Everybody welcome to the next video.
We're going to be talking about as stage keys.
Now what I want you to understand about SS H keys is that once your route on a system you always want
to check to make sure that there are to see if there are any private keys under the users.
SS H directories to see if you can leverage that to attack another system.
So for example we're in the root directory there if we look closely we should see a dot.
SS H which is hidden so they go NC to dot as the H unless dash l we're gonna see to we're gonna see
I.D. underscore RSA and then I'd you describe as a dot pub now the DOT pub is the public key and the
regular RSA is the private key.
It's important to keep the distinction between these two separate.
You do not want to get them confused but what you're looking for is the private key.
And if we take a look at the RSA pub you can see here it's appended by or prevented by SSA as RSA followed
by the key and then the machine and user.
So if we take a look at the private key we can see it begins with open SSA private key or private key
in general followed by and private key.
It's important to understand the difference between the two and what you're gonna want to do is grab
that those private keys just grab them grab as many as you can.
But keep in mind that they're not on every system you're going to find a lot of public keys but depending
on when an organisation might have a let's say a key key send out.
So they have an application that you push up your public key and it get sent out to all the machines
and that can be very dangerous because if an attacker is able to gain access to that and push up a key
then they have initial access to most of the machines on the network as long as that public key public
key got pushed out to it.
But having the private key might allow you to take that user and log into another machine and what you
can do is you can actually take and map and grab every machine on the network that has SSA open and
then go ahead and try and run a bash for loop to try to assess H to that machine or do it in Python
and SS H that machine with that private key as that user and then kick back a result saying which host
was actually able to be logged into and sometimes these users have root access or sudo access on the
machines and that could be very devastating because you just went from compromising one machine to now
compromising 10 or 20 which then you repeat that process.
You'd be surprised at how how many machines you'll be able to compromise just by using the private keys
on the machine.
But if if a network is setup correctly you should just find public keys.
But again what you're doing is you're looking for.
You can go to let's say you slash home.
I don't think there's any users here but if there was not.
You would see will do make directory test test and then you would do three dogs.
So this would be the full path for somebody whose home directory and what you can do is you can write
a bash for loop to kind of search through as root and go ahead and grab everything in that dot SSA directory
and print it out to the screen for you and then you can just quickly look out and remove anything with
DOT pub and you should find a good list of any private keys that are available for each user on the
system.
I highly recommend doing something like this every time you compromise a box because you never know
how far you can actually take this with one person having dropped their private key on this machine
in their home directory let's say or even just their home directory.
Always check the user's home directory as well because if they drop their private key in their home
directory because they transferred it to a different server for maintenance or whatever.
Now you have their private key and getting access to a private key means they need to reset all their
SSA keys and that can sometimes be a pain in the ass.
But if you've taken a copy of it chances are the user won't even know.
So keep that in mind always check the SSA keys and make sure you understand the difference between a
pub the public key or the RSA PRIVATE KEY.
Again what re watch the video and look at each contents of both of those files and you should be able
to do this on your own machine as well.
But what I want to note here is that Cowley by default does not have a route SS HQ set up so you can
do SS H dash Keegan dash t RSA and it'll ask you for which path do you want to give it when you hit
enter and it will ask you for a passphrase just give it whatever password you want and then repeat the
password again and it'll generate this for you so you can then take a look and go ahead and view it.