Is it possible to use SSH-MiTM to obtain shared secret or private key for the client <-> SSH-MiTM or SSH-MiTM <-> server?

[jubeormk1]

Hello again,

I am again using ssh-mitm to explore SSH and SFTP communications. I am using TShark to record packets between a local client and a local ssh-mitm instance.

tshark -i lo -f "port 10022" -w mitm.pcap

Loading the pcap file in Wireshark shows the expected handshake for an ssh sessions: once the key exchange has been completed and the packet New Keys is sent by any of the parties, the rest of the communication is encrypted and the fun is over.

Wireshark implements a protocol module for SSH that requires the user to provide "key exchange secrets" in a file including:

• session cookie of a participant
• kind of secret (SHARED_SECRET / PRIVATE_KEY)
• session shared secret or the private key of the same participant

In my brief experience, finding the session cookie is trivial, as it is included in Key Exchange Init packet for each participant. Finding the secret is way more complicated since is kept in the process running client/server.

Does SSH-MiTM provide a way to obtain such secrets to facilitate packet inspection with other tools (Wireshark)?