Re: SSH module broken @ Ncrack?

[ithilgore <ithilgore.ryu.l () gmail com>]

On 08/21/10 00:12, Richard Miles wrote:
> Opz, I forgot to reply to maillist and instead sent private to ithilgore.
>
> Yes, the output is like that:
>
> ssh://10.10.1.3:22 Initiating new Connection
> ssh://10.10.1.3:22 pushed to list FULL
> Stats: 0:00:07 elapsed; 0 services completed (1 total)
> Rate: 0.00; Found: 0; About 0.00% done
> ssh://10.10.1.3:22 Pool: Append root root
> ssh://10.10.1.3:22 nsock READ timeout!
> ssh://10.10.1.3:22 popped from list FULL
> ssh://10.10.1.3:22 Attempts: total 0 completed 0 supported 0 --- rate 0.00
> ssh://10.10.1.3:22 Pool: extract root root
> ssh://10.10.1.3:22 Initiating new Connection
> ssh://10.10.1.3:22 Password list finished!
> ssh://10.10.1.3:22 pushed to list PAIRFINI
> Stats: 0:00:34 elapsed; 0 services completed (1 total)
> Rate: 0.00; Found: 0; About 0.00% done
> ssh://10.10.1.3:22 Pool: Append root root
> ssh://10.10.1.3:22 popped from list PAIRFINI
> ssh://10.10.1.3:22 nsock READ timeout!
> ssh://10.10.1.3:22 Attempts: total 0 completed 0 supported 0 --- rate 0.00
> ssh://10.10.1.3:22 Pool: extract root root
> ssh://10.10.1.3:22 Initiating new Connection
> ssh://10.10.1.3:22 pushed to list PAIRFINI
>
> However, if I open a parallel shell and I call ssh root@10.10.1.3 it
> shows the SSH banner and in sequence ask for my password.

The Ncrack SSH module normally waits for the SSH server's Identification
packet (which is part of the SSH protocol), after initiating the TCP
connection. In addition, the Ncrack SSH module can successfully handle
additional SSH banner messages. The problem is that Nsock waits for some
additional data to read, which never seem to come, hence the timeout occurs.

So here are some things we could check out:

1) What is the exact SSH server version?
2) Is there any weird option enabled in sshd.conf or is it the default one?
3) Could you rerun Ncrack against it and capture the data with Wireshark?

Thanks,
ithilgore



_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/