Red Team Village - Gray Hat SSH
Anderson, Evan
The Secure Shell (SSH) was designed to replace telnet/rsh with a secure channel over unsecured networks. SSH is a swiss army knife for red team engagements letting malicious actors accomplish a multitude of interesting tasks. Aside from providing access to run commands on remote systems SSH can be used to complete a myriad of other activities including hop network boundaries, maintain persistent access, download files, steal credentials, hide access and even configure what commands users run on login. This talk goes through details of how to configure and abuse ssh for a number of red team oriented goals from beginner to advanced.
 Great SSH shenanigans This talk is going to be about all of the cool offensively focused things you can do with SSH if you are a Red team or a pen tester and you don't have SSH in your toolbox already Hopefully you'll see why you should have it in your toolbox and all the cool fun things you can do with that And if you're an advanced you've already been using SSH hopefully there's a Tip or a trick or two that you can pick up here as we go through all this So what how is this talk gonna be? How's this talk gonna go? We're gonna start off with the basics because you have to start at the beginning Then we're gonna start Looking at all the interesting thing you can interesting things you can do with port forwards How you can use those to get past firewalls hide your traffic? Make it look like you're accessing systems from other systems and a bunch of cool things Next we'll look at the configurations. So fun with the configs SSH has a bunch of different ways you can modify its behavior and make it do things that users are probably not intending Leaks a bunch of information about what users are accessing How they're accessing them where they're accessing them? etc And then lastly we will lastly we'll look at stealing creds. So SSH as we'll see has access to credential material and we would like to get access to that and we will show a couple different successful strategies in doing so First who am I my name is Evan I'm also syndrome on Twitter. I Am the director of offense at a company called Grand Dory I've been reading forever. I'm in the CTFs. I do ccc all that kind of stuff. So check check me out Let's get into it so the basics What starting off? What is SSH? So SSH stands for secure shell It is a replacement for the original plain text protocols of telnet and rsh Which we both used to get shell access onto UNIX systems And administer those remotely SSH can be used to refer to both the Damon and the client So you will hear someone say SSH to that box That means that they use the SSH client to connect to a server that was running SSH Damon and Logged into it that way got a prompt and did whatever The most common versions of SSH that you're gonna run into are open SSH Open SSH runs on pretty much everything now and there are a few other ones that will go over server and client coming up Like I said, it's used to remotely administer systems You can upload and download files. You can run commands on the shell Etc. And then SSH also provides encrypted channels, which are little tunnels that you can make in the SSH session that'll let you do port forwarding that we'll see here in a minute x11 forwarding and Like get get your shell So why is SSH useful for an attacker Really SSH should be can be thought of as a Swiss Army knife for Red Teams This lets me accomplish anything I need to do with a system if I can get SSH access so I can Download files. I can upload files. I can run commands. I can maintain access to a system. I Can configure the system such that it does things differently than the user is expecting I Can get credentials out of it all of the things that I need to be able to do to get systems and get into systems and Pivot around inside a network and it's all encrypted by default for me So the common SSH clients and tools that you'll run into Like I said on most unixes the common SSH implementation is open SSH on Embedded systems sometimes you'll run into drop bear Which is just a like a very small Implementation of SSH and just the difference here is some of the functionality might not that we go over here might not work in open SSH or in excuse me in drop bear or some of the other SSH servers There's actually just SSH comm has an SSH server and there's a few different ones But most of time you're going to run into SSH and most of the stock is geared towards that On Windows you can obviously drop into WSL WSL 2 and then you're just at a Linux prompt So you'll have the SSH client There's a GUI that's called putty which is From way back when and then there's Plink which is the CLI implementation that uses the same SSH stuff under the hood that putty's using and Additionally on Windows 10 after 1809 Open SSH is available in the Windows app store. So you can get the SSH server and the SSH client And then lastly another tool that's super common that we're going to take a look at a little bit here is Paramiko which is a Python library that implements the entire protocol the entire SSH protocol both client and server In Python super useful for being able to write scripts to do Either like log into systems for you and do stuff or as we'll see later Make a server Another reason SSH is super useful here, it's really simple to enumerate so By default SSH is port 22 That's the port that it has registered. You can move it to different ports, but All of the servers if they're installed just by like with the app or whatever is SSH Here you can just use netcat and just grab the banner Really simple banner up front. It tells you that it's SSH 2.0 is the protocol of SSH that it's speaking the version as you can see this is an open SSH server 8.31 and then it's running on a Debian system. So just with netcat I can tell what Version of SSH is installed what or what version of SSH protocol the SSH Damon speaks What version of SSH is installed and the operating system? There's even more stuff that you can figure out so with net and map or a bunch of other There's a bunch of other tools that can do this, but lots people not use end map when you run the Discovery scripts it will do that banner grab for you And it will also enumerate all the algorithms that the SSH is using so SSH is a pretty old protocol there You'll run into systems that have older more insecure algorithms and potentially vulnerable SSH versions So there are some versions of SSH that are vulnerable the user enumeration and command injection and all sorts of stuff so That it is so easy to enumerate is pretty nice So continuing on with the basics here just running a command on the remote system there's two strategies here Essentially the first is I'm going to connect to the remote system and request a interactive shell so That first command is just SSH that's going to launch the command line Bob at and then the IP address is 10 dot 10 dot 10 dot 10 So that's saying login to 10 dot 10 dot 10 dot 10 as the user Bob I cut out some stuff here it'll prompt you for a password and then you can just run commands Interactively like you're sitting at a console on that system so here you can see you can run the command who am I and you see that you're Bob The other way you do this is to run a single command at a time so I say SSH Bob at 10 dot 10 dot 10 dot 10 who am I it says Bob This is super useful if the system is being actively defended so say one of the blue team or someone is actually on the system watching for connections and seeing who's logged in This they'd have to catch that and run that command while the who it who am I command is running or whatever command you want to run this is just an example But they'd have to actually see that to see that you're logged in you will this will still show up and last and in all of the logs and everything But if someone's just sitting there trying to see if someone's actually logged in and watching for SSH processes to start this will let you have a little race Where you can run your command hopefully before they actually catch you doing whatever the thing is that you want to do Like I said earlier you can use SSH to copy files so I can copy a file from my system to the remote system or I can copy a file from the remote system to my system There's two ways to actually do this the first one that I've laid out here is SCP so secure copy and in the first the first example here I'm going to upload a file from my computer to the remote system So what that looks like is I do SCP the file that I want to copy up and then I'm just like before we saw I'm going to do the username at that system and then I'm going to give it the path that I want to copy it to So here I want to say in the user's home directory in the bin folder name my file not malware so I'm going to copy my malware up there and hopefully they won't catch it because I called it not malware And that is super secret and they will totally never be able to figure that out Next say I want to download a file from their remote system so I've been looking around and I see that there is this Etsy secret sauce that I'd like to get From my local system just like before it's source and destination but I want the source now to be the file on the remote system and then the destination to be the file on my system So SCP Bob at the remote system the path that the files at so here it's Etsy secret sauce and then finally the my loop folder so every good hacker kid should have a loop folder and I'm going to copy that secret sauce into that folder Additionally with SCP I can recursively copy so say I just want to grab everything in that secret folder I don't know what it is I'll look at it later I'm going to go ahead and use the minus R for recursive flag here to SCP So SCP minus our Bob at 10.10.10.10 the Etsy secret folder down into my loop folder The next way you can copy files is with the SFTP command so this is secure FTP This is actually a completely different implement or different part of the protocol to copy those files So SCP and SFTP while they accomplish the same thing are actually doing different stuff under the hood but functionally it's the same and if you're familiar with FTP hopefully this makes sense You SFTP as Bob to 10.10.10.10 and then the first command I want to download a file so I get that file I say get from secret sauce to my loop folder secret sauce The next example I want to upload a file so SFTP Bob at 10.10.10.10 I'm going to put from my artifacts folder the malware I'm just going to put it into not malware once again super secret no one will ever catch that totally not malware don't look at it it's fine And similar to SCP SFTP has a recursive option for the get command so get minus our slash temp secret from the remote side so say that's a folder and then I'm just going to download it into my temp folder until I can figure out what to do with it And you can see what happened there so kind of the basics there SSH lets you log into a remote system get a shell on that system if you want you can run command singularly so you don't even have an interactive session so it's a lot harder to find You can copy files down you can copy or you can download files you can upload files even that just alone is super useful to an attacker just in and of itself but let's go ahead and move on forward to fun with port forwards And we'll see kind of the more advanced stuff you can do and how you can use this SSH in your tool belt to get around common firewall setups and that kind of kind of thing so first here we're going to do look at local forwarding So in this scenario I have access to the 10.10.10.10 system hopefully that was enough 10s and I happen to know that that is sitting on a boundary so here in this slide I'm showing you that I have this box which I'm going to call my jump box so 10.10.10 Or you'll also hear this called a bounce node and I'll probably go back and forth but I happen to know that this is sitting on a like a security boundary here and there are other systems back in here that I'd like to get access to I can use SSH to forward ports from my system through that system look at it look a little bit like this so I'll have port 8080 on my local system will jump through that 10.10.10.10 system and then point at one of the systems on the other side all of that will go over the SSH tunnel so that traffic is encrypted from my laptop here to this system and then it comes out of here and will wind up over on looking at this system what that looks like on the command line is you use the minus capital L for local forward and you want to tell it the port on your system that you want to listen on the host that you want that connection to go to on the far side and the host port on the far side that you would like to go to so in practice what this looks like is SSH minus capital L I want to listen on my host on port 8080 on my laptop and I want that traffic when I go to port 8080 to go out the other side to 192.168.1.10 on port 80 so say there's a web server on that system that I'm trying to get access to and then I'm logging in as Bob to that bounce node 10.10.10.10.10 I should have done different IP addresses and then interestingly here I'm going to give it minus N so that tells it not to request a shell and then I'm going to background it what that does is now I have 8080 listening I can now go on to my next command I didn't request a shell on the remote system so once again if there's a defender watching that system trying to see like run a who or see who's logged into it all they'll actually see is that there's an SSHD process it doesn't actually spawn a shell or anything and then if they're really on the ball they'll look at net stat and see the network connection but most of the time they just won't realize that there's somebody logged in and then like I said that's backgrounded so on my local system now I can point curl at local host on port 8080 and so there's a HTTP server there that happens to be serving a file called secret that I need to get and I get it and it looks like I won that's super fun and all being able to do a local forward but I want to do that one by one by one through all these systems on this network thankfully SSH was nice enough to think of the this the kind developers of open SSH implemented this thing called dynamic port forwarding so what this does is this lets me open up on my system a port that will forward over that SSH channel either socks for or socks five proxy and then I'm essentially using that SSH server as a proxy server and I can get to any of the systems behind that network as long as whatever I'm using speaks that SSH protocol so if I point my if I use this proxy port then I can get proxy that through this system and just get to any of the systems that are behind here in the the way this kind of basic network example is laid out and kind of counterintuitively here it's actually easier to do this than the just singular local forward so at least on the SSH side so all I'm doing here is minus capital D for dynamic and that does a dynamic forward I'm telling it port ten eighty common socks port and then same thing Bob at ten dot ten dot ten dot ten think I got that right this time and super nice and easy once I run that command I've successfully logged in and now have proxy server I've turned that SSH system into a proxy server so what I can do with that is I can point a web browser at that proxy server so for instance here Firefox some Firefox you go preferences network settings manual manual proxy comp here and then click the manual proxy comp button and then do socks host and here I've picked socks five and then I just tell it my port ten now anything my browser tries to go to is going to forward over that socks proxy and come out in that other network additionally you can use proxy chains there's actually a couple different tools to do this but proxy chains is the one that I know how to use so it's pretty easy for me is you can use proxy chains here and you just configure it to tell it where the proxy host is and then you use the command proxy chains here I'm just going to drop in a bash and what proxy chains does is it hijacks the the libc calls to socket operations and then forwards them over that for TCP operations forwards them over that socks protocol speaks to the socks protocol and then you can do a lot of traffic over so anything in that bash bash session gets forwarded over that proxy you can do one off commands but I like to drop in a bash here a lot because you can do curl and a bunch of other and map and net cat and all that kind of stuff if you use the right options and map needs to be on layer two sometimes but depending on how you're trying to scan but for TCP scans super useful and so you've essentially just use that SSH host to bounce into that network that you probably didn't have access to necessarily but thankfully just to think thankfully you had access to that one SSH host and you got in the next way you can port forward is kind of the opposite of the local forward which is the remote forward so say I am sitting on my laptop and I would like a port on that SSH server to open up and forward that port back to my system so I'll do this with SSH a lot to get from a system out to the network and then be able to do all of that same forwarding and tunneling and stuff just in the opposite way so say I'm actually on I'd have to be I have to be on both systems in this scenario so I'm on my laptop and then I also have access to this system in the network and I'm trying to expel some data or something I can't get out because they're blocking the internet but I have access to this I have access to my laptop so what I do is I SSH and I set up a remote forward from here that says hey listen on 2222 here and forward that back to me on port 22 which is SSH then from this system I can just use any of those SSH commands provided I have this age command line and I can do stuff like copy files to here but it's really forwarding to here so anyone looking at the network traffic nothing's actually going out over the firewall or anything it's just traffic going to here and then there's a secure connection to here from from the bounce host to my laptop so nothing actually unless you're really on the ball looks like it's coming from this to my laptop it's routing through this other system so what that looks like here is you use the dash R command for remote I'm going to tell it what port to listen on and I'm going to tell it the host port that I want it to or the host that I want to listen on and then the host port that I want it to forward to so I say listen on 2222 open that up on any so 0.0.0.0 is the any address and then forward that traffic back to me on port 22 I log in as Bob to that 10.10.10.10 I do minus and again because I don't want to actually get a shell here importantly to be able to do this listen on 0.0.0.0 the SSH server that I'm logging into so this guy 10.10.10.10 has to have gateway ports enabled or else you won't be able to do this by default luckily it's a pretty easy change you just update at the SSHD config we'll look at config stuff a little bit later but you can just change this generally it is no by default but you just change it to yes and then you restart SSH your connection stays alive everything keeps working and then you can do this and then from that system that's inside the network that can't get out SSH to the 10.10.10.10 on port 22 so this minus P tells it to go different than the default port I log in I can either log in or I can copy files or do whatever I want important thing to point out is if I'm on a system that I don't control if I'm on a system that I don't control and I SSH into my system I am potentially giving up credentials or a password or something to my system so be careful with this make sure that this system of this user that they're logging into is something that they they're not too worried about and that that user is locked down and that they can get everything or you're kind of letting them into your system and getting hacked yourself and you do not want to be that person so that's cool but it's a lot to type say I want to do the same scenario where I have a tunnel and I want to log into that I want to log in through my my jump box or my bounce node I want to land over here so I would have to SSH to here do a port forward to go over here and then SSH to that port forward and go over here and that's a lot of work and I'm a lazy hacker I want to do that thankfully the people that implement SSH are not lazy so they think of all of these things and have it done ahead of time SSH has this cool option called a proxy command the proxy command is the old way to do this and they've actually since implemented a new version but proxy command is still super useful and we'll see another use of this in just a second but what you do is you say minus so is option you say proxy command I want my proxy command to be SSH to that remote system again and then here percent H and percent P get replaced with the system that you're trying to look into so be remote and the port like I said this is kind of the old way to do it the SSH developers were nice enough to realize that this is also a lot to type so they made this thing called proxy jump which you can do minus J until it Bob this is essentially doing the same thing as this and then you're just logged in and like we saw you are now have this set up where you're actually SSH and through this system to here anybody monitoring this boundary for access to this system won't actually see that because you're actually going through here and to here you're not going straight to it so that is pretty useful way to get around some kind of common network monitoring and popping through some boundaries you can actually do some really cool stuff with this where you set up like different jump boxes and have them go through different layers and it's just to get pretty pretty fun and you can do some pretty crazy stuff so like I said though that proxy command is super interesting and shout out to subteefer kind of prompting me to look at this here I'm actually using a proxy command to configure my SSH to use an HTTP proxy to get to wherever I'm trying to go so I'll say that again I'm using a proxy command to use an HTTP proxy to get to where I'm trying to go so anybody looking at this traffic is going to see a connection to an HTTP proxy and not even realize that I'm SSH through that proxy out to the other side this is super useful when you're in a network that's very locked down and is only letting certain things through and you have to use an HTTP proxy to get out or if you just want to blend in another thing that is very useful here is so now I have all of these tunnels and this forwarding and all of this cool stuff that I want to set up but SSH is a TCP protocol so if anything happens in this connection any of the routers or something time out something weird happens that connection will die maybe I want this tunnel to be set up really long lived and how I accomplish this is what the command called auto SSH and what I like to do with this is I will set up auto SSH to log into my laptop and forward port 2222 on my laptop back to the host so I apologize the arrow is backwards here but it would actually forward from 2222 back to my host on 22 and funnel that traffic so I connect here and it goes out here so there's an auto SSH connection out it sets up that remote port forward to come back and if that connection dies auto SSH will restart it for me monitor that process and restart it for me effectively lets me maintain access to this and I don't have to do anything once it's set up and what that looks like is you use the auto SSH command it's just a tool that you can install I'm giving it some options here the server live interval server live max count so this will wait 30 seconds and it will max try 3 times and then I'm telling it to remote forward on 2222 to point port 22 on my local host and then I log into my laptop aka hack box and then on hack box I can SSH minus P to 2222 and tell it Bob because that's user that I have at local host and that's actually going to go through that tunnel back in through the network and then I'm just logged into that victim system once again this is super cool because like all someone monitoring this network would see as someone logging into a system remotely so say you're here this boundaries monitored all you see is an SSH out you don't actually see me tunneling back in so it looks like someone who already has logged into this just logged into something on the internet and that is what happened but then additionally I'm logging back into that system here so actually have shell access that I might they might not be wanting me to have so bunch of fun stuff you can do with port forwarding super useful for kind of crossing those security boundaries and getting into networks that you're not necessarily supposed to have access to with auto SSH you can maintain that access and if you get creative with it you can jump around and get to a bunch of different network segments and really make it confusing and all the port forwarding you can make it look like someone's connecting from a different system as long as you have access to connect all through so someone that's trying to trace that back through network logs or system logs is going to have a rough time because you're essentially using a proxy to get through a bunch of stuff and you can proxy proxy proxy and jump around and get to a bunch of different ways that you can configure SSH to do things that are kind of unexpected or just interesting configurations that are useful kind of in operations or in the in the process of doing things. First up I want to point out that we have these escape sequences so if I've SSH into a system and I have an interactive shell SSH actually has this kind of hidden shell that you send a special character sequence it's like a cheat code almost and it gives me all of this functionality. So what I did here is from my prompt I did new line till day question mark just in quick succession without anything else going on and that's showing me the help for this escape sequence prompt. Probably the most useful the ones I use all the time is the terminate connection so if something messes up with that SSH session and my term my shell is hung and I can't get it to work anymore instead of having to drop into another prompt and find the SSH process and kill it you can just do this till day new line till day dot and it kills the SSH session also super useful if your friends let you sit at a prompt for their SSH and you want to mess with them just do that real quick. The other one that is super useful here is the background or sorry the command line and that's the capital C so why is this useful you already saw you can just do this. With the command line right you can SSH minus L and open up the port or minus R and open up the port and all that kind of stuff. So this is one of those things that's really useful but not very often so the most years I have out of this is when I have access to SSH on a system someone's actually actively trying to defend it and they've changed the password on me or gotten rid of my SSH key that we'll see here in a minute. Or whatever I don't I can't log back into that prompt so I can't that SSH session so I can't log out to port forward but I want to port forward through that because I still have access and they haven't noticed like that my actual shell exists they just noticed that they can't was compromised so I can still scan the network and do a bunch of stuff from there. I just need to be able to change some of the port configs and I can't log out and log back in that is when this is the most useful so just like all of the other commands minus L minus R minus D. Let's you set up all those port forwards and then it's minus K L to cancel them or kill them. Once again super useful kind of keep it in your back pocket it's not. Really common that I run into this but when I have needed this it was invaluable. So we talked I talked a little bit about. Authorize key there so one of the things you can do with SSH is. Trying to log in and put your username and your password all the time isn't very much fun it's also kind of insecure we'll see a little bit later why that is pretty insecure. So SSH came up with this concept of an authorized key so this is just public public key cryptography I. Generate. Public private key pair I put the public key on the remote system that I want to log into in a configuration file and say anyone that has the private key for this public key is allowed to log in. So this is very very useful when you run into SSH for a couple different things. One is if you can get access to someone's pipe private key you can log into any of the systems as them that they log into. Because of that you actually generally you're prompted to put a password in to password protect that private key. So when you try to use it you have to decrypt the private key before you can use it. Most of the time or still a lot of the time sadly people that are generating these keys just hit enter twice and then you get an SSH or a private key that is not protected. And by sadly I mean awesome link because it's great and you find this all the time. So where that file is stored is generally there's two places SSH is either the SSH stuff is either an Etsy SSH which is the global configuration or here where we're looking at it in the users configuration which is the dot SSH folder in their home directory. So here specifically this is in roots home directory we've generated a key pair the default for the RSA keys is just ID under RSA and then you'll have ID under RSA dot pub. If you copy that ID under RSA dot pub to the dot SSH authorized keys file for any user you can log in to that user account without a password. So this is also super useful in the case where I land on a system and I don't know the user's password so I can't change their password. But I'd like to be able to SSH in is them I can add this key and then I can SSH into that account is them and have a full PTY shell that lets me do all of the things you would do with a full PTY shell edit files run so do all that kind of stuff. And essentially this lets you maintain access I don't need to know the user's password as long as that file exists. So this is also super useful for like hack the box style challenges where you get a web shell or just if you have a web shell as a user and you want to upgrade to that user level access you if you have the ability to write to this file then you just add an SSH key in here and you can log in SSH by default will check the permissions of that file and not use it if they aren't correct. But sometimes it is configured to not do that so it's always worth checking. Kind of the meta here is it's always worth looking in the SSH folder, there is a bunch of different stuff and we'll see more of that here coming up. So next is the known host file. So this file is a list of all the systems that it users logged into for anybody familiar with SSH when you SSH out to a system the first time it'll say hey I don't recognize the system this is the public key do you accept this when you do that it saves that into this file called the known hosts. The that known host file will have one entry per line and then it has the IP address or the host name and then the public key information. So this is super useful if I can see this and I'm the user say I haven't now have access to their unencrypted private key and then I also have access to all of the IP addresses that they're logging into pretty easy way to pivot around the network and find other systems that I have access to. The next file here that is super interesting is the SSH config. So all of that stuff that we've been going over all the port forwards all of the different things are super great. But typing all of that's horrible and I'm a lazy hacker. And once again the SSH developers, they know that I guess and they came up with a solution for it. So that's this SSH config like all most the other SSH stuff the default or the kind of system wide configuration is an Etsy SSH and then the user configuration is in dot SSH and the user's home directory. That config file looks like this so here someone has set up the host called bounce. The username is Bob they're logging into 10 dot 10 dot 10 dot 10 they would like to do a local forward of port 8080 to 192 168 1 dot 10 80. They're going to do a dynamic forward for 1080 and they're going to do a remote forward for 8080 on 192 168 1 dot 10 8080 on the command line. You can just do SSH bounce and then all of those configs will get set in the command line. You don't have to do anything at all anymore. It's just SSH bounce. It'll tab complete if you have bash completion. Super awesome. When you land on a system if you have access to this config file. So there's another way to find systems that people are logging into because they'll have a bunch of configs like this for easy mode accessing the systems that they access. You can see. Okay, so this Bob guy has access to 10 dot 10 dot 10 dot 10 and likes to check out these other systems on these ports. So something I can try to do. Another fun thing you can do with SSH config is get it to do stuff that people are not intending. So let's say in this scenario. I know that Bob is SSH from the server that he's on 10 dot 10 dot 10 dot 10 to that system that he has internally. Every time he does that, I would like to get a shell back to me on 41 41 from his system. With SSH config, I can do that. So here I configure it say, say I'm on his server for some reason, I have access to his SSH config. I'm going to go ahead and I like to set this up for all hosts. By default, you're not permitted to run a local command, but luckily in the config file, you can just tell it to let you do that. And what I'm going to do here is tell it the local command is to net cat me a bin bash shell to my IP address on my listener and background and then do whatever else Bob was trying to do. So every time Bob logs into a host, it will spin a shell back to me and I'll get access to his system. So say my shells keep dying or I just want to kind of maintain access and it's super easy. Wait, wait, wait. Another config file that is super awesome is this run commands file or RC file. This similarly has the Etsy Etsy version or the user version, but what this does is this runs a command when the user is logging in right before it drops them to a shell. So back to our scenario, say I'm actually on this this far system, and now I want a shell to come back to me every time somebody logs in. So when somebody logs into this system, it sends me a shell. What that looks like here is I just put this simple net cat listener, just like the other one roughly in this, I say net cat spit a shell back to me on my listener IP address on port 41 41 and then background and go ahead and keep doing whatever it is that people want to do. So I encourage people to look at the config files. There's a ton more things you can do in there. These are kind of simplified versions for slides and they demonstrate the purposes. With the config files and the port forwarding, you can really get yourself into some pretty nifty scenarios with that jump proxy command or proxy jump or command or config option. And then also it goes in the config file with those you can set up really intricate port forwards and get through all sorts of different interesting things. And like I was saying before, really kind of run havoc on networks and for someone trying to trace stuff back. Now let's look at a couple different ways that I've successfully gotten creds out of SSH. The first one being say I'm on a system and I know someone is logging into other systems. I see their SSH config, but I don't have their private key. They're not even using private keys. I just know they're using passwords. So I want to be able to get to that system that they're getting to, but I need to get that somehow. So the thing I like to do is I set a create a little shell script here that's in their path before the normal SSH commands. So the SSH command by default is in user bin SSH. Here I'm making a shell script called user local bin SSH that prompts the user for a password again. And then writes that password to a temp file and then just SSH is for them. So what that looks like, and I'm sure people that are used to SSH is you SSH out, it asks you for your password, you type out it. It just asks you for your password again, you typed it right, you're good to go and then eventually you exit. And you can see here that in temp.creds I've now stolen that super secret password. And I have Bob's password of one and two one sixty eight one and you may be able to pivot and kind of beyond the next thing. Additionally, let's say the other way is true. Someone's SSH into a server that I have access to and I want to see what their password is. Here I use the debug tool called s trace, which just looks for all of the system calls that happen in the binary. So I find the SSH process, I attach SSS trace to that SSHD process, and I tell it to just show me the reads, because I know just I know how the SSH Damon works. I know that when you connect into it, it sends you a prompt and then reads your password from you. So here I'm telling it to just show me all of the reads. There are a lot of reads, so I've gone ahead and grep them for this magic string that happens right before the password just as part of the protocol. And here you can see I've stolen this password of super secret from someone when they're logging into the SSH. Another really fun one here is using this paramico to create your own SSH server. So this is kind of the most basic example of this that I can show and make it actually fit in a slide and be useful. But the idea here is say I'm on a server and it's not running SSH, but I know someone is trying to log in. I need to speak enough of the SSH protocol to get them to give me their password. But I don't necessarily want to let them log in because I don't know what they're trying to do and I don't want to implement the entirety of all of SSH. So let's kind of run through this Python code a little bit. What I'm going to do here is for this this line here, I'm going to go ahead and grab the TCP socket, create a TCP socket. I'm going to bind on 22. So this means I have to have access to open those non-Ephemeral ports. I'm going to listen for one connection and then accept for that connection. So once I've got a connection, I let myself know, hey, someone from this adder has connected to me. Then I'm going to take advantage of paramico and I'm going to create, they call it transport in the paramico implementation. With that transport, I'm going to go ahead and add a server with the paramico RSA key. So I have just a test key. Like I said before, when you SSH out and it says, I don't recognize this, here's the public key. This is going to be that key that it gives them. This is one chance that they could detect this. So if they're trying to SSH in and it's a key that they don't recognize, you should just say no unless you know that there's a key that you should be seeing. But most people just say yes because they assume it's a server they haven't seen. And then I'm going to go ahead and start it with my server and tell it to just serve and then accept the connection. So what this looks like here is this now uses my server, they connect in, they get the SSH protocol does its negotiation and says the only thing I can do is password authentication. So they'll get a password prompt from the client because it knows how to speak enough of the protocol and then they'll send me the username and password to my SSH server. And that the paramico server will call this check off with the username and password that it got. I can say, hey, cool, check it out. I got a username and password and then tell it, no, that's not a valid username and password. So from the user's point of view, they tried to SSH in the SSH failed. They don't know why it is. They don't know what this box is anyway. It's not supposed to be on the network. So kind of ignore this, want to connect back shell. That's not what it's actually happening. I'm actually starting an SSH server here. So start my super secret awesome SSH server just with Python. It tells me, hey, I got a connection from here. And then, hey, that connection sent me Bob as the username and sent me Bob's super secret password. So I now have that password. I know where they came from. I can probably try to log into that and see if I can pivot from there or use that credential somewhere else on the network. So that is kind of an intro and some a little bit deeper, but not super crazy deep dive into all of the cool, not all of, but a bunch of the cool things you can do with SSH. You saw that just by default, it gives you remote shell, shell access, lets you do port forwarding, you can download upload files. It's all encrypted. That port forwarding, you can use that to accomplish almost any sort of hopping that you need to be able to do around network segmentation. So really, if you can get to port 22 and you have some sort of credential material to log into that port 22, you can do quite a bit inside a network. You can get access to systems you might not necessarily, you're not necessarily supposed to have access to. You can get around network protections that are trying to block you from doing things. You can mask your traffic in different protocols via proxies. You can make your traffic look like it's coming from different systems via proxies. With all of the configuration options you saw, you can trick the system into doing things or really trick users into doing things that you're not expecting. Different ways you can run SSH commands such that it's harder to trace or see that information on the system and download, upload, Xfill all of the data. And then really the cool thing about this is you can use all of these SSH options. These are the basic ones. You can combine all of this to make yourself the craziest network map that you want, pivot through all of the different things. SSH is becoming more and more ubiquitous across environments. It's now coming on Windows 10. You have WSL. It's very, very, very useful. So I hope that was helpful. I hope it made you think a time or two about SSH and what you can do with it and all that kind of stuff. I hope to stay connected with everybody. Rendori Attack is my team's Twitter. We are kind of always hiring someone at somewhere, so hit up our careers off of our webpage. And then if you're into information like this, follow our blog, Rendori TTPs are our tips, tricks and POCs. Check that out for lots of information like this. And then lastly, I'm pretty passionate about this. We need to make sure that we're taking care of ourselves and popping all these shells is awesome. Maintaining all of this access is super great, but we also need to make sure that we're taking the time to get away and keeping ourselves fit. So hashtag Red Team Fit, check us out on Twitter. There's a bunch of Discords all over the place and we've got a bunch of groups and doing all sorts of really awesome stuff. And that's what I got. Thanks everybody. Hashtag Red Team Fit.
 Great SSH shenanigans  This talk is going to be about all of the cool offensively focused things you can do with SSH if you are a  Red team or a pen tester and you don't have SSH in your toolbox already  Hopefully you'll see why you should have it in your toolbox and all the cool fun things you can do with that  And if you're an advanced you've already been using SSH hopefully there's a  Tip or a trick or two that you can pick up here as we go through all this  So what how is this talk gonna be?  How's this talk gonna go?  We're gonna start off with the basics because you have to start at the beginning  Then we're gonna start  Looking at all the interesting thing you can interesting things you can do with port forwards  How you can use those to get past firewalls hide your traffic?  Make it look like you're accessing systems from other systems and a bunch of cool things  Next we'll look at the configurations. So fun with the configs  SSH has a bunch of different ways you can modify its behavior and make it do things that users are probably not intending  Leaks a bunch of information about what users are accessing  How they're accessing them where they're accessing them?  etc  And then lastly we will lastly we'll look at stealing creds. So  SSH as we'll see has access to credential material and we would like to get access to that and we will show a couple different  successful strategies in doing so  First who am I my name is Evan  I'm also syndrome on Twitter. I  Am the director of offense at a company called Grand Dory  I've been reading forever. I'm in the CTFs. I do ccc all that kind of stuff. So check check me out  Let's get into it so the basics  What starting off? What is SSH? So SSH stands for secure shell  It is a replacement for the original plain text protocols of telnet and rsh  Which we both used to get shell access onto UNIX systems  And administer those remotely  SSH can be used to refer to both the Damon and the client  So you will hear someone say SSH to that box  That means that they use the SSH client to connect to a server that was running SSH Damon  and  Logged into it that way got a prompt and did whatever  The most common versions of SSH that you're gonna run into are open SSH  Open SSH runs on pretty much everything now and there are a few other ones that will go over  server and client coming up  Like I said, it's used to remotely administer systems  You can upload and download files. You can run commands on the shell  Etc. And then SSH also provides encrypted channels, which are little tunnels that you can make in the SSH session  that'll let you do port forwarding that we'll see here in a minute x11 forwarding and  Like get get your shell  So why is SSH useful for an attacker  Really SSH should be can be thought of as a Swiss Army knife for Red Teams  This lets me accomplish anything I need to do with a system if I can get SSH access so I can  Download files. I can upload files. I can run commands. I can maintain access to a system. I  Can configure the system such that it does things differently than the user is expecting I  Can get credentials out of it all of the things that I need to be able to do to get systems and get into systems and  Pivot around inside a network and it's all encrypted by default for me  So the common SSH clients and tools that you'll run into  Like I said on most unixes the common SSH implementation is open SSH  on  Embedded systems sometimes you'll run into drop bear  Which is just a like a very small  Implementation of SSH and just the difference here is some of the functionality might not that we go over here might not work in open  SSH or in excuse me in drop bear or some of the other SSH servers  There's actually just SSH comm has an SSH server and there's a few different ones  But most of time you're going to run into SSH and most of the stock is geared towards that  On Windows you can obviously drop into WSL WSL 2 and then you're just at a Linux prompt  So you'll have the SSH client  There's a GUI that's called putty which is  From way back when and then there's Plink which is the CLI implementation that uses the same  SSH stuff under the hood that putty's using and  Additionally on Windows 10  after 1809  Open SSH is available in the Windows app store. So you can get the SSH server and the SSH client  And then lastly another tool that's super common that we're going to take a look at a little bit here is  Paramiko which is a Python library that implements the entire protocol the entire SSH protocol both client and server  In Python super useful for being able to write scripts to do  Either like log into systems for you and do stuff or as we'll see later  Make a server  Another reason SSH is super useful here, it's really simple to enumerate so  By default SSH is port 22  That's the port that it has registered. You can move it to different ports, but  All of the servers if they're installed just by like with the app or whatever is SSH  Here you can just use netcat and just grab the banner  Really simple banner up front. It tells you that it's SSH  2.0 is the protocol of SSH that it's speaking the version as you can see this is an open SSH server  8.31 and then it's running on a Debian system. So just with netcat I can tell what  Version of SSH is installed what or what version of SSH protocol the SSH Damon speaks  What version of SSH is installed and the operating system?  There's even more stuff that you can figure out so with net and map or a bunch of other  There's a bunch of other tools that can do this, but lots people not use end map when you run the  Discovery scripts it will do that banner grab for you  And it will also enumerate all the algorithms that the SSH is using so  SSH is a pretty old protocol there  You'll run into systems that have older more insecure algorithms and potentially vulnerable SSH versions  So there are some versions of SSH that are vulnerable the user enumeration and command  injection and all sorts of stuff so  That it is so easy to enumerate is pretty nice  So continuing on with the basics here just running a command on the remote system there's  two strategies here  Essentially the first is I'm going to connect to the remote system and request a interactive shell so  That first command is just SSH that's going to launch the command line Bob at and then the IP address is 10 dot 10 dot 10 dot 10  So that's saying login to 10 dot 10 dot 10 dot 10 as the user Bob  I cut out some stuff here it'll prompt you for a password and then you can just run commands  Interactively like you're sitting at a console on that system so here you can see you can run the command who am I and you see that you're Bob  The other way you do this is to run a single command at a time so I say SSH Bob at 10 dot 10 dot 10 dot 10 who am I it says Bob  This is super useful if the system is being actively defended so say one of the blue team or someone is actually on the system watching for connections and seeing who's logged in  This they'd have to catch that and run that command while the who it who am I command is running or whatever command you want to run this is just an example  But they'd have to actually see that to see that you're logged in you will this will still show up and last and in all of the logs and everything  But if someone's just sitting there trying to see if someone's actually logged in and watching for SSH processes to start this will let you have a little race  Where you can run your command hopefully before they actually catch you doing whatever the thing is that you want to do  Like I said earlier you can use SSH to copy files so I can copy a file from my system to the remote system or I can copy a file from the remote system to my system  There's two ways to actually do this the first one that I've laid out here is SCP so secure copy and in the first the first example here I'm going to upload a file from my computer to the remote system  So what that looks like is I do SCP the file that I want to copy up and then I'm just like before we saw I'm going to do the username at that system and then I'm going to give it the path that I want to copy it to  So here I want to say in the user's home directory in the bin folder name my file not malware so I'm going to copy my malware up there and hopefully they won't catch it because I called it not malware  And that is super secret and they will totally never be able to figure that out  Next say I want to download a file from their remote system so I've been looking around and I see that there is this Etsy secret sauce that I'd like to get  From my local system just like before it's source and destination but I want the source now to be the file on the remote system and then the destination to be the file on my system  So SCP Bob at the remote system the path that the files at so here it's Etsy secret sauce and then finally the my loop folder so every good hacker kid should have a loop folder and I'm going to copy that secret sauce into that folder  Additionally with SCP I can recursively copy so say I just want to grab everything in that secret folder I don't know what it is I'll look at it later I'm going to go ahead and use the minus R for recursive flag here to SCP  So SCP minus our Bob at 10.10.10.10 the Etsy secret folder down into my loop folder  The next way you can copy files is with the SFTP command so this is secure FTP  This is actually a completely different implement or different part of the protocol to copy those files  So SCP and SFTP while they accomplish the same thing are actually doing different stuff under the hood but functionally it's the same and if you're familiar with FTP hopefully this makes sense  You SFTP as Bob to 10.10.10.10 and then the first command I want to download a file so I get that file I say get from secret sauce to my loop folder secret sauce  The next example I want to upload a file so SFTP Bob at 10.10.10.10 I'm going to put from my artifacts folder the malware I'm just going to put it into not malware once again super secret no one will ever catch that totally not malware don't look at it it's fine  And similar to SCP SFTP has a recursive option for the get command so get minus our slash temp secret from the remote side so say that's a folder and then I'm just going to download it into my temp folder until I can figure out what to do with it  And you can see what happened there so kind of the basics there SSH lets you log into a remote system get a shell on that system if you want you can run command singularly so you don't even have an interactive session so it's a lot harder to find  You can copy files down you can copy or you can download files you can upload files even that just alone is super useful to an attacker just in and of itself but let's go ahead and move on forward to fun with port forwards  And we'll see kind of the more advanced stuff you can do and how you can use this SSH in your tool belt to get around common firewall setups and that kind of kind of thing so first here we're going to do look at local forwarding  So in this scenario I have access to the 10.10.10.10 system hopefully that was enough 10s and I happen to know that that is sitting on a boundary so here in this slide I'm showing you that I have this box which I'm going to call my jump box so 10.10.10  Or you'll also hear this called a bounce node and I'll probably go back and forth but I happen to know that this is sitting on a like a security boundary here and there are other systems back in here that I'd like to get access to  I can use SSH to forward ports from my system through that system look at it look a little bit like this so I'll have port 8080 on my local system will jump through that 10.10.10.10 system and then point at one of the systems on the other side  all of that will go over the SSH tunnel so that traffic is encrypted from my laptop here to this system and then it comes out of here and will wind up over on looking at this system  what that looks like on the command line is you use the minus capital L for local forward and you want to tell it the port on your system that you want to listen on the host that you want that connection to go to on the far side and the host port on the far side that you would like to go to  so in practice what this looks like is SSH minus capital L I want to listen on my host on port 8080 on my laptop and I want that traffic when I go to port 8080 to go out the other side to 192.168.1.10 on port 80  so say there's a web server on that system that I'm trying to get access to and then I'm logging in as Bob to that bounce node 10.10.10.10.10 I should have done different IP addresses and then interestingly here I'm going to give it minus N so that tells it not to request a shell and then I'm going to background it  what that does is now I have 8080 listening I can now go on to my next command I didn't request a shell on the remote system so once again if there's a defender watching that system trying to see like run a who or see who's logged into it  all they'll actually see is that there's an SSHD process it doesn't actually spawn a shell or anything and then if they're really on the ball they'll look at net stat and see the network connection but most of the time they just won't realize that there's somebody logged in and then like I said that's  backgrounded so on my local system now I can point curl at local host on port 8080 and so there's a HTTP server there that happens to be serving a file called secret that I need to get and I get it and it looks like I won  that's super fun and all being able to do a local forward but I want to do that one by one by one through all these systems on this network thankfully SSH was nice enough to think of the this the kind developers of open SSH  implemented this thing called dynamic port forwarding so what this does is this lets me open up on my system a port that will forward over that SSH channel either socks for or socks five proxy and then I'm essentially using that SSH server as a proxy  server and I can get to any of the systems behind that network as long as whatever I'm using speaks that SSH protocol so if I point my if I use this proxy port then I can get proxy that through this system and just get to any of the systems that are behind here in the  the way this kind of basic network example is laid out and kind of counterintuitively here it's actually easier to do this than the just singular local forward so at least on the SSH side so all I'm doing here is minus capital D for dynamic and that does a  dynamic forward I'm telling it port ten eighty common socks port and then same thing Bob at ten dot ten dot ten dot ten think I got that right this time and super nice and easy once I run that command I've successfully logged in and now have proxy server I've turned that SSH system into a proxy  server so what I can do with that is I can point a web browser at that proxy server so for instance here Firefox some Firefox you go preferences network settings manual manual proxy comp here and then click the manual proxy comp button and then do socks host and here I've picked socks five and then I just tell it my port ten  now anything my browser tries to go to is going to forward over that socks proxy and come out in that other network  additionally you can use proxy chains there's actually a couple different tools to do this but proxy chains is the one that I know how to use so it's pretty easy for me is you can use proxy chains here and you just configure it to tell it where the proxy host is and then you use the command proxy  chains here I'm just going to drop in a bash and what proxy chains does is it hijacks the the libc calls to socket operations and then forwards them over that for TCP operations forwards them over that socks protocol speaks to the socks protocol and then  you can do a lot of traffic over so anything in that bash bash session gets forwarded over that proxy you can do one off commands but I like to drop in a bash here a lot because you can do curl and a bunch of other and map and net cat and all that kind of stuff if you use the right options  and map needs to be on layer two sometimes but depending on how you're trying to scan but for TCP scans super useful and so you've essentially just use that SSH host to bounce into that network that you probably didn't have access to necessarily but thankfully just to think thankfully you had access to that one SSH host and you got in  the next way you can port forward is kind of the opposite of the local forward which is the remote forward so say I am sitting on my laptop and I would like a port on that SSH server to open up and forward that port back to my system  so I'll do this with SSH a lot to get from a system out to the network and then be able to do all of that same forwarding and tunneling and stuff just in the opposite way so say I'm actually on I'd have to be I have to be on both systems in this scenario so I'm on my laptop and then I also have access to this system in the network and I'm  trying to expel some data or something I can't get out because they're blocking the internet but I have access to this I have access to my laptop so what I do is I SSH and I set up a remote forward from here that says hey listen on 2222 here and forward that back to me on port 22 which is SSH  then from this system I can just use any of those SSH commands provided I have this age command line and I can do stuff like copy files to here but it's really forwarding to here so anyone looking at the network traffic nothing's actually going out over the firewall or anything it's just traffic going to  here and then there's a secure connection to here from from the bounce host to my laptop so nothing actually unless you're really on the ball looks like it's coming from this to my laptop it's routing through this other system  so what that looks like here is you use the dash R command for remote I'm going to tell it what port to listen on and I'm going to tell it the host port that I want it to or the host that I want to listen on and then the host port that I want it to forward to  so I say listen on 2222 open that up on any so 0.0.0.0 is the any address and then forward that traffic back to me on port 22 I log in as Bob to that 10.10.10.10 I do minus and again because I don't want to actually get a shell here  importantly to be able to do this listen on 0.0.0.0 the SSH server that I'm logging into so this guy 10.10.10.10 has to have gateway ports enabled or else you won't be able to do this by default  luckily it's a pretty easy change you just update at the SSHD config we'll look at config stuff a little bit later but you can just change this generally it is no by default but you just change it to yes and then you restart SSH your connection stays alive everything  keeps working and then you can do this and then from that system that's inside the network that can't get out SSH to the 10.10.10.10 on port 22 so this minus P tells it to go different than the default port I log in I can either log in or I can copy files or do whatever I want  important thing to point out is if I'm on a system that I don't control if I'm on a system that I don't control and I SSH into my system I am potentially giving up credentials or a password or something to my system  so be careful with this make sure that this system of this user that they're logging into is something that they they're not too worried about and that that user is locked down and that they can get everything or you're kind of letting them into your system and getting hacked yourself and you do not want to be that person  so that's cool but it's a lot to type say I want to do the same scenario where I have a tunnel and I want to log into that I want to log in through my my jump box or my bounce node I want to land over here so I would have to SSH to here do a port forward to go over here and then SSH to that port forward and go over here  and that's a lot of work and I'm a lazy hacker I want to do that thankfully the people that implement SSH are not lazy so they think of all of these things and have it done ahead of time SSH has this cool option called a proxy command  the proxy command is the old way to do this and they've actually since implemented a new version but proxy command is still super useful and we'll see another use of this in just a second but what you do is you say minus so is option you say proxy command I want my proxy command to be SSH to that remote system again  and then here percent H and percent P get replaced with the system that you're trying to look into so be remote and the port like I said this is kind of the old way to do it the SSH developers were nice enough to realize that this is also a lot to type  so they made this thing called proxy jump which you can do minus J until it Bob this is essentially doing the same thing as this and then you're just logged in and like we saw you are now have this set up where you're actually SSH and through this system to here  anybody monitoring this boundary for access to this system won't actually see that because you're actually going through here and to here you're not going straight to it so that is pretty useful way to get around some kind of common network monitoring and popping through some boundaries  you can actually do some really cool stuff with this where you set up like different jump boxes and have them go through different layers and it's just to get pretty pretty fun and you can do some pretty crazy stuff  so like I said though that proxy command is super interesting and shout out to subteefer kind of prompting me to look at this here I'm actually using a proxy command to configure my SSH to use an HTTP proxy to get to wherever I'm trying to go  so I'll say that again I'm using a proxy command to use an HTTP proxy to get to where I'm trying to go so anybody looking at this traffic is going to see a connection to an HTTP proxy and not even realize that I'm SSH through that proxy out to the other side  this is super useful when you're in a network that's very locked down and is only letting certain things through and you have to use an HTTP proxy to get out or if you just want to blend in  another thing that is very useful here is so now I have all of these tunnels and this forwarding and all of this cool stuff that I want to set up but SSH is a TCP protocol so if anything happens in this connection any of the routers or something time out something weird happens that connection will die  maybe I want this tunnel to be set up really long lived and how I accomplish this is what the command called auto SSH and what I like to do with this is I will set up auto SSH to log into my laptop and forward port 2222 on my laptop back to the host  so I apologize the arrow is backwards here but it would actually forward from 2222 back to my host on 22 and funnel that traffic so I connect here and it goes out here  so there's an auto SSH connection out it sets up that remote port forward to come back and if that connection dies auto SSH will restart it for me monitor that process and restart it for me effectively lets me maintain access to this and I don't have to do anything  once it's set up and what that looks like is you use the auto SSH command it's just a tool that you can install I'm giving it some options here the server live interval server live max count so this will wait 30 seconds and it will max try 3 times  and then I'm telling it to remote forward on 2222 to point port 22 on my local host and then I log into my laptop aka hack box and then on hack box I can SSH minus P to 2222 and tell it Bob because that's user that I have at local host and that's actually going to go through that tunnel back in through the network and then I'm just logged into that victim system  once again this is super cool because like all someone monitoring this network would see as someone logging into a system remotely so say you're here this boundaries monitored all you see is an SSH out you don't actually see me tunneling back in so it looks like someone who already has logged into this just logged into something on the internet  and that is what happened but then additionally I'm logging back into that system here so actually have shell access that I might they might not be wanting me to have  so bunch of fun stuff you can do with port forwarding super useful for kind of crossing those security boundaries and getting into networks that you're not necessarily supposed to have access to with auto SSH you can maintain that access and if you get creative with it you can jump around and get to a bunch of different network segments and really make it confusing  and all the port forwarding you can make it look like someone's connecting from a different system as long as you have access to connect all through so someone that's trying to trace that back through network logs or system logs is going to have a rough time because you're essentially using a proxy to get through a bunch of stuff and you can proxy proxy proxy and jump around and  get to a bunch of different ways that you can configure SSH to do things that are kind of unexpected or just interesting configurations that are useful kind of in operations or in the in the process of doing things.  First up I want to point out that we have these escape sequences so if I've SSH into a system and I have an interactive shell SSH actually has this kind of hidden shell that you send a special character sequence it's like a cheat code almost and it gives me all of this functionality.  So what I did here is from my prompt I did new line till day question mark just in quick succession without anything else going on and that's showing me the help for this escape sequence prompt.  Probably the most useful the ones I use all the time is the terminate connection so if something messes up with that SSH session and my term my shell is hung and I can't get it to work anymore instead of having to drop into another prompt and find the SSH process and kill it you can just do this till day new line till day dot and it kills the  SSH session also super useful if your friends let you sit at a prompt for their SSH and you want to mess with them just do that real quick.  The other one that is super useful here is the background or sorry the command line and that's the capital C so why is this useful you already saw you can just do this.  With the command line right you can SSH minus L and open up the port or minus R and open up the port and all that kind of stuff.  So this is one of those things that's really useful but not very often so the most years I have out of this is when I have access to SSH on a system someone's actually actively trying to defend it and they've changed the password on me or gotten rid of my SSH key that we'll see here in a minute.  Or whatever I don't I can't log back into that prompt so I can't that SSH session so I can't log out to port forward but I want to port forward through that because I still have access and they haven't noticed like that my actual shell exists they just noticed that they can't was compromised so I can still scan the network and do a bunch of stuff from there.  I just need to be able to change some of the port configs and I can't log out and log back in that is when this is the most useful so just like all of the other commands minus L minus R minus D.  Let's you set up all those port forwards and then it's minus K L to cancel them or kill them.  Once again super useful kind of keep it in your back pocket it's not.  Really common that I run into this but when I have needed this it was invaluable.  So we talked I talked a little bit about.  Authorize key there so one of the things you can do with SSH is.  Trying to log in and put your username and your password all the time isn't very much fun it's also kind of insecure we'll see a little bit later why that is pretty insecure.  So SSH came up with this concept of an authorized key so this is just public public key cryptography I.  Generate.  Public private key pair I put the public key on the remote system that I want to log into in a configuration file and say anyone that has the private key for this public key is allowed to log in.  So this is very very useful when you run into SSH for a couple different things.  One is if you can get access to someone's pipe private key you can log into any of the systems as them that they log into.  Because of that you actually generally you're prompted to put a password in to password protect that private key.  So when you try to use it you have to decrypt the private key before you can use it.  Most of the time or still a lot of the time sadly people that are generating these keys just hit enter twice and then you get an SSH or a private key that is not protected.  And by sadly I mean awesome link because it's great and you find this all the time.  So where that file is stored is generally there's two places SSH is either the SSH stuff is either an Etsy SSH which is the global configuration or here where we're looking at it in the users configuration which is the dot SSH folder in their home directory.  So here specifically this is in roots home directory we've generated a key pair the default for the RSA keys is just ID under RSA and then you'll have ID under RSA dot pub.  If you copy that ID under RSA dot pub to the dot SSH authorized keys file for any user you can log in to that user account without a password.  So this is also super useful in the case where I land on a system and I don't know the user's password so I can't change their password.  But I'd like to be able to SSH in is them I can add this key and then I can SSH into that account is them and have a full PTY shell that lets me do all of the things you would do with a full PTY shell edit files run so do all that kind of stuff.  And essentially this lets you maintain access I don't need to know the user's password as long as that file exists.  So this is also super useful for like hack the box style challenges where you get a web shell or just if you have a web shell as a user and you want to upgrade to that user level access you if you have the ability to write to this file then you just add an SSH key in here and you can log in SSH by default will check the permissions of that file and not use it if they aren't correct.  But sometimes it is configured to not do that so it's always worth checking.  Kind of the meta here is it's always worth looking in the SSH folder, there is a bunch of different stuff and we'll see more of that here coming up.  So next is the known host file.  So this file is a list of all the systems that it users logged into for anybody familiar with SSH when you SSH out to a system the first time it'll say hey I don't recognize the system this is the public key do you accept this when you do that it saves that into this file called the known hosts.  The that known host file will have one entry per line and then it has the IP address or the host name and then the public key information.  So this is super useful if I can see this and I'm the user say I haven't now have access to their unencrypted private key and then I also have access to all of the IP addresses that they're logging into pretty easy way to pivot around the network and find other systems that I have access to.  The next file here that is super interesting is the SSH config. So all of that stuff that we've been going over all the port forwards all of the different things are super great.  But typing all of that's horrible and I'm a lazy hacker.  And once again the SSH developers, they know that I guess and they came up with a solution for it.  So that's this SSH config like all most the other SSH stuff the default or the kind of system wide configuration is an Etsy SSH and then the user configuration is in dot SSH and the user's home directory.  That config file looks like this so here someone has set up the host called bounce.  The username is Bob they're logging into 10 dot 10 dot 10 dot 10 they would like to do a local forward of port 8080 to 192 168 1 dot 10 80.  They're going to do a dynamic forward for 1080 and they're going to do a remote forward for 8080 on 192 168 1 dot 10 8080 on the command line.  You can just do SSH bounce and then all of those configs will get set in the command line. You don't have to do anything at all anymore.  It's just SSH bounce. It'll tab complete if you have bash completion. Super awesome.  When you land on a system if you have access to this config file.  So there's another way to find systems that people are logging into because they'll have a bunch of configs like this for easy mode accessing the systems that they access.  You can see. Okay, so this Bob guy has access to 10 dot 10 dot 10 dot 10 and likes to check out these other systems on these ports.  So something I can try to do.  Another fun thing you can do with SSH config is get it to do stuff that people are not intending.  So let's say in this scenario.  I know that Bob is SSH from the server that he's on 10 dot 10 dot 10 dot 10 to that system that he has internally.  Every time he does that, I would like to get a shell back to me on 41 41 from his system.  With SSH config, I can do that. So here I configure it say, say I'm on his server for some reason, I have access to his SSH config.  I'm going to go ahead and I like to set this up for all hosts.  By default, you're not permitted to run a local command, but luckily in the config file, you can just tell it to let you do that.  And what I'm going to do here is tell it the local command is to net cat me a bin bash shell to my IP address on my listener and background and then do whatever else Bob was trying to do.  So every time Bob logs into a host, it will spin a shell back to me and I'll get access to his system.  So say my shells keep dying or I just want to kind of maintain access and it's super easy.  Wait, wait, wait.  Another config file that is super awesome is this run commands file or RC file.  This similarly has the Etsy Etsy version or the user version, but what this does is this runs a command when the user is logging in right before it drops them to a shell.  So back to our scenario, say I'm actually on this this far system, and now I want a shell to come back to me every time somebody logs in.  So when somebody logs into this system, it sends me a shell.  What that looks like here is I just put this simple net cat listener, just like the other one roughly in this, I say net cat spit a shell back to me on my listener IP address on port 41 41 and then background and go ahead and keep doing whatever it is that people want to do.  So I encourage people to look at the config files.  There's a ton more things you can do in there.  These are kind of simplified versions for slides and they demonstrate the purposes.  With the config files and the port forwarding, you can really get yourself into some pretty nifty scenarios with that jump proxy command or proxy jump or command or config option.  And then also it goes in the config file with those you can set up really intricate port forwards and get through all sorts of different interesting things.  And like I was saying before, really kind of run havoc on networks and for someone trying to trace stuff back.  Now let's look at a couple different ways that I've successfully gotten creds out of SSH.  The first one being say I'm on a system and I know someone is logging into other systems.  I see their SSH config, but I don't have their private key.  They're not even using private keys.  I just know they're using passwords.  So I want to be able to get to that system that they're getting to, but I need to get that somehow.  So the thing I like to do is I set a create a little shell script here that's in their path before the normal SSH commands.  So the SSH command by default is in user bin SSH.  Here I'm making a shell script called user local bin SSH that prompts the user for a password again.  And then writes that password to a temp file and then just SSH is for them.  So what that looks like, and I'm sure people that are used to SSH is you SSH out, it asks you for your password, you type out it.  It just asks you for your password again, you typed it right, you're good to go and then eventually you exit.  And you can see here that in temp.creds I've now stolen that super secret password.  And I have Bob's password of one and two one sixty eight one and you may be able to pivot and kind of beyond the next thing.  Additionally, let's say the other way is true.  Someone's SSH into a server that I have access to and I want to see what their password is.  Here I use the debug tool called s trace, which just looks for all of the system calls that happen in the binary.  So I find the SSH process, I attach SSS trace to that SSHD process, and I tell it to just show me the reads, because I know just I know how the SSH Damon works.  I know that when you connect into it, it sends you a prompt and then reads your password from you.  So here I'm telling it to just show me all of the reads.  There are a lot of reads, so I've gone ahead and grep them for this magic string that happens right before the password just as part of the protocol.  And here you can see I've stolen this password of super secret from someone when they're logging into the SSH.  Another really fun one here is using this paramico to create your own SSH server.  So this is kind of the most basic example of this that I can show and make it actually fit in a slide and be useful.  But the idea here is say I'm on a server and it's not running SSH, but I know someone is trying to log in.  I need to speak enough of the SSH protocol to get them to give me their password.  But I don't necessarily want to let them log in because I don't know what they're trying to do and I don't want to implement the entirety of all of SSH.  So let's kind of run through this Python code a little bit.  What I'm going to do here is for this this line here, I'm going to go ahead and grab the TCP socket, create a TCP socket.  I'm going to bind on 22.  So this means I have to have access to open those non-Ephemeral ports.  I'm going to listen for one connection and then accept for that connection.  So once I've got a connection, I let myself know, hey, someone from this adder has connected to me.  Then I'm going to take advantage of paramico and I'm going to create, they call it transport in the paramico implementation.  With that transport, I'm going to go ahead and add a server with the paramico RSA key.  So I have just a test key.  Like I said before, when you SSH out and it says, I don't recognize this, here's the public key.  This is going to be that key that it gives them.  This is one chance that they could detect this.  So if they're trying to SSH in and it's a key that they don't recognize, you should just say no unless you know that there's a key that you should be seeing.  But most people just say yes because they assume it's a server they haven't seen.  And then I'm going to go ahead and start it with my server and tell it to just serve and then accept the connection.  So what this looks like here is this now uses my server, they connect in, they get the SSH protocol does its negotiation and says the only thing I can do is password authentication.  So they'll get a password prompt from the client because it knows how to speak enough of the protocol and then they'll send me the username and password to my SSH server.  And that the paramico server will call this check off with the username and password that it got.  I can say, hey, cool, check it out.  I got a username and password and then tell it, no, that's not a valid username and password.  So from the user's point of view, they tried to SSH in the SSH failed.  They don't know why it is. They don't know what this box is anyway.  It's not supposed to be on the network.  So kind of ignore this, want to connect back shell. That's not what it's actually happening.  I'm actually starting an SSH server here.  So start my super secret awesome SSH server just with Python.  It tells me, hey, I got a connection from here.  And then, hey, that connection sent me Bob as the username and sent me Bob's super secret password.  So I now have that password. I know where they came from.  I can probably try to log into that and see if I can pivot from there or use that credential somewhere else on the network.  So that is kind of an intro and some a little bit deeper, but not super crazy deep dive into all of the cool,  not all of, but a bunch of the cool things you can do with SSH.  You saw that just by default, it gives you remote shell, shell access,  lets you do port forwarding, you can download upload files. It's all encrypted.  That port forwarding, you can use that to accomplish almost any sort of hopping that you need to be able to do around network segmentation.  So really, if you can get to port 22 and you have some sort of credential material to log into that port 22,  you can do quite a bit inside a network. You can get access to systems you might not necessarily,  you're not necessarily supposed to have access to. You can get around network protections that are trying to block you from doing things.  You can mask your traffic in different protocols via proxies.  You can make your traffic look like it's coming from different systems via proxies.  With all of the configuration options you saw, you can trick the system into doing things or really trick users into doing things that you're not expecting.  Different ways you can run SSH commands such that it's harder to trace or see that information on the system and download, upload, Xfill all of the data.  And then really the cool thing about this is you can use all of these SSH options. These are the basic ones.  You can combine all of this to make yourself the craziest network map that you want, pivot through all of the different things.  SSH is becoming more and more ubiquitous across environments. It's now coming on Windows 10. You have WSL. It's very, very, very useful.  So I hope that was helpful. I hope it made you think a time or two about SSH and what you can do with it and all that kind of stuff.  I hope to stay connected with everybody. Rendori Attack is my team's Twitter.  We are kind of always hiring someone at somewhere, so hit up our careers off of our webpage.  And then if you're into information like this, follow our blog, Rendori TTPs are our tips, tricks and POCs.  Check that out for lots of information like this.  And then lastly, I'm pretty passionate about this. We need to make sure that we're taking care of ourselves and popping all these shells is awesome.  Maintaining all of this access is super great, but we also need to make sure that we're taking the time to get away and keeping ourselves fit.  So hashtag Red Team Fit, check us out on Twitter. There's a bunch of Discords all over the place and we've got a bunch of groups and doing all sorts of really awesome stuff.  And that's what I got. Thanks everybody. Hashtag Red Team Fit.
DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_0_863.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_864_2447.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_2448_2999.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_3000_3047.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_3048_3095.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_3096_5147.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_5148_6347.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_6348_8903.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_8904_11411.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_11412_13823.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_13824_16931.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_16932_19643.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_19644_19751.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_19752_19955.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_19956_20003.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_20004_21191.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_21192_21971.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_21972_24599.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_24600_24707.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_24708_24779.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_24780_26087.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_26088_27059.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_27060_27827.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_27828_29843.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_29844_32387.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_32388_34691.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_34692_34739.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_34740_35411.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_35412_36275.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_36276_37679.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_37680_38231.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_38232_38567.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_38568_40031.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_40032_41843.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_41844_42923.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_42924_43775.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_43776_43907.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_43908_43955.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_43956_44015.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_44016_44075.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_44076_44231.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_44232_44327.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_44328_44375.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_44376_44435.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_44436_44555.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_44556_44603.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_44604_44747.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_44748_44807.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_44808_44975.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_44976_45083.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_45084_45155.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_45156_45203.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_45204_45467.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_45468_47411.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_47412_49655.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_49656_55031.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_55032_56279.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_56280_57251.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_57252_58919.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_58920_59651.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_59652_60503.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_60504_60935.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_60936_61439.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_61440_61835.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_61836_63275.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_63276_63503.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_63504_64595.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_64596_65219.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_65220_66623.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_66624_70727.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_70728_70907.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_70908_71639.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_71640_74459.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_74460_75491.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_75492_76343.png DEF_CON_Safe_Mode_Red_Team_Village_-_Evan_Anderson_asm1GoNYObM_76344_76351.png
Great SSH shenanigans This talk is going to be about all of the cool offensively focused things you can do with SSH if you are a Red team or a pen tester and you don't have SSH in your toolbox already Hopefully you'll see why you should have it in your toolbox and all the cool fun things you can do with that And if you're an advanced you've already been using SSH hopefully there's a Tip or a trick or two that you can pick up here as we go through all this So what how is this talk gonna be? How's this talk gonna go? We're gonna start off with the basics because you have to start at the beginning Then we're gonna start Looking at all the interesting thing you can interesting things you can do with port forwards How you can use those to get past firewalls hide your traffic? Make it look like you're accessing systems from other systems and a bunch of cool things Next we'll look at the configurations. So fun with the configs SSH has a bunch of different ways you can modify its behavior and make it do things that users are probably not intending Leaks a bunch of information about what users are accessing How they're accessing them where they're accessing them? etc And then lastly we will lastly we'll look at stealing creds. So SSH as we'll see has access to credential material and we would like to get access to that and we will show a couple different successful strategies in doing so First who am I my name is Evan I'm also syndrome on Twitter. I Am the director of offense at a company called Grand Dory I've been reading forever. I'm in the CTFs. I do ccc all that kind of stuff. So check check me out Let's get into it so the basics What starting off? What is SSH? So SSH stands for secure shell It is a replacement for the original plain text protocols of telnet and rsh Which we both used to get shell access onto UNIX systems And administer those remotely SSH can be used to refer to both the Damon and the client So you will hear someone say SSH to that box That means that they use the SSH client to connect to a server that was running SSH Damon and Logged into it that way got a prompt and did whatever The most common versions of SSH that you're gonna run into are open SSH Open SSH runs on pretty much everything now and there are a few other ones that will go over server and client coming up Like I said, it's used to remotely administer systems You can upload and download files. You can run commands on the shell Etc. And then SSH also provides encrypted channels, which are little tunnels that you can make in the SSH session that'll let you do port forwarding that we'll see here in a minute x11 forwarding and Like get get your shell So why is SSH useful for an attacker Really SSH should be can be thought of as a Swiss Army knife for Red Teams This lets me accomplish anything I need to do with a system if I can get SSH access so I can Download files. I can upload files. I can run commands. I can maintain access to a system. I Can configure the system such that it does things differently than the user is expecting I Can get credentials out of it all of the things that I need to be able to do to get systems and get into systems and Pivot around inside a network and it's all encrypted by default for me So the common SSH clients and tools that you'll run into Like I said on most unixes the common SSH implementation is open SSH on Embedded systems sometimes you'll run into drop bear Which is just a like a very small Implementation of SSH and just the difference here is some of the functionality might not that we go over here might not work in open SSH or in excuse me in drop bear or some of the other SSH servers There's actually just SSH comm has an SSH server and there's a few different ones But most of time you're going to run into SSH and most of the stock is geared towards that On Windows you can obviously drop into WSL WSL 2 and then you're just at a Linux prompt So you'll have the SSH client There's a GUI that's called putty which is From way back when and then there's Plink which is the CLI implementation that uses the same SSH stuff under the hood that putty's using and Additionally on Windows 10 after 1809 Open SSH is available in the Windows app store. So you can get the SSH server and the SSH client And then lastly another tool that's super common that we're going to take a look at a little bit here is Paramiko which is a Python library that implements the entire protocol the entire SSH protocol both client and server In Python super useful for being able to write scripts to do Either like log into systems for you and do stuff or as we'll see later Make a server Another reason SSH is super useful here, it's really simple to enumerate so By default SSH is port 22 That's the port that it has registered. You can move it to different ports, but All of the servers if they're installed just by like with the app or whatever is SSH Here you can just use netcat and just grab the banner Really simple banner up front. It tells you that it's SSH 2.0 is the protocol of SSH that it's speaking the version as you can see this is an open SSH server 8.31 and then it's running on a Debian system. So just with netcat I can tell what Version of SSH is installed what or what version of SSH protocol the SSH Damon speaks What version of SSH is installed and the operating system? There's even more stuff that you can figure out so with net and map or a bunch of other There's a bunch of other tools that can do this, but lots people not use end map when you run the Discovery scripts it will do that banner grab for you And it will also enumerate all the algorithms that the SSH is using so SSH is a pretty old protocol there You'll run into systems that have older more insecure algorithms and potentially vulnerable SSH versions So there are some versions of SSH that are vulnerable the user enumeration and command injection and all sorts of stuff so That it is so easy to enumerate is pretty nice So continuing on with the basics here just running a command on the remote system there's two strategies here Essentially the first is I'm going to connect to the remote system and request a interactive shell so That first command is just SSH that's going to launch the command line Bob at and then the IP address is 10 dot 10 dot 10 dot 10 So that's saying login to 10 dot 10 dot 10 dot 10 as the user Bob I cut out some stuff here it'll prompt you for a password and then you can just run commands Interactively like you're sitting at a console on that system so here you can see you can run the command who am I and you see that you're Bob The other way you do this is to run a single command at a time so I say SSH Bob at 10 dot 10 dot 10 dot 10 who am I it says Bob This is super useful if the system is being actively defended so say one of the blue team or someone is actually on the system watching for connections and seeing who's logged in This they'd have to catch that and run that command while the who it who am I command is running or whatever command you want to run this is just an example But they'd have to actually see that to see that you're logged in you will this will still show up and last and in all of the logs and everything But if someone's just sitting there trying to see if someone's actually logged in and watching for SSH processes to start this will let you have a little race Where you can run your command hopefully before they actually catch you doing whatever the thing is that you want to do Like I said earlier you can use SSH to copy files so I can copy a file from my system to the remote system or I can copy a file from the remote system to my system There's two ways to actually do this the first one that I've laid out here is SCP so secure copy and in the first the first example here I'm going to upload a file from my computer to the remote system So what that looks like is I do SCP the file that I want to copy up and then I'm just like before we saw I'm going to do the username at that system and then I'm going to give it the path that I want to copy it to So here I want to say in the user's home directory in the bin folder name my file not malware so I'm going to copy my malware up there and hopefully they won't catch it because I called it not malware And that is super secret and they will totally never be able to figure that out Next say I want to download a file from their remote system so I've been looking around and I see that there is this Etsy secret sauce that I'd like to get From my local system just like before it's source and destination but I want the source now to be the file on the remote system and then the destination to be the file on my system So SCP Bob at the remote system the path that the files at so here it's Etsy secret sauce and then finally the my loop folder so every good hacker kid should have a loop folder and I'm going to copy that secret sauce into that folder Additionally with SCP I can recursively copy so say I just want to grab everything in that secret folder I don't know what it is I'll look at it later I'm going to go ahead and use the minus R for recursive flag here to SCP So SCP minus our Bob at 10.10.10.10 the Etsy secret folder down into my loop folder The next way you can copy files is with the SFTP command so this is secure FTP This is actually a completely different implement or different part of the protocol to copy those files So SCP and SFTP while they accomplish the same thing are actually doing different stuff under the hood but functionally it's the same and if you're familiar with FTP hopefully this makes sense You SFTP as Bob to 10.10.10.10 and then the first command I want to download a file so I get that file I say get from secret sauce to my loop folder secret sauce The next example I want to upload a file so SFTP Bob at 10.10.10.10 I'm going to put from my artifacts folder the malware I'm just going to put it into not malware once again super secret no one will ever catch that totally not malware don't look at it it's fine And similar to SCP SFTP has a recursive option for the get command so get minus our slash temp secret from the remote side so say that's a folder and then I'm just going to download it into my temp folder until I can figure out what to do with it And you can see what happened there so kind of the basics there SSH lets you log into a remote system get a shell on that system if you want you can run command singularly so you don't even have an interactive session so it's a lot harder to find You can copy files down you can copy or you can download files you can upload files even that just alone is super useful to an attacker just in and of itself but let's go ahead and move on forward to fun with port forwards And we'll see kind of the more advanced stuff you can do and how you can use this SSH in your tool belt to get around common firewall setups and that kind of kind of thing so first here we're going to do look at local forwarding So in this scenario I have access to the 10.10.10.10 system hopefully that was enough 10s and I happen to know that that is sitting on a boundary so here in this slide I'm showing you that I have this box which I'm going to call my jump box so 10.10.10 Or you'll also hear this called a bounce node and I'll probably go back and forth but I happen to know that this is sitting on a like a security boundary here and there are other systems back in here that I'd like to get access to I can use SSH to forward ports from my system through that system look at it look a little bit like this so I'll have port 8080 on my local system will jump through that 10.10.10.10 system and then point at one of the systems on the other side all of that will go over the SSH tunnel so that traffic is encrypted from my laptop here to this system and then it comes out of here and will wind up over on looking at this system what that looks like on the command line is you use the minus capital L for local forward and you want to tell it the port on your system that you want to listen on the host that you want that connection to go to on the far side and the host port on the far side that you would like to go to so in practice what this looks like is SSH minus capital L I want to listen on my host on port 8080 on my laptop and I want that traffic when I go to port 8080 to go out the other side to 192.168.1.10 on port 80 so say there's a web server on that system that I'm trying to get access to and then I'm logging in as Bob to that bounce node 10.10.10.10.10 I should have done different IP addresses and then interestingly here I'm going to give it minus N so that tells it not to request a shell and then I'm going to background it what that does is now I have 8080 listening I can now go on to my next command I didn't request a shell on the remote system so once again if there's a defender watching that system trying to see like run a who or see who's logged into it all they'll actually see is that there's an SSHD process it doesn't actually spawn a shell or anything and then if they're really on the ball they'll look at net stat and see the network connection but most of the time they just won't realize that there's somebody logged in and then like I said that's backgrounded so on my local system now I can point curl at local host on port 8080 and so there's a HTTP server there that happens to be serving a file called secret that I need to get and I get it and it looks like I won that's super fun and all being able to do a local forward but I want to do that one by one by one through all these systems on this network thankfully SSH was nice enough to think of the this the kind developers of open SSH implemented this thing called dynamic port forwarding so what this does is this lets me open up on my system a port that will forward over that SSH channel either socks for or socks five proxy and then I'm essentially using that SSH server as a proxy server and I can get to any of the systems behind that network as long as whatever I'm using speaks that SSH protocol so if I point my if I use this proxy port then I can get proxy that through this system and just get to any of the systems that are behind here in the the way this kind of basic network example is laid out and kind of counterintuitively here it's actually easier to do this than the just singular local forward so at least on the SSH side so all I'm doing here is minus capital D for dynamic and that does a dynamic forward I'm telling it port ten eighty common socks port and then same thing Bob at ten dot ten dot ten dot ten think I got that right this time and super nice and easy once I run that command I've successfully logged in and now have proxy server I've turned that SSH system into a proxy server so what I can do with that is I can point a web browser at that proxy server so for instance here Firefox some Firefox you go preferences network settings manual manual proxy comp here and then click the manual proxy comp button and then do socks host and here I've picked socks five and then I just tell it my port ten now anything my browser tries to go to is going to forward over that socks proxy and come out in that other network additionally you can use proxy chains there's actually a couple different tools to do this but proxy chains is the one that I know how to use so it's pretty easy for me is you can use proxy chains here and you just configure it to tell it where the proxy host is and then you use the command proxy chains here I'm just going to drop in a bash and what proxy chains does is it hijacks the the libc calls to socket operations and then forwards them over that for TCP operations forwards them over that socks protocol speaks to the socks protocol and then you can do a lot of traffic over so anything in that bash bash session gets forwarded over that proxy you can do one off commands but I like to drop in a bash here a lot because you can do curl and a bunch of other and map and net cat and all that kind of stuff if you use the right options and map needs to be on layer two sometimes but depending on how you're trying to scan but for TCP scans super useful and so you've essentially just use that SSH host to bounce into that network that you probably didn't have access to necessarily but thankfully just to think thankfully you had access to that one SSH host and you got in the next way you can port forward is kind of the opposite of the local forward which is the remote forward so say I am sitting on my laptop and I would like a port on that SSH server to open up and forward that port back to my system so I'll do this with SSH a lot to get from a system out to the network and then be able to do all of that same forwarding and tunneling and stuff just in the opposite way so say I'm actually on I'd have to be I have to be on both systems in this scenario so I'm on my laptop and then I also have access to this system in the network and I'm trying to expel some data or something I can't get out because they're blocking the internet but I have access to this I have access to my laptop so what I do is I SSH and I set up a remote forward from here that says hey listen on 2222 here and forward that back to me on port 22 which is SSH then from this system I can just use any of those SSH commands provided I have this age command line and I can do stuff like copy files to here but it's really forwarding to here so anyone looking at the network traffic nothing's actually going out over the firewall or anything it's just traffic going to here and then there's a secure connection to here from from the bounce host to my laptop so nothing actually unless you're really on the ball looks like it's coming from this to my laptop it's routing through this other system so what that looks like here is you use the dash R command for remote I'm going to tell it what port to listen on and I'm going to tell it the host port that I want it to or the host that I want to listen on and then the host port that I want it to forward to so I say listen on 2222 open that up on any so 0.0.0.0 is the any address and then forward that traffic back to me on port 22 I log in as Bob to that 10.10.10.10 I do minus and again because I don't want to actually get a shell here importantly to be able to do this listen on 0.0.0.0 the SSH server that I'm logging into so this guy 10.10.10.10 has to have gateway ports enabled or else you won't be able to do this by default luckily it's a pretty easy change you just update at the SSHD config we'll look at config stuff a little bit later but you can just change this generally it is no by default but you just change it to yes and then you restart SSH your connection stays alive everything keeps working and then you can do this and then from that system that's inside the network that can't get out SSH to the 10.10.10.10 on port 22 so this minus P tells it to go different than the default port I log in I can either log in or I can copy files or do whatever I want important thing to point out is if I'm on a system that I don't control if I'm on a system that I don't control and I SSH into my system I am potentially giving up credentials or a password or something to my system so be careful with this make sure that this system of this user that they're logging into is something that they they're not too worried about and that that user is locked down and that they can get everything or you're kind of letting them into your system and getting hacked yourself and you do not want to be that person so that's cool but it's a lot to type say I want to do the same scenario where I have a tunnel and I want to log into that I want to log in through my my jump box or my bounce node I want to land over here so I would have to SSH to here do a port forward to go over here and then SSH to that port forward and go over here and that's a lot of work and I'm a lazy hacker I want to do that thankfully the people that implement SSH are not lazy so they think of all of these things and have it done ahead of time SSH has this cool option called a proxy command the proxy command is the old way to do this and they've actually since implemented a new version but proxy command is still super useful and we'll see another use of this in just a second but what you do is you say minus so is option you say proxy command I want my proxy command to be SSH to that remote system again and then here percent H and percent P get replaced with the system that you're trying to look into so be remote and the port like I said this is kind of the old way to do it the SSH developers were nice enough to realize that this is also a lot to type so they made this thing called proxy jump which you can do minus J until it Bob this is essentially doing the same thing as this and then you're just logged in and like we saw you are now have this set up where you're actually SSH and through this system to here anybody monitoring this boundary for access to this system won't actually see that because you're actually going through here and to here you're not going straight to it so that is pretty useful way to get around some kind of common network monitoring and popping through some boundaries you can actually do some really cool stuff with this where you set up like different jump boxes and have them go through different layers and it's just to get pretty pretty fun and you can do some pretty crazy stuff so like I said though that proxy command is super interesting and shout out to subteefer kind of prompting me to look at this here I'm actually using a proxy command to configure my SSH to use an HTTP proxy to get to wherever I'm trying to go so I'll say that again I'm using a proxy command to use an HTTP proxy to get to where I'm trying to go so anybody looking at this traffic is going to see a connection to an HTTP proxy and not even realize that I'm SSH through that proxy out to the other side this is super useful when you're in a network that's very locked down and is only letting certain things through and you have to use an HTTP proxy to get out or if you just want to blend in another thing that is very useful here is so now I have all of these tunnels and this forwarding and all of this cool stuff that I want to set up but SSH is a TCP protocol so if anything happens in this connection any of the routers or something time out something weird happens that connection will die maybe I want this tunnel to be set up really long lived and how I accomplish this is what the command called auto SSH and what I like to do with this is I will set up auto SSH to log into my laptop and forward port 2222 on my laptop back to the host so I apologize the arrow is backwards here but it would actually forward from 2222 back to my host on 22 and funnel that traffic so I connect here and it goes out here so there's an auto SSH connection out it sets up that remote port forward to come back and if that connection dies auto SSH will restart it for me monitor that process and restart it for me effectively lets me maintain access to this and I don't have to do anything once it's set up and what that looks like is you use the auto SSH command it's just a tool that you can install I'm giving it some options here the server live interval server live max count so this will wait 30 seconds and it will max try 3 times and then I'm telling it to remote forward on 2222 to point port 22 on my local host and then I log into my laptop aka hack box and then on hack box I can SSH minus P to 2222 and tell it Bob because that's user that I have at local host and that's actually going to go through that tunnel back in through the network and then I'm just logged into that victim system once again this is super cool because like all someone monitoring this network would see as someone logging into a system remotely so say you're here this boundaries monitored all you see is an SSH out you don't actually see me tunneling back in so it looks like someone who already has logged into this just logged into something on the internet and that is what happened but then additionally I'm logging back into that system here so actually have shell access that I might they might not be wanting me to have so bunch of fun stuff you can do with port forwarding super useful for kind of crossing those security boundaries and getting into networks that you're not necessarily supposed to have access to with auto SSH you can maintain that access and if you get creative with it you can jump around and get to a bunch of different network segments and really make it confusing and all the port forwarding you can make it look like someone's connecting from a different system as long as you have access to connect all through so someone that's trying to trace that back through network logs or system logs is going to have a rough time because you're essentially using a proxy to get through a bunch of stuff and you can proxy proxy proxy and jump around and get to a bunch of different ways that you can configure SSH to do things that are kind of unexpected or just interesting configurations that are useful kind of in operations or in the in the process of doing things. First up I want to point out that we have these escape sequences so if I've SSH into a system and I have an interactive shell SSH actually has this kind of hidden shell that you send a special character sequence it's like a cheat code almost and it gives me all of this functionality. So what I did here is from my prompt I did new line till day question mark just in quick succession without anything else going on and that's showing me the help for this escape sequence prompt. Probably the most useful the ones I use all the time is the terminate connection so if something messes up with that SSH session and my term my shell is hung and I can't get it to work anymore instead of having to drop into another prompt and find the SSH process and kill it you can just do this till day new line till day dot and it kills the SSH session also super useful if your friends let you sit at a prompt for their SSH and you want to mess with them just do that real quick. The other one that is super useful here is the background or sorry the command line and that's the capital C so why is this useful you already saw you can just do this. With the command line right you can SSH minus L and open up the port or minus R and open up the port and all that kind of stuff. So this is one of those things that's really useful but not very often so the most years I have out of this is when I have access to SSH on a system someone's actually actively trying to defend it and they've changed the password on me or gotten rid of my SSH key that we'll see here in a minute. Or whatever I don't I can't log back into that prompt so I can't that SSH session so I can't log out to port forward but I want to port forward through that because I still have access and they haven't noticed like that my actual shell exists they just noticed that they can't was compromised so I can still scan the network and do a bunch of stuff from there. I just need to be able to change some of the port configs and I can't log out and log back in that is when this is the most useful so just like all of the other commands minus L minus R minus D. Let's you set up all those port forwards and then it's minus K L to cancel them or kill them. Once again super useful kind of keep it in your back pocket it's not. Really common that I run into this but when I have needed this it was invaluable. So we talked I talked a little bit about. Authorize key there so one of the things you can do with SSH is. Trying to log in and put your username and your password all the time isn't very much fun it's also kind of insecure we'll see a little bit later why that is pretty insecure. So SSH came up with this concept of an authorized key so this is just public public key cryptography I. Generate. Public private key pair I put the public key on the remote system that I want to log into in a configuration file and say anyone that has the private key for this public key is allowed to log in. So this is very very useful when you run into SSH for a couple different things. One is if you can get access to someone's pipe private key you can log into any of the systems as them that they log into. Because of that you actually generally you're prompted to put a password in to password protect that private key. So when you try to use it you have to decrypt the private key before you can use it. Most of the time or still a lot of the time sadly people that are generating these keys just hit enter twice and then you get an SSH or a private key that is not protected. And by sadly I mean awesome link because it's great and you find this all the time. So where that file is stored is generally there's two places SSH is either the SSH stuff is either an Etsy SSH which is the global configuration or here where we're looking at it in the users configuration which is the dot SSH folder in their home directory. So here specifically this is in roots home directory we've generated a key pair the default for the RSA keys is just ID under RSA and then you'll have ID under RSA dot pub. If you copy that ID under RSA dot pub to the dot SSH authorized keys file for any user you can log in to that user account without a password. So this is also super useful in the case where I land on a system and I don't know the user's password so I can't change their password. But I'd like to be able to SSH in is them I can add this key and then I can SSH into that account is them and have a full PTY shell that lets me do all of the things you would do with a full PTY shell edit files run so do all that kind of stuff. And essentially this lets you maintain access I don't need to know the user's password as long as that file exists. So this is also super useful for like hack the box style challenges where you get a web shell or just if you have a web shell as a user and you want to upgrade to that user level access you if you have the ability to write to this file then you just add an SSH key in here and you can log in SSH by default will check the permissions of that file and not use it if they aren't correct. But sometimes it is configured to not do that so it's always worth checking. Kind of the meta here is it's always worth looking in the SSH folder, there is a bunch of different stuff and we'll see more of that here coming up. So next is the known host file. So this file is a list of all the systems that it users logged into for anybody familiar with SSH when you SSH out to a system the first time it'll say hey I don't recognize the system this is the public key do you accept this when you do that it saves that into this file called the known hosts. The that known host file will have one entry per line and then it has the IP address or the host name and then the public key information. So this is super useful if I can see this and I'm the user say I haven't now have access to their unencrypted private key and then I also have access to all of the IP addresses that they're logging into pretty easy way to pivot around the network and find other systems that I have access to. The next file here that is super interesting is the SSH config. So all of that stuff that we've been going over all the port forwards all of the different things are super great. But typing all of that's horrible and I'm a lazy hacker. And once again the SSH developers, they know that I guess and they came up with a solution for it. So that's this SSH config like all most the other SSH stuff the default or the kind of system wide configuration is an Etsy SSH and then the user configuration is in dot SSH and the user's home directory. That config file looks like this so here someone has set up the host called bounce. The username is Bob they're logging into 10 dot 10 dot 10 dot 10 they would like to do a local forward of port 8080 to 192 168 1 dot 10 80. They're going to do a dynamic forward for 1080 and they're going to do a remote forward for 8080 on 192 168 1 dot 10 8080 on the command line. You can just do SSH bounce and then all of those configs will get set in the command line. You don't have to do anything at all anymore. It's just SSH bounce. It'll tab complete if you have bash completion. Super awesome. When you land on a system if you have access to this config file. So there's another way to find systems that people are logging into because they'll have a bunch of configs like this for easy mode accessing the systems that they access. You can see. Okay, so this Bob guy has access to 10 dot 10 dot 10 dot 10 and likes to check out these other systems on these ports. So something I can try to do. Another fun thing you can do with SSH config is get it to do stuff that people are not intending. So let's say in this scenario. I know that Bob is SSH from the server that he's on 10 dot 10 dot 10 dot 10 to that system that he has internally. Every time he does that, I would like to get a shell back to me on 41 41 from his system. With SSH config, I can do that. So here I configure it say, say I'm on his server for some reason, I have access to his SSH config. I'm going to go ahead and I like to set this up for all hosts. By default, you're not permitted to run a local command, but luckily in the config file, you can just tell it to let you do that. And what I'm going to do here is tell it the local command is to net cat me a bin bash shell to my IP address on my listener and background and then do whatever else Bob was trying to do. So every time Bob logs into a host, it will spin a shell back to me and I'll get access to his system. So say my shells keep dying or I just want to kind of maintain access and it's super easy. Wait, wait, wait. Another config file that is super awesome is this run commands file or RC file. This similarly has the Etsy Etsy version or the user version, but what this does is this runs a command when the user is logging in right before it drops them to a shell. So back to our scenario, say I'm actually on this this far system, and now I want a shell to come back to me every time somebody logs in. So when somebody logs into this system, it sends me a shell. What that looks like here is I just put this simple net cat listener, just like the other one roughly in this, I say net cat spit a shell back to me on my listener IP address on port 41 41 and then background and go ahead and keep doing whatever it is that people want to do. So I encourage people to look at the config files. There's a ton more things you can do in there. These are kind of simplified versions for slides and they demonstrate the purposes. With the config files and the port forwarding, you can really get yourself into some pretty nifty scenarios with that jump proxy command or proxy jump or command or config option. And then also it goes in the config file with those you can set up really intricate port forwards and get through all sorts of different interesting things. And like I was saying before, really kind of run havoc on networks and for someone trying to trace stuff back. Now let's look at a couple different ways that I've successfully gotten creds out of SSH. The first one being say I'm on a system and I know someone is logging into other systems. I see their SSH config, but I don't have their private key. They're not even using private keys. I just know they're using passwords. So I want to be able to get to that system that they're getting to, but I need to get that somehow. So the thing I like to do is I set a create a little shell script here that's in their path before the normal SSH commands. So the SSH command by default is in user bin SSH. Here I'm making a shell script called user local bin SSH that prompts the user for a password again. And then writes that password to a temp file and then just SSH is for them. So what that looks like, and I'm sure people that are used to SSH is you SSH out, it asks you for your password, you type out it. It just asks you for your password again, you typed it right, you're good to go and then eventually you exit. And you can see here that in temp.creds I've now stolen that super secret password. And I have Bob's password of one and two one sixty eight one and you may be able to pivot and kind of beyond the next thing. Additionally, let's say the other way is true. Someone's SSH into a server that I have access to and I want to see what their password is. Here I use the debug tool called s trace, which just looks for all of the system calls that happen in the binary. So I find the SSH process, I attach SSS trace to that SSHD process, and I tell it to just show me the reads, because I know just I know how the SSH Damon works. I know that when you connect into it, it sends you a prompt and then reads your password from you. So here I'm telling it to just show me all of the reads. There are a lot of reads, so I've gone ahead and grep them for this magic string that happens right before the password just as part of the protocol. And here you can see I've stolen this password of super secret from someone when they're logging into the SSH. Another really fun one here is using this paramico to create your own SSH server. So this is kind of the most basic example of this that I can show and make it actually fit in a slide and be useful. But the idea here is say I'm on a server and it's not running SSH, but I know someone is trying to log in. I need to speak enough of the SSH protocol to get them to give me their password. But I don't necessarily want to let them log in because I don't know what they're trying to do and I don't want to implement the entirety of all of SSH. So let's kind of run through this Python code a little bit. What I'm going to do here is for this this line here, I'm going to go ahead and grab the TCP socket, create a TCP socket. I'm going to bind on 22. So this means I have to have access to open those non-Ephemeral ports. I'm going to listen for one connection and then accept for that connection. So once I've got a connection, I let myself know, hey, someone from this adder has connected to me. Then I'm going to take advantage of paramico and I'm going to create, they call it transport in the paramico implementation. With that transport, I'm going to go ahead and add a server with the paramico RSA key. So I have just a test key. Like I said before, when you SSH out and it says, I don't recognize this, here's the public key. This is going to be that key that it gives them. This is one chance that they could detect this. So if they're trying to SSH in and it's a key that they don't recognize, you should just say no unless you know that there's a key that you should be seeing. But most people just say yes because they assume it's a server they haven't seen. And then I'm going to go ahead and start it with my server and tell it to just serve and then accept the connection. So what this looks like here is this now uses my server, they connect in, they get the SSH protocol does its negotiation and says the only thing I can do is password authentication. So they'll get a password prompt from the client because it knows how to speak enough of the protocol and then they'll send me the username and password to my SSH server. And that the paramico server will call this check off with the username and password that it got. I can say, hey, cool, check it out. I got a username and password and then tell it, no, that's not a valid username and password. So from the user's point of view, they tried to SSH in the SSH failed. They don't know why it is. They don't know what this box is anyway. It's not supposed to be on the network. So kind of ignore this, want to connect back shell. That's not what it's actually happening. I'm actually starting an SSH server here. So start my super secret awesome SSH server just with Python. It tells me, hey, I got a connection from here. And then, hey, that connection sent me Bob as the username and sent me Bob's super secret password. So I now have that password. I know where they came from. I can probably try to log into that and see if I can pivot from there or use that credential somewhere else on the network. So that is kind of an intro and some a little bit deeper, but not super crazy deep dive into all of the cool, not all of, but a bunch of the cool things you can do with SSH. You saw that just by default, it gives you remote shell, shell access, lets you do port forwarding, you can download upload files. It's all encrypted. That port forwarding, you can use that to accomplish almost any sort of hopping that you need to be able to do around network segmentation. So really, if you can get to port 22 and you have some sort of credential material to log into that port 22, you can do quite a bit inside a network. You can get access to systems you might not necessarily, you're not necessarily supposed to have access to. You can get around network protections that are trying to block you from doing things. You can mask your traffic in different protocols via proxies. You can make your traffic look like it's coming from different systems via proxies. With all of the configuration options you saw, you can trick the system into doing things or really trick users into doing things that you're not expecting. Different ways you can run SSH commands such that it's harder to trace or see that information on the system and download, upload, Xfill all of the data. And then really the cool thing about this is you can use all of these SSH options. These are the basic ones. You can combine all of this to make yourself the craziest network map that you want, pivot through all of the different things. SSH is becoming more and more ubiquitous across environments. It's now coming on Windows 10. You have WSL. It's very, very, very useful. So I hope that was helpful. I hope it made you think a time or two about SSH and what you can do with it and all that kind of stuff. I hope to stay connected with everybody. Rendori Attack is my team's Twitter. We are kind of always hiring someone at somewhere, so hit up our careers off of our webpage. And then if you're into information like this, follow our blog, Rendori TTPs are our tips, tricks and POCs. Check that out for lots of information like this. And then lastly, I'm pretty passionate about this. We need to make sure that we're taking care of ourselves and popping all these shells is awesome. Maintaining all of this access is super great, but we also need to make sure that we're taking the time to get away and keeping ourselves fit. So hashtag Red Team Fit, check us out on Twitter. There's a bunch of Discords all over the place and we've got a bunch of groups and doing all sorts of really awesome stuff. And that's what I got. Thanks everybody. Hashtag Red Team Fit.
Great SSH shenanigans This talk is going to be interesting things you can do with port forwards systems from other systems and a bunch of cool secure shell It is a replacement for the original And administer those remotely SSH can be used to systems You can upload and download files. You can run commands on the shell Etc. And then SSH maintain access to a system. I Can configure the to be the file on the remote system and then the these systems on this network thankfully SSH was will forward over that SSH channel either socks letting certain things through and you have to how I accomplish this is what the command called boundaries and getting into networks that you're