SSH-2 is a complete rewrite of SSH-1, as SSH-1 has inherent design flaws like client authentication forwarding and packet injection. Ironically, the detection of the latter was implemented in a way that allowed executing code with the privileges of the daemon. Ettercap can utilize the design flaws in MitM-attacks by stealing the session key and decrypting all the traffic.
When the connection starts (remember that we are the
master-of-packets, all packets go through ettercap) we substitute the
server public key with one generated on the fly and save it in a list
so we can remember that this server has been poisoned before.
the client send the packet containing the session key ciphered with
our key, so we are able to decipher it and sniff the real 3DES session
key. Now we encrypt the packet with the correct server public key and
forward it to the SSH daemon. The connection is established
normally, but we have the session key !! Now we can decrypt all the
traffic and sit down watching the stream !
The connection will remain
active even if we exit from ettercap, because ettercap doesn't proxy
it (like dsniff). After the exchange of the keys, ettercap is only a
SSH-2 provides strong cryptographic integrity checks, Diffie-Hellman key agreement and support for public-key certificates. The communication protocol must be downgraded to avoid those improvements.