:39:06,100 When you land on a system, if you have access to this config file, this is another way to find systems that people are logging into because they'll have a bunch of configs like this for easy mode accessing the systems that they access. 401 00:39:06,120 --> 00:39:13,960 And you can see, okay, so this bob guy has access to 10.10.10.10 and likes to check out these other systems on these ports. 402 00:39:13,960 --> 00:39:16,000 So something I can try to do. 403 00:39:18,500 --> 00:39:23,620 Another fun thing you can do with ssh config is get it to do stuff that people are not intending. 404 00:39:23,980 --> 00:39:35,080 So let's say in this scenario, I know that bob is sshing from the server that he's on 10.10.10.10 to that system that he has internally. 405 00:39:35,680 --> 00:39:43,120 Every time he does that, I would like to get a shell back to me on 41.41 from his system. 406 00:39:45,520 --> 00:39:47,880 With ssh config, I can do that. 407 00:39:47,900 --> 00:39:52,620 So here, I configure it, say I'm on his server for some reason. 408 00:39:52,820 --> 00:39:54,940 I have access to his ssh config. 409 00:39:54,940 --> 00:39:57,780 I'm going to go ahead and I like to set this up for all hosts. 410 00:40:00,160 --> 00:40:06,180 By default, you're not permitted to run a local command, but luckily in the config file, you can just tell it to let you do that. 411 00:40:06,880 --> 00:40:20,300 And what I'm going to do here is tell it the local command is to netcat me a bin bash shell to my IP address on my listener and background and then do whatever else bob was trying to do. 412 00:40:21,300 --> 00:40:29,200 So every time bob logs into a host, it will spin a shell back to me and I'll get access to his system. 413 00:40:29,200 --> 00:40:36,920 So say my shells keep dying or I just want to kind of maintain access in a super easy way. 414 00:40:38,780 --> 00:40:44,840 Another config file that is super awesome is this run commands file or RC file. 415 00:40:45,760 --> 00:40:56,320 This similarly has the Etsy version or the user version, but what this does is this runs a command when the user's logging in right before it drops them to a shell. 416 00:40:57,440 --> 00:41:06,700 So back to our scenario, say I'm actually on this this far system and now I want a shell to come back to me every time somebody logs in. 417 00:41:06,780 --> 00:41:11,280 So when somebody logs into this system, it sends me a shell. 418 00:41:12,720 --> 00:41:19,700 What that looks like here is I just put this simple netcat listener just like the other one roughly in this. 419 00:41:19,700 --> 00:41:30,320 I say netcat spit a shell back to me on my listener IP address on port 4141 and then background and go ahead and keep doing whatever it is that people want to do. 420 00:41:30,660 --> 00:41:34,040 So I encourage people to look at the config files. 421 00:41:34,040 --> 00:41:36,620 There's a ton more things you can do in there. 422 00:41:36,620 --> 00:41:40,860 These are kind of simplified versions for slides and to demonstrate the purposes. 423 00:41:41,240 --> 00:41:56,380 With the config files and the port forwarding, you can really get yourself into some pretty scenarios with that jump proxy command or proxy jumper command or config option. 424 00:41:56,380 --> 00:41:58,980 And then also it goes in the config file. 425 00:41:59,340 --> 00:42:05,460 With those, you can set up really intricate port forwards and get through all sorts of different interesting things. 426 00:42:05,460 --> 00:42:11,200 And like I was saying before, really kind of run havoc on networks and for someone trying to trace stuff back. 427 00:42:12,640 --> 00:42:18,380 Now let's look at a couple different ways that I've successfully gotten creds out of SSH. 428 00:42:19,440 --> 00:42:24,820 The first one being, say I'm on a system and I know someone is logging into other systems. 429 00:42:24,820 --> 00:42:29,140 I see their SSH config, but I don't have their private key. 430 00:42:29,140 --> 00:42:30,420 They're not even using private keys. 431 00:42:30,420 --> 00:42:32,060 I just know they're using passwords. 432 00:42:32,300 --> 00:42:37,260 So I want to be able to get to that system that they're getting to, but I need to get that somehow. 433 00:42:37,680 --> 00:42:46,440 So a thing I like to do is I set, I create a little shell script here that's in their path before the normal SSH command. 434 00:42:46,440 --> 00:42:50,400 So the SSH command by default is in user bin SSH. 435 00:42:50,440 --> 00:43:03,580 Here I'm making a shell script called user local bin SSH that prompts the user for a password again and then writes that password to a temp file and then just SSHs for them. 436 00:43:03,580 --> 00:43:16,060 So what that looks like, and I'm sure people that are used to SSH, is you SSH out, it asks you for your password, you typoed it, it just asks you for your password again, you typed it right, you're good to go, and then eventually you exit. 437 00:43:16,060 --> 00:43:24,340 And you can see here that in temp.creds, I've now stolen that super secret password and I have Bob's password of 192.168.1.10. 438 00:43:24,340 --> 00:43:27,520 I'm able to pivot and kind of be on to the next thing. 439 00:43:29,680 --> 00:43:32,800 Additionally, so let's say the other way is true. 440 00:43:32,800 --> 00:43:38,080 Someone's SSHing into a server that I have access to and I want to see what their password is. 441 00:43:39,160 --> 00:43:46,320 Here I use the debug tool called strace which just looks for all of the system calls that happen in the binary. 442 00:43:46,420 --> 00:44:00,180 So I find the SSH process, I attach strace to that SSHD process, and I tell it to just show me the reads because I know just I know how the SSH daemon works. 443 00:44:00,180 --> 00:44:05,500 I know that when you connect into it, it sends you a prompt and then reads your password from you. 444 00:44:05,640 --> 00:44:09,460 So here I'm telling it to just show me all of the reads. 445 00:44:09,460 --> 00:44:16,740 There are a lot of reads, so I've gone ahead and grepped them for this magic string that happens right before the password just as part of the protocol. 446 00:44:16,740 --> 00:44:23,680 And here you can see I've stolen this password of super secret from someone when they're logging into the SSH. 447 00:44:26,320 --> 00:44:34,880 Another really fun one here is using this paramiko to create your own SSH server. 448 00:44:35,020 --> 00:44:42,440 So this is kind of the most basic example of this that I can show and make it actually fit in a slide and be useful. 449 00:44:42,440 --> 00:44:51,340 But the idea here is say I'm on a server and it's not running SSH but I know someone is trying to log in. 450 00:44:52,060 --> 00:44:58,060 I need to speak enough of the SSH protocol to get them to give me their password. 451 00:44:59,300 --> 00:45:06,100 But I don't necessarily want to let them log in because I don't know what they're trying to do and I don't want to implement the entirety of all of SSH. 452 00:45:07,580 --> 00:45:10,600 So let's kind of run through this Python code a little bit. 453 00:45:11,600 --> 00:45:19,200 What I'm going to do here is for this line here I'm going to go ahead and grab the TCP socket or create a TCP socket. 454 00:45:19,200 --> 00:45:20,880 I'm going to bind on 22. 455 00:45:20,880 --> 00:45:25,360 So this means I have to have access to open those non-ephemeral ports. 456 00:45:25,360 --> 00:45:30,420 I'm going to listen for one connection and then accept for that connection. 457 00:45:30,420 --> 00:45:36,860 So once I've got a connection I let myself know hey someone from this adder has connected to me. 458 00:45:38,140 --> 00:45:47,000 Then I'm going to take advantage of paramiko and they call it transport in the paramiko implementation. 459 00:45:48,140 --> 00:45:56,260 With that transport I'm going to go ahead and add a server with the paramiko RSA key. 460 00:45:56,260 --> 00:45:58,040 So I have just a test key. 461 00:45:58,040 --> 00:46:05,880 So like I said before when you SSH out and it says I don't recognize this here's the public key this is going to be that key that it gives them. 462 00:46:05,940 --> 00:46:15,960 This is one chance that they could detect so if they're trying to SSH in and it's a key that they don't recognize you should just say no unless you know that there's a key that you should be seeing. 463 00:46:16,640 --> 00:46:20,340 But most people just say yes because they assume it's a server they haven't seen. 464 00:46:20,480 --> 00:46:27,760 And then I'm going to go ahead and start it with my server and tell it to just serve and then accept the connection. 465 00:46:28,020 --> 00:46:39,100 So what this looks like here is this now uses my server they connect in they get the SSH protocol does its negotiation and says the only thing I can do is password authentication. 466 00:46:39,220 --> 00:46:54,060 So they'll get a password prompt from the client because it knows how to speak enough of the protocol and then they'll send me the username and password to my SSH server and that the paramiko server will call this check auth with the username and password that it got. 467 00:46:54,060 --> 00:47:02,340 I can say hey cool check it out I got a username and password and then tell it uh no that's not a valid username and password. 468 00:47:02,360 --> 00:47:26,180 So from the user's point of view they tried to SSH in the SSH failed they don't know why it is they don't know what this box is anyway it's not supposed to be on the network so kind of ignore this spawn a connect back shell that's not what's actually happening I'm actually starting an SSH server here so start my super secret awesome SSH server just with Python it tells me hey I got a 469 00:47:47,100 --> 00:48:00,440 So, that is kind of an intro and some a little bit deeper but not super crazy deep dive into all of the cool, not all of, but a bunch of the cool things you can do with SSH. 470 00:48:01,500 --> 00:48:10,480 You saw that just by default it gives you remote shell access, lets you do port forwarding, you can download upload files, it's all encrypted. 471 00:48:11,660 --> 00:48:20,380 That port forwarding, you can use that to accomplish almost any sort of hopping that you need to be able to do around network segmentation. 472 00:48:20,420 --> 00:48:30,580 So, if you can get to port 22 and you have some sort of credential material to log into that port 22, you can do quite a bit inside a network. 473 00:48:30,580 --> 00:48:36,380 You can get access to systems you're not necessarily supposed to have access to. 474 00:48:36,380 --> 00:48:41,880 You can get around network protections that are trying to block you from doing things. 475 00:48:41,880 --> 00:48:46,040 You can mask your traffic in different protocols via proxies. 476 00:48:46,040 --> 00:48:50,680 You can make traffic look like it's coming from different systems via proxies. 477 00:48:50,880 --> 00:48:58,460 With all of the configuration options you saw, you can trick the system into doing things or really trick users into doing things that you're not expecting. 478 00:48:58,760 --> 00:49:07,360 Different ways you can run SSH commands such that it's harder to trace or see that information on the system. 479 00:49:08,440 --> 00:49:13,660 And download, upload, exfill all of the data. 480 00:49:13,660 --> 00:49:18,740 Really, the cool thing about this is you can use all of these SSH options. 481 00:49:18,740 --> 00:49:19,980 These are the basic ones. 482 00:49:19,980 --> 00:49:24,340 You can combine all of this to make yourself the craziest network map that you want. 483 00:49:24,340 --> 00:49:26,460 Pivot through all of the different things. 484 00:49:26,700 --> 00:49:31,160 SSH is becoming more and more ubiquitous across environments. 485 00:49:31,400 --> 00:49:33,240 It's now coming on Windows 10. 486 00:49:33,240 --> 00:49:34,740 You have WSL. 487 00:49:35,020 --> 00:49:37,680 It's very, very, very useful. 488 00:49:38,300 --> 00:49:41,620 So, I hope that was helpful. 489 00:49:41,620 --> 00:49:47,640 I hope it made you think a time or two about SSH and what you can do with it and all that kind of stuff. 490 00:49:48,140 --> 00:49:50,620 I hope to stay connected with everybody. 491 00:49:50,920 --> 00:49:53,320 Randori Attack is my team's Twitter. 492 00:49:54,400 --> 00:49:57,880 We are kind of always hiring someone at somewhere. 493 00:49:57,880 --> 00:50:02,740 So, hit up our careers off of our webpage. 494 00:50:02,880 --> 00:50:08,820 And then, if you're into information like this, follow our blog. 495 00:50:09,160 --> 00:50:12,080 Randori TTPs are tips, tricks, and POCs. 496 00:50:12,700 --> 00:50:16,400 Check that out for lots of information like this. 497 00:50:17,500 --> 00:50:22,520 And then, lastly, I'm pretty passionate about this. 498 00:50:22,520 --> 00:50:25,140 We need to make sure that we're taking care of ourselves. 499 00:50:25,140 --> 00:50:27,000 And popping all these shells is awesome. 500 00:50:27,000 --> 00:50:29,560 Maintaining all of this access is super great. 501 00:50:29,720 --> 00:50:35,740 But we also need to make sure that we're taking the time to get away and keeping ourselves fit. 502 00:50:35,740 --> 00:50:37,120 So, hashtag Red Team Fit. 503 00:50:37,120 --> 00:50:38,420 Check us out on Twitter. 504 00:50:38,680 --> 00:50:41,780 There's a bunch of discords all over the place. 505 00:50:41,920 --> 00:50:46,060 And we've got a bunch of groups and doing all sorts of really awesome stuff. 506 00:50:46,060 --> 00:50:48,720 And that's what I got. 507 00:50:48,720 --> 00:50:50,160 Thanks, everybody. 508 00:50:50,500 --> 00:50:53,400 Hashtag Red Team Fit.