id: dropbear-weakalgo

info:
  name: Dropbear sshd Weak Key Exchange Algorithms Enabled
  author: pussycat0x
  severity: low
  description: |
    The SSH key exchange algorithm is fundamental to keep the protocol secure. It is what allows two previously unknown parties to generate a shared key in plain sight, and have that secret remain private to the client and server. Over time, some implementations of this algorithm have been identified as weak or vulnerable.
  reference: |
    https://www.virtuesecurity.com/kb/ssh-weak-key-exchange-algorithms-enabled
  remediation: |
    Disable the weak algorithms.
  metadata:
    max-request: 1
    shodan-query: product:"Dropbear sshd"
    verified: true
  tags: network,ssh,dropbear,misconfig

tcp:
  - inputs:
      - data: "\n"

    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "diffie-hellman-group-exchange-sha1"
          - "diffie-hellman-group1-sha1"
        condition: or
# digest: 4a0a00473045022100c67a648de03e7a12d40987111db58dbe3c171939915e2f6c252204426551ad18022008ace27d961d279e82a266d8528612dd10fda1a23346679b3063892ba540ef48:922c64590222798bb761d5b6d8e72950