ssh-enum/ssh_enumeration.py at main · kaio6fellipe/ssh-enum · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
import os
import re
import importlib
python_nmap = importlib.import_module("nmap-python.python_nmap")

class iniEnumSSH():
    def __init__(self, host, port):
        self.host = host
        self.port = port

    def start(self):
        self.dict = {"host": self.host}
        self.ssh_audit()
        self.ssh_keyscan()
        self.ssh_nmap()

    def get_dict(self):
        return self.dict

    def ssh_audit(self):
        try:
            ansi_escape = re.compile(r'\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])')
            response_ssh_audit = os.popen("ssh-audit " +  self.host + " -p" + str(self.port)).read()

            for lines in response_ssh_audit.splitlines():
                new_lines = ansi_escape.sub('', lines)
                if "(gen)" in new_lines or "(fin)" in new_lines:
                    key_gen = new_lines[:new_lines.find(":")]
                    value_gen = new_lines[new_lines.find(":"):]
                    value_gen_replace = value_gen.replace(": ", "")
                    self.dict[key_gen] = value_gen_replace
                if "(" in new_lines and "#" not in new_lines and "(nfo)" not in new_lines and "(gen)" not in new_lines and "(fin)" not in new_lines:
                    replace_lines = new_lines.replace("  ", "")
                    key = replace_lines[:replace_lines.find("--")]
                    value = new_lines[new_lines.find("--")+3:]
                    self.dict[key] = value
        except Exception as err:
            print('[*] Exception while executing sshaudit: %s' % err)

    def ssh_keyscan(self):
        try:
            response_ssh_keyscan = os.popen("ssh-keyscan -t rsa " + self.host + " -p " + str(self.port)).read()
            for lines in response_ssh_keyscan.splitlines():
                if "ssh-rsa" in lines:
                    key_rsa = "(fin) public ssh-rsa"
                    value_rsa = lines[lines.find("ssh-rsa "):].replace("ssh-rsa ", "")
                    self.dict[key_rsa] = value_rsa
        except Exception as err:
            print('[*] Exception while executing ssh_keyscan: %s' % err)

    def ssh_nmap(self):
        try:
            document1, nmap_result1 = python_nmap.nmapCustomScanProcess(self.host, '-sC -sV', self.port)
            document2, nmap_result2 = python_nmap.nmapCustomScanProcess(self.host, '--script ssh2-enum-algos', self.port)
            document3, nmap_result3 = python_nmap.nmapCustomScanProcess(self.host, '--script ssh-hostkey --script-args ssh_hostkey=full', self.port)
            document4, nmap_result4 = python_nmap.nmapCustomScanProcess(self.host, '--script ssh-auth-methods --script-args="ssh.user=root"', self.port)

            for key1 in nmap_result1.keys():
                self.dict[key1 + '1'] = nmap_result1[key1]
            for key2 in nmap_result2.keys():
                self.dict[key2 + '2'] = nmap_result2[key2]
            for key3 in nmap_result3.keys():
                self.dict[key3 + '3'] = nmap_result3[key3]
            for key4 in nmap_result4.keys():
                self.dict[key4 + '4'] = nmap_result4[key4]
        except Exception as err:
            print('[*] Exception while executing ssh_nmap: %s' % err)