ssh_version: Various improvements#21393
Open
g0tmi1k wants to merge 14 commits into
Open
Conversation
g0tmi1k
force-pushed
the
ssh_version
branch
3 times, most recently
from
fca982e to
e6e49a2
Compare
g0tmi1k
changed the title
g0tmi1k
force-pushed
the
ssh_version
branch
2 times, most recently
from
21afbba to
aa9531c
Compare
Contributor
Author
$ ./msfconsole -q -x 'db_status; workspace -D;
use auxiliary/scanner/ssh/ssh_version; set RHOST 10.0.0.10;'
[*] Connected to msf. Connection type: postgresql.
[*] Deleted workspace: default
[*] Recreated the default workspace
RHOST => 10.0.0.10
msf auxiliary(scanner/ssh/ssh_version) > run
[*] 10.0.0.10 - Key Fingerprint: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAstqnuFMBOZvO3WTEjP4TUdjgWkIVNdTq6kboEDjteOfc65TlI7sRvQBwqAhQjeeyyIk8T55gMDkOD0akSlSXvLDcmcdYfxeIF0ZSuT+nkRhij7XSSA/Oc5QSk3sJ/SInfb78e3anbRHpmkJcVgETJ5WhKObUNf1AKZW++4Xlc63M4KI5cjvMMIPEVOyR3AKmI78Fo3HJjYucg87JjLeC66I7+dlEYX6zT8i1XYwa/L1vZ3qSJISGVu8kRPikMv/cNSvki4j+qDYyZ2E5497W87+Ed46/8P42LNGoOV8OcX/ro6pAcbEPUdUEfkJrqi2YXbhvwIJ0gFMb6wfe5cnQew==
[*] 10.0.0.10 - SSH server version: SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1
[*] 10.0.0.10 - SSH Server Details
==================
Type Value Note
---- ----- ----
encryption.compression none
encryption.compression zlib@openssh.com
encryption.encryption aes128-cbc Deprecated
encryption.encryption 3des-cbc Deprecated
encryption.encryption blowfish-cbc Deprecated
encryption.encryption cast128-cbc Deprecated
encryption.encryption arcfour128 Deprecated
encryption.encryption arcfour256 Deprecated
encryption.encryption arcfour Deprecated
encryption.encryption aes192-cbc Deprecated
encryption.encryption aes256-cbc Deprecated
encryption.encryption rijndael-cbc@lysator.liu.se Deprecated
encryption.encryption aes128-ctr
encryption.encryption aes192-ctr
encryption.encryption aes256-ctr
encryption.hmac hmac-md5 Deprecated
encryption.hmac hmac-sha1
encryption.hmac umac-64@openssh.com
encryption.hmac hmac-ripemd160 Deprecated
encryption.hmac hmac-ripemd160@openssh.com Deprecated
encryption.hmac hmac-sha1-96 Deprecated
encryption.hmac hmac-md5-96 Deprecated
encryption.host_key ssh-rsa
encryption.host_key ssh-dss Deprecated SHA-1
encryption.key_exchange diffie-hellman-group-exchange-sha256
encryption.key_exchange diffie-hellman-group-exchange-sha1 Deprecated
encryption.key_exchange diffie-hellman-group14-sha1
encryption.key_exchange diffie-hellman-group1-sha1 Deprecated
fingerprint_db ssh.banner
openssh.comment Debian-8ubuntu1
os.cpe23 cpe:/o:canonical:ubuntu_linux:8.04
os.family Linux
os.product Linux
os.vendor Ubuntu
os.version 8.04
service.cpe23 cpe:/a:openbsd:openssh:4.7p1
service.family OpenSSH
service.product OpenSSH
service.protocol ssh
service.vendor OpenBSD
service.version 4.7p1
[!] 10.0.0.10 - Found 18 deprecated/weak algorithm(s) across 4 categories
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ssh/ssh_version) >
msf auxiliary(scanner/ssh/ssh_version) > workspace -v
Workspaces
==========
current name hosts services vulns creds loots notes
------- ---- ----- -------- ----- ----- ----- -----
* default 1 2 4 0 0 2
msf auxiliary(scanner/ssh/ssh_version) > hosts
Hosts
=====
address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- --------
10.0.0.10 Linux Ubuntu 8.04 server
msf auxiliary(scanner/ssh/ssh_version) > services
Services
========
host port proto name state info resource parents
---- ---- ----- ---- ----- ---- -------- -------
10.0.0.10 22 tcp open {}
10.0.0.10 22 tcp ssh open SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1 {}
msf auxiliary(scanner/ssh/ssh_version) >
msf auxiliary(scanner/ssh/ssh_version) > vulns
Vulnerabilities
===============
Timestamp Host Service Resource Name References
--------- ---- ------- -------- ---- ----------
2026-05-08 16:18:10 UTC 10.0.0.10 (22/tcp) {} SSH Weak Encryption Cipher https://github.com/net-ssh/net-ssh?tab=readme-ov-file#encryption-algorithms-ciphers,CVE-2008-5161,https://datatracker
.ietf.org/doc/html/rfc8758#name-iana-considerations
2026-05-08 16:18:10 UTC 10.0.0.10 (22/tcp) {} SSH Weak Key Exchange Algorithm https://datatracker.ietf.org/doc/html/draft-ietf-curdle-ssh-kex-sha2-20#page-16
2026-05-08 16:18:10 UTC 10.0.0.10 (22/tcp) {} SSH Weak Host Key Algorithm https://www.openssh.com/legacy.html
2026-05-08 16:18:10 UTC 10.0.0.10 (22/tcp) {} SSH Weak HMAC Algorithm https://github.com/net-ssh/net-ssh?tab=readme-ov-file#message-authentication-code-algorithms
msf auxiliary(scanner/ssh/ssh_version) >
msf auxiliary(scanner/ssh/ssh_version) > notes
Notes
=====
Time Host Service Port Protocol Type Data
---- ---- ------- ---- -------- ---- ----
2026-05-08 16:18:10 UTC 10.0.0.10 22 tcp ssh.hostkey {:type=>"ssh-rsa", :fingerprint=>"AAAAB3NzaC1yc2EAAAABIwAAAQEAstqnuFMBOZvO3WTEjP4TUdjgWkIVNdTq6kboEDjteOfc65TlI7sRvQBwqAhQjeeyyI
k8T55gMDkOD0akSlSXvLDcmcdYfxeIF0ZSuT+nkRhij7XSSA/Oc5QSk3sJ/SInfb78e3anbRHpmkJcVgETJ5WhKObUNf1AKZW++4Xlc63M4KI5cjvMMIPEVOyR3AKmI7
8Fo3HJjYucg87JjLeC66I7+dlEYX6zT8i1XYwa/L1vZ3qSJISGVu8kRPikMv/cNSvki4j+qDYyZ2E5497W87+Ed46/8P42LNGoOV8OcX/ro6pAcbEPUdUEfkJrqi2YXb
hvwIJ0gFMb6wfe5cnQew=="}
2026-05-08 16:18:11 UTC 10.0.0.10 22 tcp ssh.algorithms {:algorithms=>[{:type=>"encryption.compression", :value=>"none", :note=>""}, {:type=>"encryption.compression", :value=>"zlib@ope
nssh.com", :note=>""}, {:type=>"encryption.encryption", :value=>"aes128-cbc", :note=>"Deprecated"}, {:type=>"encryption.encrypti
on", :value=>"3des-cbc", :note=>"Deprecated"}, {:type=>"encryption.encryption", :value=>"blowfish-cbc", :note=>"Deprecated"}, {:
type=>"encryption.encryption", :value=>"cast128-cbc", :note=>"Deprecated"}, {:type=>"encryption.encryption", :value=>"arcfour128
", :note=>"Deprecated"}, {:type=>"encryption.encryption", :value=>"arcfour256", :note=>"Deprecated"}, {:type=>"encryption.encryp
tion", :value=>"arcfour", :note=>"Deprecated"}, {:type=>"encryption.encryption", :value=>"aes192-cbc", :note=>"Deprecated"}, {:t
ype=>"encryption.encryption", :value=>"aes256-cbc", :note=>"Deprecated"}, {:type=>"encryption.encryption", :value=>"rijndael-cbc
@lysator.liu.se", :note=>"Deprecated"}, {:type=>"encryption.encryption", :value=>"aes128-ctr", :note=>""}, {:type=>"encryption.e
ncryption", :value=>"aes192-ctr", :note=>""}, {:type=>"encryption.encryption", :value=>"aes256-ctr", :note=>""}, {:type=>"encryp
tion.hmac", :value=>"hmac-md5", :note=>"Deprecated"}, {:type=>"encryption.hmac", :value=>"hmac-sha1", :note=>""}, {:type=>"encry
ption.hmac", :value=>"umac-64@openssh.com", :note=>""}, {:type=>"encryption.hmac", :value=>"hmac-ripemd160", :note=>"Deprecated"
}, {:type=>"encryption.hmac", :value=>"hmac-ripemd160@openssh.com", :note=>"Deprecated"}, {:type=>"encryption.hmac", :value=>"hm
ac-sha1-96", :note=>"Deprecated"}, {:type=>"encryption.hmac", :value=>"hmac-md5-96", :note=>"Deprecated"}, {:type=>"encryption.h
ost_key", :value=>"ssh-rsa", :note=>""}, {:type=>"encryption.host_key", :value=>"ssh-dss", :note=>"Deprecated SHA-1"}, {:type=>"
encryption.key_exchange", :value=>"diffie-hellman-group-exchange-sha256", :note=>""}, {:type=>"encryption.key_exchange", :value=
>"diffie-hellman-group-exchange-sha1", :note=>"Deprecated"}, {:type=>"encryption.key_exchange", :value=>"diffie-hellman-group14-
sha1", :note=>""}, {:type=>"encryption.key_exchange", :value=>"diffie-hellman-group1-sha1", :note=>"Deprecated"}, {:type=>"finge
rprint_db", :value=>"ssh.banner", :note=>nil}, {:type=>"openssh.comment", :value=>"Debian-8ubuntu1", :note=>nil}, {:type=>"os.cp
e23", :value=>"cpe:/o:canonical:ubuntu_linux:8.04", :note=>nil}, {:type=>"os.family", :value=>"Linux", :note=>nil}, {:type=>"os.
product", :value=>"Linux", :note=>nil}, {:type=>"os.vendor", :value=>"Ubuntu", :note=>nil}, {:type=>"os.version", :value=>"8.04"
, :note=>nil}, {:type=>"service.cpe23", :value=>"cpe:/a:openbsd:openssh:4.7p1", :note=>nil}, {:type=>"service.family", :value=>"
OpenSSH", :note=>nil}, {:type=>"service.product", :value=>"OpenSSH", :note=>nil}, {:type=>"service.protocol", :value=>"ssh", :no
te=>nil}, {:type=>"service.vendor", :value=>"OpenBSD", :note=>nil}, {:type=>"service.version", :value=>"4.7p1", :note=>nil}]}
msf auxiliary(scanner/ssh/ssh_version) > |
g0tmi1k
force-pushed
the
ssh_version
branch
6 times, most recently
from
e655220 to
1ab4e66
Compare
> OpenSSH 7.0 and greater similarly disable the ssh-dss (DSA) public key algorithm.
Contributor
Author
|
Think I've finished tweaking with this PR! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR does a few things:
Target is Metasploitable 2.
Before
After