# SSH

* <https://blog.lexfo.fr/sshimpanzee.html>
* <https://github.com/lexfo/sshimpanzee>
* <https://github.com/ssh-mitm/ssh-mitm>

## Portable Clients

* <https://github.com/xct/winssh>
* <https://github.com/NHAS/reverse_ssh>

## Quicky Offline Private Key Crack

* <https://security.stackexchange.com/a/191122>

{% tabs %}
{% tab title="PEM/OpenSSH" %}
{% code title="pem-crack.sh" %}

```bash
#!/usr/bin/env bash
# pem-crack.sh passwords.txt root.protected root.priv

echo "Wordlist    : $1"
echo "PEM key     : $2"
echo "New PEM key : $3"
cp "$2" "$3" && chmod 600 "$3"

while read -r line
do
    err=$( (ssh-keygen -p -P "$line" -N '' -f "$3") 2>&1 )

    if [[ ! $err = *"incorrect passphrase"* ]]; then
        echo "Passphrase  : $line"
        echo "$err"
        break
    fi
done < "$1"
```

{% endcode %}
{% endtab %}

{% tab title="PuTTY PPK" %}
{% code title="ppk-crack.sh" %}

```bash
#!/usr/bin/env bash
# sudo apt install putty-tools -y
# ppk-crack.sh passwords.txt root.ppk.protected root.priv

echo "Wordlist    : $1"
echo "PEM key     : $2"
echo "New PEM key : $3"

touch /tmp/empty
while read -r line
do 
    echo "$line" > /tmp/w
    err=$( (puttygen "$2" -P -o "$3" --old-passphrase /tmp/w --new-passphrase /tmp/empty) 2>&1 )

    if [[ ! $err = *"wrong passphrase"* ]]; then
        echo "Passphrase  : $line"
        echo "$err"
        puttygen "$3" -O private-openssh -o "$3"
        break
    fi
done < $1

rm -f /tmp/w /tmp/empty
```

{% endcode %}
{% endtab %}
{% endtabs %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ppn.snovvcra.sh/pentest/infrastructure/ssh.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.