ProxyCommand implemented in which OpenSSH Version

Question

Scenario:

You as a pentester are in a situation where you want to do multi hopping to jump over several ssh servers to your target. The systems are somehow outdated so you want to check what you can do. ssh -v localhost reveals the ssh version and you can deduce how you will perform the jumps.

There are 3 main possibilities:

1. -J: from version August 2016 : version 7.3 like ssh -J root@jmp1,root@jmp2 root@jmp3

2. -W: from March 2010 : version 5.4 like

   ssh -oProxyCommand="ssh -W %h:%p -oProxyCommand=\"ssh -W %%h:%%p root@jmp1\" jumphost@jmp2" root@jmp3
   

3. -o ProxyCommand from ? : version ? like

   ssh -oProxyCommand="ssh root@jmp2 -oProxyCommand=\"ssh root@jmp1 nc -q0 jmp2 22\" nc -q0 jmp3 22" root@jmp3'
   

I searched in the OpenSSH release page and in Github to find when ProxyCommand was introduced.

At the release page I couldn't find a hint. Browsing the commits I found:

commit 36143d785143daabda83962a0f34404a9abf0964
Author: Damien Miller <[email protected]>
Date:   Mon Feb 7 13:20:26 2000 +1100

     - Removed SOCKS code. Will support through a ProxyCommand.

and

commit 61f08ac35a06e758c20fc85b9944d1feee146d47
Author: Damien Miller <[email protected]>
Date:   Mon Feb 24 11:56:27 2003 +1100

       - [email protected] 2003/02/05 09:02:28
         [readconf.c]
         simplify ProxyCommand parsing, remove strcat/xrealloc; ok henning@, djm@

but no definite entry.

Does anyone know since which version ProxyCommand was available in OpenSSH?

Answer 1

If you're pentesting and you encounter an OpenSSH instance that old, surely there's an exploit you could engage that is significantly more powerful than ProxyCommand.

That said, the history on Github only goes back to 2002-06-21, where you can see the oldest record of ssh_config.5 in git's import of CVS still mentions ProxyCommand. That's probably the origin of OpenSSH-portable (as in "not just for OpenBSD"), but the official OpenSSH History page isn't specific here. It says there was OpenSSH (pre -portable?) dev work logged in RCS, which presumably wasn't migrated to CVS.

Update: Steffen Ullrich noted that the ProxyCommand option was mentioned in 1999-12-06. That wasn't an announcement of a new feature, so it surely preceded the OpenSSH 1.2.2 release that shipped with OpenBSD 2.6 five days earlier. Despite the numbering, that appears to be the origin of OpenSSH, since code was initially imported from OSSH (its ancestor) on 1999-09-26 and the History page notes "the time of release [was] two months later" on 1999-12-01.

This means ProxyCommand existed in the code that became OpenSSH and was present in the first release with that name.