Lateral Movement with SSH
SSH is a network protocol
and suite of tools used to communicate between networked systems.
It's one of the most commonly-used methods for communicating between Linux machines.
Although some systems still permit password authentication to connect to a
Linux machine via SSH, many require public key authentication instead.
This method requires a user-generated public and private key pair.
The public key is stored in the authorized_keys file
of the server the user is connecting to.
The private key is typically stored in the .ssh/ directory on the system
the user is connecting from.
When a user connects to a target server, the SSH client will use the
user’s private key, if present, to authenticate with the target system.
If the private key has been protected with a passphrase, the user must also
provide that during the authentication process.
Additionally, the key must be accepted on
the target system for the authentication to succeed.
Private SSH keys are a prime target for an attacker, since they can provide
access to any remote machine that accepts the key.
As such, they are an excellent opportunity for lateral movement.
Let’s discuss some basic techniques that can be used to gain access to a user’s
private key and demonstrate how these keys can be leveraged.