102 lines
2.7 KiB
Ruby
102 lines
2.7 KiB
Ruby
##
|
|
# This module requires Metasploit: http://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
require 'msf/core'
|
|
require 'recog'
|
|
|
|
class Metasploit3 < Msf::Auxiliary
|
|
include Msf::Exploit::Remote::Tcp
|
|
include Msf::Auxiliary::Scanner
|
|
include Msf::Auxiliary::Report
|
|
|
|
# the default timeout (in seconds) to wait, in total, for both a successful
|
|
# connection to a given endpoint and for the initial protocol response
|
|
# from the supposed SSH endpoint to be returned
|
|
DEFAULT_TIMEOUT = 30
|
|
|
|
def initialize
|
|
super(
|
|
'Name' => 'SSH Version Scanner',
|
|
'Description' => 'Detect SSH Version.',
|
|
'References' =>
|
|
[
|
|
[ 'URL', 'http://en.wikipedia.org/wiki/SecureShell' ]
|
|
],
|
|
'Author' => [ 'Daniel van Eeden <metasploit[at]myname.nl>' ],
|
|
'License' => MSF_LICENSE
|
|
)
|
|
|
|
register_options(
|
|
[
|
|
Opt::RPORT(22),
|
|
OptInt.new('TIMEOUT', [true, 'Timeout for the SSH probe', DEFAULT_TIMEOUT])
|
|
],
|
|
self.class
|
|
)
|
|
end
|
|
|
|
def peer
|
|
"#{rhost}:#{rport}"
|
|
end
|
|
|
|
def timeout
|
|
datastore['TIMEOUT'] <= 0 ? DEFAULT_TIMEOUT : datastore['TIMEOUT']
|
|
end
|
|
|
|
|
|
def run_host(target_host)
|
|
begin
|
|
::Timeout.timeout(timeout) do
|
|
connect
|
|
|
|
resp = sock.get_once(-1, timeout)
|
|
|
|
if ! resp
|
|
vprint_warning("#{peer} no response")
|
|
return
|
|
end
|
|
|
|
ident, first_message = resp.split(/[\r\n]+/)
|
|
info = ""
|
|
|
|
if /^SSH-\d+\.\d+-(.*)$/ !~ ident
|
|
vprint_warning("#{peer} was not SSH -- #{resp.size} bytes beginning with #{resp[0, 12]}")
|
|
return
|
|
end
|
|
|
|
banner = $1
|
|
|
|
# Try to match with Recog and show the relevant fields to the user
|
|
recog_match = Recog::Nizer.match('ssh.banner', banner)
|
|
if recog_match
|
|
info << " ( "
|
|
recog_match.each_pair do |k,v|
|
|
next if k == 'matched'
|
|
info << "#{k}=#{v} "
|
|
end
|
|
info << ")"
|
|
end
|
|
|
|
# Check to see if this is Kippo, which sends a premature
|
|
# key init exchange right on top of the SSH version without
|
|
# waiting for the required client identification string.
|
|
if first_message && first_message.size >= 5
|
|
extra = first_message.unpack("NCCA*") # sz, pad_sz, code, data
|
|
if (extra.last.size + 2 == extra[0]) && extra[2] == 20
|
|
info << " (Kippo Honeypot)"
|
|
end
|
|
end
|
|
|
|
print_status("#{peer} SSH server version: #{ident}#{info}")
|
|
report_service(host: rhost, port: rport, name: 'ssh', proto: 'tcp', info: ident)
|
|
end
|
|
rescue Timeout::Error
|
|
vprint_warning("#{peer} timed out after #{timeout} seconds. Skipping.")
|
|
ensure
|
|
disconnect
|
|
end
|
|
end
|
|
end
|