ssh_scan 0.0.16 → 0.0.17.pre

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,14 @@
1
+ #!/usr/bin/env ruby
2
+ $:.unshift File.join(File.dirname(__FILE__), "../lib")
3
+
4
+ require 'ssh_scan'
5
+
6
+ # Get the worker config from command-line or via an example location
7
+ config_file = ARGV[0] ||
8
+ File.join(
9
+ File.dirname(__FILE__),
10
+ "../config/worker/config.yml"
11
+ )
12
+
13
+ worker = SSHScan::Worker.from_config_file(config_file)
14
+ worker.run!
@@ -12,7 +12,6 @@ require 'ssh_scan/protocol'
12
12
  require 'ssh_scan/scan_engine'
13
13
  require 'ssh_scan/target_parser'
14
14
  require 'ssh_scan/update'
15
- require 'ssh_scan/api'
16
15
 
17
16
  #Monkey Patches
18
17
  require 'string_ext'
@@ -41,7 +41,9 @@ module SSHScan
41
41
  @raw_server_banner = @sock.gets
42
42
 
43
43
  if @raw_server_banner.nil?
44
- @error = SSHScan::Error::NoBanner.new("service did not respond with an SSH banner")
44
+ @error = SSHScan::Error::NoBanner.new(
45
+ "service did not respond with an SSH banner"
46
+ )
45
47
  @sock = nil
46
48
  else
47
49
  @raw_server_banner = @raw_server_banner.chomp
@@ -76,7 +78,9 @@ module SSHScan
76
78
  resp = @sock.read(4)
77
79
 
78
80
  if resp.nil?
79
- result[:error] = SSHScan::Error::NoKexResponse.new("service did not respond to our kex init request")
81
+ result[:error] = SSHScan::Error::NoKexResponse.new(
82
+ "service did not respond to our kex init request"
83
+ )
80
84
  @sock = nil
81
85
  return result
82
86
  end
@@ -93,8 +97,10 @@ module SSHScan
93
97
  Errno::ENETUNREACH,
94
98
  Errno::ECONNRESET,
95
99
  Errno::EACCES,
96
- Errno::EHOSTUNREACH => e
97
- result[:error] = SSHScan::Error::NoKexResponse.new("service did not respond to our kex init request")
100
+ Errno::EHOSTUNREACH
101
+ result[:error] = SSHScan::Error::NoKexResponse.new(
102
+ "service did not respond to our kex init request"
103
+ )
98
104
  @sock = nil
99
105
  end
100
106
 
@@ -12,10 +12,20 @@ module SSHScan
12
12
  :padding => "6e05b3b4".unhexify,
13
13
  :key_algorithms => ["diffie-hellman-group1-sha1"],
14
14
  :server_host_key_algorithms => ["ssh-dss","ssh-rsa"],
15
- :encryption_algorithms_client_to_server => ["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],
16
- :encryption_algorithms_server_to_client => ["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],
17
- :mac_algorithms_client_to_server => ["hmac-md5","hmac-sha1","hmac-ripemd160"],
18
- :mac_algorithms_server_to_client => ["hmac-md5","hmac-sha1","hmac-ripemd160"],
15
+ :encryption_algorithms_client_to_server => [
16
+ "aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc",
17
+ "aes128-ctr","aes192-ctr","aes256-ctr"
18
+ ],
19
+ :encryption_algorithms_server_to_client => [
20
+ "aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc",
21
+ "aes128-ctr","aes192-ctr","aes256-ctr"
22
+ ],
23
+ :mac_algorithms_client_to_server => [
24
+ "hmac-md5","hmac-sha1","hmac-ripemd160"
25
+ ],
26
+ :mac_algorithms_server_to_client => [
27
+ "hmac-md5","hmac-sha1","hmac-ripemd160"
28
+ ],
19
29
  :compression_algorithms_client_to_server => ["none"],
20
30
  :compression_algorithms_server_to_client => ["none"],
21
31
  :languages_client_to_server => [],
@@ -24,19 +34,58 @@ module SSHScan
24
34
 
25
35
  DEFAULT_KEY_INIT = SSHScan::KeyExchangeInit.from_hash(default_key_init_opts)
26
36
 
27
- DEFAULT_KEY_INIT_RAW = ("000001640414e33f813f8cdcc6b00a3d852ec1aea4980000001a6" +
28
- "469666669652d68656c6c6d616e2d67726f7570312d7368613100" +
29
- "00000f7373682d6473732c7373682d72736100000057616573313" +
30
- "2382d6362632c336465732d6362632c626c6f77666973682d6362" +
31
- "632c6165733139322d6362632c6165733235362d6362632c61657" +
32
- "33132382d6374722c6165733139322d6374722c6165733235362d" +
33
- "637472000000576165733132382d6362632c336465732d6362632" +
34
- "c626c6f77666973682d6362632c6165733139322d6362632c6165" +
35
- "733235362d6362632c6165733132382d6374722c6165733139322" +
36
- "d6374722c6165733235362d63747200000021686d61632d6d6435" +
37
- "2c686d61632d736861312c686d61632d726970656d64313630000" +
38
- "00021686d61632d6d64352c686d61632d736861312c686d61632d" +
39
- "726970656d64313630000000046e6f6e65000000046e6f6e65000" +
40
- "000000000000000000000006e05b3b4").unhexify
37
+ DEFAULT_KEY_INIT_RAW =
38
+ "000001640414e33f813f8cdcc6b00a3d852ec1aea4980000001a6\
39
+ 469666669652d68656c6c6d616e2d67726f7570312d7368613100\
40
+ 00000f7373682d6473732c7373682d72736100000057616573313\
41
+ 2382d6362632c336465732d6362632c626c6f77666973682d6362\
42
+ 632c6165733139322d6362632c6165733235362d6362632c61657\
43
+ 33132382d6374722c6165733139322d6374722c6165733235362d\
44
+ 637472000000576165733132382d6362632c336465732d6362632\
45
+ c626c6f77666973682d6362632c6165733139322d6362632c6165\
46
+ 733235362d6362632c6165733132382d6374722c6165733139322\
47
+ d6374722c6165733235362d63747200000021686d61632d6d6435\
48
+ 2c686d61632d736861312c686d61632d726970656d64313630000\
49
+ 00021686d61632d6d64352c686d61632d736861312c686d61632d\
50
+ 726970656d64313630000000046e6f6e65000000046e6f6e65000\
51
+ 000000000000000000000006e05b3b4".freeze
52
+
53
+ CONTRIBUTE_JSON = {
54
+ :name => "ssh_scan api",
55
+ :description => "An api for performing ssh compliance \
56
+ and policy scanning",
57
+ :repository => {
58
+ :url => "https://github.com/mozilla/ssh_scan",
59
+ :tests => "https://travis-ci.org/mozilla/ssh_scan",
60
+ },
61
+ :participate => {
62
+ :home => "https://github.com/mozilla/ssh_scan",
63
+ :docs => "https://github.com/mozilla/ssh_scan",
64
+ :irc => "irc://irc.mozilla.org/#infosec",
65
+ :irc_contacts => [
66
+ "claudijd",
67
+ "pwnbus",
68
+ "kang",
69
+ ],
70
+ :gitter => "https://gitter.im/mozilla-ssh_scan/Lobby",
71
+ :gitter_contacts => [
72
+ "claudijd",
73
+ "pwnbus",
74
+ "kang",
75
+ "jinankjain",
76
+ "agaurav77"
77
+ ],
78
+ },
79
+ :bugs => {
80
+ :list => "https://github.com/mozilla/ssh_scan/issues",
81
+ },
82
+ :keywords => [
83
+ "ruby",
84
+ "sinatra",
85
+ ],
86
+ :urls => {
87
+ :dev => "https://sshscan.rubidus.com",
88
+ }
89
+ }.freeze
41
90
  end
42
91
  end
@@ -5,33 +5,18 @@ module SSHScan
5
5
  class PublicKey
6
6
  def initialize(key)
7
7
  @key = key
8
- @supported = check_supported
9
- if @key.is_a?(OpenSSL::PKey::RSA)
10
- @data_string = OpenSSL::ASN1::Sequence([
11
- OpenSSL::ASN1::Integer.new(@key.public_key.n),
12
- OpenSSL::ASN1::Integer.new(@key.public_key.e)
13
- ])
14
- end
15
- end
16
-
17
- def check_supported
18
- @key and @key.is_a?(OpenSSL::PKey::RSA)
19
- end
20
-
21
- def is_supported?
22
- @supported
23
8
  end
24
9
 
25
10
  def fingerprint_md5
26
- OpenSSL::Digest::MD5.hexdigest(@data_string.to_der).scan(/../).join(':')
11
+ OpenSSL::Digest::MD5.hexdigest(Base64.decode64(@key)).scan(/../).join(':')
27
12
  end
28
13
 
29
14
  def fingerprint_sha1
30
- OpenSSL::Digest::SHA1.hexdigest(@data_string.to_der).scan(/../).join(':')
15
+ OpenSSL::Digest::SHA1.hexdigest(Base64.decode64(@key)).scan(/../).join(':')
31
16
  end
32
17
 
33
18
  def fingerprint_sha256
34
- OpenSSL::Digest::SHA256.hexdigest(@data_string.to_der).scan(/../).join(':')
19
+ OpenSSL::Digest::SHA256.hexdigest(Base64.decode64(@key)).scan(/../).join(':')
35
20
  end
36
21
  end
37
22
  end
@@ -1,6 +1,6 @@
1
1
  module SSHScan
2
2
  module Error
3
- class ClosedConnection < Exception
3
+ class ClosedConnection < RuntimeError
4
4
  def to_s
5
5
  "#{self.class.to_s.split('::')[-1]}"
6
6
  end
@@ -1,6 +1,6 @@
1
1
  module SSHScan
2
2
  module Error
3
- class ConnectTimeout < Exception
3
+ class ConnectTimeout < RuntimeError
4
4
  def initialize(message)
5
5
  @message = message
6
6
  end
@@ -1,6 +1,6 @@
1
1
  module SSHScan
2
2
  module Error
3
- class ConnectionRefused < Exception
3
+ class ConnectionRefused < RuntimeError
4
4
  def initialize(message)
5
5
  @message = message
6
6
  end
@@ -1,6 +1,6 @@
1
1
  module SSHScan
2
2
  module Error
3
- class Disconnected < Exception
3
+ class Disconnected < RuntimeError
4
4
  def initialize(message)
5
5
  @message = message
6
6
  end
@@ -1,6 +1,6 @@
1
1
  module SSHScan
2
2
  module Error
3
- class NoBanner < Exception
3
+ class NoBanner < RuntimeError
4
4
  def initialize(message)
5
5
  @message = message
6
6
  end
@@ -1,6 +1,6 @@
1
1
  module SSHScan
2
2
  module Error
3
- class NoKexResponse < Exception
3
+ class NoKexResponse < RuntimeError
4
4
  def initialize(message)
5
5
  @message = message
6
6
  end
@@ -1,6 +1,8 @@
1
1
  module SSHScan
2
2
  module OS
3
3
  class Raspbian
4
+ attr_reader :version
5
+
4
6
  class Version
5
7
  def initialize(version_string)
6
8
  @version_string = version_string
@@ -30,10 +32,6 @@ module SSHScan
30
32
  def cpe
31
33
  "o:raspbian:raspbian"
32
34
  end
33
-
34
- def version
35
- @version
36
- end
37
35
  end
38
36
  end
39
37
  end
@@ -1,10 +1,13 @@
1
1
  module SSHScan
2
2
  module OS
3
3
  class Ubuntu
4
+ attr_reader :version
5
+
4
6
  class Version
5
7
  def initialize(version_string)
6
8
  @version_string = version_string
7
9
  end
10
+
8
11
  def to_s
9
12
  @version_string
10
13
  end
@@ -12,15 +15,24 @@ module SSHScan
12
15
 
13
16
  # Obtained from scraping ChangeLog on Launchpad
14
17
  FINGERPRINTS = {
15
- "4.10" => ["3.8.1p1-11ubuntu3.3", "3.8.1p1-11ubuntu3.2", "3.8.1p1-11ubuntu3"],
16
- "5.04" =>
17
- ["3.9p1-1ubuntu2.3",
18
+ "4.10" => [
19
+ "3.8.1p1-11ubuntu3.3",
20
+ "3.8.1p1-11ubuntu3.2",
21
+ "3.8.1p1-11ubuntu3"
22
+ ],
23
+ "5.04" => [
24
+ "3.9p1-1ubuntu2.3",
18
25
  "3.9p1-1ubuntu2.2",
19
26
  "3.9p1-1ubuntu2.1",
20
- "3.9p1-1ubuntu2"],
21
- "5.10" => ["4.1p1-7ubuntu4.2", "4.1p1-7ubuntu4.1", "4.1p1-7ubuntu4"],
22
- "6.04" =>
23
- ["4.2p1-7ubuntu3.5",
27
+ "3.9p1-1ubuntu2"
28
+ ],
29
+ "5.10" => [
30
+ "4.1p1-7ubuntu4.2",
31
+ "4.1p1-7ubuntu4.1",
32
+ "4.1p1-7ubuntu4"
33
+ ],
34
+ "6.04" => [
35
+ "4.2p1-7ubuntu3.5",
24
36
  "4.2p1-7ubuntu3.4",
25
37
  "4.2p1-7ubuntu3.3",
26
38
  "4.2p1-7ubuntu3.2",
@@ -29,9 +41,10 @@ module SSHScan
29
41
  "4.2p1-7ubuntu2",
30
42
  "4.2p1-7ubuntu1",
31
43
  "4.2p1-5ubuntu2",
32
- "4.2p1-5ubuntu1"],
33
- "6.10" =>
34
- ["4.3p2-5ubuntu1.2",
44
+ "4.2p1-5ubuntu1"
45
+ ],
46
+ "6.10" => [
47
+ "4.3p2-5ubuntu1.2",
35
48
  "4.3p2-5ubuntu1.1",
36
49
  "4.3p2-5ubuntu1",
37
50
  "4.3p2-4ubuntu1",
@@ -39,19 +52,21 @@ module SSHScan
39
52
  "4.3p2-2ubuntu4",
40
53
  "4.3p2-2ubuntu3",
41
54
  "4.3p2-2ubuntu2",
42
- "4.3p2-2ubuntu1"],
55
+ "4.3p2-2ubuntu1"
56
+ ],
43
57
  "7.04" => [],
44
- "7.10" =>
45
- ["4.6p1-5ubuntu0.6",
58
+ "7.10" => [
59
+ "4.6p1-5ubuntu0.6",
46
60
  "4.6p1-5ubuntu0.5",
47
61
  "4.6p1-5ubuntu0.4",
48
62
  "4.6p1-5ubuntu0.3",
49
63
  "4.6p1-5ubuntu0.2",
50
64
  "4.6p1-5ubuntu0.1",
51
65
  "4.6p1-5build1",
52
- "4.3p2-10ubuntu1"],
53
- "8.04" =>
54
- ["4.7p1-8ubuntu3",
66
+ "4.3p2-10ubuntu1"
67
+ ],
68
+ "8.04" => [
69
+ "4.7p1-8ubuntu3",
55
70
  "4.7p1-8ubuntu2",
56
71
  "4.7p1-8ubuntu1.2",
57
72
  "4.7p1-8ubuntu1.1",
@@ -59,9 +74,10 @@ module SSHScan
59
74
  "4.7p1-7ubuntu1",
60
75
  "4.7p1-6ubuntu1",
61
76
  "4.7p1-5ubuntu1",
62
- "4.7p1-4ubuntu1"],
63
- "8.10" =>
64
- ["5.1p1-3ubuntu1",
77
+ "4.7p1-4ubuntu1"
78
+ ],
79
+ "8.10" => [
80
+ "5.1p1-3ubuntu1",
65
81
  "5.1p1-1ubuntu2",
66
82
  "5.1p1-1ubuntu1",
67
83
  "4.7p1-12ubuntu4",
@@ -69,11 +85,19 @@ module SSHScan
69
85
  "4.7p1-12ubuntu2",
70
86
  "4.7p1-12ubuntu1",
71
87
  "4.7p1-10ubuntu1",
72
- "4.7p1-9ubuntu1"],
73
- "9.04" => ["5.1p1-5ubuntu1", "5.1p1-4ubuntu1"],
74
- "9.10" => ["5.1p1-6ubuntu2", "5.1p1-6ubuntu1", "5.1p1-5ubuntu2"],
75
- "10.04" =>
76
- ["5.3p1-3ubuntu7.1",
88
+ "4.7p1-9ubuntu1"
89
+ ],
90
+ "9.04" => [
91
+ "5.1p1-5ubuntu1",
92
+ "5.1p1-4ubuntu1"
93
+ ],
94
+ "9.10" => [
95
+ "5.1p1-6ubuntu2",
96
+ "5.1p1-6ubuntu1",
97
+ "5.1p1-5ubuntu2"
98
+ ],
99
+ "10.04" => [
100
+ "5.3p1-3ubuntu7.1",
77
101
  "5.3p1-3ubuntu7",
78
102
  "5.3p1-3ubuntu6",
79
103
  "5.3p1-3ubuntu5",
@@ -86,17 +110,19 @@ module SSHScan
86
110
  "5.2p1-2ubuntu1",
87
111
  "5.2p1-1ubuntu1",
88
112
  "5.1p1-8ubuntu2",
89
- "5.1p1-8ubuntu1"],
90
- "10.10" =>
91
- ["5.5p1-4ubuntu6",
113
+ "5.1p1-8ubuntu1"
114
+ ],
115
+ "10.10" => [
116
+ "5.5p1-4ubuntu6",
92
117
  "5.5p1-4ubuntu5",
93
118
  "5.5p1-4ubuntu4",
94
119
  "5.5p1-4ubuntu3",
95
120
  "5.5p1-4ubuntu2",
96
121
  "5.5p1-4ubuntu1",
97
- "5.5p1-3ubuntu1"],
98
- "11.04" =>
99
- ["5.8p1-1ubuntu3",
122
+ "5.5p1-3ubuntu1"
123
+ ],
124
+ "11.04" => [
125
+ "5.8p1-1ubuntu3",
100
126
  "5.8p1-1ubuntu2",
101
127
  "5.8p1-1ubuntu1",
102
128
  "5.7p1-2ubuntu1",
@@ -105,10 +131,15 @@ module SSHScan
105
131
  "5.6p1-2ubuntu3",
106
132
  "5.6p1-2ubuntu2",
107
133
  "5.6p1-2ubuntu1",
108
- "5.6p1-1ubuntu1"],
109
- "11.10" => ["5.8p1-7ubuntu1", "5.8p1-4ubuntu2", "5.8p1-4ubuntu1"],
110
- "12.04" =>
111
- ["5.9p1-5ubuntu1.10",
134
+ "5.6p1-1ubuntu1"
135
+ ],
136
+ "11.10" => [
137
+ "5.8p1-7ubuntu1",
138
+ "5.8p1-4ubuntu2",
139
+ "5.8p1-4ubuntu1"
140
+ ],
141
+ "12.04" => [
142
+ "5.9p1-5ubuntu1.10",
112
143
  "5.9p1-5ubuntu1.9",
113
144
  "5.9p1-5ubuntu1.8",
114
145
  "5.9p1-5ubuntu1.7",
@@ -122,22 +153,27 @@ module SSHScan
122
153
  "5.9p1-3ubuntu1",
123
154
  "5.9p1-2ubuntu2",
124
155
  "5.9p1-2ubuntu1",
125
- "5.9p1-1ubuntu1"],
126
- "12.10" =>
127
- ["6.0p1-3ubuntu1.2",
156
+ "5.9p1-1ubuntu1"
157
+ ],
158
+ "12.10" => [
159
+ "6.0p1-3ubuntu1.2",
128
160
  "6.0p1-3ubuntu1.1",
129
161
  "6.0p1-3ubuntu1",
130
162
  "6.0p1-2ubuntu1",
131
- "6.0p1-1ubuntu1"],
132
- "13.04" => ["6.1p1-1ubuntu1"],
133
- "13.10" =>
134
- ["6.2p2-6ubuntu0.5",
163
+ "6.0p1-1ubuntu1"
164
+ ],
165
+ "13.04" => [
166
+ "6.1p1-1ubuntu1"
167
+ ],
168
+ "13.10" => [
169
+ "6.2p2-6ubuntu0.5",
135
170
  "6.2p2-6ubuntu0.4",
136
171
  "6.2p2-6ubuntu0.3",
137
172
  "6.2p2-6ubuntu0.2",
138
- "6.2p2-6ubuntu0.1"],
139
- "14.04" =>
140
- ["6.6p1-2ubuntu2.8",
173
+ "6.2p2-6ubuntu0.1"
174
+ ],
175
+ "14.04" => [
176
+ "6.6p1-2ubuntu2.8",
141
177
  "6.6p1-2ubuntu2.7",
142
178
  "6.6p1-2ubuntu2.6",
143
179
  "6.6p1-2ubuntu2.5",
@@ -147,16 +183,28 @@ module SSHScan
147
183
  "6.6p1-2ubuntu2",
148
184
  "6.6p1-2ubuntu1",
149
185
  "6.2p2-6ubuntu1",
150
- "6.6.1p1 Ubuntu-8"],
151
- "14.10" => ["6.6p1-5build1"],
152
- "15.04" =>
153
- ["6.7p1-5ubuntu1.4",
186
+ "6.6.1p1 Ubuntu-8"
187
+ ],
188
+ "14.10" => [
189
+ "6.6p1-5build1"
190
+ ],
191
+ "15.04" => [
192
+ "6.7p1-5ubuntu1.4",
154
193
  "6.7p1-5ubuntu1.3",
155
194
  "6.7p1-5ubuntu1.2",
156
- "6.7p1-5ubuntu1"],
157
- "15.10" =>
158
- ["6.9p1-2ubuntu0.2", "6.9p1-2ubuntu0.1", "6.7p1-6ubuntu2", "6.7p1-6ubuntu1"],
159
- "16.04" => ["7.2p2-4ubuntu2.1", "7.2p2-4ubuntu2", "7.2p2-4ubuntu1"],
195
+ "6.7p1-5ubuntu1"
196
+ ],
197
+ "15.10" => [
198
+ "6.9p1-2ubuntu0.2",
199
+ "6.9p1-2ubuntu0.1",
200
+ "6.7p1-6ubuntu2",
201
+ "6.7p1-6ubuntu1"
202
+ ],
203
+ "16.04" => [
204
+ "7.2p2-4ubuntu2.1",
205
+ "7.2p2-4ubuntu2",
206
+ "7.2p2-4ubuntu1"
207
+ ],
160
208
  "16.10" => []
161
209
  }
162
210
 
@@ -173,10 +221,6 @@ module SSHScan
173
221
  OS::Ubuntu::FINGERPRINTS
174
222
  end
175
223
 
176
- def version
177
- @version
178
- end
179
-
180
224
  def ubuntu_version_guess
181
225
  possible_versions = []
182
226
  OS::Ubuntu::FINGERPRINTS.keys.each do |ubuntu_version|
@@ -187,13 +231,14 @@ module SSHScan
187
231
  if openssh_ps.include?("p")
188
232
  openssh_version = openssh_ps.split("p")[0]
189
233
  end
190
- if @banner.include?("OpenSSH_#{openssh_version}") and @banner.include?(ubuntu_sig)
234
+ if @banner.include?("OpenSSH_#{openssh_version}") &&
235
+ @banner.include?(ubuntu_sig)
191
236
  possible_versions << ubuntu_version
192
237
  end
193
238
  end
194
239
  end
195
240
  possible_versions.uniq!
196
- if possible_versions.length > 0
241
+ if possible_versions.any?
197
242
  return possible_versions.join("|")
198
243
  end
199
244
  return nil