Search everything Ctrl K
T1552.004

Private Keys

Sub-technique of T1552 Unsecured Credentials ↗

Stealing private keys (SSH, .pfx certificates) to authenticate as their owner.

How it shows up on Hack The Box

Look for id_rsa in home folders and backups; if it has a passphrase, run ssh2john and crack it. A password-protected .pfx is attacked the same way with pfx2john.

Techniques in our catalog that match this one (the number is their machines):

Machines to practice it

Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.

Commands

Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.

LFI, SSTI, command injection and XXE › LFI

Linux 
/etc/passwd
/etc/hosts
/proc/self/cmdline
/proc/self/environ
/home/USUARIO/.ssh/id_rsa
/var/www/html/config.php
/etc/nginx/sites-enabled/default
/etc/apache2/sites-enabled/000-default.conf

Linux privilege escalation › Exploitation

Symlink to a root file 
ln -sf /root/.ssh/id_rsa /tmp/fichero_que_copia_root

Hash identifier › Cracking

Extract hashes from files 
zip2john backup.zip > hash.txt
ssh2john id_rsa > hash.txt
keepass2john Database.kdbx > hash.txt
office2john informe.docx > hash.txt
pdf2john documento.pdf > hash.txt

John the Ripper › More formats

.pfx certificate, PDF, Office and GPG 
pfx2john cert.pfx > hash.txt
pdf2john doc.pdf > hash.txt
office2john doc.docx > hash.txt
gpg2john clave.asc > hash.txt

Tools