nuclei-templates/network/misconfig/dropbear-weakmac.yaml

id: dropbear-weakmac

info:
  name: Dropbear Weak MAC Algorithms Enabled
  author: pussycat0x
  severity: low
  description: |
    The mac-alg command specifies which MAC algorithms in the SSH client profile for SSH encryption negotiation with an SFTP server when the DataPower Gateway acts as an SFTP client.
  remediation: |
    Disable MD5 and 96-bit MAC algorithms.
  reference: |
    https://www.virtuesecurity.com/kb/ssh-weak-mac-algorithms-enabled
  metadata:
    verified: true
    shodan-query: 'product:"Dropbear sshd"'
  tags: network,ssh,dropbear,misconfig

network:
  - inputs:
      - data: "\n"

    host:
      - "{{Hostname}}"
      - "{{Host}}:22"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "hmac-md5"
          - "hmac-sha1"
        condition: or

      - type: word
        words:
          - "SSH-"
Update and rename network/detection/dropbear-weakmac-detect.yaml to network/misconfig/dropbear-weakmac.yaml 2022-11-26 16:21:18 +00:00			`id: dropbear-weakmac`
Add files via upload 2022-11-22 18:29:56 +00:00
			`info:`
Update and rename network/detection/dropbear-weakmac-detect.yaml to network/misconfig/dropbear-weakmac.yaml 2022-11-26 16:21:18 +00:00			`name: Dropbear Weak MAC Algorithms Enabled`
Add files via upload 2022-11-22 18:29:56 +00:00			`author: pussycat0x`
Update dropbear-weakmac-detect.yaml 2022-11-22 18:33:32 +00:00			`severity: low`
Add files via upload 2022-11-22 18:29:56 +00:00			`description: \|`
			`The mac-alg command specifies which MAC algorithms in the SSH client profile for SSH encryption negotiation with an SFTP server when the DataPower Gateway acts as an SFTP client.`
Update dropbear-weakmac-detect.yaml 2022-11-23 18:12:39 +00:00			`remediation: \|`
			`Disable MD5 and 96-bit MAC algorithms.`
Update dropbear-weakmac-detect.yaml 2022-11-23 07:04:04 +00:00			`reference: \|`
			`https://www.virtuesecurity.com/kb/ssh-weak-mac-algorithms-enabled`
Add files via upload 2022-11-22 18:29:56 +00:00			`metadata:`
			`verified: true`
			`shodan-query: 'product:"Dropbear sshd"'`
Update and rename network/detection/dropbear-weakmac-detect.yaml to network/misconfig/dropbear-weakmac.yaml 2022-11-26 16:21:18 +00:00			`tags: network,ssh,dropbear,misconfig`
Add files via upload 2022-11-22 18:29:56 +00:00
			`network:`
			`- inputs:`
			`- data: "\n"`
Update dropbear-weakmac-detect.yaml 2022-11-24 18:16:58 +00:00
Add files via upload 2022-11-22 18:29:56 +00:00			`host:`
			`- "{{Hostname}}"`
			`- "{{Host}}:22"`
Update dropbear-weakmac-detect.yaml 2022-11-24 18:16:58 +00:00
Update dropbear-weakmac.yaml 2022-12-02 11:58:09 +00:00			`matchers-condition: and`
Add files via upload 2022-11-22 18:29:56 +00:00			`matchers:`
Update dropbear-weakmac-detect.yaml 2022-11-24 18:32:02 +00:00			`- type: word`
			`words:`
			`- "hmac-md5"`
			`- "hmac-sha1"`
			`condition: or`
Update dropbear-weakmac.yaml 2022-12-02 11:58:09 +00:00
			`- type: word`
			`words:`
			`- "SSH-"`