SSH Hijacking with ControlMaster
In this section we’ll discuss the SSH hijacking attack
which is especially effective for lateral movement.
This approach is similar to taking over an existing RDP session on Windows.
In simple terms, SSH hijacking allows us to use an existing SSH connection
to gain access to another machine.
We can leverage this technique in several ways,
including the ControlMaster feature and the sshagent tool.
ControlMaster is a feature that enables sharing of multiple SSH
sessions over a single network connection.
This functionality can be enabled for a given user by editing their local SSH
configuration file.
This file can be created or modified by users with elevated privileges
or user's with write access to the user's home folder.
In this section, we’ll demonstrate how a malicious actor can create an attack
vector by simply enabling ControlMaster functionality for an unwitting user.
We’ll begin by logging in as the offsec user to the controller VM,
simulating an attacker gaining shell access to that account.
Next, we’ll create a ControlMaster configuration for the offsec user.
We’ll then simulate a legitimate user logged in as offsec on the same machine
connecting to a downstream server and hijack that connection.
We’ll start by logging in to our Linux controller machine as the offsec user,
and create the config file.
Let’s examine this file in more detail.
Although it is possible to configure ControlPath settings for a specific host,
the above configuration entry’s first line
specifies that the configuration is being set for all hosts.
The ControlPath entry in our example specifies the path
to the ControlMaster socket file,
and the filename format.
This assumes that the specified controlmaster folder actually exists.
The ControlMaster line identifies that any new connections
will attempt to use existing ControlMaster sockets when available.
When those are unavailable, it will start a new connection.
ControlPersist can either be set to “yes” or to a specified time.
If it is set to “yes”, the socket stays open indefinitely.
Alternatively, it will accept new connections for a specified amount of time
after the last connection has terminated.
In this configuration, the socket will remain open for 10 minutes
after the last connection and then it will close.
The number of available concurrent connections for SSH using this method
defaults to 10
as set in the MaxSessions variable,
in the server’s ssh_configfile,
but may vary on different systems depending on how they are configured.
Before moving forward,
we’ll set the correct permission on the configuration file.
Then we’ll create the required controlmaster directory.
Next, to simulate our victim connecting to a downstream server, we’ll SSH to the
controller VM as the legitimate offsec user.
We’ll then SSH from the controller VM to the linuxvictim VM in the same session.
Once the connection is established,
we’ll move back to the offsec attacker session.
We should be able to find a socket file on the controller VM
for the linuxvictim machine.
This socket file represents the legitimate SSH session to the downstream
server and, for the sake of clarity, we’ll call it the “Victim Session”.
At this point, as an attacker, if we simply SSH to the server listed in the
victim’s socket file, we will not be prompted for a password
and will be given direct access to the linuxvictim machine via SSH.
We’re now logged in on the linuxvictim machine without having been required to
enter a password, and have effectively “piggybacked” an active legitimate
connection to the same machine.
Now that we’ve demonstrated the first scenario, we’ll close the attacker SSH
session as the offsec user, while leaving the “Victim Session” open.
In the second scenario, we’re logged in as a root user
(or someone with sudo privileges).
In this case, we’ll log in to the controller VM as root instead of offsec.
From here, we can hijack the open SSH socket,
using the SSH client’s -S parameter, which specifies a socket.
Once again, we’re able to log in to the linuxvictim machine without being
required to enter a password.