If a box is using a weak SSH host key (lets say 1024-bit RSA), what kind of attacks is the box vulnerable to?
In short, the Man In The Middle Attack. If the host key is too small and the attacker would be able to factor the number, re-create private key and possibly make a user send his password (or forward public key authentication) and get the access of respective user on that server.
Though we are not there yet and 1024 bits were not yet officially factorized (recently 768 bits were factorized in 2009), but the gap is close and we can expect that there are agencies with similar computation power to factorize 1024 bits or so.
There is a possibility that an attacker factorize your key and is able to spoof the identity of your server.
The server key is the primary defense against MITM attacks perform by an adversary who is either able to attack DNS or routing infrastructure between client and server or an adversary who legitimately controls some of that infrastructure.
In case a MITM attacks happens the most significant threat is the possibility of passwords being sniffed. If you are using key based authentication (and the key used by authentication is not equally weak), the threat is much less severe.
An attacker would still be able to hijack your connection and direct them to a server controlled by the attacker. Thus the attacker could see commands that you attempt to run on the server and capture files you try to upload.
But if you are using key based authentication the attacker will not be able to authenticate to the real server, thus your chance of noticing the attack early will be much improved as none of the attempted commands or uploaded files intercepted by the attacker will reach the real server.
informational. Try using
nmap and obtain the hostkey using
ssh-hostkey, it would try to figure out the
hostkey - although this in itself isn't a vulnerability since hosts should share different hostkeys if invoked.
informational concern would be when the
ssh-hostkey finds out that same hostkeys were being distributed when invoked. This however doesn't show that attacks were surely possible. Therefore it doesn't denote the pentester that there's a sure vulnerability in that particular system.