OSCP-notes

Let's try harder...

View on GitHub

If ssh private key of victim is known

use ssh_login_pubkey module to get shell
msf > use auxiliary/scanner/ssh/ssh_login_pubkey

Attempt to obtain a list of users and their password/hashes from other means

Users and their passwords can be obtained from misconfigured webservers, shared file systems, etc.

Add your public ssh key to remote server

copy your public key to /root/.ssh/authorized_keys on remote server

Brute force ssh credentials

use auxiliary/scanner/ssh/ssh_login