WEBVTT 00:00.000 --> 00:02.600 Greyhat SSH shenanigans. 00:03.300 --> 00:09.020 This talk is going to be about all of the cool offensively focused things you can do with SSH. 00:09.020 --> 00:20.240 If you are a red teamer or a pen tester and you don't have SSH in your toolbox already, hopefully you'll see why you should have it in your toolbox and all the cool fun things you can do with it. 00:22.980 --> 00:34.500 And if you're advanced, you've already been using SSH, hopefully there's a tip or a trick or two that you can pick up here as we go through all of this. 00:36.420 --> 00:39.080 So how is this talk going to go? 00:40.980 --> 00:43.780 We're going to start off with the basics, because you have to start at the beginning. 00:44.400 --> 01:01.540 Then we're going to start looking at all of the interesting things you can do with port forwards, how you can use those to get past firewalls, hide your traffic, make it look like you're accessing systems from other systems, and a bunch of cool things. 01:02.580 --> 01:06.640 Next we'll look at the configurations, so fun with the configs. 01:07.120 --> 01:13.800 SSH has a bunch of different ways you can modify its behavior and make it do things that users are probably not intending. 01:14.460 --> 01:22.980 Leaks a bunch of information about what users are accessing, how they're accessing them, where they're accessing them, etc. 01:23.480 --> 01:27.380 And then lastly we'll look at stealing creds. 01:27.500 --> 01:38.140 So SSH, as we'll see, has access to credential material, and we would like to get access to that, and we will show a couple different successful strategies in doing so. 01:39.360 --> 01:40.920 First, who am I? 01:40.920 --> 01:42.220 My name is Evan. 01:42.220 --> 01:45.020 I'm also Syndrome on Twitter. 01:45.320 --> 01:50.000 I am the Director of Offense at a company called Randori. 01:51.300 --> 01:53.820 I've been Redding forever. 01:53.820 --> 01:55.080 I'm into CTFs. 01:55.080 --> 01:58.360 I do CCEC, all that kind of stuff. 01:58.360 --> 01:59.980 So check me out. 02:01.860 --> 02:03.020 Let's get into it. 02:03.020 --> 02:04.560 So the basics. 02:05.360 --> 02:07.660 Starting off, what is SSH? 02:07.660 --> 02:10.660 So SSH stands for Secure Shell. 02:10.860 --> 02:24.480 It is a replacement for the original plaintext protocols of Telnet and RSH, which were both used to get shell access onto Unix systems and administer those remotely. 02:26.680 --> 02:30.980 SSH can be used to refer to both the daemon and the client. 02:30.980 --> 02:33.960 So you will hear someone say SSH to that box. 02:33.960 --> 02:45.600 That means that they use the SSH client to connect to a server that was running the SSH daemon and logged into it that way, got a prompt, and did whatever. 02:46.340 --> 02:50.840 The most common versions of SSH that you're going to run into are OpenSSH. 02:53.580 --> 03:01.880 OpenSSH runs on pretty much everything now, and there are a few other ones that we'll go over, server and client, coming up. 03:02.920 --> 03:06.080 Like I said, it's used to remotely administer systems. 03:06.080 --> 03:08.000 You can upload and download files. 03:08.000 --> 03:11.720 You can run commands on the shell, etc. 03:11.820 --> 03:26.020 And then SSH also provides encrypted channels, which are little tunnels that you can make in the SSH session that will let you do port forwarding that we'll see here in a minute, X11 forwarding, and get your shell. 03:27.980 --> 03:31.980 So why is SSH useful for an attacker? 03:32.960 --> 03:37.980 Really, SSH can be thought of as a Swiss army knife for red teams. 03:38.620 --> 03:43.640 This lets me accomplish anything I need to do with a system if I can get SSH access. 03:43.640 --> 03:46.140 So I can download files. 03:46.140 --> 03:47.300 I can upload files. 03:47.300 --> 03:48.520 I can run commands. 03:48.520 --> 03:50.700 I can maintain access to a system. 03:51.220 --> 03:56.160 I can configure the system such that it does things differently than the user is expecting. 03:57.280 --> 03:59.280 I can get credentials out of it. 03:59.280 --> 04:05.780 All of the things that I need to be able to do to get systems and get into systems and pivot around inside a network. 04:05.780 --> 04:08.600 And it's all encrypted by default for me. 04:15.940 --> 04:20.840 So the common SSH clients and tools that you'll run into. 04:21.260 --> 04:27.700 Like I said, on most Unixes, the common SSH implementation is OpenSSH. 04:28.720 --> 04:37.480 On embedded systems, sometimes you'll run into DropBear, which is just a very small implementation of SSH. 04:37.480 --> 04:47.280 And just the difference here is some of the functionality that we go over here might not work in DropBear or some of the other SSH servers. 04:47.280 --> 04:56.540 There's actually just SSH.com has an SSH server and there's a few different ones, but most of the time you're run into SSH and most of the stock is geared towards that. 04:56.740 --> 05:03.640 On Windows, you can obviously drop into WSL, WSL2, and then you're just at a Linux prompt. 05:03.640 --> 05:05.680 So you'll have the SSH client. 05:06.160 --> 05:11.540 There's a GUI that's called Putty, which is from way back when. 05:11.540 --> 05:18.820 And then there's Plink, which is the CLI implementation that uses the same SSH stuff under the hood that Putty's using. 05:18.820 --> 05:27.440 And then additionally on Windows 10, after 1809, OpenSSH is available in the Windows app store. 05:27.440 --> 05:30.920 So you can get the SSH server and the SSH client. 05:31.100 --> 05:46.300 And then lastly, another tool that's super common that we're going to take a look at a little bit here is Paramiko, which is a Python library that implements the entire protocol, the entire SSH protocol, both client and server in Python. 05:46.300 --> 05:55.380 Super useful for being able to write scripts to do either like log into systems for you and do stuff, or as we'll see later, make a server. 05:58.640 --> 06:03.220 Another reason SSH is super useful here, it's really simple to enumerate. 06:03.220 --> 06:06.940 So by default, SSH is port 22. 06:07.180 --> 06:09.700 That's the port that it has registered. 06:09.700 --> 06:18.080 You can move it to different ports, but all of the servers, if they're installed, just by like with the app or whatever, it's SSH. 06:18.540 --> 06:23.460 Here you can just use netcat and just grab the banner. 06:23.800 --> 06:25.420 Really simple banner up front. 06:25.420 --> 06:30.320 It tells you that it's SSH 2.0 is the protocol of SSH that it's speaking. 06:30.320 --> 06:38.320 The version is, you can see this is an OpenSSH server, 8.3.1, and then it's running on a Debian system. 06:38.320 --> 06:51.820 So just with netcat, I can tell what version of SSH is installed, or what version of SSH protocol the SSH daemon speaks, what version of SSH is installed, and the operating system. 06:53.060 --> 06:56.020 There's even more stuff that you can figure out. 06:56.020 --> 07:03.280 So with Nmap or a bunch of other, there's a bunch of other tools that can do this, but lots of people know how to use Nmap. 07:03.280 --> 07:12.120 When you run the discovery scripts, it will do that banner grab for you, and it will also enumerate all the algorithms that the SSH is using. 07:12.340 --> 07:15.100 So SSH is a pretty old protocol. 07:15.380 --> 07:22.660 You'll run into systems that have older, more insecure algorithms and potentially vulnerable SSH versions. 07:22.660 --> 07:29.000 So there are some versions of SSH that are vulnerable to user enumeration and command injection and all sorts of stuff. 07:29.000 --> 07:34.080 So that it is so easy to enumerate is pretty nice. 07:37.340 --> 07:42.220 So continuing on with the basics here, just running a command on the remote system. 07:42.220 --> 07:45.980 There's two strategies here, essentially. 07:45.980 --> 07:52.240 The first is I'm going to connect to the remote system and request a interactive shell. 07:52.440 --> 07:56.140 So the first command is just SSH. 07:56.140 --> 08:01.980 That's going to launch the command line, bob at, and then the IP address is 10.10.10.10. 08:01.980 --> 08:06.920 So that's saying login to 10.10.10.10 as the user bob. 08:07.720 --> 08:09.380 I cut out some stuff here. 08:09.380 --> 08:10.480 It'll prompt you for a password. 08:10.700 --> 08:16.480 And then you can just run commands interactively like you're sitting at a console on that system. 08:16.480 --> 08:18.640 So here you can see you can run the command, who am I? 08:18.640 --> 08:19.660 And you see that you're bob. 08:20.720 --> 08:24.080 The other way you do this is to run a single command at a time. 08:24.080 --> 08:27.980 So I say SSH bob at 10.10.10.10. 08:27.980 --> 08:28.940 Who am I? 08:28.940 --> 08:30.360 It says bob. 08:30.980 --> 08:35.320 This is super useful if the system is being actively defended. 08:35.320 --> 08:41.960 So say one of the blue team or someone is actually on the system watching for connections and seeing who's logged in. 08:42.160 --> 08:48.440 They'd have to catch that and run that command while the who am I command is running or whatever command you want to run. 08:48.440 --> 08:49.760 This is just an example. 08:50.180 --> 08:54.000 But they'd have to actually see that to see that you're logged in. 08:54.240 --> 09:12.340 This will still show up in last and in all of the logs and everything, but if someone's just sitting there trying to see if someone's actually logged in and watching for SSH processes to start, this will let you have a little race where you can run your command hopefully before they actually catch you doing whatever the thing is that you want to do. 09:15.800 --> 09:19.640 Like I said earlier, you can use SSH to copy files. 09:19.640 --> 09:27.200 So I can copy a file from my system to the remote system, or I can copy a file from the remote system to my system. 09:27.200 --> 09:29.220 There's two ways to actually do this. 09:29.220 --> 09:35.040 The first one that I've laid out here is SCP, so secure copy. 09:35.860 --> 09:42.880 And in the first example here, I'm going to upload a file from my computer to the remote system. 09:43.080 --> 09:55.900 So what that looks like is I do SCP, the file that I want to copy up, and then I'm just like before we saw, I'm going to do the username at that system, and then I'm going to give it the path that I want to copy it to. 09:55.940 --> 10:02.180 So here I want to say in the user's home directory in the bin folder, name my file not malware. 10:02.180 --> 10:06.820 So I'm going to copy my malware up there and hopefully they won't catch it because I called it not malware. 10:06.820 --> 10:10.480 And that is super secret and they will totally never be able to figure that out. 10:12.880 --> 10:16.180 Next, say I want to download a file from their remote system. 10:16.180 --> 10:23.660 So I've been looking around and I see that there is this Etsy secret sauce that I'd like to get from my local system. 10:23.940 --> 10:32.620 Just like before, it's source and destination, but I want the source now to be the file on the remote system, and then the destination to be the file on my system. 10:32.640 --> 10:37.900 So SCP, Bob, at the remote system, the path that the file is at. 10:37.900 --> 10:39.820 So here it's Etsy secret sauce. 10:40.300 --> 10:43.180 And then finally my loot folder. 10:43.220 --> 10:50.660 So every good hacker kid should have a loot folder and I'm going to copy that secret sauce into that folder. 10:51.940 --> 10:55.880 Additionally with SCP, I can recursively copy. 10:55.880 --> 10:58.720 So say I just want to grab everything in that secret folder. 10:58.720 --> 10:59.440 I don't know what it is. 10:59.440 --> 11:00.660 I'll look at it later. 11:00.660 --> 11:05.800 I'm going to go ahead and use the minus R for recursive flag here to SCP. 11:05.800 --> 11:14.760 So SCP minus R, Bob at 10.10.10.10, the Etsy secret folder down into my loot folder. 11:17.040 --> 11:21.300 The next way you can copy files is with the SFTP command. 11:21.300 --> 11:23.320 So this is secure FTP. 11:23.320 --> 11:30.860 Uh, this is actually a completely different implemented or different, um, part of the protocol to copy those files. 11:30.860 --> 11:38.460 So SCP and SFTP, while they accomplish the same thing are actually doing different stuff under the hood, but functionally it's the same. 11:38.460 --> 11:41.960 And if you're familiar with FTP, hopefully this makes sense. 11:41.960 --> 11:46.380 You SFTP as Bob to 10.10.10.10. 11:46.380 --> 11:49.140 And then the first command I want to download a file. 11:49.140 --> 11:50.340 So I get that file. 11:50.340 --> 11:55.700 I say, get from slash secret sauce to my loot folder, secret sauce. 11:56.280 --> 11:59.620 Um, and then next example, I want to upload a, upload a file. 11:59.620 --> 12:03.600 So SFTP Bob at 10.10.10.10. 12:03.600 --> 12:09.520 I'm going to put from my artifacts folder, the malware, and I'm just going to put it into not malware. 12:09.600 --> 12:13.400 Uh, once again, super secret, no one will ever catch that. 12:13.400 --> 12:14.120 Totally not malware. 12:14.120 --> 12:14.720 Don't look at it. 12:14.720 --> 12:15.540 It's fine. 12:15.540 --> 12:22.760 Uh, and similar to SCP SFTP has a recursive option for the get command. 12:22.980 --> 12:27.240 So get minus R slash temp secret from the remote side. 12:27.240 --> 12:28.140 So say that's a folder. 12:28.160 --> 12:32.820 And then I'm just going to download it into my temp folder until I can figure out what to do with it. 12:32.960 --> 12:36.320 Uh, and you can see, uh, what happened there. 12:36.500 --> 12:45.360 So, uh, kind of the basics there as SSH lets you, uh, log into a remote system, get a shell on that system. 12:45.360 --> 12:49.460 If you want, you can, uh, run commands singularly. 12:49.460 --> 12:51.200 So you don't even have an interactive session. 12:51.200 --> 12:52.760 So it's a lot harder to find. 12:52.760 --> 12:54.540 You can copy files down. 12:54.540 --> 12:56.840 You can copy or you can download files. 12:56.840 --> 12:58.220 You can upload files. 12:58.220 --> 13:16.300 Um, even that just alone is super useful to an attacker just in and of itself, but let's go ahead and move on forward to, uh, fun with port forwards and we'll see kind of the more advanced stuff you can do and how you can use this, uh, SSH in your tool belt to get around, 13:16.300 --> 13:20.740 uh, common firewall setups and that kind of, kind of thing. 13:21.800 --> 13:25.980 Uh, so first here, we're going to do look at local forwarding. 13:27.260 --> 13:33.480 So in this scenario, I have access to the 10.10.10.10 system. 13:33.480 --> 13:35.540 Hopefully that was enough 10s. 13:36.100 --> 13:39.160 And I happen to know that that is sitting on a boundary. 13:39.360 --> 13:46.200 So here in this, um, this slide, I'm showing you that I have this box, which I'm going to call my jump box. 13:46.200 --> 13:56.100 So 10.10.10, or you'll also hear this called a bounce node and I'll probably go back and forth, but I happen to know that this is sitting on a, like a security boundary here. 13:56.100 --> 13:59.660 And there are other systems back in here that I'd like to get access to. 14:02.020 --> 14:07.640 I can use SSH to forward ports from my system through that system. 14:07.840 --> 14:10.500 Uh, look at a, look a little bit like this. 14:10.500 --> 14:16.420 So I'll have port 8080 on my local system. 14:16.420 --> 14:23.520 We'll jump through that 10.10.10.10 system and then point at one of the systems on the other side. 14:24.080 --> 14:26.560 All of that will go over the SSH tunnel. 14:27.100 --> 14:32.720 So that traffic is encrypted from, uh, my laptop here to this system. 14:32.840 --> 14:38.420 And then it comes out of here and we'll wind up over on looking at the system. 14:39.380 --> 14:46.100 Uh, what that looks like on the command line is you use the minus capital L for local forward. 14:46.320 --> 14:57.920 Um, and you want to tell it the port on your system that you want to listen on the host that you want that connection to go to on the far side and the host port on the far side that you would like to go to. 14:58.720 --> 14:59.240 Okay . 14:59.900 --> 15:03.700 So in practice, what this looks like is SSH minus capital L. 15:03.700 --> 15:07.760 I want to listen on my host on port 8080 on my laptop. 15:08.060 --> 15:16.020 I want that traffic when I go to port 8080 to go out the other side to 192.168.1.10 on port 80. 15:16.020 --> 15:19.060 So say there's a web server on that system that I'm trying to get access to. 15:19.280 --> 15:27.460 And then I'm logging in as Bob to that, that bounce node, 10.10.10.10, 10.10.10.10. 15:27.460 --> 15:29.000 Different IP addresses. 15:29.340 --> 15:32.760 Um, and then interestingly here, I'm going to give it minus N. 15:32.920 --> 15:35.200 So that tells it not to request a shell. 15:35.440 --> 15:37.160 And then I'm going to background it. 15:37.320 --> 15:40.220 What that does is now I have 8080 listening. 15:40.220 --> 15:42.340 I can now go onto my next command. 15:42.340 --> 15:44.860 I didn't request a shell on the remote system. 15:44.860 --> 15:55.240 So once again, if there's a defender watching that system and trying to see like run a who or see who's logged into it, all they'll actually see is that there's an SSH D process. 15:55.240 --> 15:57.720 It doesn't actually spawn a shell or anything. 15:57.800 --> 16:01.860 And then if they're really on the ball, they'll look at net stat and see the network connection. 16:01.860 --> 16:05.120 But most of the time they just won't realize that there's somebody logged in. 16:05.560 --> 16:08.260 And then, uh, like I said, that's backgrounded. 16:08.260 --> 16:12.840 So on my local system now I can point curl at local host on port 8080. 16:12.920 --> 16:18.320 And so there's a HTTP server there that happens to be serving a file called secret that I need to get. 16:18.320 --> 16:22.020 And I, I get it and it looks like I won. 16:24.920 --> 16:34.380 Uh, that's super fun and all being able to do a local forward, but I don't want to do that one by one by one through all of these systems on this network. 16:34.620 --> 16:41.540 Uh, thankfully SSH was nice enough to think of the, this, the, the kind developers of open SSH. 16:42.080 --> 16:45.220 They implemented this thing called dynamic port forwarding. 16:46.440 --> 16:57.340 So what this does is this lets me open up on my system, a port that will forward over that SSH tunnel, uh, either SOCKS4 or SOCKS5 proxy. 16:57.340 --> 17:01.540 And then I'm essentially using that SSH server as a proxy server. 17:01.760 --> 17:08.540 And I can get to any of the systems behind that network, as long as whatever I'm using speaks that SSH protocol. 17:08.600 --> 17:23.440 So if I point my, if I use this proxy port, then I can get proxy that through this system and just get to any of the systems that are behind here in the way this kind of basic network example is laid out. 17:24.640 --> 17:32.600 Uh, and, um, kind of counterintuitively here, it's actually easier to do this than the just singular local forward. 17:32.820 --> 17:34.780 So at least on the SSH side. 17:34.780 --> 17:40.960 So, um, all I'm doing here is minus capital D for dynamic and that does a dynamic forward. 17:40.960 --> 17:44.780 I'm telling it port 1080, just common SOCKS port. 17:44.780 --> 17:49.020 Um, and then same thing, Bob at 10.10.10.10. 17:49.380 --> 17:51.320 I think I got that right this time. 17:52.000 --> 17:54.920 Uh, and super nice and easy. 17:54.920 --> 17:57.220 Once I run that command, I've successfully logged in. 17:57.220 --> 18:00.540 I now have a proxy server. 18:00.620 --> 18:04.200 I've turned that SSH system into a proxy server. 18:04.300 --> 18:08.660 So what I can do with that is I can point a web browser at that proxy server. 18:08.660 --> 18:22.840 So for instance, here, Firefox, uh, some Firefox, go preferences, network settings, manual, manual proxy conf here, and then, or click the manual proxy conf button and then do, um, SOCKS host. 18:22.840 --> 18:26.640 And here I've picked SOCKS five, and then I just tell it my port 1080. 18:26.640 --> 18:32.220 Now, anything my browser tries to go to is going to forward over that SOCKS proxy and come out in that other network. 18:34.060 --> 18:37.200 Um, additionally, you can use, I like to use proxy chains. 18:37.200 --> 18:41.820 There's actually a couple of different tools to do this, but proxy chains is the one that I know how to use. 18:41.820 --> 18:50.100 So it's pretty easy for me is, um, you can use proxy chains here and you just configure it to tell it where the proxy host is. 18:50.160 --> 18:54.620 And then, um, you use the command proxy chains here. 18:54.620 --> 19:13.280 I'm just going to drop in a bash and what proxy chains does is it hijacks the, um, the libc calls to socket, uh, operations, and then forwards them over that, uh, for TCP operations, forwards them over that SOCKS protocol, speaks the SOCKS protocol, and then forwards the traffic gomer. 19:13.340 --> 19:17.620 So anything in that bash session gets forwarded over that proxy. 19:17.840 --> 19:26.420 You can do one-off commands, but I like to drop in a bash here a lot because you can do curl and a bunch of other, um, nmap and netcat and all that kind of stuff. 19:26.420 --> 19:36.500 You have to use the right options because nmap needs to be on layer two sometimes, but, um, depending on how you're trying to scan, but for TCP scans, uh, super useful. 19:36.500 --> 19:52.640 Uh, and so you've essentially just used that SSH host to bounce, uh, into that network that you probably didn't have access to necessarily, but thankfully just to thank, thankfully you got access to that one SSH host and you got in. 19:54.800 --> 20:01.600 Um, the next way you can port forward is kind of the opposite of the local forward, which is the remote forward. 20:01.880 --> 20:11.680 So say I am sitting on my laptop and I would like a port on that SSH server to open up and forward that port back to my system. 20:12.520 --> 20:24.520 So I'll do this with SSH a lot to get from a system out to the network and then be able to do all of that same forwarding and tunneling and stuff just in the opposite way. 20:25.440 --> 20:30.120 So say I'm actually on, I'd have to be, I have to be on both systems in this scenario. 20:30.120 --> 20:37.620 So I'm on my laptop and then I also have access to this system in the network and I'm, say I'm trying to exfil some data or something. 20:37.680 --> 20:42.780 I can't get out because they're blocking the internet, but I have access to this and I have access to my laptop. 20:42.820 --> 20:56.080 So what I do is I SSH and I set up a remote forward from here that says, Hey, listen on two, two, two, two here and forward that back to me on port 22, which is SSH. 20:57.240 --> 21:08.620 Then from this system, I can just use any of those SSH commands provided I have the SSH command line and I can do stuff like copy files to here, but it's really forwarding to here. 21:08.900 --> 21:13.740 So anyone looking at the network traffic, nothing's actually going out over the firewall or anything. 21:13.740 --> 21:16.120 It's just traffic going to here. 21:16.120 --> 21:23.460 And then there's a secure connection to here from, from the bounce host to my laptop. 21:24.300 --> 21:29.400 So nothing actually, unless you're really on the ball, looks like it's coming from this to my laptop. 21:29.400 --> 21:31.700 It's routing through this other system. 21:33.880 --> 21:39.220 So what that looks like here is you use the dash R command for remote. 21:39.800 --> 21:47.740 I'm going to tell it what port to listen on and I'm going to tell it the host port that I want it to, or the host that I want it to listen on. 21:47.740 --> 21:50.600 And then the host port that I want it to forward to. 21:51.940 --> 21:57.240 So I say, listen on 2222, open that up on any. 21:57.240 --> 22:00.300 So 0.0.0.0 is the any address. 22:00.320 --> 22:03.420 And then forward that traffic back to me on port 22. 22:03.480 --> 22:06.680 I log in as Bob to that 10.10.10.10. 22:06.800 --> 22:11.340 I do minus N again, because I don't want to actually get a shell here. 22:12.180 --> 22:20.580 Importantly, to be able to do this, listen on 0.0.0.0, the SSH server that I'm logging into. 22:20.580 --> 22:26.780 So this guy 10.10.10.10 has to have gateway ports enabled, or else you won't be able to do this by default. 22:27.360 --> 22:28.880 Luckily, it's a pretty easy change. 22:28.880 --> 22:31.520 You just update Etsy SSHD config. 22:31.600 --> 22:36.220 We'll look at config stuff a little bit later, but you can just change this. 22:36.220 --> 22:38.460 It is no by default, but you just change it to yes. 22:38.460 --> 22:40.140 And then you restart SSH. 22:40.180 --> 22:45.140 Your connection stays alive, everything keeps working, and then you can do this. 22:46.240 --> 22:54.140 And then from that system that's inside the network that can't get out, I SSH to the 10.10.10.10 on port 22. 22:54.140 --> 22:58.040 So this minus P tells it to go different than the default port. 22:58.080 --> 22:59.500 I log in. 22:59.500 --> 23:03.060 I can either log in or I can copy files or do whatever I want. 23:04.520 --> 23:20.000 Important thing to point out is if I'm on a system that I don't control, oops, if I'm on a system that I don't control and I SSH into my system, I am potentially giving up credentials or a password or something to my system. 23:20.000 --> 23:22.000 So be careful with this. 23:22.000 --> 23:36.240 Make sure that this system, this user that they're logging into is something that they they're not too worried about and that that user is locked down and that they can get everything or you're kind of letting them into your system and getting hacked yourself and you do not want to be that person. 23:39.460 --> 23:42.920 So that's cool, but it's a lot to type. 23:42.960 --> 23:47.820 Say I want to do this same scenario where I have a tunnel and I want to log into that. 23:47.820 --> 23:51.280 I want to log in through my jump box or my bounce node. 23:51.280 --> 23:53.600 I want to land over here. 23:53.860 --> 24:01.260 So I would have to SSH to here, do a port forward to tell it to go over here, and then SSH to that port forward and go over here. 24:01.260 --> 24:03.820 And that's a lot of work and I'm a lazy hacker. 24:03.820 --> 24:05.040 I don't want to do that. 24:05.440 --> 24:08.720 Thankfully, the people that implement SSH are not lazy. 24:08.720 --> 24:12.100 So they think of all of these things and have it done ahead of time. 24:12.660 --> 24:16.480 SSH has this cool option called a proxy command. 24:17.360 --> 24:22.160 The proxy command is the old way to do this and they've actually since implemented a new version. 24:22.200 --> 24:26.320 But proxy command is still super useful and we'll see another use of this in just a second. 24:26.320 --> 24:29.040 But what you do is you say minus O is option. 24:29.040 --> 24:30.800 You say proxy command. 24:30.800 --> 24:35.260 I want my proxy command to be SSHing to that remote system again. 24:35.400 --> 24:40.020 And then here percent H and percent P get replaced with the system that you're trying to log into. 24:40.020 --> 24:42.260 So it would be a remote and the port. 24:46.460 --> 24:49.120 Like I said, this is kind of the old way to do it. 24:49.120 --> 24:53.280 The SSH developers were nice enough to realize that this is also a lot to type. 24:53.780 --> 25:02.940 So they made this thing called proxy jump, which you can do minus J and tell it, Bob, this is essentially doing the same thing as this. 25:02.940 --> 25:12.040 And then you're just logged in and like we saw, you now have this set up where you're actually SSHing through this system to here. 25:12.040 --> 25:21.680 Anybody monitoring this boundary for access to this system won't actually see that because you're actually going through here and to here. 25:21.680 --> 25:23.300 You're not going straight to it. 25:23.300 --> 25:31.660 So that is a pretty useful way to get around some kind of common network monitoring and popping through some boundaries. 25:31.660 --> 25:42.960 You can actually do some really cool stuff with this where you set up like different jump boxes and have them go through different layers and it starts to get pretty fun. 25:42.960 --> 25:44.820 You can do some pretty crazy stuff. 25:45.780 --> 25:52.620 So like I said, though, that proxy command is super interesting and shout out to SubT for kind of prompting me to look at this. 25:52.620 --> 26:05.080 Here, I'm actually using a proxy command to configure my SSH to use an HTTP proxy to get to wherever I'm trying to go. 26:07.280 --> 26:08.660 So I'll say that again. 26:08.660 --> 26:14.680 I'm using a proxy command to use an HTTP proxy to get to where I'm trying to go. 26:14.680 --> 26:24.780 So anybody looking at this traffic is going to see a connection to an HTTP proxy and not even realize that I'm SSHing through that proxy out to the other side. 26:25.100 --> 26:34.520 This is super useful when you're in a network that's very locked down and is only letting certain things through and you have to use an HTTP proxy to get out. 26:36.340 --> 26:39.020 Or if you just want to blend in. 26:44.020 --> 26:53.000 Another thing that is very useful here is so now I have all of these tunnels and this forwarding and all of this cool stuff that I want to set up but SSH is a TCP protocol. 26:53.000 --> 26:59.680 So if anything happens in this connection, any of the routers or something timeout, something weird happens, that connection will die. 27:00.240 --> 27:07.900 Maybe I want this tunnel to be set up really long-lived and how I accomplish this is with a command called auto SSH. 27:07.900 --> 27:20.380 And what I like to do with this is I will set up auto SSH to log into my laptop and forward port 2222 on my laptop back to the host. 27:20.380 --> 27:22.960 So I apologize the arrow is backwards here. 27:22.960 --> 27:30.380 But it would actually forward from 2222 back to my host on 22 and funnel that traffic. 27:30.380 --> 27:32.780 So I connect here and it goes out here. 27:33.000 --> 27:36.180 So there's an auto SSH connection out. 27:36.220 --> 27:40.540 It sets up that remote port forward to come back. 27:40.600 --> 27:46.080 And if that connection dies, auto SSH will restart it for me, monitor that process and restart it for me. 27:46.080 --> 27:54.040 That effectively lets me maintain access to this and I don't have to do anything once it's set up. 27:54.640 --> 27:57.980 And what that looks like is you use the auto SSH command. 27:57.980 --> 27:59.700 It's just a tool that you can install. 27:59.700 --> 28:05.900 I'm giving it some options here, the server alive interval, server alive max count. 28:05.900 --> 28:09.780 So this will wait 30 seconds and it will max try three times. 28:09.960 --> 28:16.920 And then I'm telling it to remote forward on 2222 to port 22 on my local host. 28:16.920 --> 28:20.200 And then I log into my laptop, aka Hackbox. 28:20.820 --> 28:29.240 And then on Hackbox, I can SSH minus P to 2222 and tell it, Bob, because that's the user that I have at local host. 28:29.240 --> 28:32.940 And that's actually going to go through that tunnel back in through the network. 28:32.940 --> 28:35.260 And then I'm just logged into that victim system. 28:36.360 --> 28:45.540 Once again, this is super cool, because like all someone monitoring this network would see is someone logging into a system remotely. 28:46.300 --> 28:55.200 So say you're here, this boundary is monitored, all you see is an SSH out, you don't actually see me tunneling back in. 28:55.200 --> 28:59.680 So it looks like someone who already is logged into this just logged into something on the internet. 29:00.620 --> 29:02.120 And that is what happened. 29:02.220 --> 29:05.220 But then additionally, I'm logging back into that system here. 29:05.220 --> 29:10.240 So I actually have shell access that they might not be wanting me to have. 29:14.180 --> 29:25.880 So a bunch of fun stuff you can do with port forwarding, super useful for kind of crossing those security boundaries and getting into networks that you're not necessarily supposed to have access to. 29:26.260 --> 29:29.600 With auto SSH, you can maintain that access. 29:30.200 --> 29:37.200 And to get creative with it, you can jump around and get to a bunch of different network segments and really make it confusing. 29:37.200 --> 29:43.300 With all the port forwarding, you can make it look like someone's connecting from a different system as long as you have access to connect all through. 29:43.300 --> 29:53.000 So someone that's trying to trace that back through network logs, or system logs, it's going to have a rough time because you're essentially using a proxy to get through a bunch of stuff. 29:53.000 --> 29:59.520 And you can proxy, proxy, proxy and jump around and good clean fun to be had by all. 30:02.840 --> 30:04.200 So configuration. 30:04.220 --> 30:18.400 So what we're going to talk about here is a bunch of different ways that you can configure SSH to do things that are kind of unexpected, or just interesting configurations that are useful, kind of in operations or in the in the process of doing things. 30:18.960 --> 30:23.560 First up, I want to point out that we have these escape sequences. 30:23.580 --> 30:36.700 So if I've SSH into a system, and I have an interactive shell, SSH actually has this kind of hidden shell that you send a special character sequence, it's like a cheat code almost. 30:36.700 --> 30:38.760 And it gives me all of this functionality. 30:38.760 --> 30:45.720 So what I did here is my prompt, I did new line tilde question mark, just in quick succession without anything else going on. 30:46.520 --> 30:50.760 And that's showing me the help for this escape sequence prompt. 30:51.620 --> 30:56.740 Probably the most useful, the ones I use all the time, is the terminate connection. 30:57.000 --> 31:12.820 So if something messes up with that SSH session, and my term, my shell is hung, and I can't get it to work anymore, instead of having to drop into another prompt and find the SSH process and kill it, you can just do this tilde, new line tilde dot and it kills the kills the SSH session. 31:13.280 --> 31:19.280 Also super useful if your friends let you sit at a prompt for their SSH and you want to mess with them. 31:19.360 --> 31:21.220 Just do that real quick. 31:22.520 --> 31:31.480 The other one that is super useful here is the background, or sorry, the command line. 31:32.260 --> 31:37.140 And that's the capital C. 31:37.380 --> 31:39.840 So why is this useful? 31:39.840 --> 31:42.580 You already saw you can just do this with the command line, right? 31:42.580 --> 31:48.960 You can SSH minus L and open up the port, or minus R and open up the port and all that kind of stuff. 31:50.100 --> 31:56.280 So this is one of those things that's really useful, but not very often. 31:56.280 --> 32:11.360 So the most use I have out of this is when I have access to SSH on a system, someone's actively trying to defend it, and they've changed the password on me, or gotten rid of my SSH key that we'll see here in a minute, or whatever. 32:11.360 --> 32:15.720 I can't log back into that prompt, or that SSH session. 32:15.720 --> 32:23.160 So I can't log out to port forward, but I want to port forward through that because I still have access and they haven't noticed that my actual shell exists. 32:23.160 --> 32:25.420 They just noticed that the account was compromised. 32:25.520 --> 32:29.020 So I can still scan the network and do a bunch of stuff from there. 32:29.020 --> 32:34.560 I just need to be able to change some of the port configs and I can't log out and log back in. 32:34.720 --> 32:37.140 That is when this is the most useful. 32:37.380 --> 32:46.780 So just like all of the other commands, minus L, minus R, minus D, lets you set up all of those port forwards. 32:46.780 --> 32:52.780 And then it's minus KL to cancel them or kill them. 32:54.900 --> 32:58.320 Once again, super useful, kind of keep it in your back pocket. 32:58.320 --> 33:05.240 It's not really common that I run into this, but when I have needed this, it was invaluable. 33:07.000 --> 33:11.080 So I talked a little bit about authorized key there. 33:11.080 --> 33:20.520 So one of the things you can do with SSH is trying to log in and put your username and your password all the time isn't very much fun. 33:20.520 --> 33:21.940 It's kind of insecure. 33:21.940 --> 33:24.740 We'll see a little bit later why that is pretty insecure. 33:25.560 --> 33:28.560 So SSH came up with this concept of an authorized key. 33:28.920 --> 33:32.420 So this is just public key cryptography. 33:32.680 --> 33:37.460 I generate a public private key pair. 33:37.460 --> 33:46.700 I put the public key on the remote system that I want to log into in a configuration file and say anyone that has the private key for this public key is allowed to log in. 33:47.380 --> 33:52.760 So this is very, very useful when you run into SSH for a couple of different things. 33:53.120 --> 34:02.140 One is if you can get access to someone's private key, you can log into any of the systems as them that they log into. 34:02.940 --> 34:10.880 Because of that, you actually generally, you're prompted to put a password in to password protect that private key. 34:10.880 --> 34:14.960 So when you try to use it, you have to decrypt the private key before you can use it. 34:15.820 --> 34:27.040 Most of the time or still a lot of the time, sadly, people that are generating these keys just hit enter twice and then you get an SSH or a private key that is not protected. 34:27.640 --> 34:31.820 And by sadly, I mean awesomely because it's great and you find this all the time. 34:33.800 --> 34:38.440 So where that file is stored is generally there's two places. 34:39.440 --> 34:51.870 SSH is either or the SSH stuff is either in Etsy SSH, which is the global configuration, or here where we're looking at it in the user's configuration, which is the dot SSH folder in their home directory. 34:52.840 --> 34:55.960 So here specifically, this is in Roots home directory. 34:55.960 --> 34:59.460 We've generated a key pair. 34:59.460 --> 35:03.440 The default for the RSA keys is just ID under RSA. 35:03.440 --> 35:06.120 And then you'll have ID under RSA.pub. 35:06.120 --> 35:21.580 If you copy that ID under RSA.pub to the dot SSH authorized keys file for any user, you can log in to that user account without a password. 35:22.660 --> 35:31.560 So this is also super useful in the case where I land on a system and I don't know the user's password, so I can't change their password. 35:32.320 --> 35:35.140 But I'd like to be able to SSH in as them. 35:35.140 --> 35:48.020 I can add this key and then I can SSH into that account as them and have a full PTY shell that lets me do all of the things you would do with a full PTY shell, edit files, run sudo, all that kind of stuff. 35:49.600 --> 35:52.460 And essentially, this lets you maintain access. 35:52.460 --> 35:55.940 I don't need to know the user's password as long as that file exists. 35:56.300 --> 36:10.200 So this is also super useful for um like hack the box style challenges where you get a web shell or just if you have a web shell as a user and you want to upgrade to that user level access. 36:10.280 --> 36:18.360 If you have the ability to write to this file, then you just add an SSH key in here and you can log in. 36:18.580 --> 36:28.700 SSH by default will check the permissions of that file and not use it if they aren't correct, but sometimes it is configured to not do that. 36:28.700 --> 36:30.200 So it's always worth checking. 36:31.140 --> 36:39.900 Kind of the meta here is it's always worth looking in the SSH folder because there is a bunch of different stuff and we'll see more of that here coming up. 36:40.240 --> 36:43.760 So next is the known hosts file. 36:44.140 --> 36:47.940 So this file is a list of all of the systems that a user is logged into. 36:48.140 --> 36:55.920 For anybody familiar with SSH, when you SSH out to a system the first time, it'll say, hey, I don't recognize this system. 36:55.920 --> 36:57.140 This is the public key. 36:57.140 --> 36:58.280 Do you accept this? 36:58.280 --> 37:02.360 When you do that, it saves that into this file called the known hosts. 37:03.680 --> 37:12.020 That known hosts file will have one entry per line and then it has the IP address or the host name and then the public key information. 37:12.140 --> 37:13.300 So this is super useful. 37:13.300 --> 37:30.760 If I can see this and I'm the user, say I now have access to their unencrypted private key and then I also have access to all of the IP addresses that they're logging into, a pretty easy way to pivot around the network and find other systems that I have access to. 37:32.580 --> 37:37.800 The next file here that is super interesting is the SSH config. 37:37.980 --> 37:49.220 So all that stuff that we've been going over, all of the port forwards, all of the different things are super great, but typing all of that's horrible and I'm a lazy hacker. 37:49.220 --> 37:55.720 And once again, the SSH developers, they know that, I guess, and they came up with a solution for it. 37:55.720 --> 37:57.660 So that's this SSH config. 37:58.060 --> 38:10.500 Like all, most of the other SSH stuff, the default or the kind of system-wide configuration is an Etsy SSH and then the user configuration is in .ssh in the user's home directory. 38:11.620 --> 38:13.800 That config file looks like this. 38:13.800 --> 38:18.520 So here someone has set up a host called bounce. 38:18.520 --> 38:20.020 The username is bob. 38:20.020 --> 38:22.620 They're logging into 10.10.10.10. 38:22.620 --> 38:28.760 They would like to do a local forward of port 8080 to 192.168.1.10.80. 38:28.780 --> 38:38.420 They're going to do a dynamic forward for 1080 and they're going to do a remote forward for 8080 on 192.168.1.10.80. 38:38.960 --> 38:45.920 On the command line, you can just do ssh bounce and then all of those configs will get set in the command line. 38:45.920 --> 38:47.760 You don't have to do anything at all anymore. 38:47.760 --> 38:49.080 It's just ssh bounce. 38:49.080 --> 38:51.360 It'll tab complete if you have bash completion. 38:51.360 --> 38:52.500 Super awesome. 38:54.280 --> 39:06.100 When you land on a system, if you have access to this config file, this is another way to find systems that people are logging into because they'll have a bunch of configs like this for easy mode accessing the systems that they access. 39:06.120 --> 39:13.960 And you can see, okay, so this bob guy has access to 10.10.10.10 and likes to check out these other systems on these ports. 39:13.960 --> 39:16.000 So something I can try to do. 39:18.500 --> 39:23.620 Another fun thing you can do with ssh config is get it to do stuff that people are not intending. 39:23.980 --> 39:35.080 So let's say in this scenario, I know that bob is sshing from the server that he's on 10.10.10.10 to that system that he has internally. 39:35.680 --> 39:43.120 Every time he does that, I would like to get a shell back to me on 41.41 from his system. 39:45.520 --> 39:47.880 With ssh config, I can do that. 39:47.900 --> 39:52.620 So here, I configure it, say I'm on his server for some reason. 39:52.820 --> 39:54.940 I have access to his ssh config. 39:54.940 --> 39:57.780 I'm going to go ahead and I like to set this up for all hosts. 40:00.160 --> 40:06.180 By default, you're not permitted to run a local command, but luckily in the config file, you can just tell it to let you do that. 40:06.880 --> 40:20.300 And what I'm going to do here is tell it the local command is to netcat me a bin bash shell to my IP address on my listener and background and then do whatever else bob was trying to do. 40:21.300 --> 40:29.200 So every time bob logs into a host, it will spin a shell back to me and I'll get access to his system. 40:29.200 --> 40:36.920 So say my shells keep dying or I just want to kind of maintain access in a super easy way. 40:38.780 --> 40:44.840 Another config file that is super awesome is this run commands file or RC file. 40:45.760 --> 40:56.320 This similarly has the Etsy version or the user version, but what this does is this runs a command when the user's logging in right before it drops them to a shell. 40:57.440 --> 41:06.700 So back to our scenario, say I'm actually on this this far system and now I want a shell to come back to me every time somebody logs in. 41:06.780 --> 41:11.280 So when somebody logs into this system, it sends me a shell. 41:12.720 --> 41:19.700 What that looks like here is I just put this simple netcat listener just like the other one roughly in this. 41:19.700 --> 41:30.320 I say netcat spit a shell back to me on my listener IP address on port 4141 and then background and go ahead and keep doing whatever it is that people want to do. 41:30.660 --> 41:34.040 So I encourage people to look at the config files. 41:34.040 --> 41:36.620 There's a ton more things you can do in there. 41:36.620 --> 41:40.860 These are kind of simplified versions for slides and to demonstrate the purposes. 41:41.240 --> 41:56.380 With the config files and the port forwarding, you can really get yourself into some pretty scenarios with that jump proxy command or proxy jumper command or config option. 41:56.380 --> 41:58.980 And then also it goes in the config file. 41:59.340 --> 42:05.460 With those, you can set up really intricate port forwards and get through all sorts of different interesting things. 42:05.460 --> 42:11.200 And like I was saying before, really kind of run havoc on networks and for someone trying to trace stuff back. 42:12.640 --> 42:18.380 Now let's look at a couple different ways that I've successfully gotten creds out of SSH. 42:19.440 --> 42:24.820 The first one being, say I'm on a system and I know someone is logging into other systems. 42:24.820 --> 42:29.140 I see their SSH config, but I don't have their private key. 42:29.140 --> 42:30.420 They're not even using private keys. 42:30.420 --> 42:32.060 I just know they're using passwords. 42:32.300 --> 42:37.260 So I want to be able to get to that system that they're getting to, but I need to get that somehow. 42:37.680 --> 42:46.440 So a thing I like to do is I set, I create a little shell script here that's in their path before the normal SSH command. 42:46.440 --> 42:50.400 So the SSH command by default is in user bin SSH. 42:50.440 --> 43:03.580 Here I'm making a shell script called user local bin SSH that prompts the user for a password again and then writes that password to a temp file and then just SSHs for them. 43:03.580 --> 43:16.060 So what that looks like, and I'm sure people that are used to SSH, is you SSH out, it asks you for your password, you typoed it, it just asks you for your password again, you typed it right, you're good to go, and then eventually you exit. 43:16.060 --> 43:24.340 And you can see here that in temp.creds, I've now stolen that super secret password and I have Bob's password of 192.168.1.10. 43:24.340 --> 43:27.520 I'm able to pivot and kind of be on to the next thing. 43:29.680 --> 43:32.800 Additionally, so let's say the other way is true. 43:32.800 --> 43:38.080 Someone's SSHing into a server that I have access to and I want to see what their password is. 43:39.160 --> 43:46.320 Here I use the debug tool called strace which just looks for all of the system calls that happen in the binary. 43:46.420 --> 44:00.180 So I find the SSH process, I attach strace to that SSHD process, and I tell it to just show me the reads because I know just I know how the SSH daemon works. 44:00.180 --> 44:05.500 I know that when you connect into it, it sends you a prompt and then reads your password from you. 44:05.640 --> 44:09.460 So here I'm telling it to just show me all of the reads. 44:09.460 --> 44:16.740 There are a lot of reads, so I've gone ahead and grepped them for this magic string that happens right before the password just as part of the protocol. 44:16.740 --> 44:23.680 And here you can see I've stolen this password of super secret from someone when they're logging into the SSH. 44:26.320 --> 44:34.880 Another really fun one here is using this paramiko to create your own SSH server. 44:35.020 --> 44:42.440 So this is kind of the most basic example of this that I can show and make it actually fit in a slide and be useful. 44:42.440 --> 44:51.340 But the idea here is say I'm on a server and it's not running SSH but I know someone is trying to log in. 44:52.060 --> 44:58.060 I need to speak enough of the SSH protocol to get them to give me their password. 44:59.300 --> 45:06.100 But I don't necessarily want to let them log in because I don't know what they're trying to do and I don't want to implement the entirety of all of SSH. 45:07.580 --> 45:10.600 So let's kind of run through this Python code a little bit. 45:11.600 --> 45:19.200 What I'm going to do here is for this line here I'm going to go ahead and grab the TCP socket or create a TCP socket. 45:19.200 --> 45:20.880 I'm going to bind on 22. 45:20.880 --> 45:25.360 So this means I have to have access to open those non-ephemeral ports. 45:25.360 --> 45:30.420 I'm going to listen for one connection and then accept for that connection. 45:30.420 --> 45:36.860 So once I've got a connection I let myself know hey someone from this adder has connected to me. 45:38.140 --> 45:47.000 Then I'm going to take advantage of paramiko and they call it transport in the paramiko implementation. 45:48.140 --> 45:56.260 With that transport I'm going to go ahead and add a server with the paramiko RSA key. 45:56.260 --> 45:58.040 So I have just a test key. 45:58.040 --> 46:05.880 So like I said before when you SSH out and it says I don't recognize this here's the public key this is going to be that key that it gives them. 46:05.940 --> 46:15.960 This is one chance that they could detect so if they're trying to SSH in and it's a key that they don't recognize you should just say no unless you know that there's a key that you should be seeing. 46:16.640 --> 46:20.340 But most people just say yes because they assume it's a server they haven't seen. 46:20.480 --> 46:27.760 And then I'm going to go ahead and start it with my server and tell it to just serve and then accept the connection. 46:28.020 --> 46:39.100 So what this looks like here is this now uses my server they connect in they get the SSH protocol does its negotiation and says the only thing I can do is password authentication. 46:39.220 --> 46:54.060 So they'll get a password prompt from the client because it knows how to speak enough of the protocol and then they'll send me the username and password to my SSH server and that the paramiko server will call this check auth with the username and password that it got. 46:54.060 --> 47:02.340 I can say hey cool check it out I got a username and password and then tell it uh no that's not a valid username and password. 47:02.360 --> 47:26.180 So from the user's point of view they tried to SSH in the SSH failed they don't know why it is they don't know what this box is anyway it's not supposed to be on the network so kind of ignore this spawn a connect back shell that's not what's actually happening I'm actually starting an SSH server here so start my super secret awesome SSH server just with Python it tells me hey I got a 47:47.100 --> 48:00.440 So, that is kind of an intro and some a little bit deeper but not super crazy deep dive into all of the cool, not all of, but a bunch of the cool things you can do with SSH. 48:01.500 --> 48:10.480 You saw that just by default it gives you remote shell access, lets you do port forwarding, you can download upload files, it's all encrypted. 48:11.660 --> 48:20.380 That port forwarding, you can use that to accomplish almost any sort of hopping that you need to be able to do around network segmentation. 48:20.420 --> 48:30.580 So, if you can get to port 22 and you have some sort of credential material to log into that port 22, you can do quite a bit inside a network. 48:30.580 --> 48:36.380 You can get access to systems you're not necessarily supposed to have access to. 48:36.380 --> 48:41.880 You can get around network protections that are trying to block you from doing things. 48:41.880 --> 48:46.040 You can mask your traffic in different protocols via proxies. 48:46.040 --> 48:50.680 You can make traffic look like it's coming from different systems via proxies. 48:50.880 --> 48:58.460 With all of the configuration options you saw, you can trick the system into doing things or really trick users into doing things that you're not expecting. 48:58.760 --> 49:07.360 Different ways you can run SSH commands such that it's harder to trace or see that information on the system. 49:08.440 --> 49:13.660 And download, upload, exfill all of the data. 49:13.660 --> 49:18.740 Really, the cool thing about this is you can use all of these SSH options. 49:18.740 --> 49:19.980 These are the basic ones. 49:19.980 --> 49:24.340 You can combine all of this to make yourself the craziest network map that you want. 49:24.340 --> 49:26.460 Pivot through all of the different things. 49:26.700 --> 49:31.160 SSH is becoming more and more ubiquitous across environments. 49:31.400 --> 49:33.240 It's now coming on Windows 10. 49:33.240 --> 49:34.740 You have WSL. 49:35.020 --> 49:37.680 It's very, very, very useful. 49:38.300 --> 49:41.620 So, I hope that was helpful. 49:41.620 --> 49:47.640 I hope it made you think a time or two about SSH and what you can do with it and all that kind of stuff. 49:48.140 --> 49:50.620 I hope to stay connected with everybody. 49:50.920 --> 49:53.320 Randori Attack is my team's Twitter. 49:54.400 --> 49:57.880 We are kind of always hiring someone at somewhere. 49:57.880 --> 50:02.740 So, hit up our careers off of our webpage. 50:02.880 --> 50:08.820 And then, if you're into information like this, follow our blog. 50:09.160 --> 50:12.080 Randori TTPs are tips, tricks, and POCs. 50:12.700 --> 50:16.400 Check that out for lots of information like this. 50:17.500 --> 50:22.520 And then, lastly, I'm pretty passionate about this. 50:22.520 --> 50:25.140 We need to make sure that we're taking care of ourselves. 50:25.140 --> 50:27.000 And popping all these shells is awesome. 50:27.000 --> 50:29.560 Maintaining all of this access is super great. 50:29.720 --> 50:35.740 But we also need to make sure that we're taking the time to get away and keeping ourselves fit. 50:35.740 --> 50:37.120 So, hashtag Red Team Fit. 50:37.120 --> 50:38.420 Check us out on Twitter. 50:38.680 --> 50:41.780 There's a bunch of discords all over the place. 50:41.920 --> 50:46.060 And we've got a bunch of groups and doing all sorts of really awesome stuff. 50:46.060 --> 50:48.720 And that's what I got. 50:48.720 --> 50:50.160 Thanks, everybody. 50:50.500 --> 50:53.400 Hashtag Red Team Fit.