0

I am developing a lab exercise with Cain and Abel and want to know why it is necessary to downgrade SSH before attacking.

Identification phase

The server sends to the client an identification string of the form "SSH-.-"; the client parses the server's string, and sends a corresponding string with its own information in response. Here APR-SSH-1 automatically replaces the version specified by the server in the first packet in order to downgrade the communication to SSH protocol v1.51.

What can SSH-2 do that version 1.51 can't?

1

SSH-2 is a complete rewrite of SSH-1, as SSH-1 has inherent design flaws like client authentication forwarding and packet injection. Ironically, the detection of the latter was implemented in a way that allowed executing code with the privileges of the daemon. Ettercap can utilize the design flaws in MitM-attacks by stealing the session key and decrypting all the traffic.

SSH1 MAN-IN-THE-MIDDLE

When the connection starts (remember that we are the master-of-packets, all packets go through ettercap) we substitute the server public key with one generated on the fly and save it in a list so we can remember that this server has been poisoned before.

Then the client send the packet containing the session key ciphered with our key, so we are able to decipher it and sniff the real 3DES session key. Now we encrypt the packet with the correct server public key and forward it to the SSH daemon. The connection is established normally, but we have the session key !! Now we can decrypt all the traffic and sit down watching the stream !

The connection will remain active even if we exit from ettercap, because ettercap doesn't proxy it (like dsniff). After the exchange of the keys, ettercap is only a spectator... ;)

SSH-2 provides strong cryptographic integrity checks, Diffie-Hellman key agreement and support for public-key certificates. The communication protocol must be downgraded to avoid those improvements.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.