SSH Protocol Versions Supported

#TRUSTED 7807c597961ec53c1d897458e082c0f40100fc41a297a95f5aff83d19e8d21adbd94a47fb683b8a455f9c1becf13c4c2045a734ff03cea39ec64a1a7e9d272440427351f4692e4d454a39f8ab4ab43ef532aa2c701bd10a17420f3177a016dc79f349f7908bfb6688bc981dd188a0a40c682e70a43a74792517e049fae412dba9fcc79715f3b02d5e1338ffd27391387b00e9ea380e14441a92fddb276a9895f5cabfd18e9490e93efa4e2e7fb1cf0307cfcb1ec2b4976edca8f6058ceaeb77bd5cd9b8698588681f9c0d6188d365d099610cdfa4461579350f9215c7b1bfd5e4f68f1bfa8ba522ddd07030d9e08c123a4b4e9b5846eb44db1768a25bce55538b638ade8f9bcc91866375019fe5fae60a33a1589aa862700160c80f92fc3b291e1e1c446d0cf42032c8be7c7f0ed6ed22441cdfae5c3bb52c9781d53f11b71dd072d13d464cd779cfaba0aa681e19c46e9854bbb1a47d1e3d4def8de9d682f869d3b0f0cac91b6eeb3721a2b9e9fe6f50f147b442c1f984fcbae2af7daabcf016b63fc29097af83e55c3f1fa3b5488ce82606dc6fc2317f7c3c734892e842cb1ee95841f302138d4b5b03e9b341bfe22e78ed2c391138eac38c38e914672e86762fc5f7117dbde3b817ddd700a6cb26a7897b9870a65aff39007d2a743d1adec5cd9a86153e0447f17092da9c8f5a41e7bb7d85186e01de329c341288bf82d2d
#TRUST-RSA-SHA256 7ac1a52c4cfc370b7baf1cec0c621c86b300b05f5b716800b70fcca0b4161c7b7280f9edf5ebe1b0aadd95a12312cb4bccaffde2e9f2941d995455043a7dc870c698e9963fa410f90b38bd33012b624d30ff6a18430f052c2f7adff50110cd9a4c29a41b0eb9c29101c822b846baec22db8a1a8401ea9f9b0ab3b25f6732cb637201aad031f9cba6c20ba49132cef15c5cb171c726aec6165a96e4070ea536e8335b2384b5cdf8334940dcebb2f5e700bbc7fed33482713175d23f706509f5142e873bdcd7ea07be89475dedac26f96b488300a339764c6c470826364388d3934b71143bf8f1fb0bad1b13a62f7801132e4cbc2069dd919f4d33acbd541973bb948b433db29d7defae689c5f7fde28c3b8c4289ea7da0a408abe759037c33de67b34f77bac8d051e6288443465eeeb761c68cb3b04013ac7ef510b594e09b33d7bcba8db0be1004bdfad053a135bee2bb0520f717fdcb8ee12c4b4ec79f3a7ef2dd924c328ac0ce203acc5e035f3ab8533c3ff290412644f56416bdb59693edb785e1520afeab9b8bafe41033f8d48a4609e46aa7ab3324b68386e4955276769ea74b30c51a62d9d055455c99224bfb1e098b0340446f3a6a11c73afdddb73c3c9c2fbcd3cdd983cb564d73bb31849d829843dcec91cf2bd51881446cee685a24a0a6d9350eb59c272ed37a683d50ae391b13ea5010fd8c87a9693ca83b17a32
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
 script_id(10881);
 script_version("1.41");
 script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/12");

 script_name(english:"SSH Protocol Versions Supported");
 script_summary(english:"Negotiate SSHd connections");

 script_set_attribute(attribute:"synopsis", value:
"A SSH server is running on the remote host.");
 script_set_attribute(attribute:"description", value:
"This plugin determines the versions of the SSH protocol supported by
the remote SSH daemon.");
 script_set_attribute(attribute:"solution", value:"n/a");
 script_set_attribute(attribute:"risk_factor", value:"None");

 script_set_attribute(attribute:"plugin_publication_date", value:"2002/03/06");

 script_set_attribute(attribute:"plugin_type", value:"remote");
 script_set_attribute(attribute:"asset_inventory", value:"True");
 script_end_attributes();

 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2007-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");
 script_family(english:"General");

 script_dependencies("ssh_detect.nasl");
 script_require_ports("Services/ssh", 22);
 exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("ssh_lib.inc");

enable_ssh_wrappers();

function test_version(version, port)
{
  local_var soc, r, str;

  soc = open_sock_tcp(port);
  if (!soc) audit(AUDIT_SOCK_FAIL, port);

  r = recv_line(socket:soc, length:255);
  if (!r) audit(AUDIT_NO_BANNER, port);

  if(!preg(pattern:"^SSH-.*", string:r)){
   	close(soc);
 	  return(0);
  }

  str = "SSH-" + version + "-" + sshlib::get_ssh_client_ver() + '\n';
  send(socket:soc, data:str);
  r = recv(socket:soc, length:255, min:1, timeout:10);
  close(soc);

  sleep(1);

  if(!strlen(r)) {
    return(0);
  }

  # if one of the below strings is matched in response we assume version not supported.
  if(preg(pattern:"^Protocol.*version", string:r)) {
    return(0);
  }
  else if ("ssh version is too old" >< r) {
    return(0);
  }
  else if (preg(pattern:"[Vv]ersion [0-9.]* client not allowed", string:r)) {
    return(0);
  }
  else if ("The connection is closed by SSH Server" >< r)
  {
    # Some Huawei devices return a disconnect code
    return 0;
  }
  else if ("Protocol major versions differ" >< r)
  {
    return 0;
  }
  else {
    return(1);
  }
}

function sshv1_recv(socket)
{
 local_var len, head, data;

 head  = recv(socket:socket, length:4, min:4);
 if ( strlen(head) < 4 ) return NULL;

 len = ord(head[2]) * 256 + ord(head[3]);
 data = recv(socket:socket, length:len, min:len);
 return head + data;
}

function ssh2_get_fingerprint(port)
{
 local_var soc,key, fingerprint, fg, i;

 _ssh_socket = open_sock_tcp(port);
 if(!_ssh_socket)
   audit(AUDIT_SOCK_FAIL, port);

 if(!supplied_logins_only)
   ssh_login(no_reuse:TRUE);
 ssh_close_connection();

 key = get_server_public_key();

 if (key != NULL)
 {
  fingerprint = hexstr(MD5(key));
  fg = "";
  for ( i = 0 ; i < strlen(fingerprint) ; i += 2 )
  {
   fg += substr(fingerprint, i, i + 1);
   if ( i + 2 < strlen(fingerprint) ) fg += ":";
  }

  return fg;
 }
 return NULL;
}

function ssh1_get_fingerprint(port)
{
 local_var soc,key, key_len, key_len_str, blob, fingerprint, fg, i, idx, buf;

 soc = open_sock_tcp(port);
 if (!soc) audit(AUDIT_SOCK_FAIL, port);

 buf = recv_line(socket:soc, length:4096);
 send(socket:soc, data:'SSH-1.5-' + sshlib::get_ssh_client_ver() + '\n');

  blob = sshv1_recv(socket:soc);
  close(soc);
  if ( blob != NULL && "Protocol" >!< blob && strlen(blob) >= (132 + 127) )
  {
  idx = stridx(hexstr(blob), "e8dc4c7f1b53b99ff6f89bc7bf0448cf587d667");
  key_len_str = substr(blob, 130,131);
  key_len = ord(key_len_str[0]) * 256 + ord(key_len_str[1]);
  key = substr(blob, 132, 132 + 127 ) + raw_string(0x23);
  fingerprint = hexstr(MD5(key));
  fg = "";
  for ( i = 0 ; i < strlen(fingerprint) ; i += 2 )
  {
   fg += substr(fingerprint, i, i + 1);
   if ( i + 2 < strlen(fingerprint) ) fg += ":";
  }
  return fg;
 }
 return NULL;
}

port = get_service(svc:"ssh", default:22, exit_on_fail:TRUE);

v = 0;

vers_1_33 = 0;
vers_1_5  = 0;
vers_1_99 = 0;
vers_2_0  = 0;

# Some SSHd implementations reply to anything.
if(test_version(version:"9.9", port:port))
{
 exit(0, "The SSH service listening on port "+port+" claims to support a nonsensical SSH protocol version.");
}

if(test_version(version:"1.33", port:port))
	{
	v = 1;
	vers_1_33 = 1;
	}

if(test_version(version:"1.5", port:port))
	{
	v = 1;
	vers_1_5 = 1;
	}

if(test_version(version:"1.99", port:port))
	{
	v = 1;
	vers_1_99 = 1;
	}

if(test_version(version:"2.0", port:port))
	{
	v = 1;
	vers_2_0 = 1;
	}



report = "The remote SSH daemon supports the following versions of the" + '\n'
       + "SSH protocol :" + '\n\n';

if(vers_1_33)report = report + "  - 1.33" + '\n';
if(vers_1_5){
	report = report + "  - 1.5" + '\n';
	fg1 = ssh1_get_fingerprint(port:port);
	}
if(vers_1_99)report = report + "  - 1.99" + '\n';
if(vers_2_0) {
	report = report + "  - 2.0" + '\n';
	fg2 = ssh2_get_fingerprint(port:port);
	}

if ( vers_1_33 || vers_1_5 )
{
 set_kb_item(name:"SSH/" + port + "/v1_supported", value:TRUE);
}

if ( fg1 || fg2 ) report += '\n\n';
if ( fg1 ) report += "SSHv1 host key fingerprint : " + fg1 + '\n';
if ( fg2 ) report += "SSHv2 host key fingerprint : " + fg2 + '\n';


if (v)
 security_note(port:port, extra:report);