Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ssh: Port lib/ssh from x/crypto v0.7.0 #399

Open
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

TrueSkrillor
Copy link

This PR updates the lib/ssh package to be on par with x/crypto/ssh v0.7.0. I chose not to update to v0.14.0 to avoid possible incompatibilities with the x/crypto dependency of the project. Updating lib/ssh is necessary for zgrab2 to stay relevant in the future and retain its ability to scan a large variety of different SSH servers.

The following key changes ported from x/crypto are relevant for zgrab2:

  • Support for AEAD algorithms (AES-GCM and ChaCha20-Poly1305)
  • Support for RFC-compliant Curve25519 key exchange (currently, only the deprecated libssh-variant is supported)
  • Support for Encrypt-then-MAC ([email protected]) MAC algorithms
  • Support for SSH extension negotiation (RFC8308)

In addition, I integrated some minor improvements myself:

  • Capture SSH extensions sent by the server after SSH_MSG_NEWKEYS. This requires either --userauth or the new --extensions flag to be present.
  • Removed unused lib/ssh/terminal and lib/ssh/agent packages
  • Fixed tests to be compatible with the changes from zgrab2 (see also Fixes various problems (mostly syntax) in tests #391)
  • Redesign the DontAuthenticate config flag by splitting it into two separate flags (DontAuthenticate and CollectUserAuth) for better readability

How to Test

Simply scan a few SSH servers and observe the results. I was able to perform an entire IPv4 address range scan without issues.

Notes & Caveats

Without this PR (or a similar one), the SSH scanning capabilities of zgrab2 will slowly decline due to its lack of recent key exchange and cipher algorithms. In the future, it may be beneficial to implement additional algorithms to increase the overall coverage of zgrab2. However, since supported algorithms can be captured without supporting the actual algorithms, a sufficient amount of data is already available to the user.

@developStorm developStorm requested review from a team and developStorm May 22, 2024 01:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants