jobroche / libssh-scanner

Script to identify hosts vulnerable to CVE-2018-10933

libssh scanner

Introduction

---

This is a python based script to identify hosts vulnerable to CVE-2018-10933. Libssh scanner has two modes: passive (banner grabbing) and aggressive (bypass auth) to validate vulnerability's existence. By default, libssh scanner uses passive mode but supply the -a argument and aggressive mode will be used which provides more accurate results.

The vulnerability is present on versions of libssh 0.6+ and was remediated by a patch present in libssh 0.7.6 and 0.8.4. For more details: https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/

Installation

---

Run pip install -r requirements.txt within the cloned libssh-scanner directory.

Help

---

libssh Scanner - Find vulnerable libssh services by Leap Security (@LeapSecurity)

positional arguments:
  target                An ip address or new line delimited file containing
                        IPs to search for the vulnerability.

optional arguments:
  -h, --help            show this help message and exit
  -v, --version         show program's version number and exit
  -p PORT, --port PORT  Set port of SSH service
  -a, --aggressive      Identify vulnerable hosts by bypassing authentication

libssh-scanner's Issues

argparse Target Handling

The code for the target parsing is incomplete. You need to add '-t' and '--target'

Target list

Instead of specifying a single target, indicate a file with a list where several ips addresses are found.

SyntaxError: invalid syntax

Hi,
i tried and received syntax error

C:\Users\me-laptop\AppData\Local\Programs\Python\Python37-32>python scan_libssh.py
File "scan_libssh.py", line 14
print "{blue}[*]{white} {ipaddr}:{port} is not vulnerable to authentication bypass ({banner})".format(blue=colors.blue, white=colors.normal, ipaddr=ip, port=port, banner=banner.strip())
^
SyntaxError: invalid syntax

Please advise

Crash on some banners

Hi,

Thanks a tonne for this tool. I have found some devices that crash it however. The banner I'm seeing is:

SSH-1.5-OpenSSH_2.9p1

And when scanned I get

Traceback (most recent call last):
  File "./libsshscan.py", line 93, in <module>
    aggressive(ip, int(args.port))
  File "./libsshscan.py", line 57, in aggressive
    pstatus(ip, port, banner)

version of pyhton required

The tool installed correctly with the depencies through pip command.
when i run it i have this error msg

# python libsshscan.py
  File "libsshscan.py", line 14
    print "{blue}[*]{white} {ipaddr}:{port} is not vulnerable to authentication bypass ({banner})".format(blue=colors.blue, white=colors.normal, ipaddr=ip, port=port, banner=banner.strip()) 
                                                                                                 ^
SyntaxError: invalid syntax

So How to overcome ?
Thks in advance

Split by bytes not text

banner is bytes not text. so it should also be treated as bytes - that's only my opinion
e.g.

-        return banner.split("\n")[0]
+        return banner.split(b"\n")[0]

bytehandling.patch.txt

#17

invalid banner check

Hi,

I'm scanning a version of libssh which is known as vulnerable and I get the following output:

[*] 127.0.0.1:22 is not vulnerable to authentication bypass (SSH-2.0-libssh_0.7.5)

Strangely, the banner does not match because of the _ instead of -.
From what I see in libssh code (libssh/include/libssh/priv.h), the banner is "SSH-2.0-libssh_" SSH_STRINGIFY(LIBSSH_VERSION), so I suppose the scanner should be updated to match an underscore instead of the dash.

After doing the modification, the scanner properly detects the server as "likely VULNERABLE".

By the way, in aggressive mode, the server is seen as not vulnerable, can it be because of the server configuration?