Greyhat SSH shenanigans. This talk is going to be about all of the cool offensively focused
things you can do with SSH. If you are a red teamer or a pen tester and you don't have SSH
in your toolbox already, hopefully you'll see why you should have it in your toolbox and all
the cool fun things you can do with it. And if you're advanced, you've already been using SSH,
hopefully there's a tip or a trick or two that you can pick up here as we go through all of this.
So how is this talk going to go? We're going to start off with the basics,
because you have to start at the beginning. Then we're going to start looking at all of the
interesting things you can do with port forwards, how you can use those to get past firewalls,
hide your traffic, make it look like you're accessing systems from other systems, and a
bunch of cool things. Next we'll look at the configurations, so fun with the configs.
SSH has a bunch of different ways you can modify its behavior and make it do things that users are
probably not intending. Leaks a bunch of information about what users are accessing,
how they're accessing them, where they're accessing them, etc. And then lastly we'll look
at stealing creds. So SSH, as we'll see, has access to credential material, and we would
like to get access to that, and we will show a couple different successful strategies in doing
so. First, who am I? My name is Evan. I'm also Syndrome on Twitter. I am the Director of Offense
at a company called Randori. I've been Redding forever. I'm into CTFs. I do CCEC,
all that kind of stuff. So check me out. Let's get into it. So the basics. Starting off,
what is SSH? So SSH stands for Secure Shell. It is a replacement for the original plaintext
protocols of Telnet and RSH, which were both used to get shell access onto Unix systems
and administer those remotely. SSH can be used to refer to both the daemon and the client. So
you will hear someone say SSH to that box. That means that they use the SSH client to connect
to a server that was running the SSH daemon and logged into it that way, got a prompt,
and did whatever. The most common versions of SSH that you're going to run into are OpenSSH.
OpenSSH runs on pretty much everything now, and there are a few other ones that we'll go over,
server and client, coming up. Like I said, it's used to remotely administer systems.
You can upload and download files. You can run commands on the shell,
etc. And then SSH also provides encrypted channels, which are little tunnels that you
can make in the SSH session that will let you do port forwarding that we'll see here in a minute,
X11 forwarding, and get your shell. So why is SSH useful for an attacker?
Really, SSH can be thought of as a Swiss army knife for red teams.
This lets me accomplish anything I need to do with a system if I can get SSH access. So I can
download files. I can upload files. I can run commands. I can maintain access to a system.
I can configure the system such that it does things differently than the user is expecting.
I can get credentials out of it. All of the things that I need to be able to do
to get systems and get into systems and pivot around inside a network.
And it's all encrypted by default for me.
So the common SSH clients and tools that you'll run into.
Like I said, on most Unixes, the common SSH implementation is OpenSSH.
On embedded systems, sometimes you'll run into DropBear, which is just a very small
implementation of SSH. And just the difference here is some of the functionality that we go
over here might not work in DropBear or some of the other SSH servers. There's actually just
SSH.com has an SSH server and there's a few different ones, but most of the time you're
run into SSH and most of the stock is geared towards that. On Windows, you can obviously
drop into WSL, WSL2, and then you're just at a Linux prompt. So you'll have the SSH client.
There's a GUI that's called Putty, which is from way back when. And then there's Plink,
which is the CLI implementation that uses the same SSH stuff under the hood that Putty's using.
And then additionally on Windows 10, after 1809, OpenSSH is available in the Windows app store.
So you can get the SSH server and the SSH client. And then lastly, another tool that's super common
that we're going to take a look at a little bit here is Paramiko, which is a Python library
that implements the entire protocol, the entire SSH protocol, both client and server
in Python. Super useful for being able to write scripts to do either like log into systems for
you and do stuff, or as we'll see later, make a server. Another reason SSH is super useful here,
it's really simple to enumerate. So by default, SSH is port 22. That's the port that it has
registered. You can move it to different ports, but all of the servers, if they're installed,
just by like with the app or whatever, it's SSH. Here you can just use netcat and just
grab the banner. Really simple banner up front. It tells you that it's SSH 2.0 is the protocol
of SSH that it's speaking. The version is, you can see this is an OpenSSH server, 8.3.1,
and then it's running on a Debian system. So just with netcat, I can tell what version of SSH is
installed, or what version of SSH protocol the SSH daemon speaks, what version of SSH is installed,
and the operating system. There's even more stuff that you can figure out. So with Nmap or a bunch
of other, there's a bunch of other tools that can do this, but lots of people know how to use Nmap.
When you run the discovery scripts, it will do that banner grab for you, and it will also
enumerate all the algorithms that the SSH is using. So SSH is a pretty old protocol. You'll
run into systems that have older, more insecure algorithms and potentially vulnerable SSH versions.
So there are some versions of SSH that are vulnerable to user enumeration and command
injection and all sorts of stuff. So that it is so easy to enumerate is pretty nice.
So continuing on with the basics here, just running a command on the remote system. There's
two strategies here, essentially. The first is I'm going to connect to the remote system
and request a interactive shell. So the first command is just SSH. That's going to launch the
command line, bob at, and then the IP address is 10.10.10.10. So that's saying login to 10.10.10.10
as the user bob. I cut out some stuff here. It'll prompt you for a password. And then you can just
run commands interactively like you're sitting at a console on that system. So here you can see you
can run the command, who am I? And you see that you're bob. The other way you do this is to run
a single command at a time. So I say SSH bob at 10.10.10.10. Who am I? It says bob. This is super
useful if the system is being actively defended. So say one of the blue team or someone is actually
on the system watching for connections and seeing who's logged in. They'd have to catch that and
run that command while the who am I command is running or whatever command you want to run. This
is just an example. But they'd have to actually see that to see that you're logged in. This will
still show up in last and in all of the logs and everything, but if someone's just sitting there
trying to see if someone's actually logged in and watching for SSH processes to start, this will let
you have a little race where you can run your command hopefully before they actually catch you
doing whatever the thing is that you want to do.
Like I said earlier, you can use SSH to copy files. So I can copy a file from my system to
the remote system, or I can copy a file from the remote system to my system. There's two ways to
actually do this. The first one that I've laid out here is SCP, so secure copy. And in the first
example here, I'm going to upload a file from my computer to the remote system. So what that
looks like is I do SCP, the file that I want to copy up, and then I'm just like before we saw,
I'm going to do the username at that system, and then I'm going to give it the path that I want to
copy it to. So here I want to say in the user's home directory in the bin folder, name my file
not malware. So I'm going to copy my malware up there and hopefully they won't catch it because
I called it not malware. And that is super secret and they will totally never be able to figure that
out. Next, say I want to download a file from their remote system. So I've been looking around
and I see that there is this Etsy secret sauce that I'd like to get from my local system. Just
like before, it's source and destination, but I want the source now to be the file on the remote
system, and then the destination to be the file on my system. So SCP, Bob, at the remote system,
the path that the file is at. So here it's Etsy secret sauce. And then finally my loot folder.
So every good hacker kid should have a loot folder and I'm going to copy that secret sauce
into that folder. Additionally with SCP, I can recursively copy. So say I just want to grab
everything in that secret folder. I don't know what it is. I'll look at it later. I'm going to
go ahead and use the minus R for recursive flag here to SCP. So SCP minus R, Bob at 10.10.10.10,
the Etsy secret folder down into my loot folder.
The next way you can copy files is with the SFTP command. So this is secure FTP.
Uh, this is actually a completely different implemented or different, um, part of the
protocol to copy those files. So SCP and SFTP, while they accomplish the same thing are actually
doing different stuff under the hood, but functionally it's the same. And if you're
familiar with FTP, hopefully this makes sense. You SFTP as Bob to 10.10.10.10. And then the
first command I want to download a file. So I get that file. I say, get from slash secret sauce
to my loot folder, secret sauce. Um, and then next example, I want to upload a, upload a file.
So SFTP Bob at 10.10.10.10. I'm going to put from my artifacts folder, the malware,
and I'm just going to put it into not malware. Uh, once again, super secret,
no one will ever catch that. Totally not malware. Don't look at it. It's fine.
Uh, and similar to SCP SFTP has a recursive option for the get command. So get minus R
slash temp secret from the remote side. So say that's a folder. And then I'm just going to
download it into my temp folder until I can figure out what to do with it. Uh, and you can see, uh,
what happened there. So, uh, kind of the basics there as SSH lets you, uh, log into a remote
system, get a shell on that system. If you want, you can, uh, run commands singularly. So you don't
even have an interactive session. So it's a lot harder to find. You can copy files down. You can
copy or you can download files. You can upload files. Um, even that just alone is super useful
to an attacker just in and of itself, but let's go ahead and move on forward to, uh, fun with
port forwards and we'll see kind of the more advanced stuff you can do and how you can use
this, uh, SSH in your tool belt to get around, uh, common firewall setups and that kind of,
kind of thing. Uh, so first here, we're going to do look at local forwarding.
So in this scenario, I have access to the 10.10.10.10 system. Hopefully that was enough 10s.
And I happen to know that that is sitting on a boundary. So here in this, um, this slide,
I'm showing you that I have this box, which I'm going to call my jump box. So 10.10.10,
or you'll also hear this called a bounce node and I'll probably go back and forth,
but I happen to know that this is sitting on a, like a security boundary here. And there
are other systems back in here that I'd like to get access to. I can use SSH to forward ports
from my system through that system. Uh, look at a, look a little bit like this. So I'll have
port 8080 on my local system. We'll jump through that 10.10.10.10 system and then point at one of
the systems on the other side. All of that will go over the SSH tunnel. So that traffic is encrypted
from, uh, my laptop here to this system. And then it comes out of here and we'll wind up over on
looking at the system. Uh, what that looks like on the command line is you use the minus capital L
for local forward. Um, and you want to tell it the port on your system that you want to listen on
the host that you want that connection to go to on the far side
and the host port on the far side that you would like to go to.
Okay. So in practice, what this looks like is SSH minus capital L. I want to listen on my host
on port 8080 on my laptop. I want that traffic when I go to port 8080 to go out the other side
to 192.168.1.10 on port 80. So say there's a web server on that system that I'm trying to get
access to. And then I'm logging in as Bob to that, that bounce node, 10.10.10.10, 10.10.10.10.
Different IP addresses. Um, and then interestingly here, I'm going to give it minus N. So that tells
it not to request a shell. And then I'm going to background it. What that does is now I have 8080
listening. I can now go onto my next command. I didn't request a shell on the remote system.
So once again, if there's a defender watching that system and trying to see like run a who
or see who's logged into it, all they'll actually see is that there's an SSH D process. It doesn't
actually spawn a shell or anything. And then if they're really on the ball, they'll look at net
stat and see the network connection. But most of the time they just won't realize that there's
somebody logged in. And then, uh, like I said, that's backgrounded. So on my local system now
I can point curl at local host on port 8080. And so there's a HTTP server there that happens to
be serving a file called secret that I need to get. And I, I get it and it looks like I won.
Uh, that's super fun and all being able to do a local forward, but I don't want to do that one
by one by one through all of these systems on this network. Uh, thankfully SSH was nice enough
to think of the, this, the, the kind developers of open SSH. They implemented this thing called
dynamic port forwarding. So what this does is this lets me open up on my system, a port that will
forward over that SSH tunnel, uh, either SOCKS4 or SOCKS5 proxy. And then I'm essentially using
that SSH server as a proxy server. And I can get to any of the systems behind that network,
as long as whatever I'm using speaks that SSH protocol. So if I point my, if I use this proxy
port, then I can get proxy that through this system and just get to any of the systems that
are behind here in the way this kind of basic network example is laid out.
Uh, and, um, kind of counterintuitively here, it's actually easier to do this than the just
singular local forward. So at least on the SSH side. So, um, all I'm doing here is minus capital
D for dynamic and that does a dynamic forward. I'm telling it port 1080, just common SOCKS port.
Um, and then same thing, Bob at 10.10.10.10. I think I got that right this time. Uh, and
super nice and easy. Once I run that command, I've successfully logged in. I now have a proxy
server. I've turned that SSH system into a proxy server. So what I can do with that is I can point
a web browser at that proxy server. So for instance, here, Firefox, uh, some Firefox,
go preferences, network settings, manual, manual proxy conf here, and then, or click the manual
proxy conf button and then do, um, SOCKS host. And here I've picked SOCKS five, and then I just
tell it my port 1080. Now, anything my browser tries to go to is going to forward over that
SOCKS proxy and come out in that other network. Um, additionally, you can use, I like to use proxy
chains. There's actually a couple of different tools to do this, but proxy chains is the one
that I know how to use. So it's pretty easy for me is, um, you can use proxy chains here and you
just configure it to tell it where the proxy host is. And then, um, you use the command proxy chains
here. I'm just going to drop in a bash and what proxy chains does is it hijacks the, um, the libc
calls to socket, uh, operations, and then forwards them over that, uh, for TCP operations, forwards
them over that SOCKS protocol, speaks the SOCKS protocol, and then forwards the traffic gomer.
So anything in that bash session gets forwarded over that proxy. You can do one-off commands,
but I like to drop in a bash here a lot because you can do curl and a bunch of other, um,
nmap and netcat and all that kind of stuff. You have to use the right options because nmap needs
to be on layer two sometimes, but, um, depending on how you're trying to scan, but for TCP scans,
uh, super useful. Uh, and so you've essentially just used that SSH host to bounce, uh, into that
network that you probably didn't have access to necessarily, but thankfully just to thank,
thankfully you got access to that one SSH host and you got in.
Um, the next way you can port forward is kind of the opposite of the local forward,
which is the remote forward. So say I am sitting on my laptop and I would like a port on that SSH
server to open up and forward that port back to my system. So I'll do this with SSH a lot to get
from a system out to the network and then be able to do all of that same forwarding and tunneling
and stuff just in the opposite way. So say I'm actually on, I'd have to be, I have to be on both
systems in this scenario. So I'm on my laptop and then I also have access to this system in the
network and I'm, say I'm trying to exfil some data or something. I can't get out because they're
blocking the internet, but I have access to this and I have access to my laptop. So what I do is
I SSH and I set up a remote forward from here that says, Hey, listen on two, two, two, two here
and forward that back to me on port 22, which is SSH. Then from this system, I can just use any of
those SSH commands provided I have the SSH command line and I can do stuff like copy files to here,
but it's really forwarding to here. So anyone looking at the network traffic, nothing's actually
going out over the firewall or anything. It's just traffic going to here. And then there's a secure
connection to here from, from the bounce host to my laptop. So nothing actually, unless you're
really on the ball, looks like it's coming from this to my laptop. It's routing through this other
system. So what that looks like here is you use the dash R command for remote. I'm going to tell
it what port to listen on and I'm going to tell it the host port that I want it to, or the host
that I want it to listen on. And then the host port that I want it to forward to. So I say,
listen on 2222, open that up on any. So 0.0.0.0 is the any address. And then forward that traffic
back to me on port 22. I log in as Bob to that 10.10.10.10. I do minus N again, because I don't
want to actually get a shell here. Importantly, to be able to do this, listen on 0.0.0.0,
the SSH server that I'm logging into. So this guy 10.10.10.10 has to have gateway ports enabled,
or else you won't be able to do this by default. Luckily, it's a pretty easy change. You just
update Etsy SSHD config. We'll look at config stuff a little bit later, but you can just change
this. It is no by default, but you just change it to yes. And then you restart SSH. Your connection
stays alive, everything keeps working, and then you can do this. And then from that system that's
inside the network that can't get out, I SSH to the 10.10.10.10 on port 22. So this minus P
tells it to go different than the default port. I log in. I can either log in or I can copy files
or do whatever I want. Important thing to point out is if I'm on a system that I don't control,
oops, if I'm on a system that I don't control and I SSH into my system, I am potentially giving
up credentials or a password or something to my system. So be careful with this. Make sure that
this system, this user that they're logging into is something that they they're not too worried
about and that that user is locked down and that they can get everything or you're kind of letting
them into your system and getting hacked yourself and you do not want to be that person.
So that's cool, but it's a lot to type. Say I want to do this same scenario where I have a tunnel
and I want to log into that. I want to log in through my jump box or my bounce node. I want to
land over here. So I would have to SSH to here, do a port forward to tell it to go over here,
and then SSH to that port forward and go over here. And that's a lot of work and I'm a lazy
hacker. I don't want to do that. Thankfully, the people that implement SSH are not lazy. So they
think of all of these things and have it done ahead of time. SSH has this cool option called
a proxy command. The proxy command is the old way to do this and they've actually since implemented
a new version. But proxy command is still super useful and we'll see another use of this in just
a second. But what you do is you say minus O is option. You say proxy command. I want my proxy
command to be SSHing to that remote system again. And then here percent H and percent P get replaced
with the system that you're trying to log into. So it would be a remote and the port.
Like I said, this is kind of the old way to do it. The SSH developers were nice enough to realize
that this is also a lot to type. So they made this thing called proxy jump, which you can do minus J
and tell it, Bob, this is essentially doing the same thing as this. And then you're just logged
in and like we saw, you now have this set up where you're actually SSHing through this system to here.
Anybody monitoring this boundary for access to this system won't actually see that because you're
actually going through here and to here. You're not going straight to it. So that is a pretty
useful way to get around some kind of common network monitoring and popping through some
boundaries. You can actually do some really cool stuff with this where you set up like different
jump boxes and have them go through different layers and it starts to get pretty fun. You can
do some pretty crazy stuff. So like I said, though, that proxy command is super interesting
and shout out to SubT for kind of prompting me to look at this. Here, I'm actually using a proxy
command to configure my SSH to use an HTTP proxy to get to wherever I'm trying to go.
So I'll say that again. I'm using a proxy command to use an HTTP proxy to get to where I'm trying
to go. So anybody looking at this traffic is going to see a connection to an HTTP proxy and not even
realize that I'm SSHing through that proxy out to the other side. This is super useful when you're
in a network that's very locked down and is only letting certain things through and you have to
use an HTTP proxy to get out. Or if you just want to blend in. Another thing that is very useful
here is so now I have all of these tunnels and this forwarding and all of this cool stuff that
I want to set up but SSH is a TCP protocol. So if anything happens in this connection,
any of the routers or something timeout, something weird happens, that connection will die. Maybe I
want this tunnel to be set up really long-lived and how I accomplish this is with a command
called auto SSH. And what I like to do with this is I will set up auto SSH to log into my laptop
and forward port 2222 on my laptop back to the host. So I apologize the arrow is backwards here.
But it would actually forward from 2222 back to my host on 22 and funnel that traffic. So I connect
here and it goes out here. So there's an auto SSH connection out. It sets up that remote port forward
to come back. And if that connection dies, auto SSH will restart it for me, monitor that process
and restart it for me. That effectively lets me maintain access to this and I don't have to do
anything once it's set up. And what that looks like is you use the auto SSH command. It's just
a tool that you can install. I'm giving it some options here, the server alive interval,
server alive max count. So this will wait 30 seconds and it will max try three times.
And then I'm telling it to remote forward on 2222 to port 22 on my local host. And then I log into
my laptop, aka Hackbox. And then on Hackbox, I can SSH minus P to 2222 and tell it, Bob,
because that's the user that I have at local host. And that's actually going to go through that
tunnel back in through the network. And then I'm just logged into that victim system.
Once again, this is super cool, because like all someone monitoring this network would see
is someone logging into a system remotely. So say you're here, this boundary is monitored,
all you see is an SSH out, you don't actually see me tunneling back in. So it looks like someone
who already is logged into this just logged into something on the internet. And that is what
happened. But then additionally, I'm logging back into that system here. So I actually have shell
access that they might not be wanting me to have. So a bunch of fun stuff you can do with port
forwarding, super useful for kind of crossing those security boundaries and getting into networks that
you're not necessarily supposed to have access to. With auto SSH, you can maintain that access.
And to get creative with it, you can jump around and get to a bunch of different network segments
and really make it confusing. With all the port forwarding, you can make it look like someone's
connecting from a different system as long as you have access to connect all through. So someone
that's trying to trace that back through network logs, or system logs, it's going to have a rough
time because you're essentially using a proxy to get through a bunch of stuff. And you can proxy,
proxy, proxy and jump around and good clean fun to be had by all. So configuration. So what we're
going to talk about here is a bunch of different ways that you can configure SSH to do things that
are kind of unexpected, or just interesting configurations that are useful, kind of in
operations or in the in the process of doing things. First up, I want to point out that we
have these escape sequences. So if I've SSH into a system, and I have an interactive shell,
SSH actually has this kind of hidden shell that you send a special character sequence,
it's like a cheat code almost. And it gives me all of this functionality. So what I did here is
my prompt, I did new line tilde question mark, just in quick succession without anything else
going on. And that's showing me the help for this escape sequence prompt. Probably the most useful,
the ones I use all the time, is the terminate connection. So if something messes up with that
SSH session, and my term, my shell is hung, and I can't get it to work anymore, instead of having to
drop into another prompt and find the SSH process and kill it, you can just do this tilde, new line
tilde dot and it kills the kills the SSH session. Also super useful if your friends let you sit at
a prompt for their SSH and you want to mess with them. Just do that real quick. The other one that
is super useful here is the background, or sorry, the command line. And that's the capital C. So
why is this useful? You already saw you can just do this with the command line, right? You can SSH
minus L and open up the port, or minus R and open up the port and all that kind of stuff.
So this is one of those things that's really useful, but not very often. So the most use I
have out of this is when I have access to SSH on a system, someone's actively trying to defend it,
and they've changed the password on me, or gotten rid of my SSH key that we'll see here in a minute,
or whatever. I can't log back into that prompt, or that SSH session. So I can't log out to port
forward, but I want to port forward through that because I still have access and they haven't
noticed that my actual shell exists. They just noticed that the account was compromised.
So I can still scan the network and do a bunch of stuff from there. I just need to be able to
change some of the port configs and I can't log out and log back in. That is when this is the most
useful. So just like all of the other commands, minus L, minus R, minus D, lets you set up all
of those port forwards. And then it's minus KL to cancel them or kill them.
Once again, super useful, kind of keep it in your back pocket. It's not
really common that I run into this, but when I have needed this, it was invaluable.
So I talked a little bit about authorized key there. So one of the things you can do with SSH is
trying to log in and put your username and your password all the time isn't very much fun. It's
kind of insecure. We'll see a little bit later why that is pretty insecure. So SSH came up with
this concept of an authorized key. So this is just public key cryptography. I generate a public
private key pair. I put the public key on the remote system that I want to log into in a
configuration file and say anyone that has the private key for this public key is allowed to log
in. So this is very, very useful when you run into SSH for a couple of different things.
One is if you can get access to someone's private key, you can log into any of the systems as them
that they log into. Because of that, you actually generally, you're prompted to put a password in
to password protect that private key. So when you try to use it, you have to decrypt the private
key before you can use it. Most of the time or still a lot of the time, sadly, people that are
generating these keys just hit enter twice and then you get an SSH or a private key that is not
protected. And by sadly, I mean awesomely because it's great and you find this all the time.
So where that file is stored is generally there's two places. SSH is either or the SSH stuff is
either in Etsy SSH, which is the global configuration, or here where we're looking
at it in the user's configuration, which is the dot SSH folder in their home directory.
So here specifically, this is in Roots home directory. We've generated a key pair. The
default for the RSA keys is just ID under RSA. And then you'll have ID under RSA.pub.
If you copy that ID under RSA.pub to the dot SSH authorized keys file for any user,
you can log in to that user account without a password.
So this is also super useful in the case where I land on a system and I don't know the user's
password, so I can't change their password. But I'd like to be able to SSH in as them.
I can add this key and then I can SSH into that account as them and have a full PTY shell that
lets me do all of the things you would do with a full PTY shell, edit files, run sudo,
all that kind of stuff. And essentially, this lets you maintain access. I don't need to know
the user's password as long as that file exists. So this is also super useful for
um like hack the box style challenges where you get a web shell or just if you have a web shell
as a user and you want to upgrade to that user level access. If you have the ability to write
to this file, then you just add an SSH key in here and you can log in. SSH by default will
check the permissions of that file and not use it if they aren't correct, but sometimes it is
configured to not do that. So it's always worth checking. Kind of the meta here is it's always
worth looking in the SSH folder because there is a bunch of different stuff and we'll see more of
that here coming up. So next is the known hosts file. So this file is a list of all of the systems
that a user is logged into. For anybody familiar with SSH, when you SSH out to a system the first
time, it'll say, hey, I don't recognize this system. This is the public key. Do you accept
this? When you do that, it saves that into this file called the known hosts. That known hosts
file will have one entry per line and then it has the IP address or the host name and then the
public key information. So this is super useful. If I can see this and I'm the user, say I now
have access to their unencrypted private key and then I also have access to all of the IP addresses
that they're logging into, a pretty easy way to pivot around the network and find other systems
that I have access to. The next file here that is super interesting is the SSH config. So all
that stuff that we've been going over, all of the port forwards, all of the different things
are super great, but typing all of that's horrible and I'm a lazy hacker. And once again, the SSH
developers, they know that, I guess, and they came up with a solution for it. So that's this
SSH config. Like all, most of the other SSH stuff, the default or the kind of system-wide
configuration is an Etsy SSH and then the user configuration is in .ssh in the user's home
directory. That config file looks like this. So here someone has set up a host called bounce.
The username is bob. They're logging into 10.10.10.10. They would like to do a local forward
of port 8080 to 192.168.1.10.80. They're going to do a dynamic forward for 1080 and they're going to
do a remote forward for 8080 on 192.168.1.10.80. On the command line, you can just do ssh bounce
and then all of those configs will get set in the command line. You don't have to do anything at all
anymore. It's just ssh bounce. It'll tab complete if you have bash completion. Super awesome.
When you land on a system, if you have access to this config file, this is another way to find
systems that people are logging into because they'll have a bunch of configs like this
for easy mode accessing the systems that they access. And you can see, okay, so this bob guy
has access to 10.10.10.10 and likes to check out these other systems on these ports. So
something I can try to do. Another fun thing you can do with ssh config is get it to do
stuff that people are not intending. So let's say in this scenario, I know that bob is sshing
from the server that he's on 10.10.10.10 to that system that he has internally.
Every time he does that, I would like to get a shell back to me on 41.41 from his system.
With ssh config, I can do that. So here, I configure it, say I'm on his server for some
reason. I have access to his ssh config. I'm going to go ahead and I like to set this up for all
hosts. By default, you're not permitted to run a local command, but luckily in the config file,
you can just tell it to let you do that. And what I'm going to do here is tell it the local
command is to netcat me a bin bash shell to my IP address on my listener and background and then do
whatever else bob was trying to do. So every time bob logs into a host, it will spin a shell back
to me and I'll get access to his system. So say my shells keep dying or I just want to kind of
maintain access in a super easy way. Another config file that is super awesome is this
run commands file or RC file. This similarly has the Etsy version or the user version,
but what this does is this runs a command when the user's logging in right before it drops them
to a shell. So back to our scenario, say I'm actually on this this far system and now I want
a shell to come back to me every time somebody logs in. So when somebody logs into this system,
it sends me a shell. What that looks like here is I just put this simple netcat listener just
like the other one roughly in this. I say netcat spit a shell back to me on my listener IP address
on port 4141 and then background and go ahead and keep doing whatever it is that people want to do.
So I encourage people to look at the config files. There's a ton more things you can do in there.
These are kind of simplified versions for slides and to demonstrate the purposes.
With the config files and the port forwarding, you can really get yourself into some pretty
scenarios with that jump proxy command or proxy jumper command or config option. And then also
it goes in the config file. With those, you can set up really intricate port forwards and get
through all sorts of different interesting things. And like I was saying before, really kind of run
havoc on networks and for someone trying to trace stuff back. Now let's look at a couple different
ways that I've successfully gotten creds out of SSH. The first one being, say I'm on a system
and I know someone is logging into other systems. I see their SSH config, but I don't have their
private key. They're not even using private keys. I just know they're using passwords.
So I want to be able to get to that system that they're getting to, but I need to get that
somehow. So a thing I like to do is I set, I create a little shell script here that's in their path
before the normal SSH command. So the SSH command by default is in user bin SSH.
Here I'm making a shell script called user local bin SSH that prompts the user for a password again
and then writes that password to a temp file and then just SSHs for them. So what that looks like,
and I'm sure people that are used to SSH, is you SSH out, it asks you for your password,
you typoed it, it just asks you for your password again, you typed it right, you're good to go,
and then eventually you exit. And you can see here that in temp.creds, I've now stolen that
super secret password and I have Bob's password of 192.168.1.10. I'm able to pivot and kind of
be on to the next thing. Additionally, so let's say the other way is true. Someone's SSHing into
a server that I have access to and I want to see what their password is. Here I use the debug tool
called strace which just looks for all of the system calls that happen in the binary. So I find
the SSH process, I attach strace to that SSHD process, and I tell it to just show me the reads
because I know just I know how the SSH daemon works. I know that when you connect into it,
it sends you a prompt and then reads your password from you. So here I'm telling it to just
show me all of the reads. There are a lot of reads, so I've gone ahead and grepped them for
this magic string that happens right before the password just as part of the protocol.
And here you can see I've stolen this password of super secret from someone when they're logging
into the SSH. Another really fun one here is using this paramiko to create your own SSH server.
So this is kind of the most basic example of this that I can show and make it actually fit in a
slide and be useful. But the idea here is say I'm on a server and it's not running SSH but I know
someone is trying to log in. I need to speak enough of the SSH protocol to get them to give
me their password. But I don't necessarily want to let them log in because I don't know what they're
trying to do and I don't want to implement the entirety of all of SSH. So let's kind of run
through this Python code a little bit. What I'm going to do here is for this line here I'm
going to go ahead and grab the TCP socket or create a TCP socket. I'm going to bind on 22.
So this means I have to have access to open those non-ephemeral ports. I'm going to listen for one
connection and then accept for that connection. So once I've got a connection I let myself know
hey someone from this adder has connected to me. Then I'm going to take advantage of paramiko and
they call it transport in the paramiko implementation. With that transport I'm
going to go ahead and add a server with the paramiko RSA key. So I have just a test key.
So like I said before when you SSH out and it says I don't recognize this here's the public
key this is going to be that key that it gives them. This is one chance that they could detect
so if they're trying to SSH in and it's a key that they don't recognize you should just say
no unless you know that there's a key that you should be seeing. But most people just say yes
because they assume it's a server they haven't seen. And then I'm going to go ahead and start
it with my server and tell it to just serve and then accept the connection. So what this looks
like here is this now uses my server they connect in they get the SSH protocol does its negotiation
and says the only thing I can do is password authentication. So they'll get a password
prompt from the client because it knows how to speak enough of the protocol and then they'll
send me the username and password to my SSH server and that the paramiko server will call
this check auth with the username and password that it got. I can say hey cool check it out I
got a username and password and then tell it uh no that's not a valid username and password. So
from the user's point of view they tried to SSH in the SSH failed they don't know why it is they
don't know what this box is anyway it's not supposed to be on the network so kind of ignore
this spawn a connect back shell that's not what's actually happening I'm actually starting an SSH
server here so start my super secret awesome SSH server just with Python it tells me hey I got a
So, that is kind of an intro and some a little bit deeper but not super crazy deep dive into
all of the cool, not all of, but a bunch of the cool things you can do with SSH. You saw that
just by default it gives you remote shell access, lets you do port forwarding, you can download
upload files, it's all encrypted. That port forwarding, you can use that to accomplish
almost any sort of hopping that you need to be able to do around network segmentation. So,
if you can get to port 22 and you have some sort of credential material to log into that port 22,
you can do quite a bit inside a network. You can get access to systems you're not necessarily
supposed to have access to. You can get around network protections that are trying to block you
from doing things. You can mask your traffic in different protocols via proxies. You can make
traffic look like it's coming from different systems via proxies. With all of the configuration
options you saw, you can trick the system into doing things or really trick users into doing
things that you're not expecting. Different ways you can run SSH commands such that it's harder to
trace or see that information on the system. And download, upload, exfill all of the data.
Really, the cool thing about this is you can use all of these SSH options. These are the basic ones.
You can combine all of this to make yourself the craziest network map that you want.
Pivot through all of the different things. SSH is becoming more and more ubiquitous across
environments. It's now coming on Windows 10. You have WSL. It's very, very, very useful.
So, I hope that was helpful. I hope it made you think a time or two about SSH and what you can do
with it and all that kind of stuff. I hope to stay connected with everybody. Randori Attack
is my team's Twitter. We are kind of always hiring someone at somewhere. So, hit up our careers
off of our webpage. And then, if you're into information like this, follow our blog.
Randori TTPs are tips, tricks, and POCs. Check that out for lots of information like this.
And then, lastly, I'm pretty passionate about this. We need to make sure that we're taking
care of ourselves. And popping all these shells is awesome. Maintaining all of this access is
super great. But we also need to make sure that we're taking the time to get away and keeping
ourselves fit. So, hashtag Red Team Fit. Check us out on Twitter. There's a bunch of discords
all over the place. And we've got a bunch of groups and doing all sorts of really awesome stuff.
And that's what I got. Thanks, everybody. Hashtag Red Team Fit.