3

I just did a scan with nmap and it found a ssh service running (nothing wrong here). The problem is it identifies the service as OpenSSH 12.1, but when I looked on the website of OpenSSH they say the last release is 7.3

Here the command, if it may help:

nmap -sS -A -p 22 xxx.xxx.xxx.xxx

Here is the output:

Starting Nmap 7.12SVN ( https://nmap.org ) at 2016-08-15 15:29 EDT
Nmap scan report for xx.xx.xx.xx
Host is up (0.00026s latency).
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 12.1 (protocol 2.0)
| ssh-hostkey:
|   1024 xx (DSA)
|_  2048 xx (RSA)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32, Linux 2.6.32 - 2.6.35

Any idea?

4

Someone is being deliberately deceptive. Nmap's service fingerprints are written as regular expressions that match and capture portions of the banner. Here's an example for OpenSSH:

match ssh m|^SSH-([\d.]+)-OpenSSH[_-]([\w.]+)\r?\n|i p/OpenSSH/ v/$2/ i/protocol $1/ cpe:/a:openbsd:openssh:$2/

So if someone created an SSH service that returned a banner like this:

SSH-2.0-OpenSSH-12.1

Then it would produce the output you see. OpenSSH itself does not allow this banner to be configured at runtime, so the person in question either changed the code before compiling or is running some other SSH daemon.

| improve this answer | |
  • It's also possible he has a custom (poisoned?) version of nmap-service-probes in his installation. He could compare his copy to svn.nmap.org/nmap/nmap-service-probes to make sure. – John Deters Aug 15 '16 at 20:07
  • @bonsaiviking Ok thanks, I will to look further into it. It could make sense, because Nexpose is giving me info that the scan is on a Palo Alto Networks PA Firewall ... For my personnal knowledge, were did you get this information? :) – RandomSecGuy Aug 15 '16 at 20:09
  • I confirm the banner. Using telnet xx.xx.xx.xx 22 give me the banner with the OpenSSH-12.1 – RandomSecGuy Aug 15 '16 at 20:24
0

I'm pretty sure Palo Alto is doing this intentionally. Every instance of OpenSSH 12.1 that I have seen were Palo Alto PA firewalls. I think they're doing this so that a scanning tool will not show vulnerabilities in their SSH.

Some of those firewalls were atleast 4 or 5 years old and if they are actually running OpenSSH and haven't been patched, those have to vulnerable. These firewalls may run in networks without their packages updated for years. So they could have chosen this version number so that it would remain latest for decades to come.

I'd suggest trying all the PoCs for OpenSSH in the last one decade to see how it holds up then.

| improve this answer | |
  • In comments above, the OP confirms that the target is a Palo Alto Networks PA Firewall. But your speculation for why the version number is different needs support, else this is a pretty serious accusation. They might simply have their own version. – schroeder May 13 at 13:32
  • @schroeder - While they could indeed have their own version of SSH , it would not be OpenSSH. That would be a contradiction in definition. – user10216038 May 13 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.