From f15f7dac2390547a344e010c4c19f35dab2fbdb1 Mon Sep 17 00:00:00 2001 From: Andris Raugulis Date: Tue, 29 Dec 2015 17:28:08 +0200 Subject: [PATCH] Add support for dropbear sshd: - send client banner first - use data read in first chunk (buffer data) --- ssh-audit.py | 94 +++++++++++++++++++++++++++++++++++----------------- 1 file changed, 63 insertions(+), 31 deletions(-) diff --git a/ssh-audit.py b/ssh-audit.py index 229a006..90a99c3 100755 --- a/ssh-audit.py +++ b/ssh-audit.py @@ -77,36 +77,64 @@ class Kex(object): @classmethod def parse(cls, payload): kex = cls() - buf = io.BytesIO(payload) - kex.cookie = buf.read(16) - kex.kex_algorithms = read_list(buf) - kex.key_algorithms = read_list(buf) - kex.client.encryption = read_list(buf) - kex.server.encryption = read_list(buf) - kex.client.mac = read_list(buf) - kex.server.mac = read_list(buf) - kex.client.compression = read_list(buf) - kex.server.compression = read_list(buf) - kex.client.languages = read_list(buf) - kex.server.languages = read_list(buf) - kex.follows = read_bool(buf) - kex.unused = read_int(buf) + buf = ReadBuf(payload) + kex.cookie = buf.read_raw(16) + kex.kex_algorithms = buf.read_list() + kex.key_algorithms = buf.read_list() + kex.client.encryption = buf.read_list() + kex.server.encryption = buf.read_list() + kex.client.mac = buf.read_list() + kex.server.mac = buf.read_list() + kex.client.compression = buf.read_list() + kex.server.compression = buf.read_list() + kex.client.languages = buf.read_list() + kex.server.languages = buf.read_list() + kex.follows = buf.read_bool() + kex.unused = buf.read_int() return kex -def read_int(buf): - return struct.unpack('>I', buf.read(4))[0] +class ReadBuf(object): + def __init__(self, data = None): + self._buf = io.BytesIO(data) if data else io.BytesIO() + self._len = len(data) if data else 0 + + @property + def unread_len(self): + return self._len - self._buf.tell() + + def read_raw(self, size): + return self._buf.read(size) + + def read_line(self): + return self._buf.readline().rstrip().decode('utf-8') + + def read_int(self): + return struct.unpack('>I', self._buf.read(4))[0] + + def read_bool(self): + return struct.unpack('b', self._buf.read(1))[0] != 0 + + def read_list(self): + list_size = self.read_int() + return self._buf.read(list_size).decode().split(',') -def read_bool(buf): - return struct.unpack('b', buf.read(1))[0] != 0 +class SockBuf(ReadBuf): + def __init__(self, s): + super(SockBuf, self).__init__() + self.__sock = s + + def recv(self, size = 2048): + data = self.__sock.recv(size) + pos = self._buf.tell() + self._buf.seek(0, 2) + self._buf.write(data) + self._len += len(data) + self._buf.seek(pos, 0) -def read_list(buf): - list_size = read_int(buf) - return buf.read(list_size).decode().split(',') def get_ssh_ver(v): return 'available since OpenSSH {0}'.format(v) - WARN_OPENSSH72_LEGACY = 'removed (in client) since OpenSSH 7.2, legacy algorithm' WARN_OPENSSH70_LEGACY = 'removed since OpenSSH 7.0, legacy algorithm' FAIL_OPENSSH70_WEAK = 'removed (in server) and disabled (in client) since OpenSSH 7.0, weak algorithm' @@ -246,9 +274,9 @@ def process_kex(kex): process_algorithms('mac', kex.server.mac, maxlen) out.sep() -def read_ssh_packet(s): +def read_ssh_packet(sbuf): block_size = 8 - header = s.recv(block_size) + header = sbuf.read_raw(block_size) packet_size = struct.unpack('>I', header[:4])[0] rest = header[4:] lrest = len(rest) @@ -257,7 +285,7 @@ def read_ssh_packet(s): if (packet_size - lrest) % block_size != 0: out.fail('[exception] invalid ssh packet (block size)') sys.exit(1) - buf = s.recv(packet_size - lrest) + buf = sbuf.read_raw(packet_size - lrest) packet = rest[2:] + buf[0:packet_size - lrest] payload = packet[0:packet_size - padding] return packet_type, payload @@ -291,13 +319,17 @@ def main(): try: s = socket.create_connection((host, port), SOCK_CONN_TIMEOUT) s.settimeout(SOCK_READ_TIMEOUT) - banner = s.recv(1024).strip() - out.head('# general') - out.good('[info] banner: ' + banner.decode()) - if banner.decode().startswith('SSH-1.99-'): - out.fail('[fail] protocol SSH1 enabled') + sbuf = SockBuf(s) s.send(SSH_BANNER.encode() + b'\r\n') - packet_type, payload = read_ssh_packet(s) + sbuf.recv() + banner = sbuf.read_line() + out.head('# general') + out.good('[info] banner: ' + banner) + if banner.startswith('SSH-1.99-'): + out.fail('[fail] protocol SSH1 enabled') + if sbuf.unread_len == 0: + sbuf.recv() + packet_type, payload = read_ssh_packet(sbuf) if packet_type != 20: out.fail('[exception] did not receive MSG_KEXINIT (20), instead received unknown message ({0})'.format(packet_type)) sys.exit(1)