Wire in recog support for ssh_version

Author: jhart-r7

modules/auxiliary/scanner/ssh/ssh_version.rb

@@ -4,6 +4,7 @@
 ##
 
 require 'msf/core'
+require 'recog'
 
 class Metasploit3 < Msf::Auxiliary
   include Msf::Exploit::Remote::Tcp
@@ -36,10 +37,15 @@ def initialize
     )
   end
 
+  def peer
+    "#{rhost}:#{rport}"
+  end
+
   def timeout
     datastore['TIMEOUT'] <= 0 ? DEFAULT_TIMEOUT : datastore['TIMEOUT']
   end
 
+
   def run_host(target_host)
     begin
       ::Timeout.timeout(timeout) do
@@ -48,19 +54,25 @@ def run_host(target_host)
         resp = sock.get_once(-1, timeout)
 
         if resp
-          if resp =~ /^SSH/
-            ver, msg = resp.split(/[\r\n]+/)
+          ident, first_message = resp.split(/[\r\n]+/)
+          if /^SSH-\d+\.\d+-(?<banner>.*)$/ =~ ident
+            if recog_match = Recog::Nizer.match('ssh.banner', banner)
+              info = recog_match.to_s
+            else
+              info = 'UNKNOWN'
+              print_warning("#{peer} unknown SSH banner: #{banner}")
+            end
             # Check to see if this is Kippo, which sends a premature
             # key init exchange right on top of the SSH version without
             # waiting for the required client identification string.
-            if msg && msg.size >= 5
-              extra = msg.unpack("NCCA*") # sz, pad_sz, code, data
+            if first_message && first_message.size >= 5
+              extra = first_message.unpack("NCCA*") # sz, pad_sz, code, data
               if (extra.last.size + 2 == extra[0]) && extra[2] == 20
-                ver << " (Kippo Honeypot)"
+                info << " (Kippo Honeypot)"
               end
             end
-            print_status("#{target_host}:#{rport}, SSH server version: #{ver}")
-            report_service(host: rhost, port: rport, name: 'ssh', proto: 'tcp', info: ver)
+            print_status("#{target_host}:#{rport}, SSH server version: #{ident}")
+            report_service(host: rhost, port: rport, name: 'ssh', proto: 'tcp', info: info)
           else
             vprint_warning("#{target_host}:#{rport} was not SSH --"  \
                           " #{resp.size} bytes beginning with #{resp[0, 12]}")