How to Run Your Favorite Graphical X Applications Over SSH « Null Byte :: WonderHowTo

While SSH is a powerful tool for controlling a computer remotely, not all applications can be run over the command line. Some apps (like Firefox) and hacking tools (like Airgeddon) require opening multiple X windows to function, which can be accomplished by taking advantage of built-in graphical X forwarding for SSH.SSH, or the secure shell, is the de-facto way or accessing a computer remotely, allowing anyone to log in and administer a computer over a local or remote network. Many useful apps can be controlled this way, but those requiring an interactive window aren't able to open when summoned over SSH. To make this happen, we'll need to forward the data from the remote computer to a server running on our local machine, which will display the remote application in a window on our local screen.Don't Miss:Set Up an SSH Server with Tor to Hide It from Shodan & HackersWhat Can't You Do Without x11 ForwardingMost hackers are familiar with the basic use of SSH for everything from accessing your Linux system remotely to transferring files over a network. For command-line applications, SSH can give you complete control without any modifications, running programs likeBesside-ng,Bettercap, andKismetwithout any issues.The limitations of SSH become clear as soon as we try to do something like runAirgeddon, which requires multiple windows to open and execute programs to feed data back to the main program. Without launching these programs in additional graphical windows, Airgeddon won't work, making it seemingly useless for a hacker with only a remote SSH connection.Trusted vs. Untrusted Graphical X ForwardingIf you want to run something more complicated than a command-line program, SSH has us covered by offering x11 forwarding. This means that, provided that there is a graphical X window running on the remote computer, we can forward the data from the application running on the remote machine to make it look like it's running on the local device instead.There are two kinds of graphical X forwarding, trusted and untrusted. In trusted X forwarding, we ensure that the application we're running doesn't crash by disabling certain security checks designed to crash the connection if the app violates specific security policies. In an untrusted connection, we have greater security when connecting to an untrusted computer network, but also have a higher likelihood of the application crashing.Don't Miss:Locate & Exploit Devices Vulnerable to the Libssh Security FlawBecause graphical X forwarding is enabled by default on most Linux systems, running applications over SSH is a lot easier to do than setting up a VNC server from scratch. This makes it a useful skill for any hacker wanting to do anything from injecting websites into a target's web history to running tools that require opening multiple windows to function.What You'll NeedTo follow this guide, you'll need to have two computers connected to the same network. Both will need to have SSH installed and running.On your remote computer, you'll need to have an SSH server enabled and running. If you have Linux, no modifications should be required, but on macOS or Windows, we'll need to change things in a later step.On your local machine, Linux should come with a graphical X window preinstalled, but you'll need to install one for this to work on Windows of macOS. If your local machine is a MacBook or another macOS device, you candownload and install XQuartzto run a graphical X window server. If you're running Windows, you can useXmingto do the same thing.Don't Miss:Brute-Force Nearly Any Website Login with HatchStep 1: Enable Graphical X ForwardingThe first step will be to enable graphical X forwarding on the server that is running on the computer you want to access remotely. This will differ slightly depending on the operating system this system is using.On MacOS & LinuxIf the remote computer is running Linux, then x11 forwarding is enabled by default, and you don't need to do anything. If the remote computer you're logging in to is running macOS, you will need to edit your sshd_config file.~$ nano /etc/ssh/sshd_configIf sshd_config includes#X11Forwarding no(or justX11Forwarding no), change it toX11Forwarding yesinstead, and you can see below.#       $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

...

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# pass locale information
AcceptEnv LANG LC_*

# no default banner path
#Banner none

# override default of no subsystems
Subsystem       sftp    /usr/libexec/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding yee
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs serverPressCtrl-Xand thenYto save the changes to this file in Nano. You should now have x11 forwarding enabled on the computer.On WindowsIf you're using Windows, you'll need to make some changes to PuTTY. The program is the easiest way to get started working with SSH on Windows, and it'sfree to download from the official website.You can enable X11 forwarding on PuTTY by selecting "Enable X11 forwarding" in the "PuTTY Configuration" menu under the "Connection" tab, located under the "SSH" options. Once this option is enabled, you should be able to forward graphical X sessions to remote devices from your Windows machine.Step 2: Start a Trusted Graphical X SessionTo get started, let's start a "trusted" graphical X session. Because untrusted sessions can crash fairly easily, this is the default option that is enabled on Ubuntu, as of this writing.The difference between a trusted and untrusted session is essential when looking at security. In a trusted session, we potentially give the remote computer the ability to screenshot, keylog, and inject input into any of the windows of other programs.In our first example, we'll use the default trusted connection to launch a Firefox window. First, let's take a look at the command we need to launch any graphical application over SSH.~$ ssh -Y username@LOCAL_IP_ADDRESSIf we are logging into a remote computer with a username of "root" at 192.168.0.3, our command to launch Firefox would then be as follows.~$ ssh -Y root@192.168.0.3 firefoxIf we've started our graphical X window server (such as XQuartz), we should see a Firefox window open on our local machine.We should be able to do this with any graphical application on the system.Don't Miss:Discover & Attack Raspberry Pis Using Default Credentials with Rpi-hunterStep 3: Start an Untrusted Graphical X SessionBy default, Linux systems like Ubuntu are configured to minimize applications being forwarded over x11 crashing by treating them as trusted by default. This isn't always desired, because you may not actually trust a computer you are connecting to remotely.The command for treating a remote system while forwarding a graphical X window is the-Xoption, but this won't do anything differently until we access the ssh_config file and modify it to disable trusting remote x11 connections by default. To do this, we can open up our ssh_config file with Nano again to modify the line that saysForwardX11Trustedto look like below.ForwardX11Trusted noNow, we can run Firefox again as an untrusted app with the following command.~$ ssh -X root@192.168.0.3 firefoxWhile this application may be more prone to crashing, it will also do so rather than cause security problems on your computer, which may be desirable depending on the situation.It's Easy to Use Graphical X Applications Over SSHWhile using SSH to access a remote computer can come with some restrictions, there are a lot of ways to get around them. Graphical X forwarding is one incredibly useful way of doing to run programs that aren't possible to run otherwise and prevent the need for installing VNC or other more complicated protocols. With graphical X forwarding, nearly any application can be run remotely from anywhere.I hope you enjoyed this guide to opening graphical X applications over SSH! If you have any questions about this tutorial on SSH or you have a comment, ask below or feel free to reach me on Twitter@KodyKinzie.Don't Miss:How to Hide MacOS Payloads Inside Photo MetadataWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image and screenshots by Kody/Null ByteRelatedRasberry Pi:Connecting on ComputerHow To:Spy on SSH Sessions with SSHPry2.0How To:Use SSH Local Port Forwarding to Pivot into Restricted NetworksSSH the World:Mac, Linux, Windows, iDevices and Android.How To:Enable the New Native SSH Client on Windows 10How To:SSH into an iPod Touch 2G for Windows (3.0 firmware)How To:Set Up an SSH Server with Tor to Hide It from Shodan & HackersSPLOIT:How to Make an SSH Brute-Forcer in PythonHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 15 (Creating a Secure Tunnel to MySQL)How To:Create a Native SSH Server on Your Windows 10 SystemHow To:Connect to an iPhone or iPod Touch from a PC via SSHHow To:Discover & Attack Services on Web Apps or Networks with SpartaHow To:Haunt a Computer with SSHHow To:Top 10 Things to Do After Installing Kali LinuxHow To:Discover & Attack Raspberry Pis Using Default Credentials with Rpi-hunterHow To:SSH file share on your Apple iPhone or iPod TouchHow To:Use the Cowrie SSH Honeypot to Catch Attackers on Your NetworkHow To:Hack Metasploitable 2 Part 1How To:Replicate the Moto X's "Active Listening" Hands-Free Assistant on Your Samsung Galaxy S3How To:Use the Chrome Browser Secure Shell App to SSH into Remote DevicesHow To:Detect Misconfigurations in 'Anonymous' Dark Web Sites with OnionScanHow To:Use voice-overs in your video projectHow To:Punchabunch Just Made SSH Local Forwarding Stupid EasyHow To:SSH into your iPhone or iPod Touch using MacHow To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreHow To:Remotely Control Computers Over VNC Securely with SSHHow To:Create an SSH Tunnel Server and Client in LinuxHow To:Safely Log In to Your SSH Account Without a PasswordHow To:Push and Pull Remote Files Securely Over SSH with PipesHow To:Code Your Own Twitter Client in Python Using OAuthNews:ZOMBIES, RUN! A running game & audio adventureHow To:Quickly Encrypt Your Web Browsing Traffic When Connected to Public WiFiNews:Richard Stallman's RiderButler:The Ultimate Time Saving App for MacHow To:10+ Time Saving Menu Bar Applications for MacNews:Flaw in the Latest Linux Graphical Server Allows Passwordless LoginsHow To:Activate the Little-Known Paper Tape Feature on Mac OS X's Calculator App