Jump to content
Nytro

Automating Man-in-the-Middle SSHv2 attacks

Recommended Posts

Automating Man-in-the-Middle SSHv2 attacks

Recently during an internal penetration test, I was performing ARP spoofing and i found a SSH connection from the administrator computer to another box.

That sounds like the correct way to access remote hosts securely. However, the problem here was that the company was using a network switch that was vulnerable to ARP spoofing.

I came across the below article about performing ARP spoofing and MITM SSH connections to steal credentials.

The victim does get an alert message saying that there is a key mismatch but most people just ignore them anyway.

SSH2 "MITM" like attack with JMITM2 | woFF

In the article, he uses a software called JMITM2 (david-guembel.de: jmitm2) which is sort of like a honey pot that proxies SSH connections between the victim and the target SSH server.

However, there are a number of steps to be done manually to execute this attack during an internal penetration test.

1. Check if network is vulnerable to ARP spoofing

2. Check if there are any active SSH connections in the network

2. Identify the victim computer and SSH server

3. Modify the configuration files of JMITM2

4. Modifying iptables

5. ARP spoofing

6. Checking JMITM2 console for credentials

7. Re-arp the router and victim host with the correct MAC addresses of each.

It would save a great amount of time to automate these steps. I wrote a script that does just that.

Running the command below checks the network for active SSH connections (via ARP spoofing) and then automates the whole attack to outputs any credentials captured to the console.

python2.7 mitmSSH.py -analyze

If you know the victim host IP and SSH server, you can use the below command

python2.7 mitmSSH.py -host victims -ssh sshServerIP

img_2025.png?w=595

This script has only been tested on Kali Linux.

There are a couple of things that are still in the works to improve the script.

1. Switching from intercepter-ng for ARP spoofing to scapy.

The script can be grabbed from the below link

https://github.com/milo2012/pentest_automation/blob/master/mitmSSH.py

Sursa: Automating Man-in-the-Middle SSHv2 attacks | Milo2012's Security Blog

  • Upvote 1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...