Re: SSH module broken @ Ncrack?

[Richard Miles <richard.k.miles () googlemail com>]

Hi

Sorry for delay in reply, I was a bit busy. Since this information is
a bit confidential, I will send to you via private e-mail, but feel
free to discuss the issues (without reveal my IPs and sensitive
information) on the list.

Thanks

On Fri, Aug 20, 2010 at 8:12 PM, ithilgore <ithilgore.ryu.l () gmail com> wrote:
> On 08/21/10 00:12, Richard Miles wrote:
> > Opz, I forgot to reply to maillist and instead sent private to ithilgore.
> >
> > Yes, the output is like that:
> >
> > ssh://10.10.1.3:22 Initiating new Connection
> > ssh://10.10.1.3:22 pushed to list FULL
> > Stats: 0:00:07 elapsed; 0 services completed (1 total)
> > Rate: 0.00; Found: 0; About 0.00% done
> > ssh://10.10.1.3:22 Pool: Append root root
> > ssh://10.10.1.3:22 nsock READ timeout!
> > ssh://10.10.1.3:22 popped from list FULL
> > ssh://10.10.1.3:22 Attempts: total 0 completed 0 supported 0 --- rate 0.00
> > ssh://10.10.1.3:22 Pool: extract root root
> > ssh://10.10.1.3:22 Initiating new Connection
> > ssh://10.10.1.3:22 Password list finished!
> > ssh://10.10.1.3:22 pushed to list PAIRFINI
> > Stats: 0:00:34 elapsed; 0 services completed (1 total)
> > Rate: 0.00; Found: 0; About 0.00% done
> > ssh://10.10.1.3:22 Pool: Append root root
> > ssh://10.10.1.3:22 popped from list PAIRFINI
> > ssh://10.10.1.3:22 nsock READ timeout!
> > ssh://10.10.1.3:22 Attempts: total 0 completed 0 supported 0 --- rate 0.00
> > ssh://10.10.1.3:22 Pool: extract root root
> > ssh://10.10.1.3:22 Initiating new Connection
> > ssh://10.10.1.3:22 pushed to list PAIRFINI
> >
> > However, if I open a parallel shell and I call ssh root@10.10.1.3 it
> > shows the SSH banner and in sequence ask for my password.
>
> The Ncrack SSH module normally waits for the SSH server's Identification
> packet (which is part of the SSH protocol), after initiating the TCP
> connection. In addition, the Ncrack SSH module can successfully handle
> additional SSH banner messages. The problem is that Nsock waits for some
> additional data to read, which never seem to come, hence the timeout occurs.
>
> So here are some things we could check out:
>
> 1) What is the exact SSH server version?
> 2) Is there any weird option enabled in sshd.conf or is it the default one?
> 3) Could you rerun Ncrack against it and capture the data with Wireshark?
>
> Thanks,
> ithilgore
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/