Re: [NSE script] SSH2 hostkey

[Brandon Enright <bmenrigh () ucsd edu>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 05 Aug 2008 16:35:48 +0200 or thereabouts Sven Klemm
<sven () c3d2 de> wrote:

> Hi
>
> attached to this mail you can find a script that shows the rsa and
> das host keys of ssh2 ssh daemons.
>
> The script requires the nse openssl bindings, the nse pack/unpack 
> library and the base64 library.
>
> Sample output:
>
> ./nmap --script SSH2-hostkey -p 22 localhost
>
> Starting Nmap 4.68 ( http://nmap.org ) at 2008-08-05 16:34 CEST
> Interesting ports on localhost (127.0.0.1):
> PORT   STATE SERVICE
> 22/tcp open  ssh
> |  SSH2-Hostkey: ssh-rsa 
> AAAAB3NzaC1yc2EAAAABIwAAAQEAwVuv2gcr0maaKQ69VVIEv2ob4OxnuI64fkeOnCXD1lUx5tTA+vefXUWEMxgMuA7iX4irJHy2zer0NQ3Z3yJvr5scPgTYIaEOp5Uo/eGFG9Agpk5wE8CoF0e47iCAPHqzlmP2V7aNURLMODb3jVZuI07A2ZRrMGrD8d888E2ORVORv1rYeTYCqcMMoVFmX9l3gWEdk4yx3w5sD8v501Iuyd1v19mPfyhrI5E1E1nl/Xjp5N0/xP2GUBrdkDMxKaxqTPMie/f0dXBUPQQN697a5q+5lBRPhKYOtn6yQKCd9s1Q22nxn72Jmi1RzbMyYJ52FosDT755Qmb46GLrDMaZMQ==
> |_ ssh-dss 
> AAAAB3NzaC1kc3MAAACBAJD6ApUbSAGL/jKRaxE0QQLGB3eH7sEPxAFYhWz1nEiwOIh50ONd0Nr2UAFsQlYvnk7Bchx7tElWP57eHpyr9BWZwFOTQQAEM77dKNbUzqQhoSppRqnbFjErTp/PnvwY95M05Kdm98MnxA6ngE4Nz8C0eL69sm/oFRQ6ahGmWcSLAAAAFQCW+NG4KsuIgk/9LuuKmUy/9MMQ1wAAAIA8vwBaH5evPRJi1rmo/QGhJiC8iQCnwbXqwnJGVIWFvYuofQCERs0xzfcrMOi8J3AMd1qhOjUC0YTg6xXtxPlW3Un7cmLcia3IVPUewjsNfLUIQ6TVXqAP8yU9elSE39zrBNrC0o30K2fMDB/ngn+ml/G9gd0/W0XStfx8svglsQAAAIEAgXXWoZej/rbTwTd61Gz+XpLwwqJkPT9EHgPVSVRD399BN3zxP9ghib+K9c6snavFvhWxrTgU/ZZZmiyOwOMcltp08REErOj5U54dzM/hYbYio0Ke83y1/llnFwoOimCHdJ0NSr/a69ZudNN3j8651ufIp13kDETBmEMMCGy8OqY=
>
> Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds
>
>
> Cheers,
> Sven

Sven,

This is awesome.  Something I've wanted this for a long time.  I went
to go code up the script myself, realized I'd need to do math in the
script and handle large chunks of binary data and pushed the project
aside.  I'm very glad we now have the tools in NSE to do it (and that
you went and did it).

You might consider only displaying the key fingerprint instead of the
full key unless verbose is set to at least 2.  Here is what that would
look like:

> Starting Nmap 4.68 ( http://nmap.org ) at 2008-08-05 16:34 CEST
> Interesting ports on localhost (127.0.0.1):
> PORT   STATE SERVICE
> 22/tcp open  ssh
> |  SSH2-Hostkey: ssh-rsa 2048 f0:58:ce:f4:aa:a4:59:1c:8e:dd:4d:07:44:c8:25:11
> |_ ssh-dss 1024 23:23:8c:73:26:22:4a:63:d8:5d:41:eb:86:cf:a0:58

You'll have to dig into the standard spec to figure out what part of
the key you compute the hash over.  For RSA it is probably the modulus
but I'm not sure for DSA.

Brandon




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkiYeDAACgkQqaGPzAsl94KeEACgi8+tC2iqzfFY+NF4alg86BjK
wnAAn2VaRQIG1rTek082qvRjDEK6dkF1
=oorK
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org