ssh_version module #18686

h00die · 2024-01-09T22:50:44Z

ssh_version module does what it says. However, it would be nice if we had the ability to pull ciphers, encryption methods etc. Similar to the upgrade to ssl_version in #17149

This PR does that, it shows:

ssh server fingerprint
looks for encryption/hmac/kex/etc that are deprecated and prints those
prints the values returned by the server related to encryption/compression/etc

Validation

start msfconsole
use auxiliary/scanner/ssh/ssh_version
set rhost to the docker image, or any host really that you want
run
you should see info and warnings printed.

h00die · 2024-01-09T22:53:48Z

Still need to do docs, and test on additional devices.

jvoisin · 2024-01-10T12:15:37Z

I would suggest using a map like [url => [cipher1, cipher2, cipher3, …]]` instead of copy/pasting everything :)

jmartin-tech · 2024-01-11T18:23:53Z

A passing thought, it would be nice if the data gathered and displayed here was stored even when a vuln in not found.

h00die · 2024-01-11T19:53:38Z

A passing thought, it would be nice if the data gathered and displayed here was stored even when a vuln in not found.

I'm up for suggestions. ssl_version, which this is slightly similar to only stores the cert.

smcintyre-r7

I'm generally concerned about the output in a scanner module increasing from 1 line to 96 for a single host in the default condition. How would you feel about making some of the output either VERBOSE or controlled by a dedicated datastore option?

modules/auxiliary/scanner/ssh/ssh_version.rb

smcintyre-r7 · 2024-02-13T19:33:00Z

modules/auxiliary/scanner/ssh/ssh_version.rb

+      server_data[:encryption_server].each do |encryption|
+        encryption_checks.each do |encryptions, refs|
+          encryptions.each do |bad_enc|
+            next unless encryption.downcase.start_with? bad_enc


Is the #start_with? check necessary here instead of a normal equality check? The reason I ask is that before of arcfour being defined in the first group, anything that starts with arcfour would be included, not just the ones that are defined. The same goes for other entries.

This was done for consistency. https://datatracker.ietf.org/doc/html/rfc8732#name-deprecated-algorithms mentions gss-group1-sha1-* and it seemed like a lot of added logic for some to check starts_with and others not. However, I've switched it to be more exact.

modules/auxiliary/scanner/ssh/ssh_version.rb

h00die · 2024-03-03T13:55:38Z

I made the print_good on each bad (reverse logic since pentest?) a verbose, which cuts down on output. I also added a datastore option, so I think its the best of both worlds.

smcintyre-r7 · 2024-03-04T18:18:58Z

@msjenkins-r7 test this please.

smcintyre-r7 · 2024-03-04T21:15:48Z

@msjenkins-r7 test this please.

modules/auxiliary/scanner/ssh/ssh_version.rb

documentation/modules/auxiliary/scanner/ssh/ssh_version.md

smcintyre-r7

Everything is looking good to me on this now. Thanks for all the changes you put together to improve this!

msf6 auxiliary(scanner/ssh/ssh_version) > show options 

Module options (auxiliary/scanner/ssh/ssh_version):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   EXTENDED_CHECKS  true             yes       Check for cryptographic issues
   RHOSTS           192.168.250.1    yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT            22               yes       The target port
   THREADS          1                yes       The number of concurrent threads (max one per host)
   TIMEOUT          30               yes       Timeout for the SSH probe


View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/ssh/ssh_version) > run
msf6 auxiliary(scanner/ssh/ssh_version) > run

[*] 192.168.250.1 - Key Fingerprint: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGMf2Rx2HLHYxwv3acxlS+r8ZXSwrcNb/z6YPSl4rmEs
[*] 192.168.250.1 - SSH server version: SSH-2.0-OpenSSH_6.6.1p1 Debian-4~bpo70+1
[*] 192.168.250.1 - Server Information and Encryption
=================================

  Type                     Value                                 Note
  ----                     -----                                 ----
  encryption.compression   none
  encryption.compression   [email protected]
  encryption.encryption    [email protected]
  encryption.encryption    aes128-ctr
  encryption.encryption    aes192-ctr
  encryption.encryption    aes256-ctr
  encryption.encryption    [email protected]
  encryption.encryption    [email protected]
  encryption.hmac          [email protected]
  encryption.hmac          [email protected]
  encryption.hmac          [email protected]
  encryption.hmac          [email protected]
  encryption.hmac          [email protected]
  encryption.hmac          [email protected]
  encryption.hmac          [email protected]
  encryption.hmac          hmac-sha2-256
  encryption.hmac          hmac-sha2-512
  encryption.hmac          hmac-sha1
  encryption.host_key      ssh-rsa
  encryption.host_key      ssh-dss
  encryption.host_key      ecdsa-sha2-nistp256                   Weak elliptic curve
  encryption.host_key      ssh-ed25519
  encryption.key_exchange  [email protected]
  encryption.key_exchange  ecdh-sha2-nistp256
  encryption.key_exchange  ecdh-sha2-nistp384
  encryption.key_exchange  ecdh-sha2-nistp521
  encryption.key_exchange  diffie-hellman-group-exchange-sha256
  encryption.key_exchange  diffie-hellman-group-exchange-sha1    Deprecated
  encryption.key_exchange  diffie-hellman-group14-sha1
  encryption.key_exchange  diffie-hellman-group1-sha1            Deprecated
  fingerprint_db           ssh.banner
  openssh.comment          Debian-4~bpo70+1
  os.cpe23                 cpe:/o:debian:debian_linux:7.0
  os.family                Linux
  os.product               Linux
  os.vendor                Debian
  os.version               7.0
  service.cpe23            cpe:/a:openbsd:openssh:6.6.1p1
  service.family           OpenSSH
  service.product          OpenSSH
  service.protocol         ssh
  service.vendor           OpenBSD
  service.version          6.6.1p1

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/ssh/ssh_version) > set EXTENDED_CHECKS false 
EXTENDED_CHECKS => false
msf6 auxiliary(scanner/ssh/ssh_version) > run

[*] 192.168.250.1 - Key Fingerprint: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGMf2Rx2HLHYxwv3acxlS+r8ZXSwrcNb/z6YPSl4rmEs
[*] 192.168.250.1 - SSH server version: SSH-2.0-OpenSSH_6.6.1p1 Debian-4~bpo70+1
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/ssh/ssh_version) >

smcintyre-r7 · 2024-03-06T15:33:32Z

Release Notes

This updates the existing auxiliary/scanner/ssh/ssh_version module with new checks for supported cryptographic algorithms and version detection capabilities.

ssh_version module

b8e2fee

h00die force-pushed the ssh_version branch from e73159c to b8e2fee Compare January 9, 2024 22:53

h00die changed the title ~~ssh_login module~~ ssh_version module Jan 10, 2024

ssh_version module

d57c9fb

ssh_version module docs

a8bc6cc

h00die marked this pull request as ready for review January 11, 2024 19:56

smcintyre-r7 self-assigned this Feb 12, 2024

smcintyre-r7 added module enhancement rn-enhancement release notes enhancement labels Feb 12, 2024

smcintyre-r7 requested changes Feb 13, 2024

View reviewed changes

h00die added 2 commits March 3, 2024 09:18

review of ssh_version improvements

f2d836d

review of ssh_version improvements

7f6be50

smcintyre-r7 requested changes Mar 5, 2024

View reviewed changes

modules/auxiliary/scanner/ssh/ssh_version.rb Outdated Show resolved Hide resolved

modules/auxiliary/scanner/ssh/ssh_version.rb Outdated Show resolved Hide resolved

documentation/modules/auxiliary/scanner/ssh/ssh_version.md Outdated Show resolved Hide resolved

h00die added 2 commits March 5, 2024 17:15

ssh_version module

c4837d0

ssh_version module

8b6f759

smcintyre-r7 approved these changes Mar 6, 2024

View reviewed changes

smcintyre-r7 merged commit 23e0abe into rapid7:master Mar 6, 2024
33 of 34 checks passed

h00die deleted the ssh_version branch March 6, 2024 22:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ssh_version module #18686

ssh_version module #18686

h00die commented Jan 9, 2024 •

edited by smcintyre-r7

Loading

h00die commented Jan 9, 2024

jvoisin commented Jan 10, 2024

jmartin-tech commented Jan 11, 2024

h00die commented Jan 11, 2024

smcintyre-r7 left a comment

smcintyre-r7 Feb 13, 2024

h00die Mar 4, 2024

h00die commented Mar 3, 2024

smcintyre-r7 commented Mar 4, 2024

smcintyre-r7 commented Mar 4, 2024

smcintyre-r7 left a comment

smcintyre-r7 commented Mar 6, 2024

ssh_version module #18686

ssh_version module #18686

Conversation

h00die commented Jan 9, 2024 • edited by smcintyre-r7 Loading

Validation

h00die commented Jan 9, 2024

jvoisin commented Jan 10, 2024

jmartin-tech commented Jan 11, 2024

h00die commented Jan 11, 2024

smcintyre-r7 left a comment

Choose a reason for hiding this comment

smcintyre-r7 Feb 13, 2024

Choose a reason for hiding this comment

h00die Mar 4, 2024

Choose a reason for hiding this comment

h00die commented Mar 3, 2024

smcintyre-r7 commented Mar 4, 2024

smcintyre-r7 commented Mar 4, 2024

smcintyre-r7 left a comment

Choose a reason for hiding this comment

smcintyre-r7 commented Mar 6, 2024

Release Notes

h00die commented Jan 9, 2024 •

edited by smcintyre-r7

Loading