Add error_callback to SSH Command Stream

Author: sjanusz-r7

lib/msf/base/sessions/aws_instance_connect_command_shell_bind.rb

@@ -76,7 +76,7 @@ def desc
     end
 
     def bootstrap(datastore = {}, handler = nil)
-      @ssh_command_stream = Net::SSH::CommandStream.new(ssh_connection, session: self)
+      @ssh_command_stream = Net::SSH::CommandStream.new(ssh_connection, session: self, logger: self)
 
       @ssh_command_stream.verify_channel
       # set remote_window_size to 32 which seems to help stability

lib/msf/base/sessions/ssh_command_shell_bind.rb

@@ -243,7 +243,7 @@ def bootstrap(datastore = {}, handler = nil)
       # shells accessed through SSH may respond to the echo command issued for verification as expected
       datastore['AutoVerifySession'] &= @platform.blank?
 
-      @rstream = Net::SSH::CommandStream.new(ssh_connection, session: self).lsock
+      @rstream = Net::SSH::CommandStream.new(ssh_connection, session: self, logger: self).lsock
       super
 
       @info = "SSH #{username} @ #{@peer_info}"

lib/net/ssh/command_stream.rb

@@ -2,7 +2,7 @@
 
 class Net::SSH::CommandStream
 
-  attr_accessor :channel, :thread, :error, :ssh, :session
+  attr_accessor :channel, :thread, :error, :ssh, :session, :logger
   attr_accessor :lsock, :rsock, :monitor
 
   module PeerInfo
@@ -13,9 +13,8 @@ module PeerInfo
 
   def shell_requested(channel, success)
     unless success
-      error = Net::SSH::ChannelRequestFailed, 'Shell/exec channel request failed'
+      error = Net::SSH::ChannelRequestFailed.new('Shell/exec channel request failed')
       handle_error(error: error)
-      raise error
     end
 
     self.channel = channel
@@ -42,8 +41,9 @@ def shell_requested(channel, success)
     end
   end
 
-  def initialize(ssh, cmd = nil, pty: false, cleanup: false, session: nil)
+  def initialize(ssh, cmd = nil, pty: false, cleanup: false, session: nil, logger: nil)
     self.session = session
+    self.logger = logger
     self.lsock, self.rsock = Rex::Socket.tcp_socket_pair()
     self.lsock.extend(Rex::IO::Stream)
     self.lsock.extend(PeerInfo)
@@ -79,7 +79,6 @@ def initialize(ssh, cmd = nil, pty: false, cleanup: false, session: nil)
       channel.on_open_failed do |ch, code, desc|
         error = Net::SSH::ChannelOpenFailed.new(code, 'Session channel open failed')
         handle_error(error: error)
-        raise error
       end
 
       self.monitor = Thread.new do
@@ -109,7 +108,6 @@ def initialize(ssh, cmd = nil, pty: false, cleanup: false, session: nil)
         rssh.close
       end
     end
-    self.thread.abort_on_exception = true
   rescue ::StandardError => e
     # XXX: This won't be set UNTIL there's a failure from a thread
     handle_error(error: e)
@@ -129,6 +127,11 @@ def verify_channel
 
   def handle_error(error: nil)
     self.error = error if error
+
+    if self.logger
+      self.logger.print_error("SSH Command Stream encountered an error: #{self.error} (Server Version: #{self.ssh.transport.server_version.version})")
+    end
+
     cleanup
   end
 

modules/auxiliary/scanner/ssh/eaton_xpert_backdoor.rb

@@ -84,7 +84,7 @@ def run_host(ip)
       info: version
     )
 
-    shell = Net::SSH::CommandStream.new(ssh)
+    shell = Net::SSH::CommandStream.new(ssh, logger: self)
 
     # XXX: Wait for CommandStream to log a channel request failure
     sleep 0.1

modules/auxiliary/scanner/ssh/fortinet_backdoor.rb

@@ -77,7 +77,7 @@ def run_host(ip)
       info: version
     )
 
-    shell = Net::SSH::CommandStream.new(ssh)
+    shell = Net::SSH::CommandStream.new(ssh, logger: self)
 
     # XXX: Wait for CommandStream to log a channel request failure
     sleep 0.1

modules/auxiliary/scanner/ssh/libssh_auth_bypass.rb

@@ -120,7 +120,7 @@ def run_host(ip)
       info: version
     )
 
-    shell = Net::SSH::CommandStream.new(ssh, datastore['CMD'], pty: datastore['SPAWN_PTY'])
+    shell = Net::SSH::CommandStream.new(ssh, datastore['CMD'], pty: datastore['SPAWN_PTY'], logger: self)
 
     # XXX: Wait for CommandStream to log a channel request failure
     sleep 0.1

modules/exploits/apple_ios/ssh/cydia_default_ssh.rb

@@ -110,7 +110,7 @@ def do_login(user, pass)
     end
 
     if ssh
-      conn = Net::SSH::CommandStream.new(ssh)
+      conn = Net::SSH::CommandStream.new(ssh, logger: self)
       ssh = nil
       return conn
     end

modules/exploits/freebsd/http/junos_phprc_auto_prepend_file.rb

@@ -349,7 +349,7 @@ def ssh_login
     end
 
     if ssh
-      Net::SSH::CommandStream.new(ssh)
+      Net::SSH::CommandStream.new(ssh, logger: self)
     end
   end
 

modules/exploits/linux/http/ubiquiti_airos_file_upload.rb

@@ -156,7 +156,7 @@ def ssh_login
         private: private_key,
         private_type: :ssh_key
       )
-      return Net::SSH::CommandStream.new(ssh)
+      return Net::SSH::CommandStream.new(ssh, logger: self)
     end
 
     nil

modules/exploits/linux/ssh/ceragon_fibeair_known_privkey.rb

@@ -111,7 +111,7 @@ def do_login(user)
     if ssh_socket
 
       # Create a new session from the socket, then dump it.
-      conn = Net::SSH::CommandStream.new(ssh_socket)
+      conn = Net::SSH::CommandStream.new(ssh_socket, logger: self)
       ssh_socket = nil
 
       return conn