Module: SSH_FINGERPRINT

Defined in:
lib/audit/lib/ssh_fingerprint.rb

Overview

auntitled.blogspot.com/2010/07/identified-ubuntu-version-from-ssh.html

Defined Under Namespace

Classes: ParseException, ProgramExecutionException

Constant Summary collapse

TMP_DIRECTORY = 
'/tmp'

Class Method Summary collapse

Class Method Details

.fingerprint(host, port = 22) ⇒ Object 



211
212
213
214
215
216
217
218
219
 
# File 'lib/audit/lib/ssh_fingerprint.rb', line 211

def self.fingerprint(host, port = 22)
	return {
		:host => host,
		:port => port,
		:banner => get_banner(host, port),
		:host_keys => get_host_keys(host, port),
		:algorithms => get_algorithms(host, port),
		:version1 => version1_supported?(host, port)}
end

.get_algorithms(host, port = 22) ⇒ Object

Raises:



51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
 
# File 'lib/audit/lib/ssh_fingerprint.rb', line 51

def self.get_algorithms(host, port = 22)
	file = get_temp_file()
	
	exit_ok = system("nmap -p#{port} -v -Pn --script ssh2-enum-algos -oX #{file} #{host} 2>/dev/null 1>/dev/null")
	raise ProgramExecutionException, "NMap returned exit code #{$?} instead of 0" unless exit_ok
	
	xml_data = File.open(file, "r") {|f| f.read}
	FileUtils.rm_f(file)
	doc = REXML::Document.new(xml_data)
	
#		raise ParseException, "NMap ssh script did not execute" unless doc.elements["//script"] && doc.elements["//script"].attributes['output']
	return {} unless doc.elements["//script"] && doc.elements["//script"].attributes['output']
	
	algorithm_lines = doc.elements['//script'].attributes['output'].lines

	algorithms = {}
	current_section = nil
	algorithm_lines.each do|line|
		if /^  ([a-z_]+) \([0-9]+\)$/.match(line) then
			current_section = $1
			algorithms[current_section] = []
		elsif /^      ([a-zA-Z0-9_@.=+-]+)$/.match(line) then
			raise ParseException, "algorithm line not preceded by an algorithm type section: '#{line}'" if current_section.nil?
			algorithms[current_section] << $1
		else
			if line.strip() != "" then
				raise ParseException, "unexpected line in nmap output: '#{line}'"
			end
		end
	end

	return algorithms
end

.get_banner(host, port = 22, timeout = 5) ⇒ Object 



163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
 
# File 'lib/audit/lib/ssh_fingerprint.rb', line 163

def self.get_banner(host, port = 22, timeout = 5)
	begin
		timeout(timeout) do
			sock = TCPSocket.new(host, port)
			sock.puts "SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu5\r\n"
			banner = sock.readline
			sock.close
			return banner
		end
	rescue Errno::EHOSTUNREACH
		return :HOST_UNREACHABLE
	rescue Errno::ECONNREFUSED
		return :CONNECTION_REFUSED
	rescue Timeout::Error
	end
	
	return :TIMEOUT
end

.get_host_keys(host, port = 22) ⇒ Object

Raises:



101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
 
# File 'lib/audit/lib/ssh_fingerprint.rb', line 101

def self.get_host_keys(host, port = 22)
	file = get_temp_file()
	
	exit_ok = system("nmap -p#{port} -v -Pn --script ssh-hostkey -oX #{file} #{host} 2>/dev/null 1>/dev/null")
	raise ProgramExecutionException, "NMap returned exit code #{$?} instead of 0" unless exit_ok
	
	xml_data = File.open(file, "r") {|f| f.read}
	FileUtils.rm_f(file)
	doc = REXML::Document.new(xml_data)
	
#		raise ParseException, "NMap ssh script did not execute" unless doc.elements["//script"] && doc.elements["//script"].attributes['output']
	return [] unless doc.elements["//script"] && doc.elements["//script"].attributes['output']
	
	keys_lines = doc.elements['//script'].attributes['output'].lines

	line_type = :fingerprint_line
	
	keys = []
	current_key = nil
	keys_lines.each do|line|
		line = line.strip
		if line_type == :fingerprint_line then
			line_type = :key_line
			match = /^([0-9]+) ([0-9a-f:]+) (\([A-Z0-9]+\))$/.match(line)
			if match then
				raise ParseException, "current_key is not nil, it should be" unless current_key.nil?
				
				current_key = {:length => match[1], :fingerprint => match[2], :type => match[3]}
			else
				raise ParseException, "Unexpected line '#{line}', expected fingerprint line"
			end
		else
			line_type = :fingerprint_line
			match = /^([a-z0-9_-]+) ([A-Za-z0-9+\/=]+)$/.match(line)
			if match then
				raise ParseException, "current_key is nil, it shouldn't be" if current_key.nil?
				
				current_key[:ssh_type] = match[1]
				current_key[:key] = match[2]
				keys << current_key
				current_key = nil
			else
				raise ParseException, "Unexpected line '#{line}', expected key line"
			end
		end
	end
	
	raise ParseException, "current_key is not nil, it should be" unless current_key.nil?
	return keys
end

.get_temp_file ⇒ Object

Create a name for a new temporary file and check that it does not exist yet. Returns [String] Name of unused temporary file



16
17
18
19
20
21
22
23
 
# File 'lib/audit/lib/ssh_fingerprint.rb', line 16

def self.get_temp_file()
	while true do
		file = TMP_DIRECTORY + '/' + RandomString::generate_name(20)
	 	if !File.exists?(file) then
			return file
		end
	end
end

.version1_supported?(host, port = 22, timeout = 5) ⇒ Boolean

Test if protocol version 1 is supported by the server

Parameter host [String] The target host to connect to Parameter port [Integer] Target port Parameter timeout [Integer] Timeout in seconds

Returns [Boolean/:TIMEOUT] true if remote server supports protocol version 1, false if protocol version 1 is not supported. :TIMEOUT if the connection times out; :HOST_UNREACHABLE if destination host is unreachable

Returns:

  • (Boolean) 


190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
 
# File 'lib/audit/lib/ssh_fingerprint.rb', line 190

def self.version1_supported?(host, port = 22, timeout = 5)
	begin
		timeout(timeout) do
			sock = TCPSocket.new(host, port)
			sock.puts "SSH-1.5-OpenSSH_5.3p1 Debian-3ubuntu5\r\n"
			banner = sock.readline
			data = sock.read(13)
			sock.close
			return /^....[\x00]+\x02/.match(data) != nil
		end
	rescue Errno::EHOSTUNREACH
		return :HOST_UNREACHABLE
	rescue Errno::ECONNREFUSED
		return :CONNECTION_REFUSED
	rescue Timeout::Error
	end
	
	return :TIMEOUT
end