49 lines
1.3 KiB
YAML
49 lines
1.3 KiB
YAML
id: privesc-ssh-agent
|
|
|
|
info:
|
|
name: ssh-agent - Privilege Escalation
|
|
author: daffainfo
|
|
severity: high
|
|
description: |
|
|
ssh-agent is a program that helps manage and store private keys used for SSH authentication. It is often used to hold the decrypted private keys in memory, allowing for seamless authentication to remote servers without the need to re-enter passphrases for the keys.
|
|
reference:
|
|
- https://gtfobins.github.io/gtfobins/ssh-agent/
|
|
metadata:
|
|
verified: true
|
|
max-request: 3
|
|
tags: code,linux,ssh-agent,privesc,local
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
whoami
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
ssh-agent whoami
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
sudo ssh-agent whoami
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: code_1_response
|
|
words:
|
|
- "root"
|
|
negative: true
|
|
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains(code_2_response, "root")'
|
|
- 'contains(code_3_response, "root")'
|
|
condition: or
|
|
# digest: 4b0a0048304602210097e3d63029818e5d2e81fda0c3087d89ee4eb8304ff3916d66fd3e55bbdf169e022100ed38e13697f09436a051297c35da6f03118ab07621ba25ddd959af7f2f954fb5:922c64590222798bb761d5b6d8e72950 |