full-disclosure - stealing ssh keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <7D8E00B7FC6E87438AEE9091E655D9FE189AF975@MB02.corp.ponderosatel.com>
Date: Tue, 23 Oct 2012 15:07:16 +0000
From: Daniel Sichel <daniels@...derosatel.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: stealing ssh keys

> Hello everybody:
>      environment is A is hacker client? B is target and C is Manager
> center and C have all A and B private key.
>      C are open 80,22. And this is http's 403 state on the C.
>      I have A's root,how to steal private key On the C. Are there have
> some vuln with openssh.
>      Is there some impossible which C login in to the A and B when A and B
> let C run some bash.

OK, I am a total n00b here but I do not see how having an ssl connection would help reveal an SSH key.  Our organization generates our root certs separate from, and unrelated to SSH keys.. I do not see how SSL access in and of itself, helps get at SSH keys, If it does, let me know, I bank at Chase and that would be darn handy to know (believe me, they have it coming)!

Cheers,
Dan Sichel
Ponderosa Telephone

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/