mirror of
https://github.com/nmap/nmap.git
synced 2026-10-20 19:01:56 +00:00
Revert libssh2 branch, for now.
$ svn merge -r r33518:r33513 . and removed added scripts to the script.db. The branch needs further refinement/testing for Windows and Mac before merging into the trunk. There is also the latent EOF bug which is giving performance issues. Further work on the branch will continue in Devin's latest branch: /nmap-exp/devin/nmap-libssh2
This commit is contained in:
batrick
parent
3702d44201
commit
de27812fe4
14 changed files with 27 additions and 1092 deletions
|
|
@ -433,7 +433,6 @@ Entry { filename = "socks-auth-info.nse", categories = { "default", "discovery",
|
|||
Entry { filename = "socks-brute.nse", categories = { "brute", "intrusive", } }
|
||||
Entry { filename = "socks-open-proxy.nse", categories = { "default", "discovery", "external", "safe", } }
|
||||
Entry { filename = "ssh-hostkey.nse", categories = { "default", "discovery", "safe", } }
|
||||
Entry { filename = "ssh-vuln-hostkey.nse", categories = { "default", "discovery", "safe", } }
|
||||
Entry { filename = "ssh2-enum-algos.nse", categories = { "discovery", "safe", } }
|
||||
Entry { filename = "sshv1.nse", categories = { "default", "safe", } }
|
||||
Entry { filename = "ssl-ccs-injection.nse", categories = { "safe", "vuln", } }
|
||||
|
|
|
|||
|
|
@ -1,37 +0,0 @@
|
|||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local libssh2 = stdnse.silent_require "libssh2"
|
||||
|
||||
description = [[
|
||||
Returns authenication methods a ssh server supports.
|
||||
]]
|
||||
|
||||
---
|
||||
-- @usage
|
||||
-- nmap -p 22 --script ssh-auth-methods --script-args="ssh.user=<username>" <target>
|
||||
--
|
||||
-- @output
|
||||
-- 22/tcp open ssh syn-ack
|
||||
-- | ssh-auth-methods:
|
||||
-- | Supported authentication methods:
|
||||
-- | publickey
|
||||
-- |_ password
|
||||
|
||||
author = "Devin Bjelland"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
|
||||
local username = stdnse.get_script_args("ssh.user") or stdnse.generate_random_string(5)
|
||||
portrule = shortport.port_or_service(22, 'ssh')
|
||||
|
||||
categories = {"safe"}
|
||||
|
||||
action = function (host, port)
|
||||
local result = stdnse.output_table()
|
||||
|
||||
local session = libssh2.session_open(host, port.number)
|
||||
local authmethods = libssh2.userauth_list(session, username)
|
||||
|
||||
result["Supported authentication methods"] = authmethods
|
||||
|
||||
return result
|
||||
end
|
||||
|
|
@ -1,118 +0,0 @@
|
|||
local shortport = require "shortport"
|
||||
local stdnse = require "stdnse"
|
||||
local brute = require "brute"
|
||||
|
||||
local libssh2 = stdnse.silent_require "libssh2"
|
||||
|
||||
description = [[
|
||||
Performs brute-force password guessing against ssh servers.
|
||||
]]
|
||||
|
||||
---
|
||||
-- @usage
|
||||
-- nmap -p 22 --script ssh-brute --script-args userdb=users.lst,passdb=pass.lst \
|
||||
-- --script-args ssh-brute.timeout=4s <target>
|
||||
--
|
||||
-- @output
|
||||
-- 22/ssh open ssh
|
||||
-- | ssh-brute:
|
||||
-- | Accounts
|
||||
-- | username:password
|
||||
-- | Statistics
|
||||
-- |_ Performed 32 guesses in 25 seconds.
|
||||
--
|
||||
-- @args ssh-brute.timeout Connection timeout (default: "5s")
|
||||
|
||||
author = "Devin Bjelland"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {'brute', 'intrusive'}
|
||||
|
||||
portrule = shortport.port_or_service(22, 'ssh')
|
||||
|
||||
local arg_timeout = stdnse.get_script_args(SCRIPT_NAME .. ".timeout") or "5s"
|
||||
|
||||
Driver = {
|
||||
new = function(self, host, port, options)
|
||||
stdnse.debug(2, "creating brute driver")
|
||||
local o = {}
|
||||
setmetatable(o, self)
|
||||
self.__index = self
|
||||
o.host = host
|
||||
o.port = port
|
||||
o.options = options
|
||||
return o
|
||||
end,
|
||||
|
||||
connect = function (self)
|
||||
stdnse.debug(2, "connecting to %s:%d", self.host.ip, self.port.number)
|
||||
local status, session, err = pcall(libssh2.session_open, self.host, self.port.number)
|
||||
if not status then
|
||||
stdnse.debug(2, "libssh2 error: %s", session)
|
||||
local err = brute.Error:new(session)
|
||||
err:setAbort(true)
|
||||
return false, err
|
||||
elseif not session then
|
||||
stdnse.debug(2, "failure to connect: %s", err);
|
||||
local err = brute.Error:new(err)
|
||||
err:setAbort(true)
|
||||
return false, err
|
||||
else
|
||||
self.ssh_session = session
|
||||
libssh2.set_timeout(self.ssh_session, self.options.ssh_timeout)
|
||||
return true
|
||||
end
|
||||
end,
|
||||
|
||||
disconnect = function(self)
|
||||
stdnse.debug(2, "disconnecting from %s:%d", self.host.ip, self.port.number);
|
||||
local status, err = pcall(libssh2.session_close, self.ssh_session)
|
||||
if not status then
|
||||
stdnse.debug(2, "libssh2 error: %s", ok)
|
||||
end
|
||||
end,
|
||||
|
||||
login = function(self, username, password)
|
||||
stdnse.verbose(2, "Trying username/password pair: %s:%s", username, password)
|
||||
local status, ok = pcall(libssh2.userauth_password, self.ssh_session, username, password)
|
||||
if not status then
|
||||
stdnse.debug(2, "libssh2 error: %s", ok)
|
||||
return false, brute.Error:new(ok)
|
||||
elseif not ok then
|
||||
stdnse.debug(2, "login failed for %s:%s", username, password)
|
||||
return false, brute.Error:new("login failed")
|
||||
else
|
||||
stdnse.verbose(1, "Found working Credentials: %s:%s", username, password)
|
||||
return true, brute.Account:new(username, password, "OPEN")
|
||||
end
|
||||
end,
|
||||
}
|
||||
|
||||
password_auth_allowed = function (host, port)
|
||||
local status, ssh_session = pcall(libssh2.session_open, host, port.number)
|
||||
if status and ssh_session then
|
||||
local status, methods = pcall(libssh2.userauth_list, ssh_session, "root")
|
||||
if status then
|
||||
for _, value in pairs(methods) do
|
||||
if value == "password" then
|
||||
return true
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
return false
|
||||
end
|
||||
|
||||
action = function (host, port)
|
||||
local timems = stdnse.parse_timespec(arg_timeout) --todo: use this!
|
||||
local ssh_timeout = 1000 * timems
|
||||
if password_auth_allowed(host, port) then
|
||||
local options = {ssh_timeout = ssh_timeout}
|
||||
local engine = brute.Engine:new(Driver, host, port, options)
|
||||
engine.options.script_name = SCRIPT_NAME
|
||||
local _, result = engine:start()
|
||||
return result
|
||||
else
|
||||
return "Password authenication not allowed"
|
||||
end
|
||||
end
|
||||
|
||||
|
|
@ -1,128 +0,0 @@
|
|||
local shortport = require "shortport"
|
||||
local ssh2 = require "ssh2"
|
||||
local ssh1 = require "ssh1"
|
||||
local stdnse = require "stdnse"
|
||||
|
||||
local io = require "io"
|
||||
local string = require "string"
|
||||
local table = require "table"
|
||||
|
||||
description = [[
|
||||
Checks if ssh server has a predictable hostkey by checking it against a list of fingerprints
|
||||
generated by HD Moore. You have to download these hostkeys separately and specify their directory
|
||||
as the fingerprintdir variable. The keys are available at http://itsecurity.net/debian_ssh_scan_v4.tar.bz2. Additionally, you can specify a file ssh hostkey fingerprints, one per line, and the scripts will report if the hostkey matches one of the provided fingerprints.
|
||||
]]
|
||||
|
||||
---
|
||||
-- @usage
|
||||
-- nmap -p 22 --script ssh-vuln-hostkey \
|
||||
-- --script-args fingerprintdir=<directory with vulnerable fingerprints> <target>
|
||||
--
|
||||
-- @output
|
||||
--
|
||||
-- 22/tcp open ssh syn-ack
|
||||
-- | ssh-vuln-hostkey:
|
||||
-- | Weak hostkeys:
|
||||
-- |_ 2048 6d:cd:2a:8b:dc:3e:e0:92:00:47:59:16:8c:8b:17:70 (RSA)
|
||||
--
|
||||
--
|
||||
-- @usage
|
||||
-- -- nmap -p 22 --script ssh-vuln-hostkey \
|
||||
-- --script-args fingerprintfile=<file with fingerprints to check for> <target>
|
||||
--
|
||||
-- @output
|
||||
--
|
||||
-- 22/tcp open ssh syn-ack
|
||||
-- | ssh-vuln-hostkey:
|
||||
-- | Listed hostkeys:
|
||||
-- |_ 2048 6d:cd:2a:8b:dc:3e:e0:92:00:47:59:16:8c:8b:17:70 (RSA)
|
||||
--
|
||||
-- @args fingerprintdir Directory containing vulnerable fingerprints
|
||||
-- @args fingerprintfile File containing fingerprints to check against
|
||||
--
|
||||
|
||||
author = "Devin Bjelland"
|
||||
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"safe","default","discovery"}
|
||||
|
||||
dependencies = {"ssh-hostkey"}
|
||||
|
||||
portrule = shortport.port_or_service(22, 'ssh')
|
||||
|
||||
local fingerprintdir = stdnse.get_script_args("fingerprintdir")
|
||||
local fingerprintfile = stdnse.get_script_args("fingerprintfile")
|
||||
|
||||
action = function (host, port)
|
||||
local key
|
||||
local keys = {}
|
||||
local r = stdnse.output_table()
|
||||
local w = {}
|
||||
local listed_hostkeys = {}
|
||||
local found_listed_key
|
||||
local found_weak_key
|
||||
|
||||
if nmap.registry.sshhostkey and nmap.registry.sshhostkey[host.ip] then
|
||||
keys = nmap.registgry.sshhostkey[host.ip]
|
||||
else
|
||||
key = ssh2.fetch_host_key( host, port, "ssh-rsa" )
|
||||
if key then table.insert( keys, key ) end
|
||||
|
||||
key = ssh2.fetch_host_key( host, port, "ssh-dss" )
|
||||
if key then table.insert( keys, key ) end
|
||||
end
|
||||
|
||||
for _,key in ipairs(keys) do
|
||||
local fingerprint = stdnse.tohex(key.fingerprint)
|
||||
stdnse.debug("fingerprint: " .. fingerprint)
|
||||
if fingerprintdir then
|
||||
if key.key_type == "ssh-rsa" then
|
||||
for line in io.lines(fingerprintdir .. "ssh_rsa_" .. key.bits .. "_keys.txt") do
|
||||
local stripped_line = string.gsub(line, "-.*", "")
|
||||
if stripped_line == fingerprint then
|
||||
found_weak_key = true
|
||||
stdnse.verbose("Found weak hostkey: " .. ssh1.fingerprint_hex(key.fingerprint, key.algorithm, key.bits))
|
||||
table.insert(w, ssh1.fingerprint_hex(key.fingerprint, key.algorithm, key.bits))
|
||||
end
|
||||
end
|
||||
elseif key.key_type == "ssh-dss" and key.bits == "1024" then
|
||||
for line in io.lines(fingerprintdir .. "ssh_dsa_1024_keys.txt", "r") do
|
||||
local stripped_line = string.gsub(line, "-.*", "")
|
||||
if stripped_line == fingerprint then
|
||||
found_weak_key = true
|
||||
stdnse.verbose("Found weak hostkey: " .. ssh1.fingerprint_hex(key.fingerprint, key.algorithm, key.bits))
|
||||
table.insert(w, ssh1.fingerprint_hex(key.fingerprint, key.algorithm, key.bits))
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
if fingerprintfile then
|
||||
for line in io.lines(fingerprintfile) do
|
||||
local stripped_line = string.gsub(line, ":", "")
|
||||
if stripped_line == fingerprint then
|
||||
found_listed_key = true
|
||||
table.insert(listed_hostkeys, ssh1.fingerprint_hex(key.fingerprint, key.algorithm, key.bits))
|
||||
stdnse.verbose("Found hostkey on list:" .. ssh1.fingerprint_hex(key.fingerprint, key.algorithm, key.bits))
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
if not found_weak_key then
|
||||
w = "No weak hostkeys found"
|
||||
end
|
||||
|
||||
if not found_listed_key then
|
||||
list_hostkey = "No listed hostkeys found"
|
||||
end
|
||||
|
||||
if fingerprintdir then
|
||||
r["Weak hostkeys"] = w
|
||||
end
|
||||
|
||||
if fingerprintfile then
|
||||
r["Listed hostkeys"] = listed_hostkeys
|
||||
end
|
||||
|
||||
return r
|
||||
end
|
||||
Loading…
Add table
Add a link
Reference in a new issue