SSH

Metasploit

Msf::Exploit::Remote::SSH provides shared settings for Net::SSH connections. Its implementation is lib/msf/core/exploit/remote/ssh.rb. Options come through Msf::Exploit::Remote::SSH::Options.

include

include Msf::Exploit::Remote::SSH
# Or include only Options
include Msf::Exploit::Remote::SSH::Options

Main helpers

def ssh_client_defaults
  # non_interactive, verify_host_key: :never, proxy factory, etc.
end

factory = ssh_socket_factory

A connection example:

opts = ssh_client_defaults.merge(
  auth_methods: ['password', 'keyboard-interactive'],
  port: datastore['RPORT'],
  password: pass
)
ssh = Net::SSH.start(ip, user, opts)
ssh.exec!('id')

Patterns

AuthBrute + Scanner + SSH Options. Record a successful login with create_credential_and_login and create a session if needed.

Existing example: modules/auxiliary/scanner/ssh/ssh_login.rb

Command-execution exploit

After authentication, use exec! to send CmdStager fragments or a payload.

Existing example: modules/exploits/multi/ssh/sshexec.rb (execute_command uses ssh_socket.exec!)

Interactive session

Some targets support an interactive channel through a payload or session such as generic/ssh/interact. See SSH / WinRM Login for operational steps.

Example options

Option	Meaning
`RPORT`	Usually 22
`SSH_TIMEOUT` / `SSH_DEBUG` / `SSH_IDENT`	Provided by the Options mixin (names may vary by version)
`KEY_PATH` / `PRIVATE_KEY`	Public-key authentication (module-dependent)

Check the actual option names with show options and show advanced.

SSH