start	end	text
0	7280	Greyhat SSH shenanigans. This talk is going to be about all of the cool offensively focused
7280	13600	things you can do with SSH. If you are a red teamer or a pen tester and you don't have SSH
13600	18180	in your toolbox already, hopefully you'll see why you should have it in your toolbox and all
18180	27400	the cool fun things you can do with it. And if you're advanced, you've already been using SSH,
27400	34500	hopefully there's a tip or a trick or two that you can pick up here as we go through all of this.
36420	42220	So how is this talk going to go? We're going to start off with the basics,
42220	47360	because you have to start at the beginning. Then we're going to start looking at all of the
47360	53700	interesting things you can do with port forwards, how you can use those to get past firewalls,
53700	60500	hide your traffic, make it look like you're accessing systems from other systems, and a
60500	67640	bunch of cool things. Next we'll look at the configurations, so fun with the configs.
67640	72880	SSH has a bunch of different ways you can modify its behavior and make it do things that users are
72880	77780	probably not intending. Leaks a bunch of information about what users are accessing,
78400	85580	how they're accessing them, where they're accessing them, etc. And then lastly we'll look
85580	92860	at stealing creds. So SSH, as we'll see, has access to credential material, and we would
92860	97240	like to get access to that, and we will show a couple different successful strategies in doing
97240	107340	so. First, who am I? My name is Evan. I'm also Syndrome on Twitter. I am the Director of Offense
107340	116780	at a company called Randori. I've been Redding forever. I'm into CTFs. I do CCEC,
116780	126420	all that kind of stuff. So check me out. Let's get into it. So the basics. Starting off,
126420	133700	what is SSH? So SSH stands for Secure Shell. It is a replacement for the original plaintext
133700	141300	protocols of Telnet and RSH, which were both used to get shell access onto Unix systems
141980	151160	and administer those remotely. SSH can be used to refer to both the daemon and the client. So
151160	156960	you will hear someone say SSH to that box. That means that they use the SSH client to connect
156960	164640	to a server that was running the SSH daemon and logged into it that way, got a prompt,
164640	170840	and did whatever. The most common versions of SSH that you're going to run into are OpenSSH.
173580	179860	OpenSSH runs on pretty much everything now, and there are a few other ones that we'll go over,
179860	186080	server and client, coming up. Like I said, it's used to remotely administer systems.
186080	190160	You can upload and download files. You can run commands on the shell,
190160	197000	etc. And then SSH also provides encrypted channels, which are little tunnels that you
197000	201860	can make in the SSH session that will let you do port forwarding that we'll see here in a minute,
201860	211980	X11 forwarding, and get your shell. So why is SSH useful for an attacker?
212960	217980	Really, SSH can be thought of as a Swiss army knife for red teams.
218620	224140	This lets me accomplish anything I need to do with a system if I can get SSH access. So I can
225120	230700	download files. I can upload files. I can run commands. I can maintain access to a system.
231220	236160	I can configure the system such that it does things differently than the user is expecting.
237280	241300	I can get credentials out of it. All of the things that I need to be able to do
241300	245780	to get systems and get into systems and pivot around inside a network.
245780	248600	And it's all encrypted by default for me.
255940	260840	So the common SSH clients and tools that you'll run into.
261260	267700	Like I said, on most Unixes, the common SSH implementation is OpenSSH.
268720	275500	On embedded systems, sometimes you'll run into DropBear, which is just a very small
275500	280620	implementation of SSH. And just the difference here is some of the functionality that we go
280620	287840	over here might not work in DropBear or some of the other SSH servers. There's actually just
287840	292560	SSH.com has an SSH server and there's a few different ones, but most of the time you're
292560	298960	run into SSH and most of the stock is geared towards that. On Windows, you can obviously
298960	305680	drop into WSL, WSL2, and then you're just at a Linux prompt. So you'll have the SSH client.
306160	312740	There's a GUI that's called Putty, which is from way back when. And then there's Plink,
312740	318820	which is the CLI implementation that uses the same SSH stuff under the hood that Putty's using.
318820	327440	And then additionally on Windows 10, after 1809, OpenSSH is available in the Windows app store.
327440	333880	So you can get the SSH server and the SSH client. And then lastly, another tool that's super common
333880	339040	that we're going to take a look at a little bit here is Paramiko, which is a Python library
339040	343940	that implements the entire protocol, the entire SSH protocol, both client and server
344960	351680	in Python. Super useful for being able to write scripts to do either like log into systems for
351680	361100	you and do stuff, or as we'll see later, make a server. Another reason SSH is super useful here,
361100	368960	it's really simple to enumerate. So by default, SSH is port 22. That's the port that it has
368960	374920	registered. You can move it to different ports, but all of the servers, if they're installed,
374920	381660	just by like with the app or whatever, it's SSH. Here you can just use netcat and just
381660	388480	grab the banner. Really simple banner up front. It tells you that it's SSH 2.0 is the protocol
388480	395060	of SSH that it's speaking. The version is, you can see this is an OpenSSH server, 8.3.1,
395060	403220	and then it's running on a Debian system. So just with netcat, I can tell what version of SSH is
403220	410040	installed, or what version of SSH protocol the SSH daemon speaks, what version of SSH is installed,
410040	418000	and the operating system. There's even more stuff that you can figure out. So with Nmap or a bunch
418000	423280	of other, there's a bunch of other tools that can do this, but lots of people know how to use Nmap.
423280	428240	When you run the discovery scripts, it will do that banner grab for you, and it will also
428240	435940	enumerate all the algorithms that the SSH is using. So SSH is a pretty old protocol. You'll
435940	442660	run into systems that have older, more insecure algorithms and potentially vulnerable SSH versions.
442660	446960	So there are some versions of SSH that are vulnerable to user enumeration and command
446960	454080	injection and all sorts of stuff. So that it is so easy to enumerate is pretty nice.
457340	462680	So continuing on with the basics here, just running a command on the remote system. There's
463440	468740	two strategies here, essentially. The first is I'm going to connect to the remote system
468740	477180	and request a interactive shell. So the first command is just SSH. That's going to launch the
477180	485400	command line, bob at, and then the IP address is 10.10.10.10. So that's saying login to 10.10.10.10
485400	492520	as the user bob. I cut out some stuff here. It'll prompt you for a password. And then you can just
492520	497440	run commands interactively like you're sitting at a console on that system. So here you can see you
497440	502600	can run the command, who am I? And you see that you're bob. The other way you do this is to run
502760	512020	a single command at a time. So I say SSH bob at 10.10.10.10. Who am I? It says bob. This is super
512020	518320	useful if the system is being actively defended. So say one of the blue team or someone is actually
518320	523620	on the system watching for connections and seeing who's logged in. They'd have to catch that and
523620	528560	run that command while the who am I command is running or whatever command you want to run. This
528560	534940	is just an example. But they'd have to actually see that to see that you're logged in. This will
534940	539020	still show up in last and in all of the logs and everything, but if someone's just sitting there
539020	544040	trying to see if someone's actually logged in and watching for SSH processes to start, this will let
544040	549280	you have a little race where you can run your command hopefully before they actually catch you
549280	552340	doing whatever the thing is that you want to do.
555800	562500	Like I said earlier, you can use SSH to copy files. So I can copy a file from my system to
562500	568180	the remote system, or I can copy a file from the remote system to my system. There's two ways to
568180	577240	actually do this. The first one that I've laid out here is SCP, so secure copy. And in the first
577880	583660	example here, I'm going to upload a file from my computer to the remote system. So what that
583660	589340	looks like is I do SCP, the file that I want to copy up, and then I'm just like before we saw,
589340	595260	I'm going to do the username at that system, and then I'm going to give it the path that I want to
595260	601360	copy it to. So here I want to say in the user's home directory in the bin folder, name my file
601360	605400	not malware. So I'm going to copy my malware up there and hopefully they won't catch it because
605400	609860	I called it not malware. And that is super secret and they will totally never be able to figure that
609860	617300	out. Next, say I want to download a file from their remote system. So I've been looking around
617300	624380	and I see that there is this Etsy secret sauce that I'd like to get from my local system. Just
624380	628860	like before, it's source and destination, but I want the source now to be the file on the remote
628860	636460	system, and then the destination to be the file on my system. So SCP, Bob, at the remote system,
636460	643180	the path that the file is at. So here it's Etsy secret sauce. And then finally my loot folder.
643220	649020	So every good hacker kid should have a loot folder and I'm going to copy that secret sauce
649020	656960	into that folder. Additionally with SCP, I can recursively copy. So say I just want to grab
656960	661020	everything in that secret folder. I don't know what it is. I'll look at it later. I'm going to
661020	671300	go ahead and use the minus R for recursive flag here to SCP. So SCP minus R, Bob at 10.10.10.10,
671300	674760	the Etsy secret folder down into my loot folder.
677040	683320	The next way you can copy files is with the SFTP command. So this is secure FTP.
683320	689380	Uh, this is actually a completely different implemented or different, um, part of the
689380	695220	protocol to copy those files. So SCP and SFTP, while they accomplish the same thing are actually
695220	698900	doing different stuff under the hood, but functionally it's the same. And if you're
698900	707660	familiar with FTP, hopefully this makes sense. You SFTP as Bob to 10.10.10.10. And then the
707660	712780	first command I want to download a file. So I get that file. I say, get from slash secret sauce
712780	719620	to my loot folder, secret sauce. Um, and then next example, I want to upload a, upload a file.
719620	727020	So SFTP Bob at 10.10.10.10. I'm going to put from my artifacts folder, the malware,
727020	732060	and I'm just going to put it into not malware. Uh, once again, super secret,
732060	735540	no one will ever catch that. Totally not malware. Don't look at it. It's fine.
735540	744780	Uh, and similar to SCP SFTP has a recursive option for the get command. So get minus R
744780	749240	slash temp secret from the remote side. So say that's a folder. And then I'm just going to
749240	755320	download it into my temp folder until I can figure out what to do with it. Uh, and you can see, uh,
755320	763180	what happened there. So, uh, kind of the basics there as SSH lets you, uh, log into a remote
763180	769760	system, get a shell on that system. If you want, you can, uh, run commands singularly. So you don't
769760	774900	even have an interactive session. So it's a lot harder to find. You can copy files down. You can
774900	780440	copy or you can download files. You can upload files. Um, even that just alone is super useful
780440	787040	to an attacker just in and of itself, but let's go ahead and move on forward to, uh, fun with
787040	792320	port forwards and we'll see kind of the more advanced stuff you can do and how you can use
792320	799440	this, uh, SSH in your tool belt to get around, uh, common firewall setups and that kind of,
799440	805980	kind of thing. Uh, so first here, we're going to do look at local forwarding.
807260	815540	So in this scenario, I have access to the 10.10.10.10 system. Hopefully that was enough 10s.
816100	822840	And I happen to know that that is sitting on a boundary. So here in this, um, this slide,
822840	827780	I'm showing you that I have this box, which I'm going to call my jump box. So 10.10.10,
828480	832220	or you'll also hear this called a bounce node and I'll probably go back and forth,
832220	836460	but I happen to know that this is sitting on a, like a security boundary here. And there
836460	844560	are other systems back in here that I'd like to get access to. I can use SSH to forward ports
844560	851480	from my system through that system. Uh, look at a, look a little bit like this. So I'll have
854020	861640	port 8080 on my local system. We'll jump through that 10.10.10.10 system and then point at one of
861640	868720	the systems on the other side. All of that will go over the SSH tunnel. So that traffic is encrypted
868720	876540	from, uh, my laptop here to this system. And then it comes out of here and we'll wind up over on
876540	883640	looking at the system. Uh, what that looks like on the command line is you use the minus capital L
884380	890660	for local forward. Um, and you want to tell it the port on your system that you want to listen on
891380	894800	the host that you want that connection to go to on the far side
894800	897920	and the host port on the far side that you would like to go to.
898720	905280	Okay. So in practice, what this looks like is SSH minus capital L. I want to listen on my host
905280	912300	on port 8080 on my laptop. I want that traffic when I go to port 8080 to go out the other side
912300	918340	to 192.168.1.10 on port 80. So say there's a web server on that system that I'm trying to get
918340	927460	access to. And then I'm logging in as Bob to that, that bounce node, 10.10.10.10, 10.10.10.10.
927460	933580	Different IP addresses. Um, and then interestingly here, I'm going to give it minus N. So that tells
933580	939500	it not to request a shell. And then I'm going to background it. What that does is now I have 8080
939500	944860	listening. I can now go onto my next command. I didn't request a shell on the remote system.
944860	949660	So once again, if there's a defender watching that system and trying to see like run a who
950140	955640	or see who's logged into it, all they'll actually see is that there's an SSH D process. It doesn't
955640	960080	actually spawn a shell or anything. And then if they're really on the ball, they'll look at net
960080	963900	stat and see the network connection. But most of the time they just won't realize that there's
963900	969440	somebody logged in. And then, uh, like I said, that's backgrounded. So on my local system now
969440	975960	I can point curl at local host on port 8080. And so there's a HTTP server there that happens to
975960	982020	be serving a file called secret that I need to get. And I, I get it and it looks like I won.
984920	991280	Uh, that's super fun and all being able to do a local forward, but I don't want to do that one
991280	996880	by one by one through all of these systems on this network. Uh, thankfully SSH was nice enough
996880	1003760	to think of the, this, the, the kind developers of open SSH. They implemented this thing called
1003760	1011100	dynamic port forwarding. So what this does is this lets me open up on my system, a port that will
1011100	1019360	forward over that SSH tunnel, uh, either SOCKS4 or SOCKS5 proxy. And then I'm essentially using
1019360	1024920	that SSH server as a proxy server. And I can get to any of the systems behind that network,
1024920	1032660	as long as whatever I'm using speaks that SSH protocol. So if I point my, if I use this proxy
1032660	1038960	port, then I can get proxy that through this system and just get to any of the systems that
1038960	1043440	are behind here in the way this kind of basic network example is laid out.
1044640	1051220	Uh, and, um, kind of counterintuitively here, it's actually easier to do this than the just
1051220	1057580	singular local forward. So at least on the SSH side. So, um, all I'm doing here is minus capital
1057580	1064780	D for dynamic and that does a dynamic forward. I'm telling it port 1080, just common SOCKS port.
1064780	1073160	Um, and then same thing, Bob at 10.10.10.10. I think I got that right this time. Uh, and
1073160	1079780	super nice and easy. Once I run that command, I've successfully logged in. I now have a proxy
1079780	1086660	server. I've turned that SSH system into a proxy server. So what I can do with that is I can point
1086900	1091980	a web browser at that proxy server. So for instance, here, Firefox, uh, some Firefox,
1091980	1098300	go preferences, network settings, manual, manual proxy conf here, and then, or click the manual
1098300	1104900	proxy conf button and then do, um, SOCKS host. And here I've picked SOCKS five, and then I just
1104900	1109620	tell it my port 1080. Now, anything my browser tries to go to is going to forward over that
1109620	1116740	SOCKS proxy and come out in that other network. Um, additionally, you can use, I like to use proxy
1116740	1120780	chains. There's actually a couple of different tools to do this, but proxy chains is the one
1120780	1126980	that I know how to use. So it's pretty easy for me is, um, you can use proxy chains here and you
1126980	1133920	just configure it to tell it where the proxy host is. And then, um, you use the command proxy chains
1133920	1141880	here. I'm just going to drop in a bash and what proxy chains does is it hijacks the, um, the libc
1141880	1149280	calls to socket, uh, operations, and then forwards them over that, uh, for TCP operations, forwards
1149280	1153280	them over that SOCKS protocol, speaks the SOCKS protocol, and then forwards the traffic gomer.
1153340	1159140	So anything in that bash session gets forwarded over that proxy. You can do one-off commands,
1159140	1164040	but I like to drop in a bash here a lot because you can do curl and a bunch of other, um,
1164040	1169100	nmap and netcat and all that kind of stuff. You have to use the right options because nmap needs
1169100	1174880	to be on layer two sometimes, but, um, depending on how you're trying to scan, but for TCP scans,
1174880	1183480	uh, super useful. Uh, and so you've essentially just used that SSH host to bounce, uh, into that
1183480	1189120	network that you probably didn't have access to necessarily, but thankfully just to thank,
1189520	1192640	thankfully you got access to that one SSH host and you got in.
1194800	1199940	Um, the next way you can port forward is kind of the opposite of the local forward,
1199940	1206980	which is the remote forward. So say I am sitting on my laptop and I would like a port on that SSH
1206980	1216220	server to open up and forward that port back to my system. So I'll do this with SSH a lot to get
1216220	1221940	from a system out to the network and then be able to do all of that same forwarding and tunneling
1221940	1228940	and stuff just in the opposite way. So say I'm actually on, I'd have to be, I have to be on both
1228940	1234560	systems in this scenario. So I'm on my laptop and then I also have access to this system in the
1234560	1238920	network and I'm, say I'm trying to exfil some data or something. I can't get out because they're
1238920	1244460	blocking the internet, but I have access to this and I have access to my laptop. So what I do is
1244460	1250200	I SSH and I set up a remote forward from here that says, Hey, listen on two, two, two, two here
1250200	1260040	and forward that back to me on port 22, which is SSH. Then from this system, I can just use any of
1260040	1266500	those SSH commands provided I have the SSH command line and I can do stuff like copy files to here,
1266500	1271880	but it's really forwarding to here. So anyone looking at the network traffic, nothing's actually
1271880	1277680	going out over the firewall or anything. It's just traffic going to here. And then there's a secure
1278360	1286560	connection to here from, from the bounce host to my laptop. So nothing actually, unless you're
1286560	1290840	really on the ball, looks like it's coming from this to my laptop. It's routing through this other
1290840	1300640	system. So what that looks like here is you use the dash R command for remote. I'm going to tell
1300640	1306460	it what port to listen on and I'm going to tell it the host port that I want it to, or the host
1306460	1313480	that I want it to listen on. And then the host port that I want it to forward to. So I say,
1313480	1321700	listen on 2222, open that up on any. So 0.0.0.0 is the any address. And then forward that traffic
1321700	1329000	back to me on port 22. I log in as Bob to that 10.10.10.10. I do minus N again, because I don't
1329000	1335880	want to actually get a shell here. Importantly, to be able to do this, listen on 0.0.0.0,
1335880	1344460	the SSH server that I'm logging into. So this guy 10.10.10.10 has to have gateway ports enabled,
1344460	1349120	or else you won't be able to do this by default. Luckily, it's a pretty easy change. You just
1349120	1355480	update Etsy SSHD config. We'll look at config stuff a little bit later, but you can just change
1355480	1360860	this. It is no by default, but you just change it to yes. And then you restart SSH. Your connection
1360860	1367740	stays alive, everything keeps working, and then you can do this. And then from that system that's
1367740	1375100	inside the network that can't get out, I SSH to the 10.10.10.10 on port 22. So this minus P
1375100	1381640	tells it to go different than the default port. I log in. I can either log in or I can copy files
1381640	1388420	or do whatever I want. Important thing to point out is if I'm on a system that I don't control,
1388420	1396240	oops, if I'm on a system that I don't control and I SSH into my system, I am potentially giving
1396240	1402700	up credentials or a password or something to my system. So be careful with this. Make sure that
1402700	1407180	this system, this user that they're logging into is something that they they're not too worried
1407180	1411060	about and that that user is locked down and that they can get everything or you're kind of letting
1411060	1416240	them into your system and getting hacked yourself and you do not want to be that person.
1419460	1425800	So that's cool, but it's a lot to type. Say I want to do this same scenario where I have a tunnel
1425800	1432120	and I want to log into that. I want to log in through my jump box or my bounce node. I want to
1432120	1438380	land over here. So I would have to SSH to here, do a port forward to tell it to go over here,
1438380	1443120	and then SSH to that port forward and go over here. And that's a lot of work and I'm a lazy
1443120	1449020	hacker. I don't want to do that. Thankfully, the people that implement SSH are not lazy. So they
1449020	1455160	think of all of these things and have it done ahead of time. SSH has this cool option called
1455400	1461020	a proxy command. The proxy command is the old way to do this and they've actually since implemented
1461240	1465460	a new version. But proxy command is still super useful and we'll see another use of this in just
1465600	1471580	a second. But what you do is you say minus O is option. You say proxy command. I want my proxy
1471580	1478060	command to be SSHing to that remote system again. And then here percent H and percent P get replaced
1478060	1482260	with the system that you're trying to log into. So it would be a remote and the port.
1486460	1491340	Like I said, this is kind of the old way to do it. The SSH developers were nice enough to realize
1491340	1497340	that this is also a lot to type. So they made this thing called proxy jump, which you can do minus J
1498380	1504160	and tell it, Bob, this is essentially doing the same thing as this. And then you're just logged
1504160	1512040	in and like we saw, you now have this set up where you're actually SSHing through this system to here.
1512040	1519720	Anybody monitoring this boundary for access to this system won't actually see that because you're
1519720	1525000	actually going through here and to here. You're not going straight to it. So that is a pretty
1525000	1530780	useful way to get around some kind of common network monitoring and popping through some
1530780	1536020	boundaries. You can actually do some really cool stuff with this where you set up like different
1536020	1543180	jump boxes and have them go through different layers and it starts to get pretty fun. You can
1543180	1548520	do some pretty crazy stuff. So like I said, though, that proxy command is super interesting
1548520	1554900	and shout out to SubT for kind of prompting me to look at this. Here, I'm actually using a proxy
1554900	1565080	command to configure my SSH to use an HTTP proxy to get to wherever I'm trying to go.
1567280	1573760	So I'll say that again. I'm using a proxy command to use an HTTP proxy to get to where I'm trying
1573760	1580880	to go. So anybody looking at this traffic is going to see a connection to an HTTP proxy and not even
1580880	1586720	realize that I'm SSHing through that proxy out to the other side. This is super useful when you're
1586720	1592200	in a network that's very locked down and is only letting certain things through and you have to
1592200	1605760	use an HTTP proxy to get out. Or if you just want to blend in. Another thing that is very useful
1605760	1609900	here is so now I have all of these tunnels and this forwarding and all of this cool stuff that
1609900	1614960	I want to set up but SSH is a TCP protocol. So if anything happens in this connection,
1614960	1620660	any of the routers or something timeout, something weird happens, that connection will die. Maybe I
1620660	1625920	want this tunnel to be set up really long-lived and how I accomplish this is with a command
1625920	1632940	called auto SSH. And what I like to do with this is I will set up auto SSH to log into my laptop
1632940	1642960	and forward port 2222 on my laptop back to the host. So I apologize the arrow is backwards here.
1642960	1650920	But it would actually forward from 2222 back to my host on 22 and funnel that traffic. So I connect
1650920	1658800	here and it goes out here. So there's an auto SSH connection out. It sets up that remote port forward
1658800	1664740	to come back. And if that connection dies, auto SSH will restart it for me, monitor that process
1664740	1669420	and restart it for me. That effectively lets me maintain access to this and I don't have to do
1669420	1678280	anything once it's set up. And what that looks like is you use the auto SSH command. It's just
1678440	1684020	a tool that you can install. I'm giving it some options here, the server alive interval,
1684020	1689780	server alive max count. So this will wait 30 seconds and it will max try three times.
1689960	1697800	And then I'm telling it to remote forward on 2222 to port 22 on my local host. And then I log into
1697800	1707080	my laptop, aka Hackbox. And then on Hackbox, I can SSH minus P to 2222 and tell it, Bob,
1707080	1710840	because that's the user that I have at local host. And that's actually going to go through that
1710840	1715260	tunnel back in through the network. And then I'm just logged into that victim system.
1716360	1722200	Once again, this is super cool, because like all someone monitoring this network would see
1722200	1729560	is someone logging into a system remotely. So say you're here, this boundary is monitored,
1729560	1735880	all you see is an SSH out, you don't actually see me tunneling back in. So it looks like someone
1735880	1741240	who already is logged into this just logged into something on the internet. And that is what
1741240	1746020	happened. But then additionally, I'm logging back into that system here. So I actually have shell
1746020	1756240	access that they might not be wanting me to have. So a bunch of fun stuff you can do with port
1756240	1762500	forwarding, super useful for kind of crossing those security boundaries and getting into networks that
1762500	1769600	you're not necessarily supposed to have access to. With auto SSH, you can maintain that access.
1770200	1774660	And to get creative with it, you can jump around and get to a bunch of different network segments
1774660	1779720	and really make it confusing. With all the port forwarding, you can make it look like someone's
1779720	1783900	connecting from a different system as long as you have access to connect all through. So someone
1783900	1788980	that's trying to trace that back through network logs, or system logs, it's going to have a rough
1788980	1793840	time because you're essentially using a proxy to get through a bunch of stuff. And you can proxy,
1793840	1804620	proxy, proxy and jump around and good clean fun to be had by all. So configuration. So what we're
1804620	1809900	going to talk about here is a bunch of different ways that you can configure SSH to do things that
1809900	1814680	are kind of unexpected, or just interesting configurations that are useful, kind of in
1814680	1821140	operations or in the in the process of doing things. First up, I want to point out that we
1821140	1828140	have these escape sequences. So if I've SSH into a system, and I have an interactive shell,
1828140	1835020	SSH actually has this kind of hidden shell that you send a special character sequence,
1835020	1840080	it's like a cheat code almost. And it gives me all of this functionality. So what I did here is
1840080	1844840	my prompt, I did new line tilde question mark, just in quick succession without anything else
1844840	1853040	going on. And that's showing me the help for this escape sequence prompt. Probably the most useful,
1853040	1858800	the ones I use all the time, is the terminate connection. So if something messes up with that
1858800	1864320	SSH session, and my term, my shell is hung, and I can't get it to work anymore, instead of having to
1864320	1869460	drop into another prompt and find the SSH process and kill it, you can just do this tilde, new line
1869460	1875900	tilde dot and it kills the kills the SSH session. Also super useful if your friends let you sit at
1876020	1885260	a prompt for their SSH and you want to mess with them. Just do that real quick. The other one that
1885260	1897860	is super useful here is the background, or sorry, the command line. And that's the capital C. So
1898460	1903480	why is this useful? You already saw you can just do this with the command line, right? You can SSH
1903480	1908960	minus L and open up the port, or minus R and open up the port and all that kind of stuff.
1910100	1918320	So this is one of those things that's really useful, but not very often. So the most use I
1918320	1924180	have out of this is when I have access to SSH on a system, someone's actively trying to defend it,
1924180	1929960	and they've changed the password on me, or gotten rid of my SSH key that we'll see here in a minute,
1930400	1937300	or whatever. I can't log back into that prompt, or that SSH session. So I can't log out to port
1937300	1940880	forward, but I want to port forward through that because I still have access and they haven't
1940880	1945420	noticed that my actual shell exists. They just noticed that the account was compromised.
1945520	1950200	So I can still scan the network and do a bunch of stuff from there. I just need to be able to
1950200	1956320	change some of the port configs and I can't log out and log back in. That is when this is the most
1956320	1965540	useful. So just like all of the other commands, minus L, minus R, minus D, lets you set up all
1965540	1972780	of those port forwards. And then it's minus KL to cancel them or kill them.
1974900	1979060	Once again, super useful, kind of keep it in your back pocket. It's not
1980160	1985240	really common that I run into this, but when I have needed this, it was invaluable.
1987000	1993860	So I talked a little bit about authorized key there. So one of the things you can do with SSH is
1995680	2000800	trying to log in and put your username and your password all the time isn't very much fun. It's
2000800	2006700	kind of insecure. We'll see a little bit later why that is pretty insecure. So SSH came up with
2006700	2016240	this concept of an authorized key. So this is just public key cryptography. I generate a public
2016240	2021640	private key pair. I put the public key on the remote system that I want to log into in a
2021640	2026000	configuration file and say anyone that has the private key for this public key is allowed to log
2026000	2032760	in. So this is very, very useful when you run into SSH for a couple of different things.
2033120	2040320	One is if you can get access to someone's private key, you can log into any of the systems as them
2040320	2047760	that they log into. Because of that, you actually generally, you're prompted to put a password in
2047760	2053040	to password protect that private key. So when you try to use it, you have to decrypt the private
2053040	2060240	key before you can use it. Most of the time or still a lot of the time, sadly, people that are
2060240	2066060	generating these keys just hit enter twice and then you get an SSH or a private key that is not
2066060	2071820	protected. And by sadly, I mean awesomely because it's great and you find this all the time.
2073800	2081700	So where that file is stored is generally there's two places. SSH is either or the SSH stuff is
2081700	2087100	either in Etsy SSH, which is the global configuration, or here where we're looking
2087100	2091870	at it in the user's configuration, which is the dot SSH folder in their home directory.
2092840	2099500	So here specifically, this is in Roots home directory. We've generated a key pair. The
2099820	2106120	default for the RSA keys is just ID under RSA. And then you'll have ID under RSA.pub.
2106120	2115580	If you copy that ID under RSA.pub to the dot SSH authorized keys file for any user,
2117340	2121580	you can log in to that user account without a password.
2122660	2129160	So this is also super useful in the case where I land on a system and I don't know the user's
2129160	2135140	password, so I can't change their password. But I'd like to be able to SSH in as them.
2135140	2142620	I can add this key and then I can SSH into that account as them and have a full PTY shell that
2142620	2146720	lets me do all of the things you would do with a full PTY shell, edit files, run sudo,
2146720	2153080	all that kind of stuff. And essentially, this lets you maintain access. I don't need to know
2153080	2158980	the user's password as long as that file exists. So this is also super useful for
2159420	2166520	um like hack the box style challenges where you get a web shell or just if you have a web shell
2166520	2173820	as a user and you want to upgrade to that user level access. If you have the ability to write
2173820	2180160	to this file, then you just add an SSH key in here and you can log in. SSH by default will
2180720	2187240	check the permissions of that file and not use it if they aren't correct, but sometimes it is
2187240	2193280	configured to not do that. So it's always worth checking. Kind of the meta here is it's always
2193280	2198440	worth looking in the SSH folder because there is a bunch of different stuff and we'll see more of
2198440	2206540	that here coming up. So next is the known hosts file. So this file is a list of all of the systems
2206540	2212860	that a user is logged into. For anybody familiar with SSH, when you SSH out to a system the first
2212860	2217660	time, it'll say, hey, I don't recognize this system. This is the public key. Do you accept
2217660	2224700	this? When you do that, it saves that into this file called the known hosts. That known hosts
2224700	2230160	file will have one entry per line and then it has the IP address or the host name and then the
2230160	2236500	public key information. So this is super useful. If I can see this and I'm the user, say I now
2236500	2242460	have access to their unencrypted private key and then I also have access to all of the IP addresses
2242460	2247940	that they're logging into, a pretty easy way to pivot around the network and find other systems
2247940	2259620	that I have access to. The next file here that is super interesting is the SSH config. So all
2259620	2263920	that stuff that we've been going over, all of the port forwards, all of the different things
2263920	2270580	are super great, but typing all of that's horrible and I'm a lazy hacker. And once again, the SSH
2270580	2276220	developers, they know that, I guess, and they came up with a solution for it. So that's this
2276220	2284020	SSH config. Like all, most of the other SSH stuff, the default or the kind of system-wide
2284020	2289580	configuration is an Etsy SSH and then the user configuration is in .ssh in the user's home
2289580	2298520	directory. That config file looks like this. So here someone has set up a host called bounce.
2298520	2304340	The username is bob. They're logging into 10.10.10.10. They would like to do a local forward
2304340	2312680	of port 8080 to 192.168.1.10.80. They're going to do a dynamic forward for 1080 and they're going to
2312680	2321760	do a remote forward for 8080 on 192.168.1.10.80. On the command line, you can just do ssh bounce
2321760	2327300	and then all of those configs will get set in the command line. You don't have to do anything at all
2327300	2332500	anymore. It's just ssh bounce. It'll tab complete if you have bash completion. Super awesome.
2334280	2338840	When you land on a system, if you have access to this config file, this is another way to find
2338840	2342220	systems that people are logging into because they'll have a bunch of configs like this
2342220	2348820	for easy mode accessing the systems that they access. And you can see, okay, so this bob guy
2348820	2354120	has access to 10.10.10.10 and likes to check out these other systems on these ports. So
2354120	2361460	something I can try to do. Another fun thing you can do with ssh config is get it to do
2361460	2369660	stuff that people are not intending. So let's say in this scenario, I know that bob is sshing
2369660	2375080	from the server that he's on 10.10.10.10 to that system that he has internally.
2375680	2383120	Every time he does that, I would like to get a shell back to me on 41.41 from his system.
2385520	2391960	With ssh config, I can do that. So here, I configure it, say I'm on his server for some
2391960	2397020	reason. I have access to his ssh config. I'm going to go ahead and I like to set this up for all
2397020	2404280	hosts. By default, you're not permitted to run a local command, but luckily in the config file,
2404280	2409660	you can just tell it to let you do that. And what I'm going to do here is tell it the local
2409660	2417920	command is to netcat me a bin bash shell to my IP address on my listener and background and then do
2417920	2425340	whatever else bob was trying to do. So every time bob logs into a host, it will spin a shell back
2425340	2432560	to me and I'll get access to his system. So say my shells keep dying or I just want to kind of
2432560	2441660	maintain access in a super easy way. Another config file that is super awesome is this
2441660	2449660	run commands file or RC file. This similarly has the Etsy version or the user version,
2449660	2455300	but what this does is this runs a command when the user's logging in right before it drops them
2455300	2463460	to a shell. So back to our scenario, say I'm actually on this this far system and now I want
2463580	2469440	a shell to come back to me every time somebody logs in. So when somebody logs into this system,
2469440	2477580	it sends me a shell. What that looks like here is I just put this simple netcat listener just
2477580	2483200	like the other one roughly in this. I say netcat spit a shell back to me on my listener IP address
2483200	2490320	on port 4141 and then background and go ahead and keep doing whatever it is that people want to do.
2490660	2496620	So I encourage people to look at the config files. There's a ton more things you can do in there.
2496620	2500860	These are kind of simplified versions for slides and to demonstrate the purposes.
2501240	2506420	With the config files and the port forwarding, you can really get yourself into some pretty
2506420	2516940	scenarios with that jump proxy command or proxy jumper command or config option. And then also
2516940	2523420	it goes in the config file. With those, you can set up really intricate port forwards and get
2523420	2527240	through all sorts of different interesting things. And like I was saying before, really kind of run
2527240	2534720	havoc on networks and for someone trying to trace stuff back. Now let's look at a couple different
2534720	2542100	ways that I've successfully gotten creds out of SSH. The first one being, say I'm on a system
2542100	2548260	and I know someone is logging into other systems. I see their SSH config, but I don't have their
2548260	2552060	private key. They're not even using private keys. I just know they're using passwords.
2552300	2556400	So I want to be able to get to that system that they're getting to, but I need to get that
2556400	2563100	somehow. So a thing I like to do is I set, I create a little shell script here that's in their path
2563100	2570400	before the normal SSH command. So the SSH command by default is in user bin SSH.
2570440	2576900	Here I'm making a shell script called user local bin SSH that prompts the user for a password again
2576900	2584800	and then writes that password to a temp file and then just SSHs for them. So what that looks like,
2584800	2590120	and I'm sure people that are used to SSH, is you SSH out, it asks you for your password,
2590120	2594800	you typoed it, it just asks you for your password again, you typed it right, you're good to go,
2594800	2599980	and then eventually you exit. And you can see here that in temp.creds, I've now stolen that
2599980	2606300	super secret password and I have Bob's password of 192.168.1.10. I'm able to pivot and kind of
2606300	2614000	be on to the next thing. Additionally, so let's say the other way is true. Someone's SSHing into
2614140	2621600	a server that I have access to and I want to see what their password is. Here I use the debug tool
2621600	2627340	called strace which just looks for all of the system calls that happen in the binary. So I find
2627340	2636040	the SSH process, I attach strace to that SSHD process, and I tell it to just show me the reads
2636040	2642140	because I know just I know how the SSH daemon works. I know that when you connect into it,
2642140	2647680	it sends you a prompt and then reads your password from you. So here I'm telling it to just
2648220	2652600	show me all of the reads. There are a lot of reads, so I've gone ahead and grepped them for
2652600	2656740	this magic string that happens right before the password just as part of the protocol.
2656740	2661940	And here you can see I've stolen this password of super secret from someone when they're logging
2661940	2674880	into the SSH. Another really fun one here is using this paramiko to create your own SSH server.
2675020	2681100	So this is kind of the most basic example of this that I can show and make it actually fit in a
2681100	2689740	slide and be useful. But the idea here is say I'm on a server and it's not running SSH but I know
2689740	2696800	someone is trying to log in. I need to speak enough of the SSH protocol to get them to give
2696800	2702240	me their password. But I don't necessarily want to let them log in because I don't know what they're
2702240	2708840	trying to do and I don't want to implement the entirety of all of SSH. So let's kind of run
2708840	2714580	through this Python code a little bit. What I'm going to do here is for this line here I'm
2714580	2720880	going to go ahead and grab the TCP socket or create a TCP socket. I'm going to bind on 22.
2720880	2726600	So this means I have to have access to open those non-ephemeral ports. I'm going to listen for one
2726600	2733540	connection and then accept for that connection. So once I've got a connection I let myself know
2733540	2740620	hey someone from this adder has connected to me. Then I'm going to take advantage of paramiko and
2741260	2749820	they call it transport in the paramiko implementation. With that transport I'm
2749820	2758040	going to go ahead and add a server with the paramiko RSA key. So I have just a test key.
2758040	2762540	So like I said before when you SSH out and it says I don't recognize this here's the public
2762540	2767820	key this is going to be that key that it gives them. This is one chance that they could detect
2767820	2772160	so if they're trying to SSH in and it's a key that they don't recognize you should just say
2772160	2778260	no unless you know that there's a key that you should be seeing. But most people just say yes
2778260	2781520	because they assume it's a server they haven't seen. And then I'm going to go ahead and start
2781520	2789060	it with my server and tell it to just serve and then accept the connection. So what this looks
2789060	2795940	like here is this now uses my server they connect in they get the SSH protocol does its negotiation
2795940	2800200	and says the only thing I can do is password authentication. So they'll get a password
2800200	2804440	prompt from the client because it knows how to speak enough of the protocol and then they'll
2804440	2811260	send me the username and password to my SSH server and that the paramiko server will call
2811260	2816720	this check auth with the username and password that it got. I can say hey cool check it out I
2816720	2822520	got a username and password and then tell it uh no that's not a valid username and password. So
2822520	2828100	from the user's point of view they tried to SSH in the SSH failed they don't know why it is they
2828100	2832540	don't know what this box is anyway it's not supposed to be on the network so kind of ignore
2832540	2836460	this spawn a connect back shell that's not what's actually happening I'm actually starting an SSH
2836460	2846180	server here so start my super secret awesome SSH server just with Python it tells me hey I got a
2867100	2874840	So, that is kind of an intro and some a little bit deeper but not super crazy deep dive into
2874840	2882700	all of the cool, not all of, but a bunch of the cool things you can do with SSH. You saw that
2882700	2888380	just by default it gives you remote shell access, lets you do port forwarding, you can download
2888380	2895340	upload files, it's all encrypted. That port forwarding, you can use that to accomplish
2895860	2900620	almost any sort of hopping that you need to be able to do around network segmentation. So,
2900620	2907340	if you can get to port 22 and you have some sort of credential material to log into that port 22,
2907340	2914760	you can do quite a bit inside a network. You can get access to systems you're not necessarily
2914760	2920640	supposed to have access to. You can get around network protections that are trying to block you
2920640	2926820	from doing things. You can mask your traffic in different protocols via proxies. You can make
2926820	2932120	traffic look like it's coming from different systems via proxies. With all of the configuration
2932120	2936640	options you saw, you can trick the system into doing things or really trick users into doing
2936640	2943260	things that you're not expecting. Different ways you can run SSH commands such that it's harder to
2943260	2953660	trace or see that information on the system. And download, upload, exfill all of the data.
2953660	2959980	Really, the cool thing about this is you can use all of these SSH options. These are the basic ones.
2959980	2964340	You can combine all of this to make yourself the craziest network map that you want.
2964340	2970040	Pivot through all of the different things. SSH is becoming more and more ubiquitous across
2970040	2977680	environments. It's now coming on Windows 10. You have WSL. It's very, very, very useful.
2978300	2985840	So, I hope that was helpful. I hope it made you think a time or two about SSH and what you can do
2985840	2991680	with it and all that kind of stuff. I hope to stay connected with everybody. Randori Attack
2991680	2999900	is my team's Twitter. We are kind of always hiring someone at somewhere. So, hit up our careers
3000860	3008820	off of our webpage. And then, if you're into information like this, follow our blog.
3009160	3016400	Randori TTPs are tips, tricks, and POCs. Check that out for lots of information like this.
3017500	3024120	And then, lastly, I'm pretty passionate about this. We need to make sure that we're taking
3024120	3028600	care of ourselves. And popping all these shells is awesome. Maintaining all of this access is
3028600	3034880	super great. But we also need to make sure that we're taking the time to get away and keeping
3034880	3040120	ourselves fit. So, hashtag Red Team Fit. Check us out on Twitter. There's a bunch of discords
3040120	3046060	all over the place. And we've got a bunch of groups and doing all sorts of really awesome stuff.
3046060	3053400	And that's what I got. Thanks, everybody. Hashtag Red Team Fit.