56 lines
1.7 KiB
YAML
56 lines
1.7 KiB
YAML
id: ssh-weak-public-key
|
|
|
|
info:
|
|
name: SSH Host Keys < 2048 Bits Considered Weak
|
|
author: pussycat0x
|
|
severity: low
|
|
description: |
|
|
SSH host keys with a bit length below 2048 are deemed weak, posing an increased vulnerability to security threats. Employing robust key lengths is crucial for fortifying the integrity of encrypted communication and thwarting potential exploits.
|
|
reference:
|
|
- https://www.tenable.com/plugins/nessus/153954
|
|
metadata:
|
|
verified: true
|
|
max-request: 2
|
|
shodan-query: product:"OpenSSH"
|
|
tags: enum,js,ssh,misconfig,network
|
|
|
|
variables:
|
|
ecdsa_bit: '256' # 256 bytes = 2048 bits
|
|
rsa_bit: '2048' # 2048 bits
|
|
|
|
javascript:
|
|
- pre-condition: |
|
|
isPortOpen(Host,Port);
|
|
code: |
|
|
let m = require("nuclei/ssh");
|
|
let c = m.SSHClient();
|
|
let response = c.ConnectSSHInfoMode(Host, Port);
|
|
to_json(response);
|
|
args:
|
|
Host: "{{Host}}"
|
|
Port: "22"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "server_host_key"
|
|
|
|
- type: dsl
|
|
dsl:
|
|
- 'len(ecdsa_keylen) != 0 && ecdsa_keylen < ecdsa_bit'
|
|
- 'len(rsa_keylen) !=0 && rsa_keylen < rsa_bit'
|
|
|
|
extractors:
|
|
- type: json
|
|
internal: true
|
|
name: ecdsa_keylen
|
|
json:
|
|
- '.DHKeyExchange.server_host_key.ecdsa_public_key.length'
|
|
|
|
- type: json
|
|
internal: true
|
|
name: rsa_keylen
|
|
json:
|
|
- '.DHKeyExchange.server_host_key.rsa_public_key.length'
|
|
# digest: 4a0a0047304502204b98e1786f6494bcf96bf3b39d57952295c377938b7b72a812cb6d3a2ba43d85022100f73954e4a88a8b86052942f190163c039261f30781ab20b2d91102da65b2f7ab:922c64590222798bb761d5b6d8e72950 |