4 ms·

SSH-Snake: Automated SSH-Based Network Traversal

157 points by lozf 3y ago

trashtester 3y ago
This part of the readme makes me a bit worried: curl https://raw.githubusercontent.com/MegaManSec/SSH-Snake/main/Snake.nocomments.sh | stdbuf -o0 bash Combined with the admission that the tool is intended for hacking, I would be concerned that it would suddenly start to phone home with all keys and hosts at some point after users have started using it.
- BossingAround 3y ago
  You should always inspect a script before executing it. You can even pass it to AI and query the AI about it.
  - trashtester 3y ago
    Agree, and especially if it's from a dubious source. Piping it directly from curl to bash makes that near impossible if you run it multiple times. Even suggesting that for something like this in the readme is a red flag to me. It's probably just a bad habit on the part of the author, but it may very well be intended to promote such unsafe practices with the intent to at least have the option to exploit it at some point later.
    - mmsc 3y ago
      >Piping it directly from curl to bash makes that near impossible if you run it multiple times. I’m not sure whether pressing the „fork” button and inspecting it in your local repository is “near impossible”.
      - trashtester 3y ago
        "near impossible" referred to the specific act re-reading the code every time you run it, which you should do if you use the exact method for executing it that is in the readme. There are many ways more competent/sane users who realize the danger can work around those. My concern is that some percentage of users are likely to follow the method in the readme to the letter, without knowing or caring about the danger. Either the author knows this (if not-> incompetent, which is not likely), doesn't care (maybe it's mostly intended for black hack hacking). Or it's actually a trap, where it's first presented as a useful tool, but where a phone home addon is injected at some point later, and able to collect massive numbers of keys before it's detected.
- mmsc 3y ago
  You can download it to somewhere else then curl where you’ve downloaded it (with the settings changed which are set at the beginning of the file). The tool is marketed as fileless. How are you going to run it on a system which has no writable space?
  - trashtester 3y ago
    > You can download it to somewhere Obviously, but the howto in the readme does lay the groundwork for a huge security concern if some admins start to run it recurrently in that way, without reading the code every time. > The tool is marketed as fileless. Which is great if your purpose is indeed to use it for hacking, and you run it on machines that you've already compromised, not on your own. For anyone else, I think it's vital to only run it from an instance where you can download it and examine the code every time there is a change. I would do a git pull for that, not a curl command. Git makes it easier to go through all changes every time you do a pull.
godelski 3y ago
I know this is positioned as a hacking tool, but it seems actually pretty useful. It's pretty easy to lose track of where your keys are used and how you might perform hops. Having that diagram be generated for you really looks useful and can help you navigate this. I'm sure there are good practices to solve this (and please suggest them, I'm always looking to learn more), but I'm no expert. I do daily drive linux and am terminally terminal, so it wouldn't surprise me if the GUI people are even worse. I think this is a general problem with a lot of terminal based tools, is that there are far higher expectations to read the documentation and less focus on design (and importantly, design that makes sense to someone that isn't you). Totally fine for hacky projects but with something as mature as ssh it seems like we'd have far better tools built in or to exist. I'm sure many do exist, but are they well known? (I'm happy to see any tools if you all have some suggestions)
- chaps 3y ago
  Yes, it is a very useful tool. Used to do very similar when I worked as a sysadmin in larger infrastructures that largely get managed over ssh. A surprisingly large number of infrastructures have keys setup for individual sysadmins across all hosts, through straight sshd user auth. One problem this helps with is getting into older servers with an unknown password and can't be rebooted for business reasons. At some point, some person may have setup keys to that host, and the only way to find out which is to basically try all hosts and all users. So having something that snakes through an infrastructure like this would help get into that host.
GabrieleR 3y ago
The snake sh code was a graceful late night read to me. Thanks. I can see it being used even to purposely puppeteer ssh linked machines
tommsy64 3y ago
An interesting limitation mentioned in the README "IPv4 Only: Like all of the best programs, the script does not support IPv6. I can't imagine there will be support for this anytime soon." What are considered "all the best programs" these days? Is IPv6 adoption really so looked down upon?
- dtgriscom 3y ago
  I'm guessing "all the best programs" was offered tongue-in-cheek.
- mmsc 3y ago
  Author of the software here. It was a joke.
- fulafel 3y ago
  It's for post-exploitation, all the "crunchy outside, chewy interior" 90s style insecure enterprise networks separated from the elements by a perimeter firewall have 10.x ipv4 addressing.
  - otabdeveloper4 3y ago
    I don't think anything changed in this respect since the 90's. (Well, except we have more of the nu-style "expose all ports to the Internet and protect them with an HTML form and a q1w2e3 password, #yolo" corporate networks.)
    - fulafel 3y ago
      Yep, that's what i'm saying, at least for the easy targets.
pcthrowaway 3y ago
I'm curious why this tool wouldn't use all the settings in the ssh config to attempt to connect to hosts.. instead it only picks a subset of those settings. For example, of the config file specifies a port besides 22, it won't be able to connect to that host (or for example, if the config file sets `PubkeyAcceptedAlgorithms=+ssh-rsa` which is necessary, albeit insecure, if using an older private key file on a newer version of ssh which disables RSA key exchange) I see no downside to just using the hostname from the config file instead of trying to apply a few select options from the config, and non-standard ports are extremely common
- chaps 3y ago
  My theory's that it's to ensure backwards compatibility with ooooold hosts.
- mmsc 3y ago
  or for example, if the config file sets `PubkeyAcceptedAlgorithms=+ssh-rsa` which is necessary It already does this: https://github.com/MegaManSec/SSH-Snake/blob/7ae7ef0afe0e067a1b96f69e508df52831a08b8b/Snake.sh#L216 https://github.com/MegaManSec/SSH-Snake/blob/7ae7ef0afe0e067... and https://github.com/MegaManSec/SSH-Snake/blob/7ae7ef0afe0e067a1b96f69e508df52831a08b8b/Snake.sh#L639C3-L639C3 https://github.com/MegaManSec/SSH-Snake/blob/7ae7ef0afe0e067... I see no downside to just using the hostname from the config file It already does this: https://github.com/MegaManSec/SSH-Snake/blob/main/Snake.sh#L1225 https://github.com/MegaManSec/SSH-Snake/blob/main/Snake.sh#L... the config file specifies a port besides 22, it won't be able to connect to that host This shouldn't be hard to implement and can certainly be added in a later version.
randombits0 3y ago
A message-passer or a Quine? Because a Quine would be awesome.
stevebmark 3y ago
Is there any risk with running this locally just to see what SSH traversal is available? I have several legitimate hosts I SSH into regularly, some are cloud hosting.
- mmsc 3y ago
  Not really. You can comment out this line: https://github.com/MegaManSec/SSH-Snake/blob/7ae7ef0afe0e067a1b96f69e508df52831a08b8b/Snake.sh#L964 https://github.com/MegaManSec/SSH-Snake/blob/7ae7ef0afe0e067... to disable the printing of the private keys to the terminal if you want, too.
mmsc 3y ago
[dupe] of https://news.ycombinator.com/item?id=38877185 https://news.ycombinator.com/item?id=38877185 (I'm the author)
- frumiousirc 3y ago
  Traversal progress is blocked by a hashed `authorized_keys` file, right?
  - mmsc 3y ago
    Assuming you mean `known_hosts`, no. It uses various data sources to determine where to try to connect with discovered keys: https://github.com/MegaManSec/SSH-Snake/blob/main/SETTINGS.md#ssh-host-discovery-strategies https://github.com/MegaManSec/SSH-Snake/blob/main/SETTINGS.m... lists all of them (which can be enabled and disabled by the user). https://github.com/MegaManSec/SSH-Snake/blob/main/SETTINGS.md#use_find_from_bash_history https://github.com/MegaManSec/SSH-Snake/blob/main/SETTINGS.m... is particularly interesting.
    - frumiousirc 3y ago
      Err brain fart, yes, `known_hosts`. Thanks for the answer. It seems there is room to expand from checking Bash history to also other popular shells (eg `fish`).
deoxykev 3y ago
Here’s a similar project, but for windows AD networks https://github.com/byt3bl33d3r/DeathStar https://github.com/byt3bl33d3r/DeathStar
normaler 3y ago
This is a good reminder to give keys only to huma s and in case of e.g. backups use specific users and limit the commands this user can access on the remote machines via jails or the authorized key file.
ksjskskskkk 3y ago
> bash (tons of other deps) already excludes most modems and iot. :( probably need a rewrite in sh and dropbear
yonrg 3y ago
If you need this, your private key management needs to be reviewed and reworked, imo.

157 points by lozf 3y ago

This part of the readme makes me a bit worried: curl https://raw.githubusercontent.com/MegaManSec/SSH-Snake/main/Snake.nocomments.sh | stdbuf -o0 bash Combined with the admission that the tool is intended for hacking, I would be concerned that it would suddenly start to phone home with all keys and hosts at some point after users have started using it.

BossingAround 3y ago
You should always inspect a script before executing it. You can even pass it to AI and query the AI about it.
- trashtester 3y ago
  Agree, and especially if it's from a dubious source. Piping it directly from curl to bash makes that near impossible if you run it multiple times. Even suggesting that for something like this in the readme is a red flag to me. It's probably just a bad habit on the part of the author, but it may very well be intended to promote such unsafe practices with the intent to at least have the option to exploit it at some point later.
  - mmsc 3y ago
    >Piping it directly from curl to bash makes that near impossible if you run it multiple times. I’m not sure whether pressing the „fork” button and inspecting it in your local repository is “near impossible”.
    - trashtester 3y ago
      "near impossible" referred to the specific act re-reading the code every time you run it, which you should do if you use the exact method for executing it that is in the readme. There are many ways more competent/sane users who realize the danger can work around those. My concern is that some percentage of users are likely to follow the method in the readme to the letter, without knowing or caring about the danger. Either the author knows this (if not-> incompetent, which is not likely), doesn't care (maybe it's mostly intended for black hack hacking). Or it's actually a trap, where it's first presented as a useful tool, but where a phone home addon is injected at some point later, and able to collect massive numbers of keys before it's detected.
mmsc 3y ago
You can download it to somewhere else then curl where you’ve downloaded it (with the settings changed which are set at the beginning of the file). The tool is marketed as fileless. How are you going to run it on a system which has no writable space?
- trashtester 3y ago
  > You can download it to somewhere Obviously, but the howto in the readme does lay the groundwork for a huge security concern if some admins start to run it recurrently in that way, without reading the code every time. > The tool is marketed as fileless. Which is great if your purpose is indeed to use it for hacking, and you run it on machines that you've already compromised, not on your own. For anyone else, I think it's vital to only run it from an instance where you can download it and examine the code every time there is a change. I would do a git pull for that, not a curl command. Git makes it easier to go through all changes every time you do a pull.

godelski 3y ago

I know this is positioned as a hacking tool, but it seems actually pretty useful. It's pretty easy to lose track of where your keys are used and how you might perform hops. Having that diagram be generated for you really looks useful and can help you navigate this. I'm sure there are good practices to solve this (and please suggest them, I'm always looking to learn more), but I'm no expert. I do daily drive linux and am terminally terminal, so it wouldn't surprise me if the GUI people are even worse. I think this is a general problem with a lot of terminal based tools, is that there are far higher expectations to read the documentation and less focus on design (and importantly, design that makes sense to someone that isn't you). Totally fine for hacky projects but with something as mature as ssh it seems like we'd have far better tools built in or to exist. I'm sure many do exist, but are they well known? (I'm happy to see any tools if you all have some suggestions)

chaps 3y ago
Yes, it is a very useful tool. Used to do very similar when I worked as a sysadmin in larger infrastructures that largely get managed over ssh. A surprisingly large number of infrastructures have keys setup for individual sysadmins across all hosts, through straight sshd user auth. One problem this helps with is getting into older servers with an unknown password and can't be rebooted for business reasons. At some point, some person may have setup keys to that host, and the only way to find out which is to basically try all hosts and all users. So having something that snakes through an infrastructure like this would help get into that host.

GabrieleR 3y ago

The snake sh code was a graceful late night read to me. Thanks. I can see it being used even to purposely puppeteer ssh linked machines

tommsy64 3y ago

An interesting limitation mentioned in the README "IPv4 Only: Like all of the best programs, the script does not support IPv6. I can't imagine there will be support for this anytime soon." What are considered "all the best programs" these days? Is IPv6 adoption really so looked down upon?

dtgriscom 3y ago
I'm guessing "all the best programs" was offered tongue-in-cheek.
mmsc 3y ago
Author of the software here. It was a joke.
fulafel 3y ago
It's for post-exploitation, all the "crunchy outside, chewy interior" 90s style insecure enterprise networks separated from the elements by a perimeter firewall have 10.x ipv4 addressing.
- otabdeveloper4 3y ago
  I don't think anything changed in this respect since the 90's. (Well, except we have more of the nu-style "expose all ports to the Internet and protect them with an HTML form and a q1w2e3 password, #yolo" corporate networks.)
  - fulafel 3y ago
    Yep, that's what i'm saying, at least for the easy targets.

pcthrowaway 3y ago

I'm curious why this tool wouldn't use all the settings in the ssh config to attempt to connect to hosts.. instead it only picks a subset of those settings. For example, of the config file specifies a port besides 22, it won't be able to connect to that host (or for example, if the config file sets `PubkeyAcceptedAlgorithms=+ssh-rsa` which is necessary, albeit insecure, if using an older private key file on a newer version of ssh which disables RSA key exchange) I see no downside to just using the hostname from the config file instead of trying to apply a few select options from the config, and non-standard ports are extremely common

chaps 3y ago
My theory's that it's to ensure backwards compatibility with ooooold hosts.
mmsc 3y ago
or for example, if the config file sets `PubkeyAcceptedAlgorithms=+ssh-rsa` which is necessary It already does this: https://github.com/MegaManSec/SSH-Snake/blob/7ae7ef0afe0e067a1b96f69e508df52831a08b8b/Snake.sh#L216 https://github.com/MegaManSec/SSH-Snake/blob/7ae7ef0afe0e067... and https://github.com/MegaManSec/SSH-Snake/blob/7ae7ef0afe0e067a1b96f69e508df52831a08b8b/Snake.sh#L639C3-L639C3 https://github.com/MegaManSec/SSH-Snake/blob/7ae7ef0afe0e067... I see no downside to just using the hostname from the config file It already does this: https://github.com/MegaManSec/SSH-Snake/blob/main/Snake.sh#L1225 https://github.com/MegaManSec/SSH-Snake/blob/main/Snake.sh#L... the config file specifies a port besides 22, it won't be able to connect to that host This shouldn't be hard to implement and can certainly be added in a later version.

randombits0 3y ago

A message-passer or a Quine? Because a Quine would be awesome.

stevebmark 3y ago

Is there any risk with running this locally just to see what SSH traversal is available? I have several legitimate hosts I SSH into regularly, some are cloud hosting.

mmsc 3y ago
Not really. You can comment out this line: https://github.com/MegaManSec/SSH-Snake/blob/7ae7ef0afe0e067a1b96f69e508df52831a08b8b/Snake.sh#L964 https://github.com/MegaManSec/SSH-Snake/blob/7ae7ef0afe0e067... to disable the printing of the private keys to the terminal if you want, too.

mmsc 3y ago

[dupe] of https://news.ycombinator.com/item?id=38877185 https://news.ycombinator.com/item?id=38877185 (I'm the author)

frumiousirc 3y ago
Traversal progress is blocked by a hashed `authorized_keys` file, right?
- mmsc 3y ago
  Assuming you mean `known_hosts`, no. It uses various data sources to determine where to try to connect with discovered keys: https://github.com/MegaManSec/SSH-Snake/blob/main/SETTINGS.md#ssh-host-discovery-strategies https://github.com/MegaManSec/SSH-Snake/blob/main/SETTINGS.m... lists all of them (which can be enabled and disabled by the user). https://github.com/MegaManSec/SSH-Snake/blob/main/SETTINGS.md#use_find_from_bash_history https://github.com/MegaManSec/SSH-Snake/blob/main/SETTINGS.m... is particularly interesting.
  - frumiousirc 3y ago
    Err brain fart, yes, `known_hosts`. Thanks for the answer. It seems there is room to expand from checking Bash history to also other popular shells (eg `fish`).

deoxykev 3y ago

Here’s a similar project, but for windows AD networks https://github.com/byt3bl33d3r/DeathStar https://github.com/byt3bl33d3r/DeathStar

normaler 3y ago

This is a good reminder to give keys only to huma s and in case of e.g. backups use specific users and limit the commands this user can access on the remote machines via jails or the authorized key file.

ksjskskskkk 3y ago

> bash (tons of other deps) already excludes most modems and iot. :( probably need a rewrite in sh and dropbear

yonrg 3y ago

If you need this, your private key management needs to be reviewed and reworked, imo.