# 22 - Pentesting SSH/SFTP {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** πŸ’¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}
**Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**! {% embed url="https://go.intigriti.com/hacktricks" %} ## κΈ°λ³Έ 정보 **SSH (Secure Shell λ˜λŠ” Secure Socket Shell)**은 λ³΄μ•ˆλ˜μ§€ μ•Šμ€ λ„€νŠΈμ›Œν¬λ₯Ό 톡해 컴퓨터에 λŒ€ν•œ μ•ˆμ „ν•œ 연결을 κ°€λŠ₯ν•˜κ²Œ ν•˜λŠ” λ„€νŠΈμ›Œν¬ ν”„λ‘œν† μ½œμž…λ‹ˆλ‹€. 원격 μ‹œμŠ€ν…œμ— μ ‘κ·Όν•  λ•Œ λ°μ΄ν„°μ˜ κΈ°λ°€μ„±κ³Ό 무결성을 μœ μ§€ν•˜λŠ” 데 ν•„μˆ˜μ μž…λ‹ˆλ‹€. **κΈ°λ³Έ 포트:** 22 ``` 22/tcp open ssh syn-ack ``` **SSH μ„œλ²„:** * [openSSH](http://www.openssh.org) – OpenBSD SSH, BSD, Linux 배포판 및 Windows 10λΆ€ν„° Windows에 νƒ‘μž¬λ¨ * [Dropbear](https://matt.ucc.asn.au/dropbear/dropbear.html) – λ©”λͺ¨λ¦¬μ™€ ν”„λ‘œμ„Έμ„œ μžμ›μ΄ 적은 ν™˜κ²½μ„ μœ„ν•œ SSH κ΅¬ν˜„, OpenWrt에 νƒ‘μž¬λ¨ * [PuTTY](https://www.chiark.greenend.org.uk/\~sgtatham/putty/) – Windows용 SSH κ΅¬ν˜„, ν΄λΌμ΄μ–ΈνŠΈλŠ” 일반적으둜 μ‚¬μš©λ˜μ§€λ§Œ μ„œλ²„μ˜ μ‚¬μš©μ€ λ“œλ¬Όλ‹€ * [CopSSH](https://www.itefix.net/copssh) – Windows용 OpenSSH κ΅¬ν˜„ **SSH 라이브러리 (μ„œλ²„ μΈ‘ κ΅¬ν˜„):** * [libssh](https://www.libssh.org) – SSHv2 ν”„λ‘œν† μ½œμ„ κ΅¬ν˜„ν•˜λŠ” 닀쀑 ν”Œλž«νΌ C 라이브러리, [Python](https://github.com/ParallelSSH/ssh-python), [Perl](https://github.com/garnier-quentin/perl-libssh/) 및 [R](https://github.com/ropensci/ssh)μ—μ„œ 바인딩됨; KDE의 sftp와 GitHub의 git SSH μΈν”„λΌμ—μ„œ μ‚¬μš©λ¨ * [wolfSSH](https://www.wolfssl.com/products/wolfssh/) – ANSI C둜 μž‘μ„±λœ SSHv2 μ„œλ²„ 라이브러리, μž„λ² λ””λ“œ, RTOS 및 μžμ›μ΄ μ œν•œλœ ν™˜κ²½μ„ λͺ©ν‘œλ‘œ 함 * [Apache MINA SSHD](https://mina.apache.org/sshd-project/index.html) – Apache SSHD μžλ°” λΌμ΄λΈŒλŸ¬λ¦¬λŠ” Apache MINAλ₯Ό 기반으둜 함 * [paramiko](https://github.com/paramiko/paramiko) – Python SSHv2 ν”„λ‘œν† μ½œ 라이브러리 ## μ—΄κ±° ### λ°°λ„ˆ μˆ˜μ§‘ ```bash nc -vn 22 ``` ### μžλ™ν™”λœ ssh-audit ssh-auditλŠ” ssh μ„œλ²„ 및 ν΄λΌμ΄μ–ΈνŠΈ ꡬ성 감사λ₯Ό μœ„ν•œ λ„κ΅¬μž…λ‹ˆλ‹€. [https://github.com/jtesta/ssh-audit](https://github.com/jtesta/ssh-audit)λŠ” [https://github.com/arthepsy/ssh-audit/](https://github.com/arthepsy/ssh-audit/)의 μ—…λ°μ΄νŠΈλœ ν¬ν¬μž…λ‹ˆλ‹€. **κΈ°λŠ₯:** * SSH1 및 SSH2 ν”„λ‘œν† μ½œ μ„œλ²„ 지원; * SSH ν΄λΌμ΄μ–ΈνŠΈ ꡬ성 뢄석; * λ°°λ„ˆ κ°€μ Έμ˜€κΈ°, μž₯치 λ˜λŠ” μ†Œν”„νŠΈμ›¨μ–΄ 및 운영 체제 인식, μ••μΆ• 감지; * ν‚€ κ΅ν™˜, 호슀트 ν‚€, μ•”ν˜Έν™” 및 λ©”μ‹œμ§€ 인증 μ½”λ“œ μ•Œκ³ λ¦¬μ¦˜ μˆ˜μ§‘; * μ•Œκ³ λ¦¬μ¦˜ 정보 좜λ ₯ (μ‚¬μš© κ°€λŠ₯ μ‹œμ , 제거/λΉ„ν™œμ„±ν™”, μ•ˆμ „ν•˜μ§€ μ•ŠμŒ/약함/ꡬ식 λ“±); * μ•Œκ³ λ¦¬μ¦˜ ꢌμž₯ 사항 좜λ ₯ (μΈμ‹λœ μ†Œν”„νŠΈμ›¨μ–΄ 버전에 따라 μΆ”κ°€ λ˜λŠ” 제거); * λ³΄μ•ˆ 정보 좜λ ₯ (κ΄€λ ¨ 문제, ν• λ‹Ήλœ CVE λͺ©λ‘ λ“±); * μ•Œκ³ λ¦¬μ¦˜ 정보λ₯Ό 기반으둜 SSH 버전 ν˜Έν™˜μ„± 뢄석; * OpenSSH, Dropbear SSH 및 libssh의 역사적 정보; * Linux 및 Windowsμ—μ„œ μ‹€ν–‰; * μ˜μ‘΄μ„± μ—†μŒ ```bash usage: ssh-audit.py [-1246pbcnjvlt] -1, --ssh1 force ssh version 1 only -2, --ssh2 force ssh version 2 only -4, --ipv4 enable IPv4 (order of precedence) -6, --ipv6 enable IPv6 (order of precedence) -p, --port= port to connect -b, --batch batch output -c, --client-audit starts a server on port 2222 to audit client software config (use -p to change port; use -t to change timeout) -n, --no-colors disable colors -j, --json JSON output -v, --verbose verbose output -l, --level= minimum output level (info|warn|fail) -t, --timeout= timeout (in seconds) for connection and reading (default: 5) $ python3 ssh-audit ``` [See it in action (Asciinema)](https://asciinema.org/a/96ejZKxpbuupTK9j7h8BdClzp) ### μ„œλ²„μ˜ 곡개 SSH ν‚€ ```bash ssh-keyscan -t rsa -p ``` ### μ•½ν•œ μ•”ν˜Έ μ•Œκ³ λ¦¬μ¦˜ μ΄λŠ” 기본적으둜 **nmap**에 μ˜ν•΄ λ°œκ²¬λ©λ‹ˆλ‹€. κ·ΈλŸ¬λ‚˜ **sslcan** λ˜λŠ” **sslyze**λ₯Ό μ‚¬μš©ν•  μˆ˜λ„ μžˆμŠ΅λ‹ˆλ‹€. ### Nmap 슀크립트 ```bash nmap -p22 -sC # Send default nmap scripts for SSH nmap -p22 -sV # Retrieve version nmap -p22 --script ssh2-enum-algos # Retrieve supported algorythms nmap -p22 --script ssh-hostkey --script-args ssh_hostkey=full # Retrieve weak keys nmap -p22 --script ssh-auth-methods --script-args="ssh.user=root" # Check authentication methods ``` ### Shodan * `ssh` ## μ‚¬μš©μž 이름, λΉ„λ°€λ²ˆν˜Έ 및 개인 킀에 λŒ€ν•œ 무차별 λŒ€μž… 곡격 ### μ‚¬μš©μž 이름 μ—΄κ±° 일뢀 OpenSSH λ²„μ „μ—μ„œλŠ” 타이밍 곡격을 톡해 μ‚¬μš©μžλ₯Ό μ—΄κ±°ν•  수 μžˆμŠ΅λ‹ˆλ‹€. 이λ₯Ό μ΄μš©ν•˜κΈ° μœ„ν•΄ λ©”νƒ€μŠ€ν”Œλ‘œμž‡ λͺ¨λ“ˆμ„ μ‚¬μš©ν•  수 μžˆμŠ΅λ‹ˆλ‹€: ``` msf> use scanner/ssh/ssh_enumusers ``` ### [Brute force](../generic-methodologies-and-resources/brute-force.md#ssh) 일뢀 일반적인 ssh 자격 증λͺ… [μ—¬κΈ°](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/ssh-betterdefaultpasslist.txt)와 [μ—¬κΈ°](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt) 및 μ•„λž˜μ— μžˆμŠ΅λ‹ˆλ‹€. ### 개인 ν‚€ 브루트 포슀 μ‚¬μš©ν•  수 μžˆλŠ” ssh 개인 ν‚€λ₯Ό μ•Œκ³  μžˆλ‹€λ©΄... μ‹œλ„ν•΄ λ³΄κ² μŠ΅λ‹ˆλ‹€. nmap 슀크립트λ₯Ό μ‚¬μš©ν•  수 μžˆμŠ΅λ‹ˆλ‹€: ``` https://nmap.org/nsedoc/scripts/ssh-publickey-acceptance.html ``` λ˜λŠ” MSF 보쑰 λͺ¨λ“ˆ: ``` msf> use scanner/ssh/ssh_identify_pubkeys ``` Or use `ssh-keybrute.py` (native python3, lightweight and has legacy algorithms enabled): [snowdroppe/ssh-keybrute](https://github.com/snowdroppe/ssh-keybrute). #### Known badkeys can be found here: {% embed url="https://github.com/rapid7/ssh-badkeys/tree/master/authorized" %} #### Weak SSH keys / Debian predictable PRNG 일뢀 μ‹œμŠ€ν…œμ€ μ•”ν˜Έν™” 자료λ₯Ό μƒμ„±ν•˜λŠ” 데 μ‚¬μš©λ˜λŠ” 랜덀 μ‹œλ“œμ— μ•Œλ €μ§„ 결함이 μžˆμŠ΅λ‹ˆλ‹€. 이둜 인해 ν‚€ 곡간이 극적으둜 쀄어듀어 무차별 λŒ€μž… 곡격을 받을 수 μžˆμŠ΅λ‹ˆλ‹€. μ•½ν•œ PRNG의 영ν–₯을 λ°›λŠ” Debian μ‹œμŠ€ν…œμ—μ„œ μƒμ„±λœ 미리 μƒμ„±λœ ν‚€ μ„ΈνŠΈλŠ” μ—¬κΈ°μ—μ„œ μ‚¬μš©ν•  수 μžˆμŠ΅λ‹ˆλ‹€: [g0tmi1k/debian-ssh](https://github.com/g0tmi1k/debian-ssh). ν”Όν•΄μž λ¨Έμ‹ μ˜ μœ νš¨ν•œ ν‚€λ₯Ό κ²€μƒ‰ν•˜κΈ° μœ„ν•΄ μ—¬κΈ°λ₯Ό 확인해야 ν•©λ‹ˆλ‹€. ### Kerberos **crackmapexec**λŠ” `ssh` ν”„λ‘œν† μ½œμ„ μ‚¬μš©ν•˜μ—¬ **kerberosλ₯Ό 톡해 인증**ν•  수 μžˆλŠ” `--kerberos` μ˜΅μ…˜μ„ μ‚¬μš©ν•  수 μžˆμŠ΅λ‹ˆλ‹€.\ μžμ„Έν•œ μ •λ³΄λŠ” `crackmapexec ssh --help`λ₯Ό μ‹€ν–‰ν•˜μ‹­μ‹œμ˜€. ## Default Credentials | **Vendor** | **Usernames** | **Passwords** | | ---------- | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | APC | apc, device | apc | | Brocade | admin | admin123, password, brocade, fibranne | | Cisco | admin, cisco, enable, hsa, pix, pnadmin, ripeop, root, shelladmin | admin, Admin123, default, password, secur4u, cisco, Cisco, \_Cisco, cisco123, C1sco!23, Cisco123, Cisco1234, TANDBERG, change\_it, 12345, ipics, pnadmin, diamond, hsadb, c, cc, attack, blender, changeme | | Citrix | root, nsroot, nsmaint, vdiadmin, kvm, cli, admin | C1trix321, nsroot, nsmaint, kaviza, kaviza123, freebsd, public, rootadmin, wanscaler | | D-Link | admin, user | private, admin, user | | Dell | root, user1, admin, vkernel, cli | calvin, 123456, password, vkernel, Stor@ge!, admin | | EMC | admin, root, sysadmin | EMCPMAdm7n, Password#1, Password123#, sysadmin, changeme, emc | | HP/3Com | admin, root, vcx, app, spvar, manage, hpsupport, opc\_op | admin, password, hpinvent, iMC123, pvadmin, passw0rd, besgroup, vcx, nice, access, config, 3V@rpar, 3V#rpar, procurve, badg3r5, OpC\_op, !manage, !admin | | Huawei | admin, root | 123456, admin, root, Admin123, Admin@storage, Huawei12#$, HwDec@01, hwosta2.0, HuaWei123, fsp200@HW, huawei123 | | IBM | USERID, admin, manager, mqm, db2inst1, db2fenc1, dausr1, db2admin, iadmin, system, device, ufmcli, customer | PASSW0RD, passw0rd, admin, password, Passw8rd, iadmin, apc, 123456, cust0mer | | Juniper | netscreen | netscreen | | NetApp | admin | netapp123 | | Oracle | root, oracle, oravis, applvis, ilom-admin, ilom-operator, nm2user | changeme, ilom-admin, ilom-operator, welcome1, oracle | | VMware | vi-admin, root, hqadmin, vmware, admin | vmware, vmw@re, hqadmin, default | ## SSH-MitM ν”Όν•΄μžκ°€ μ‚¬μš©μž 이름과 λΉ„λ°€λ²ˆν˜Έλ₯Ό μ‚¬μš©ν•˜μ—¬ SSH μ„œλ²„μ— μ—°κ²°ν•˜λ €κ³  ν•˜λŠ” 둜컬 λ„€νŠΈμ›Œν¬μ— μžˆλŠ” 경우, **MitM 곡격을 μˆ˜ν–‰ν•˜μ—¬ ν•΄λ‹Ή 자격 증λͺ…을 ν›”μΉ  수 μžˆμŠ΅λ‹ˆλ‹€:** **곡격 경둜:** * **νŠΈλž˜ν”½ λ¦¬λ””λ ‰μ…˜:** κ³΅κ²©μžλŠ” ν”Όν•΄μžμ˜ νŠΈλž˜ν”½μ„ μžμ‹ μ˜ λ¨Έμ‹ μœΌλ‘œ **μ „ν™˜**ν•˜μ—¬ SSH μ„œλ²„μ— λŒ€ν•œ μ—°κ²° μ‹œλ„λ₯Ό **κ°€λ‘œμ±•λ‹ˆλ‹€**. * **κ°€λ‘œμ±„κΈ° 및 λ‘œκΉ…:** 곡격자의 머신은 **ν”„λ‘μ‹œ** 역할을 ν•˜μ—¬ 합법적인 SSH μ„œλ²„μΈ μ²™ ν•˜λ©΄μ„œ μ‚¬μš©μžμ˜ 둜그인 μ„ΈλΆ€ 정보λ₯Ό **캑처**ν•©λ‹ˆλ‹€. * **λͺ…λ Ή μ‹€ν–‰ 및 쀑계:** λ§ˆμ§€λ§‰μœΌλ‘œ, 곡격자의 μ„œλ²„λŠ” **μ‚¬μš©μžμ˜ 자격 증λͺ…을 κΈ°λ‘ν•˜κ³ **, **λͺ…령을** μ‹€μ œ SSH μ„œλ²„λ‘œ **μ „λ‹¬ν•˜λ©°**, **μ‹€ν–‰**ν•˜κ³ , **κ²°κ³Όλ₯Ό μ‚¬μš©μžμ—κ²Œ λ‹€μ‹œ 전솑**ν•˜μ—¬ ν”„λ‘œμ„ΈμŠ€κ°€ λ§€λ„λŸ½κ³  ν•©λ²•μ μœΌλ‘œ 보이게 λ§Œλ“­λ‹ˆλ‹€. [**SSH MITM**](https://github.com/jtesta/ssh-mitm)은 μœ„μ—μ„œ μ„€λͺ…ν•œ λŒ€λ‘œ μ •ν™•νžˆ μˆ˜ν–‰ν•©λ‹ˆλ‹€. μ‹€μ œ MitM을 μˆ˜ν–‰ν•˜κΈ° μœ„ν•΄ ARP μŠ€ν‘Έν•‘, DNS μŠ€ν‘Έν•‘ λ˜λŠ” [**λ„€νŠΈμ›Œν¬ μŠ€ν‘Έν•‘ 곡격**](../generic-methodologies-and-resources/pentesting-network/#spoofing)μ—μ„œ μ„€λͺ…λœ λ‹€λ₯Έ κΈ°μˆ μ„ μ‚¬μš©ν•  수 μžˆμŠ΅λ‹ˆλ‹€. ## SSH-Snake 발견된 SSH 개인 ν‚€λ₯Ό μ‚¬μš©ν•˜μ—¬ μ‹œμŠ€ν…œμ—μ„œ λ„€νŠΈμ›Œν¬λ₯Ό νƒμƒ‰ν•˜κ³  각 μ‹œμŠ€ν…œμ˜ 각 개인 ν‚€λ₯Ό μƒˆλ‘œμš΄ ν˜ΈμŠ€νŠΈμ— ν™œμš©ν•˜λ €λ©΄ [**SSH-Snake**](https://github.com/MegaManSec/SSH-Snake)κ°€ ν•„μš”ν•©λ‹ˆλ‹€. SSH-SnakeλŠ” λ‹€μŒ μž‘μ—…μ„ μžλ™μœΌλ‘œ μž¬κ·€μ μœΌλ‘œ μˆ˜ν–‰ν•©λ‹ˆλ‹€: 1. ν˜„μž¬ μ‹œμŠ€ν…œμ—μ„œ λͺ¨λ“  SSH 개인 ν‚€λ₯Ό μ°ΎμŠ΅λ‹ˆλ‹€, 2. ν˜„μž¬ μ‹œμŠ€ν…œμ—μ„œ 개인 ν‚€κ°€ 수락될 수 μžˆλŠ” λͺ¨λ“  호슀트 λ˜λŠ” λͺ©μ μ§€(user@host)λ₯Ό μ°ΎμŠ΅λ‹ˆλ‹€, 3. 발견된 λͺ¨λ“  개인 ν‚€λ₯Ό μ‚¬μš©ν•˜μ—¬ λͺ¨λ“  λͺ©μ μ§€μ— SSH 연결을 μ‹œλ„ν•©λ‹ˆλ‹€, 4. λͺ©μ μ§€μ— μ„±κ³΅μ μœΌλ‘œ μ—°κ²°λ˜λ©΄ μ—°κ²°λœ μ‹œμŠ€ν…œμ—μ„œ #1 - #4 단계λ₯Ό λ°˜λ³΅ν•©λ‹ˆλ‹€. μ™„μ „νžˆ 자기 볡제 및 자기 μ „νŒŒκ°€ κ°€λŠ₯ν•˜λ©°, μ™„μ „νžˆ 파일이 μ—†μŠ΅λ‹ˆλ‹€. ## Config Misconfigurations ### Root login SSH μ„œλ²„κ°€ 기본적으둜 루트 μ‚¬μš©μž λ‘œκ·ΈμΈμ„ ν—ˆμš©ν•˜λŠ” 것은 일반적이며, μ΄λŠ” μƒλ‹Ήν•œ λ³΄μ•ˆ μœ„ν—˜μ„ μ΄ˆλž˜ν•©λ‹ˆλ‹€. **루트 λ‘œκ·ΈμΈμ„ λΉ„ν™œμ„±ν™”ν•˜λŠ” 것**은 μ„œλ²„ λ³΄μ•ˆμ„ κ°•ν™”ν•˜λŠ” μ€‘μš”ν•œ λ‹¨κ³„μž…λ‹ˆλ‹€. 관리 κΆŒν•œμœΌλ‘œμ˜ 무단 μ ‘κ·Ό 및 무차별 λŒ€μž… 곡격을 μ™„ν™”ν•  수 μžˆμŠ΅λ‹ˆλ‹€. **OpenSSHμ—μ„œ 루트 둜그인 λΉ„ν™œμ„±ν™”ν•˜κΈ°:** 1. `sudoedit /etc/ssh/sshd_config`둜 SSH ꡬ성 νŒŒμΌμ„ **νŽΈμ§‘ν•©λ‹ˆλ‹€**. 2. `#PermitRootLogin yes`μ—μ„œ **`PermitRootLogin no`**둜 **섀정을 λ³€κ²½ν•©λ‹ˆλ‹€**. 3. `sudo systemctl daemon-reload`λ₯Ό μ‚¬μš©ν•˜μ—¬ **ꡬ성을 λ‹€μ‹œ λ‘œλ“œν•©λ‹ˆλ‹€**. 4. λ³€κ²½ 사항을 μ μš©ν•˜κΈ° μœ„ν•΄ SSH μ„œλ²„λ₯Ό **μž¬μ‹œμž‘ν•©λ‹ˆλ‹€**: `sudo systemctl restart sshd` ### SFTP Brute Force * [**SFTP Brute Force**](../generic-methodologies-and-resources/brute-force.md#sftp) ### SFTP command execution SFTP μ„€μ •μ—μ„œ 일반적인 κ°„κ³Όκ°€ λ°œμƒν•˜λŠ”λ°, κ΄€λ¦¬μžκ°€ μ‚¬μš©μžκ°€ 원격 μ…Έ 접근을 ν™œμ„±ν™”ν•˜μ§€ μ•Šκ³  νŒŒμΌμ„ κ΅ν™˜ν•˜λ„λ‘ μ˜λ„ν•˜λŠ” κ²½μš°μž…λ‹ˆλ‹€. λΉ„λŒ€ν™”ν˜• μ…Έ(예: `/usr/bin/nologin`)둜 μ‚¬μš©μžλ₯Ό μ„€μ •ν•˜κ³  νŠΉμ • 디렉토리에 μ œν•œν•˜λ”λΌλ„ λ³΄μ•ˆ ν—ˆμ μ΄ 남아 μžˆμŠ΅λ‹ˆλ‹€. **μ‚¬μš©μžλŠ” 둜그인 직후 λΉ„λŒ€ν™”ν˜• 셸이 μ°¨μ§€ν•˜κΈ° 전에 λͺ…λ Ή 싀행을 μš”μ²­ν•˜μ—¬ μ΄λŸ¬ν•œ μ œν•œμ„ μš°νšŒν•  수 μžˆμŠ΅λ‹ˆλ‹€**(예: `/bin/bash`). μ΄λŠ” 무단 λͺ…λ Ή 싀행을 ν—ˆμš©ν•˜μ—¬ μ˜λ„λœ λ³΄μ•ˆ 쑰치λ₯Ό μ•½ν™”μ‹œν‚΅λ‹ˆλ‹€. [μ—¬κΈ°μ—μ„œμ˜ μ˜ˆμ‹œ](https://community.turgensec.com/ssh-hacking-guide/): ```bash ssh -v noraj@192.168.1.94 id ... Password: debug1: Authentication succeeded (keyboard-interactive). Authenticated to 192.168.1.94 ([192.168.1.94]:22). debug1: channel 0: new [client-session] debug1: Requesting no-more-sessions@openssh.com debug1: Entering interactive session. debug1: pledge: network debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0 debug1: Sending command: id debug1: client_input_channel_req: channel 0 rtype exit-status reply 0 debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0 uid=1000(noraj) gid=100(users) groups=100(users) debug1: channel 0: free: client-session, nchannels 1 Transferred: sent 2412, received 2480 bytes, in 0.1 seconds Bytes per second: sent 43133.4, received 44349.5 debug1: Exit status 0 $ ssh noraj@192.168.1.94 /bin/bash ``` μ—¬κΈ° μ‚¬μš©μž `noraj`λ₯Ό μœ„ν•œ μ•ˆμ „ν•œ SFTP κ΅¬μ„±μ˜ μ˜ˆκ°€ μžˆμŠ΅λ‹ˆλ‹€ (`/etc/ssh/sshd_config` – openSSH): ``` Match User noraj ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no PermitTunnel no X11Forwarding no PermitTTY no ``` 이 ꡬ성은 SFTP만 ν—ˆμš©ν•©λ‹ˆλ‹€: μ‹œμž‘ λͺ…령을 κ°•μ œν•˜μ—¬ μ…Έ μ•‘μ„ΈμŠ€λ₯Ό λΉ„ν™œμ„±ν™”ν•˜κ³  TTY μ•‘μ„ΈμŠ€λ₯Ό λΉ„ν™œμ„±ν™”ν•˜λ©° λͺ¨λ“  μ’…λ₯˜μ˜ 포트 ν¬μ›Œλ”© λ˜λŠ” 터널링을 λΉ„ν™œμ„±ν™”ν•©λ‹ˆλ‹€. ### SFTP 터널링 SFTP μ„œλ²„μ— μ•‘μ„ΈμŠ€ν•  수 μžˆλŠ” 경우, 일반적인 포트 ν¬μ›Œλ”©μ„ μ‚¬μš©ν•˜μ—¬ 이 경둜λ₯Ό 톡해 νŠΈλž˜ν”½μ„ 터널링할 수 μžˆμŠ΅λ‹ˆλ‹€: ```bash sudo ssh -L :: -N -f @ ``` ### SFTP Symlink The **sftp** have the command "**symlink**". Therefore, if you have **writable rights** in some folder, you can create **symlinks** of **other folders/files**. As you are probably **trapped** inside a chroot this **won't be specially useful** for you, but, if you can **access** the created **symlink** from a **no-chroot** **service** (for example, if you can access the symlink from the web), you could **open the symlinked files through the web**. 예λ₯Ό λ“€μ–΄, μƒˆ 파일 **"**_**froot**_**"**μ—μ„œ "**_**/**_**"**둜 **symlink**λ₯Ό μƒμ„±ν•˜λ €λ©΄: ```bash sftp> symlink / froot ``` If you can access the file "_froot_" via web, you will be able to list the root ("/") folder of the system. ### 인증 방법 κ³ λ³΄μ•ˆ ν™˜κ²½μ—μ„œλŠ” λ‹¨μˆœν•œ λΉ„λ°€λ²ˆν˜Έ 기반 인증 λŒ€μ‹  ν‚€ 기반 λ˜λŠ” 이쀑 인증만 ν™œμ„±ν™”ν•˜λŠ” 것이 일반적인 κ΄€ν–‰μž…λ‹ˆλ‹€. κ·ΈλŸ¬λ‚˜ μ’…μ’… 더 κ°•λ ₯ν•œ 인증 방법이 ν™œμ„±ν™”λ˜λ©΄μ„œ μ•½ν•œ 방법이 λΉ„ν™œμ„±ν™”λ˜μ§€ μ•ŠμŠ΅λ‹ˆλ‹€. 자주 λ°œμƒν•˜λŠ” κ²½μš°λŠ” openSSH κ΅¬μ„±μ—μ„œ `publickey`λ₯Ό ν™œμ„±ν™”ν•˜κ³  κΈ°λ³Έ λ°©λ²•μœΌλ‘œ μ„€μ •ν•˜μ§€λ§Œ `password`λ₯Ό λΉ„ν™œμ„±ν™”ν•˜μ§€ μ•ŠλŠ” κ²ƒμž…λ‹ˆλ‹€. λ”°λΌμ„œ SSH ν΄λΌμ΄μ–ΈνŠΈμ˜ μžμ„Έν•œ λͺ¨λ“œλ₯Ό μ‚¬μš©ν•˜λ©΄ κ³΅κ²©μžκ°€ μ•½ν•œ 방법이 ν™œμ„±ν™”λ˜μ–΄ μžˆμŒμ„ 확인할 수 μžˆμŠ΅λ‹ˆλ‹€: ```bash ssh -v 192.168.1.94 OpenSSH_8.1p1, OpenSSL 1.1.1d 10 Sep 2019 ... debug1: Authentications that can continue: publickey,password,keyboard-interactive ``` 예λ₯Ό λ“€μ–΄ 인증 μ‹€νŒ¨ μ œν•œμ΄ μ„€μ •λ˜μ–΄ 있고 λΉ„λ°€λ²ˆν˜Έ 방법에 도달할 κΈ°νšŒκ°€ μ—†λ‹€λ©΄, `PreferredAuthentications` μ˜΅μ…˜μ„ μ‚¬μš©ν•˜μ—¬ 이 방법을 κ°•μ œλ‘œ μ‚¬μš©ν•  수 μžˆμŠ΅λ‹ˆλ‹€. ```bash ssh -v 192.168.1.94 -o PreferredAuthentications=password ... debug1: Next authentication method: password ``` SSH μ„œλ²„ ꡬ성을 κ²€ν† ν•˜λŠ” 것은 μ˜ˆμƒλ˜λŠ” λ°©λ²•λ§Œμ΄ ν—ˆκ°€λ˜μ—ˆλŠ”μ§€ ν™•μΈν•˜λŠ” 데 ν•„μš”ν•©λ‹ˆλ‹€. ν΄λΌμ΄μ–ΈνŠΈμ—μ„œ μžμ„Έν•œ λͺ¨λ“œλ₯Ό μ‚¬μš©ν•˜λ©΄ κ΅¬μ„±μ˜ 효과λ₯Ό ν™•μΈν•˜λŠ” 데 도움이 될 수 μžˆμŠ΅λ‹ˆλ‹€. ### Config files ```bash ssh_config sshd_config authorized_keys ssh_known_hosts known_hosts id_rsa ``` ## 퍼징 * [https://packetstormsecurity.com/files/download/71252/sshfuzz.txt](https://packetstormsecurity.com/files/download/71252/sshfuzz.txt) * [https://www.rapid7.com/db/modules/auxiliary/fuzzers/ssh/ssh\_version\_2](https://www.rapid7.com/db/modules/auxiliary/fuzzers/ssh/ssh\_version\_2) ## 참고자료 * SSHλ₯Ό κ°•ν™”ν•˜λŠ” 방법에 λŒ€ν•œ ν₯미둜운 κ°€μ΄λ“œλŠ” [https://www.ssh-audit.com/hardening\_guides.html](https://www.ssh-audit.com/hardening\_guides.html)μ—μ„œ 찾을 수 μžˆμŠ΅λ‹ˆλ‹€. * [https://community.turgensec.com/ssh-hacking-guide](https://community.turgensec.com/ssh-hacking-guide)
**버그 λ°”μš΄ν‹° 팁**: **해컀λ₯Ό μœ„ν•΄ 해컀가 λ§Œλ“  프리미엄 **버그 λ°”μš΄ν‹° ν”Œλž«νΌμΈ **Intigriti**에 **κ°€μž…ν•˜μ„Έμš”**! 였늘 [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks)μ—μ„œ 저희와 ν•¨κ»˜ν•˜κ³  μ΅œλŒ€ **$100,000**의 보상을 λ°›κΈ° μ‹œμž‘ν•˜μ„Έμš”! {% embed url="https://go.intigriti.com/hacktricks" %} ## HackTricks μžλ™ λͺ…λ Ή ``` Protocol_Name: SSH Port_Number: 22 Protocol_Description: Secure Shell Hardening Entry_1: Name: Hydra Brute Force Description: Need Username Command: hydra -v -V -u -l {Username} -P {Big_Passwordlist} -t 1 {IP} ssh Entry_2: Name: consolesless mfs enumeration Description: SSH enumeration without the need to run msfconsole Note: sourced from https://github.com/carlospolop/legion Command: msfconsole -q -x 'use auxiliary/scanner/ssh/ssh_version; set RHOSTS {IP}; set RPORT 22; run; exit' && msfconsole -q -x 'use scanner/ssh/ssh_enumusers; set RHOSTS {IP}; set RPORT 22; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ssh/juniper_backdoor; set RHOSTS {IP}; set RPORT 22; run; exit' ``` {% hint style="success" %} AWS ν•΄ν‚Ή 배우기 및 μ—°μŠ΅ν•˜κΈ°:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ GCP ν•΄ν‚Ή 배우기 및 μ—°μŠ΅ν•˜κΈ°: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
HackTricks μ§€μ›ν•˜κΈ° * [**ꡬ독 κ³„νš**](https://github.com/sponsors/carlospolop) ν™•μΈν•˜κΈ°! * **πŸ’¬ [**Discord κ·Έλ£Ή**](https://discord.gg/hRep4RUj7f) λ˜λŠ” [**ν…”λ ˆκ·Έλž¨ κ·Έλ£Ή**](https://t.me/peass)에 μ°Έμ—¬ν•˜κ±°λ‚˜ **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**λ₯Ό νŒ”λ‘œμš°ν•˜μ„Έμš”.** * **[**HackTricks**](https://github.com/carlospolop/hacktricks) 및 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) κΉƒν—ˆλΈŒ 리포지토리에 PR을 μ œμΆœν•˜μ—¬ ν•΄ν‚Ή νŒμ„ κ³΅μœ ν•˜μ„Έμš”.**
{% endhint %}