s0ld13rr SSH — Version CVEs & Tricks
CVE-2024-6387 (regreSSHion)
OpenSSH 8.5–9.7 on glibc-based Linux. Race condition → unauthenticated RCE. Public PoCs exist but are slow/unreliable — confirm version, note as high-value finding.
CVE-2018-15473 (user enumeration)
OpenSSH <7.7. Timing-based username enumeration.
ssh-audit TARGET or Metasploit auxiliary/scanner/ssh/ssh_enumusers.
User list → password spray / AS-REP roast.
SSH agent forwarding hijack
If another user has agent forwarding enabled:
find /tmp -name "agent.*" → SSH_AUTH_SOCK=/tmp/agent.XXXX ssh other-target
Post-auth pivot intel
~/.ssh/config— other hosts, jump hosts, proxy configs~/.ssh/known_hosts— every host this user connected to~/.ssh/authorized_keys— who else has access (persistence opportunity)
Auth method check
ssh -o PreferredAuthentications=none TARGET reveals accepted methods.
If only publickey → password brute is impossible, don't waste time on hydra.