SSH Access using private keys

Question

I am trying to practice ethical hacking in my own lab. I have got limited shell in a fedora box in addition I am able to read root files like /etc/shadow trough another vulnerability.

Now, I need to get the box rooted, I tried to crack the root hash in /etc/shadow but no luck. I though of getting in using ssh keys.

I managed to get the content of /root/.ssh/authorized_keys and thought that I can use it to authenticate without a password. however, when I issued the following command :

     root@kali:~/Desktop# ssh -o BatchMode=yes -i ~/Desktop/x.pem root@10.0.0.50

Permission denied (publickey,gssapi-with-mic,password).

I get the error above -where x.pem is just a file i used to save a copy of the key found in authorized_keys as it is on the victim machine. any idea what is the problem? or another suggested way to get a root privileges ?

Thanks

Answer 1

~/.ssh/authorized_keys contains the public key, you need the corresponding private key to login. Private keys usually look like ~/.ssh/id_rsa, ~/.ssh/id_dsa, ~/.ssh/something.id_rsa, etc.

Unfortunately you didn't post enough information on what privileges you exactly have / the possibilities your vulnerability provides (can you only read files as root, can you execute anything as root?).

Answer 2

As @RSchulze points out, you need the private key to log in, not the public key. Specifically, the sshd server will grant access if the client demonstrates control (by computing a signature on a challenge) of the private key corresponding to one of the public keys stored in the .ssh/authorized_keys.

Note that this implies that if you can write in .ssh/authorized_keys, not merely read it, then you can put a public key of your choice here, e.g. one for which you know the private key (because you generated it). Alternatively, if this box was meant to be hacked for educational purposes, then it is possible that there is a weak public key in the .ssh/authorized_keys put there on purpose (it depends on whether whoever installed this system wanted to educate you on cryptography specifically).

Also note that in many systems, root login through SSH is deactivated. See the /etc/ssh/sshd_config file; this is the PermitRootLogin option. You may want to check that before pursuing this path. Although if the local root user has a .ssh/authorized_keys, then root login is probably permitted (that file would not make a lot of sense otherwise).