My Security Diary

Dear Diary, Today was a good day. I learned about a powerful new feature called Port Forwarding! Port Forwarding is a feature of SSH that allows you to redirect traffic from on a target machine to another using a specified IP and port. This is a powerful tool because it allows you to relay communication from a target machine to an external host (i.e. your computer!). All you need is: SSH Credentials The port of the resource you want to access Let's say the web server is hosted on 127.0.0.1:8443. You can use the command below to access that webserver: ssh -L 8443:127.0.0.1:8443 <username>@10.10.10.184 Where you can now execute curl commands to retrieve information on that website (without port forwarding, this would've resulted in an access denied error!) curl -k -i -u admin:<password> https://localhost:8443 

Dear Diary, Today I learned how to configure ssh to login to a remote machine without a password! So, SSH uses public key cryptography (i.e. that chapter that bored you to death in the Security+ textbook). Which means that is uses a private key and public key to create a connection (does that jog your memory?). First, type this command in the attacking computer to generate a key pair: $ ssh-keygen This will output the following: Then navigate to your /<username>/.ssh folder... And you'll see these files. id_rsa is your private key and id_rsa.pub is the public key (which is why it ends in .pub :)   Now, navigate to the /home/<username>/.ssh/ directory on the target machine and copy and paste the contents of id_rsa.pub to to the authorized_keys file. It looks something like this: Then, return your attacking box and type these commands: # ssh-add # ssh -i id_rsa <username>@<remote ip> And voila! You have just exploited authorized_keys to ...