What can I do with a SSH certificate?

Question

Doing an information security project at the moment. After gaining access to ftp drive, there was a file simply called 'hackme' inside. It contains what looks like to me a SSH certificate, but not sure what I can do with it or how to reverse/break it.

The file

MIIEowIBAAKCAQEAop+enpIZtPJpZfz5Op7O1EswtZX+OvNDYKYzO/qdi0EhnJKU
Os3ltr2utFZsEuVKCeXMkcFbJTQu/DuUD8sKPXYC4d7JR9j5Xaz2s9NAVcUtezZ2
cE2vLPAt9AhT2gSknuemYM8nSuYE2IGGaYOztTtjkSDXNrm6M3MTMdLPziGGp8lg
1/7mTnQQ6HHn4fLqSKJLRH8dMZ3MfgMaPtbdvaw+GjZsm8pL8o5OzVrBKZqbOS2/
IOP7vrL43MmgPCpWsJIZMKeFHYCAzB3sTK++O2f6uag3U7tDun/P7Ztkhhbtxx1e
K4NXawjTT4AzZu2jo8LGGD+t7DdiPdIMNSIFbwIDAQABAoIBAHwsmbfHI23xc912
bu/99zxPNaBSKc/llFsmTRTNZqLAVuPxYNIOCguhhtcY7mj3P7OTDsN0+x3LXN0o
uQPeK7GGfOjvbo439SE8QxxIgGV9rB7bFVDnYI1V0CD4gt6EkRbtFzPwubYNMUII
lRPYhs4pzPsyMmMNKkrC4bM3n4lrBDBEjcRgITho54xDBY7frcEamm5DllUcKYuZ
sNLqwZ1LSuVFBRNRKp/U5X8tDYud+QduNfCdtho5eDrHkUOvh/6tJ0RrMk2M4bQU
rUNJSl/6qh1nga5gaTSitBerwkcgC0hnA55EsLKuf7sGNLSF0IEzRawOvWvGkgTG
X9WkJQECgYEA1c89buUyW6dsx5B5+C3sTHTVNlCumZVj+ectzQTe42XzKTS4kwDb
h9JZhGtAl3MiuRjA6vOvGPPagFmcFDfoDpiK47ATfia8ruxRK/51XqaMnaQb+Un0
gZdkhOflcWiG0QzSXRpjfxAQyunKMcJQEuu6WjnxTmCTA6Zjs3FfN8ECgYEAwrat
SgFhF+zJGajIkNvPOHC6g6Q8Cwoww7QmbJ+erOvefJbASn8vEh/7y3pEFmm0W5tw
8e9+FoMv4BVqm5UZ0WsxgYN4qivmmaXRBWNiPJVk0nLCA1dZttN53lJqldynO6zo
pkmMjINd1+nB/78aGMK8cEA39XlOs/c5xk/xCS8CgYAXssC8aesK/aOw+vKJ740h
bFG1k3vGyigqqtUIxGFwEvzAtHdA0/eBNm91ne2q27gdjADWCex+d4jgcQ47r3ap
J389fWartN91A/x7Q9j+hLdRQb9YAjp3orAhixKDX3KR+TnX1/TvQHicBQ3ENiVp
83bUSVfVuB6TaP3kBczoAQKBgBRnuHlM87PiKKD7wykLIAg2KBWrnG87viiENJKl
l6dfgI1l7vjfozsvBuAoDAKdST1gaNGx23DYhqfhFq7/TRlZNnLwKDENMLlhWypJ
Y/4dWdeEFzjqaohyWQ8na+wQl6X1VNw4UPZYvfjmkmIO0NlPbxgEYtjiwZCyk+do
cUYZAoGBAJ+SpmK1lL0tvuy+bwEe3H4IwCfRBZ+lKUhCeJ4+3S4WF4W23T8urmd1
zVo81WxHReJAWQIT1QxjwqWkcQmMSzgpsy2JSOzjvps2NHkt+XUozmv43wRlPLon
y407ZNPOrzD+82cKCrX6BpPy5EagwP+v1HFb5QiJsoEnZt7VRJPC

Tried using it to login via SSH but still asked for a password. Any suggestions on the route I could take to exploit this? It's a first project so I feel a little silly being stumped so early on.

Answer 1

I hope you recognized base64. The first few bytes in a hexadecimal dump are

30 82 04 a3 02 01 00 02  82 01 01 00 a2 9f 9e 9e

30 82 screams “ASN.1 DER” — 30 means “sequence”, 82 means “followed by a 2-byte length” and the next two bytes are the length. The first element in the sequence has the type integer, with a 2-byte length 01 01 (257), and the next 257 bytes are that integer value (starting with a 00 byte, so it's a 2048-bit integer.

I'm not going to continue the manual analysis. Here's the output of base64 -d | dumpasn1 with the integer values elided, giving the structure:

   0 1187: SEQUENCE {
   4    1:   INTEGER 0
   7  257:   INTEGER
 268    3:   INTEGER 65537
 273  256:   INTEGER
 533  129:   INTEGER
 665  129:   INTEGER
 797  128:   INTEGER
 928  128:   INTEGER
1059  129:   INTEGER
         :   }

So we have a 2048-bit integer, the integer 65537, another 2048-bit integer, and five 1024-bit integers. That's strongly reminiscent of an RSA private key: modulus, public exponent, private exponent, and the CRT parameters.

This matches the format of an OpenSSH private key file with no passphrase, except that you need to add two lines -----BEGIN RSA PRIVATE KEY----- at the beginning and -----END RSA PRIVATE KEY----- at the end. So add those two lines and try using the file as an SSH private key file (ssh -i /path/to/file username@thehost.example.com).