# ssh-keygen

> Load unsigned dynamic libraries into the ssh-keygen binary.

ssh-keygen is a tool for creating new authentication key pairs for SSH (Secure Shell). ssh-keygen holds the "com.apple.security.cs.disable-library-validation" entitlement and is capable of loading arbitrary libraries without requiring signed code.

- Page: https://loobins.io/binaries/ssh-keygen/
- Author: Leo Pitt (@_D00mfist)
- Created: 2023-05-22
- Tactics: Execution, Defense Evasion

## Paths

- `/usr/bin/ssh-keygen`

## Example Use Cases

### Execute malicious dynamic library (.dylib) from standard input

An attacker can execute a malicious .dylib from stdin by echoing a load command and piping to tclsh. This will bypass code signing requirements.

```bash
ssh-keygen -D /private/tmp/evil.dylib
```

- Tactics: Execution, Defense Evasion
- Tags: dylib

## Detections

- [Recommendations included in resource below. No formal detection content at this time.](https://medium.com/@D00MFist/generate-keys-or-generate-dylib-loads-c99ed48f323d)

## Resources

- [Generate Keys or Generate Dylib Loads?](https://medium.com/@D00MFist/generate-keys-or-generate-dylib-loads-c99ed48f323d)