Land rapid7#19656 Close ssh session on error

Author: jheysel-r7

lib/msf/base/sessions/aws_instance_connect_command_shell_bind.rb

@@ -76,7 +76,7 @@ def desc
     end
 
     def bootstrap(datastore = {}, handler = nil)
-      @ssh_command_stream = Net::SSH::CommandStream.new(ssh_connection)
+      @ssh_command_stream = Net::SSH::CommandStream.new(ssh_connection, session: self, logger: self)
 
       @ssh_command_stream.verify_channel
       # set remote_window_size to 32 which seems to help stability

lib/msf/base/sessions/ssh_command_shell_bind.rb

@@ -243,7 +243,7 @@ def bootstrap(datastore = {}, handler = nil)
       # shells accessed through SSH may respond to the echo command issued for verification as expected
       datastore['AutoVerifySession'] &= @platform.blank?
 
-      @rstream = Net::SSH::CommandStream.new(ssh_connection).lsock
+      @rstream = Net::SSH::CommandStream.new(ssh_connection, session: self, logger: self).lsock
       super
 
       @info = "SSH #{username} @ #{@peer_info}"

lib/net/ssh/command_stream.rb

@@ -2,7 +2,7 @@
 
 class Net::SSH::CommandStream
 
-  attr_accessor :channel, :thread, :error, :ssh
+  attr_accessor :channel, :thread, :error, :ssh, :session, :logger
   attr_accessor :lsock, :rsock, :monitor
 
   module PeerInfo
@@ -13,7 +13,8 @@ module PeerInfo
 
   def shell_requested(channel, success)
     unless success
-      raise Net::SSH::ChannelRequestFailed, 'Shell/exec channel request failed'
+      error = Net::SSH::ChannelRequestFailed.new('Shell/exec channel request failed')
+      handle_error(error: error)
     end
 
     self.channel = channel
@@ -40,7 +41,9 @@ def shell_requested(channel, success)
     end
   end
 
-  def initialize(ssh, cmd = nil, pty: false, cleanup: false)
+  def initialize(ssh, cmd = nil, pty: false, cleanup: false, session: nil, logger: nil)
+    self.session = session
+    self.logger = logger
     self.lsock, self.rsock = Rex::Socket.tcp_socket_pair()
     self.lsock.extend(Rex::IO::Stream)
     self.lsock.extend(PeerInfo)
@@ -74,31 +77,40 @@ def initialize(ssh, cmd = nil, pty: false, cleanup: false)
       end
 
       channel.on_open_failed do |ch, code, desc|
-        raise Net::SSH::ChannelOpenFailed.new(code, 'Session channel open failed')
+        error = Net::SSH::ChannelOpenFailed.new(code, 'Session channel open failed')
+        handle_error(error: error)
       end
 
       self.monitor = Thread.new do
-        while(true)
-          next if not self.rsock.has_read_data?(1.0)
-          buff = self.rsock.read(16384)
-          break if not buff
-          verify_channel
-          self.channel.send_data(buff) if buff
+        begin
+          Kernel.loop do
+            next if not self.rsock.has_read_data?(1.0)
+
+            buff = self.rsock.read(16384)
+            break if not buff
+
+            verify_channel
+            self.channel.send_data(buff) if buff
+          end
+        rescue ::StandardError => e
+          handle_error(error: e)
         end
       end
 
-      while true
-        rssh.process(0.5) { true }
+      begin
+        Kernel.loop { rssh.process(0.5) { true } }
+      rescue ::StandardError => e
+        handle_error(error: e)
       end
 
       # Shut down the SSH session if requested
       if !rcmd.nil? && rcleanup
         rssh.close
       end
     end
-  rescue ::Exception => e
+  rescue ::StandardError => e
     # XXX: This won't be set UNTIL there's a failure from a thread
-    self.error = e
+    handle_error(error: e)
   ensure
     self.monitor.kill if self.monitor
   end
@@ -113,7 +125,18 @@ def verify_channel
     end
   end
 
+  def handle_error(error: nil)
+    self.error = error if error
+
+    if self.logger
+      self.logger.print_error("SSH Command Stream encountered an error: #{self.error} (Server Version: #{self.ssh.transport.server_version.version})")
+    end
+
+    cleanup
+  end
+
   def cleanup
+    self.session.alive = false if self.session
     self.monitor.kill
     self.lsock.close rescue nil
     self.rsock.close rescue nil

modules/auxiliary/scanner/ssh/eaton_xpert_backdoor.rb

@@ -84,7 +84,7 @@ def run_host(ip)
       info: version
     )
 
-    shell = Net::SSH::CommandStream.new(ssh)
+    shell = Net::SSH::CommandStream.new(ssh, logger: self)
 
     # XXX: Wait for CommandStream to log a channel request failure
     sleep 0.1

modules/auxiliary/scanner/ssh/fortinet_backdoor.rb

@@ -77,7 +77,7 @@ def run_host(ip)
       info: version
     )
 
-    shell = Net::SSH::CommandStream.new(ssh)
+    shell = Net::SSH::CommandStream.new(ssh, logger: self)
 
     # XXX: Wait for CommandStream to log a channel request failure
     sleep 0.1

modules/auxiliary/scanner/ssh/libssh_auth_bypass.rb

@@ -120,7 +120,7 @@ def run_host(ip)
       info: version
     )
 
-    shell = Net::SSH::CommandStream.new(ssh, datastore['CMD'], pty: datastore['SPAWN_PTY'])
+    shell = Net::SSH::CommandStream.new(ssh, datastore['CMD'], pty: datastore['SPAWN_PTY'], logger: self)
 
     # XXX: Wait for CommandStream to log a channel request failure
     sleep 0.1

modules/exploits/apple_ios/ssh/cydia_default_ssh.rb

@@ -110,7 +110,7 @@ def do_login(user, pass)
     end
 
     if ssh
-      conn = Net::SSH::CommandStream.new(ssh)
+      conn = Net::SSH::CommandStream.new(ssh, logger: self)
       ssh = nil
       return conn
     end

modules/exploits/freebsd/http/junos_phprc_auto_prepend_file.rb

@@ -349,7 +349,7 @@ def ssh_login
     end
 
     if ssh
-      Net::SSH::CommandStream.new(ssh)
+      Net::SSH::CommandStream.new(ssh, logger: self)
     end
   end
 

modules/exploits/linux/http/ubiquiti_airos_file_upload.rb

@@ -156,7 +156,7 @@ def ssh_login
         private: private_key,
         private_type: :ssh_key
       )
-      return Net::SSH::CommandStream.new(ssh)
+      return Net::SSH::CommandStream.new(ssh, logger: self)
     end
 
     nil

modules/exploits/linux/ssh/ceragon_fibeair_known_privkey.rb

@@ -111,7 +111,7 @@ def do_login(user)
     if ssh_socket
 
       # Create a new session from the socket, then dump it.
-      conn = Net::SSH::CommandStream.new(ssh_socket)
+      conn = Net::SSH::CommandStream.new(ssh_socket, logger: self)
       ssh_socket = nil
 
       return conn