Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Local ssh key not registered in pwnvasive disturbs ‘_test_creds’ #2

Open
0sx86 opened this issue Nov 27, 2024 · 0 comments · May be fixed by #3
Open

Local ssh key not registered in pwnvasive disturbs ‘_test_creds’ #2

0sx86 opened this issue Nov 27, 2024 · 0 comments · May be fixed by #3

Comments

@0sx86
Copy link

0sx86 commented Nov 27, 2024

If we have a local ssh key on our machine, asyncssh will be able to use it to connect to a Node (subject to approval). No need to interact with the user.

extract from the source code of the ‘connect’ function of asyncssh

:param client_keys: (optional)
           A list of keys which will be used to authenticate this client
           via public key authentication. These keys will be used after
           trying keys from a PKCS11 provider or an ssh-agent, if either
           of those are configured. If no client keys are specified,                      <---
           an attempt will be made to load them from the files
           :file:`.ssh/id_ed25519_sk`, :file:`.ssh/id_ecdsa_sk`,
           :file:`.ssh/id_ed448`, :file:`.ssh/id_ed25519`,
           :file:`.ssh/id_ecdsa`, :file:`.ssh/id_rsa`, and
           :file:`.ssh/id_dsa` in the user's home directory, with
           optional certificates loaded from the files
           :file:`.ssh/id_ed25519_sk-cert.pub`,
           :file:`.ssh/id_ecdsa_sk-cert.pub`, :file:`.ssh/id_ed448-cert.pub`,
           :file:`.ssh/id_ed25519-cert.pub`, :file:`.ssh/id_ecdsa-cert.pub`,
           :file:`.ssh/id_rsa-cert.pub`, and :file:`.ssh/id_dsa-cert.pub`.**
           If this argument is explicitly set to `None`, client public key
           authentication will not be performed.

The problem

The ssh key is not registered in pwnvasive.
The output of pwnvasive is as follows:

pwnvasive > show nodes 0
----- ('172.17.0.2', 22) -----
{'arp_cache': {},
 'controlled': True,
 'files': {},
 'hostname': None,
 'ip': '172.17.0.2',
 'jump_host': None,
 'os': None,
 'port': 22,
 'reachable': True,
 'routes': [],
 'tested_credentials': [.....],
 'working_credentials': [{'username': 'root'},
                         {'password': 'root', 'username': 'root'},
                         {'password': 'toto', 'username': 'root'},
                         {'password': 'root', 'username': 'root'},
                         {'password': 'toor', 'username': 'root'},
                         {'password': 'super', 'username': 'root'},
                         {'password': 'test', 'username': 'root'},
                         {'password': 'admin', 'username': 'root'},
                         {'password': 'password', 'username': 'root'}]}

The credentials are all wrong, but the connection is established using the ssh key, which is not seen by pwnvasive.

Expected behavior

Local ssh keys must not be used that way, but entered manually by the user.

@0sx86 0sx86 linked a pull request Dec 16, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant