SSH:
Exploitation
Guides for SSH auth attacks, key testing, and legacy crypto access
SSH Password Credential Attacks
Covers brute-forcing and credential stuffing SSH logins using tools like Hydra and Medusa to gain unauthorized shell access via weak or default passwords.
SSH Terrapin Attack (CVE-2023-48795)
Exploiting the Terrapin attack to downgrade SSH session security by manipulating sequence numbers during handshake negotiation.
SSH User Enumeration Exploitation
Exploit SSH user enumeration vulnerabilities to identify valid system accounts via timing attacks and response analysis, enabling targeted credential attacks.
SSH exploitation converts enumeration findings into authenticated access. Credential brute-forcing with Hydra, nxc, or Medusa targets password authentication when it is enabled. Wordlists tuned to the target (usernames from enumeration, passwords from credential dumps or OSINT) dramatically improve success rates over generic lists.
Known CVEs provide direct exploitation paths when the version is vulnerable. libssh authentication bypass (CVE-2018-10933), OpenSSH user enumeration for targeted attacks, and older vulnerabilities in Dropbear or proprietary implementations all have public exploits. Private key reuse is another reliable vector: keys found on one host, in backups, or in code repositories often work on multiple systems.
Agent forwarding hijack is a post-auth technique that deserves mention here. If a user connects with agent forwarding enabled (-A), anyone with root on the intermediate host can use their forwarded keys to authenticate to other systems. This turns a single compromised host into a pivot point without ever touching a private key file.