Re: [gentoo-security] SSH probes

[William Yang]

Brian Micek wrote:
> I don't mean to re-start an old topic, but would anyone happen to have
> access to the source code for the second phase of the popular SSH
> probes?  The reason I'm interested in it is because I'd like to exploit
> some weaknesses in the code and at least cause it to drop a core.

IANAL.  I am also not law enforcement.  I'm also not a poser when it comes 
to security.

I have spoken to law enforcement agencies from a number of countries about 
this specific issue on several occasions, and I've also spoken with 
attorneys about this specific idea in a couple of countries.  You tread on 
very dangerous ground, and it's an immature and unwise approach.  The fact 
is, defensive measures are generally not interpreted to include trying to 
exploit vulnerabilities in code operating on boxes you don't own or have 
authorization to attack.  You'll exceed authorized access on someone else's 
system, if you're successful.  It may cause a great deal of collateral damage.

Your approach is ill-advised.  It's also not all that wise as it could be 
used to lauch DoS against other sites, and may be capable of doing DoS 
against your site (MITM, forged syn, synack, ack sequences in two 
directions, linking the stream from your /dev/urandom dump (ie: chargen) to 
any port that will listen (echo).  Chews up cycles, at a bare minimum... 
forever.

> Currently, I have a service started by xinetd and close stdin on the
> command line arguments to avoid hackers hacking my program.  I run a
> bash script as user "nobody" that basically looks like this (extra
> extraneous stuff is removed):
>
> #!/bin/bash
> function fakessh() {
>   echo SSH-2.0-OpenSSH_3.9p1 # ID ourself as a valid SSH service
>   /bin/cat /dev/urandom # and send random data
> }
> # Main follows - this is run as user "nobody"
> fakessh <&-  # Call the payload and (again) close stdin to avoid hacks
> # EOF - fakessh
>
> The result for someone using a normal ssh client is:
> UNIX>  ssh localhost
> Disconnecting: Bad packet length 3349376822.
>
> I am hoping to cause some kind of memory problem here and thats why I
> need the source code.  Another exploit to examine is what happens with
> zero length packets if we cat /dev/zero.  If there is nothing to exploit
> here, I'll remove the "echo" line so I send random data until the hacker
> client terminates his connection.
>
> Thank you,
> Brian Micek


-- 
William Yang
wyang@××××.net
-- 
gentoo-security@g.o mailing list