Metasploitable/SSH/Keys - Revision history

Admin at 02:32, 26 October 2017

2017-10-26T02:32:34Z

← Older revision		Revision as of 02:32, 26 October 2017
Line 1:		Line 1:
	=~~Background Info~~=		=Obtaining Remote Access Using SSH Keys=

	On ~~your attacking~~ machine, ~~copy your~~ public ~~SSH~~ key in <code>~/.ssh/id_rsa.pub</code>. Using ~~your~~ remote shell, ~~modify~~ the ~~Metasploitable Virtual Machine~~'s <code>/root/.ssh/authorized_keys</code> ~~file to include your attacking machine~~'~~s public key~~. ~~This will give~~ you ~~root~~ access without a password.		The basic idea behind this type of exploit is to copy your SSH keys into the remote machine's list of authorized keys. It requires write access to the remote filesystem.

			On the attacker machine, the public key is located in <code>~/.ssh/id_rsa.pub</code>.

			Using a remote shell on metasploitable, or by taking advantage of backdoors, or by mounting the remote filesystem using an exploit, gain write access to the victim's machine. Then copy the public key into </code>/root/.ssh/authorized_keys</code>, and you'll have passwordless root access.

			If you have write access to a filesystem, this technique can turn that write access into remote shell access ''without cracking the root password''.

	Then you'll be able to log in like this:		Then you'll be able to log in like this:
Line 9:		Line 15:
	Last login: Tue Mar 22 20:26:16 EDT 2016 from :0.0 on pts/0		Last login: Tue Mar 22 20:26:16 EDT 2016 from :0.0 on pts/0
	Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686		Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686

	~~The programs included with the Ubuntu system are free software;~~
	~~the exact distribution terms for each program are described in the~~
	~~individual files in /usr/share/doc/*/copyright.~~

	~~Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by~~
	~~applicable law.~~

	~~To access official Ubuntu documentation, please visit:~~
	~~http://help.ubuntu.com/~~
	~~You have new mail.~~
	root@metasploitable:~#		root@metasploitable:~#
	</pre>		</pre>



	=Flags=		=Flags=

Admin at 17:50, 26 March 2016

2016-03-26T17:50:11Z

← Older revision		Revision as of 17:50, 26 March 2016
Line 28:		Line 28:

	{{MSFlag}}		{{MSFlag}}

			{{SSHFlag}}

Admin: Created page with "=Background Info= On your attacking machine, copy your public SSH key in `~/.ssh/id_rsa.pub`. Using your remote shell, modify the Metasploitable Virtual Machine's..."

2016-03-26T17:24:55Z

Created page with "=Background Info= On your attacking machine, copy your public SSH key in <code>~/.ssh/id_rsa.pub</code>. Using your remote shell, modify the Metasploitable Virtual Machine's..."

New page

=Background Info=

On your attacking machine, copy your public SSH key in <code>~/.ssh/id_rsa.pub</code>. Using your remote shell, modify the Metasploitable Virtual Machine's <code>/root/.ssh/authorized_keys</code> file to include your attacking machine's public key. This will give you root access without a password.

Then you'll be able to log in like this:

<pre>
# ssh root@10.0.0.27
Last login: Tue Mar 22 20:26:16 EDT 2016 from :0.0 on pts/0
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

To access official Ubuntu documentation, please visit:
http://help.ubuntu.com/
You have new mail.
root@metasploitable:~#
</pre>

=Flags=

{{MSFlag}}

Metasploitable/SSH/Keys - Revision history

Admin at 02:32, 26 October 2017

Admin at 17:50, 26 March 2016

Admin: Created page with "=Background Info= On your attacking machine, copy your public SSH key in ~/.ssh/id_rsa.pub. Using your remote shell, modify the Metasploitable Virtual Machine's..."

Admin: Created page with "=Background Info= On your attacking machine, copy your public SSH key in `~/.ssh/id_rsa.pub`. Using your remote shell, modify the Metasploitable Virtual Machine's..."