Skip to content

Commit 23e0abe

Browse files
smcintyre-r7smcintyre-r7
committed
Land rapid7#18686, ssh_version module
2 parents b114058 + 8b6f759 commit 23e0abe

File tree

2 files changed

+469
-64
lines changed

2 files changed

+469
-64
lines changed

‎documentation/modules/auxiliary/scanner/ssh/ssh_version.md

Lines changed: 236 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,260 @@
1-
## Description
2-
3-
SSH, Secure SHell, is an encrypted network protocol used to remotely interact with an Operating System at a command line level. SSH is available on most every system, including Windows, but is mainly used by *nix administrators.
1+
## Vulnerable Application
42

5-
This module identifies the version of SSH service in use by the server based on the server's banner. Any SSH server should return this information.
3+
SSH, Secure SHell, is an encrypted network protocol used to remotely interact with an Operating System at a command line level.
4+
SSH is available on most every system, including Windows, but is mainly used by *nix administrators.
65

7-
## Vulnerable Application
6+
This module identifies the version of SSH service in use by the server based on the server's banner.
7+
Any SSH server should return this information. It also identifies the varous cryptographic settings
8+
and vulnerabilities associated with those.
89

910
This module is tested on several different SSH services, such as:
1011

1112
- Virtual testing environment: SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8
1213
- `github.com`: SSH-2.0-babeld-38be96bc
1314
- `gitlab.com`: SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8
1415

16+
### Vulnerable Ubuntu 14.04.1
17+
18+
The following `Dockerfile` can be used to create an Ubuntu 14.04.1 image with SSH running.
19+
20+
```
21+
FROM ubuntu:14.04.1
22+
23+
RUN apt-get update && apt-get -y install --no-install-recommends openssh-server=1:6.6p1-2ubuntu1 openssh-client=1:6.6p1-2ubuntu1 openssh-sftp-server=1:6.6p1-2ubuntu1
24+
RUN mkdir /var/run/sshd
25+
EXPOSE 22
26+
27+
CMD ["/usr/sbin/sshd","-D"]
28+
```
29+
1530
## Verification Steps
1631

1732
1. Do: `use auxiliary/scanner/ssh/ssh_version`
1833
2. Do: `set rhosts [ips]`
1934
3. Do: `run`
2035

36+
## Options
37+
38+
### EXTENDED_CHECKS
39+
40+
Check for cryptographic issues. Defaults to `true`
41+
2142
## Scenarios
2243

2344
### SSH-2.0 on GitHub
2445

25-
```
26-
msf5 auxiliary(scanner/ssh/ssh_version) > use auxiliary/scanner/ssh/ssh_version
46+
```
47+
msf5 > use auxiliary/scanner/ssh/ssh_version
2748
msf5 auxiliary(scanner/ssh/ssh_version) > set RHOSTS github.com
2849
RHOSTS => github.com
2950
msf5 auxiliary(scanner/ssh/ssh_version) > run
3051
31-
[+] 140.82.118.4:22 - SSH server version: SSH-2.0-babeld-38be96bc
32-
[*] github.com:22 - Scanned 1 of 1 hosts (100% complete)
52+
[*] 140.82.113.4 - Key Fingerprint: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
53+
[*] 140.82.113.4 - SSH server version: SSH-2.0-babeld-8405f9f3
54+
[*] 140.82.113.4 - Server Information and Encryption
55+
=================================
56+
57+
Type Value Note
58+
---- ----- ----
59+
encryption.compression none
60+
encryption.compression [email protected]
61+
encryption.compression zlib
62+
encryption.encryption [email protected]
63+
encryption.encryption [email protected]
64+
encryption.encryption [email protected]
65+
encryption.encryption aes256-ctr
66+
encryption.encryption aes192-ctr
67+
encryption.encryption aes128-ctr
68+
encryption.hmac [email protected]
69+
encryption.hmac [email protected]
70+
encryption.hmac hmac-sha2-512
71+
encryption.hmac hmac-sha2-256
72+
encryption.host_key ssh-ed25519
73+
encryption.host_key ecdsa-sha2-nistp256 Weak elliptic curve
74+
encryption.host_key rsa-sha2-512
75+
encryption.host_key rsa-sha2-256
76+
encryption.host_key ssh-rsa
77+
encryption.key_exchange curve25519-sha256
78+
encryption.key_exchange [email protected]
79+
encryption.key_exchange ecdh-sha2-nistp256
80+
encryption.key_exchange ecdh-sha2-nistp384
81+
encryption.key_exchange ecdh-sha2-nistp521
82+
encryption.key_exchange diffie-hellman-group-exchange-sha256
83+
encryption.key_exchange [email protected]
84+
85+
[*] Scanned 1 of 1 hosts (100% complete)
86+
[*] Auxiliary module execution completed
87+
```
88+
89+
### Docker image
90+
91+
```
92+
msf5 > use auxiliary/scanner/ssh/ssh_version
93+
msf6 auxiliary(scanner/ssh/ssh_version) > set rhosts 172.17.0.2
94+
rhosts => 172.17.0.2
95+
msf6 auxiliary(scanner/ssh/ssh_version) > set verbose true
96+
verbose => true
97+
msf6 auxiliary(scanner/ssh/ssh_version) > run
98+
99+
[*] 172.17.0.2 - Key Fingerprint: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG52hWkobwr57akGxiK6eeMN9/M5MH+sQsNPv8Mci049
100+
[*] 172.17.0.2 - SSH server version: SSH-2.0-OpenSSH_6.6p1 Ubuntu-2ubuntu1
101+
[+] 172.17.0.2 - Key Exchange (kex) diffie-hellman-group-exchange-sha1 is deprecated and should not be used.
102+
[+] 172.17.0.2 - Key Exchange (kex) diffie-hellman-group1-sha1 is deprecated and should not be used.
103+
[+] 172.17.0.2 - Host Key Encryption ecdsa-sha2-nistp256 uses a weak elliptic curve and should not be used.
104+
[+] 172.17.0.2 - HMAC hmac-md5 is deprecated and should not be used.
105+
[+] 172.17.0.2 - HMAC hmac-ripemd160 is deprecated and should not be used.
106+
[+] 172.17.0.2 - HMAC hmac-sha1-96 is deprecated and should not be used.
107+
[+] 172.17.0.2 - HMAC hmac-md5-96 is deprecated and should not be used.
108+
[+] 172.17.0.2 - Encryption arcfour256 is deprecated and should not be used.
109+
[+] 172.17.0.2 - Encryption arcfour128 is deprecated and should not be used.
110+
[+] 172.17.0.2 - Encryption aes128-cbc is deprecated and should not be used.
111+
[+] 172.17.0.2 - Encryption 3des-cbc is deprecated and should not be used.
112+
[+] 172.17.0.2 - Encryption blowfish-cbc is deprecated and should not be used.
113+
[+] 172.17.0.2 - Encryption cast128-cbc is deprecated and should not be used.
114+
[+] 172.17.0.2 - Encryption aes192-cbc is deprecated and should not be used.
115+
[+] 172.17.0.2 - Encryption aes256-cbc is deprecated and should not be used.
116+
[+] 172.17.0.2 - Encryption arcfour is deprecated and should not be used.
117+
[+] 172.17.0.2 - Encryption [email protected] is deprecated and should not be used.
118+
[*] 172.17.0.2 - Server Information and Encryption
119+
=================================
120+
121+
Type Value Note
122+
---- ----- ----
123+
encryption.compression none
124+
encryption.compression [email protected]
125+
encryption.encryption aes128-ctr
126+
encryption.encryption aes192-ctr
127+
encryption.encryption aes256-ctr
128+
encryption.encryption arcfour256 Deprecated
129+
encryption.encryption arcfour128 Deprecated
130+
encryption.encryption [email protected]
131+
encryption.encryption [email protected]
132+
encryption.encryption [email protected]
133+
encryption.encryption aes128-cbc Deprecated
134+
encryption.encryption 3des-cbc Deprecated
135+
encryption.encryption blowfish-cbc Deprecated
136+
encryption.encryption cast128-cbc Deprecated
137+
encryption.encryption aes192-cbc Deprecated
138+
encryption.encryption aes256-cbc Deprecated
139+
encryption.encryption arcfour Deprecated
140+
encryption.encryption [email protected] Deprecated
141+
encryption.hmac [email protected]
142+
encryption.hmac [email protected]
143+
encryption.hmac [email protected]
144+
encryption.hmac [email protected]
145+
encryption.hmac [email protected]
146+
encryption.hmac [email protected]
147+
encryption.hmac [email protected]
148+
encryption.hmac [email protected]
149+
encryption.hmac [email protected]
150+
encryption.hmac hmac-md5 Deprecated
151+
encryption.hmac hmac-sha1
152+
encryption.hmac [email protected]
153+
encryption.hmac [email protected]
154+
encryption.hmac hmac-sha2-256
155+
encryption.hmac hmac-sha2-512
156+
encryption.hmac hmac-ripemd160 Deprecated
157+
encryption.hmac [email protected]
158+
encryption.hmac hmac-sha1-96 Deprecated
159+
encryption.hmac hmac-md5-96 Deprecated
160+
encryption.host_key ssh-rsa
161+
encryption.host_key ssh-dss
162+
encryption.host_key ecdsa-sha2-nistp256 Weak elliptic curve
163+
encryption.host_key ssh-ed25519
164+
encryption.key_exchange [email protected]
165+
encryption.key_exchange ecdh-sha2-nistp256
166+
encryption.key_exchange ecdh-sha2-nistp384
167+
encryption.key_exchange ecdh-sha2-nistp521
168+
encryption.key_exchange diffie-hellman-group-exchange-sha256
169+
encryption.key_exchange diffie-hellman-group-exchange-sha1 Deprecated
170+
encryption.key_exchange diffie-hellman-group14-sha1
171+
encryption.key_exchange diffie-hellman-group1-sha1 Deprecated
172+
fingerprint_db ssh.banner
173+
openssh.comment Ubuntu-2ubuntu1
174+
os.cpe23 cpe:/o:canonical:ubuntu_linux:14.04
175+
os.family Linux
176+
os.product Linux
177+
os.vendor Ubuntu
178+
os.version 14.04
179+
service.cpe23 cpe:/a:openbsd:openssh:6.6p1
180+
service.family OpenSSH
181+
service.product OpenSSH
182+
service.protocol ssh
183+
service.vendor OpenBSD
184+
service.version 6.6p1
185+
186+
[*] Scanned 1 of 1 hosts (100% complete)
33187
[*] Auxiliary module execution completed
34-
```
188+
```
189+
190+
## Confirming using NMAP
191+
192+
Utilizing the [ssh2-enum-algos](https://nmap.org/nsedoc/scripts/ssh2-enum-algos.html) NMAP script.
193+
194+
```
195+
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-11 14:55 EST
196+
Nmap scan report for 172.17.0.2
197+
Host is up (0.000099s latency).
198+
199+
PORT STATE SERVICE VERSION
200+
22/tcp open ssh OpenSSH 6.6p1 Ubuntu 2ubuntu1 (Ubuntu Linux; protocol 2.0)
201+
| ssh2-enum-algos:
202+
| kex_algorithms: (8)
203+
| [email protected]
204+
| ecdh-sha2-nistp256
205+
| ecdh-sha2-nistp384
206+
| ecdh-sha2-nistp521
207+
| diffie-hellman-group-exchange-sha256
208+
| diffie-hellman-group-exchange-sha1
209+
| diffie-hellman-group14-sha1
210+
| diffie-hellman-group1-sha1
211+
| server_host_key_algorithms: (4)
212+
| ssh-rsa
213+
| ssh-dss
214+
| ecdsa-sha2-nistp256
215+
| ssh-ed25519
216+
| encryption_algorithms: (16)
217+
| aes128-ctr
218+
| aes192-ctr
219+
| aes256-ctr
220+
| arcfour256
221+
| arcfour128
222+
| [email protected]
223+
| [email protected]
224+
| [email protected]
225+
| aes128-cbc
226+
| 3des-cbc
227+
| blowfish-cbc
228+
| cast128-cbc
229+
| aes192-cbc
230+
| aes256-cbc
231+
| arcfour
232+
| [email protected]
233+
| mac_algorithms: (19)
234+
| [email protected]
235+
| [email protected]
236+
| [email protected]
237+
| [email protected]
238+
| [email protected]
239+
| [email protected]
240+
| [email protected]
241+
| [email protected]
242+
| [email protected]
243+
| hmac-md5
244+
| hmac-sha1
245+
| [email protected]
246+
| [email protected]
247+
| hmac-sha2-256
248+
| hmac-sha2-512
249+
| hmac-ripemd160
250+
| [email protected]
251+
| hmac-sha1-96
252+
| hmac-md5-96
253+
| compression_algorithms: (2)
254+
| none
255+
|_ [email protected]
256+
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
257+
258+
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
259+
Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds
260+
```

0 commit comments

Comments
 (0)