#########################################################################################
# SSH Settings
#########################################################################################

[config]
default_port = 22
protocol	 = tcp
categories 	 = vulnscan, vulnlookup, exploit, defaultcreds, bruteforce

[products]
ssh-server =
    OpenSSH,
    Dropbear SSH


#########################################################################################
# Vulnscan
#########################################################################################
[check_vulns-algos-scan]
name        = vulns-algos-scan
category    = vulnscan
description = Scan supported algorithms and security info on SSH server
tool        = ssh-audit
command_1   = python2.7 ssh-audit.py -v -p [PORT] [IP]


#########################################################################################
# Vulnlookup
#########################################################################################
[check_vulners-lookup]
name        = vulners-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Vulners.com (requires product name+version)
tool        = vulners-lookup
apikey      = vulners
# To avoid lots of false positives, only syntax using affectedSoftware is used here
command_1   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] 'affectedSoftware.name:"[SSH-SERVER-VENDOR] [SSH-SERVER-NAME]" AND affectedSoftware.version:"[SSH-SERVER-VERSION]"'
context_1   = { 'ssh-server': 'any|version_known' }

[check_cvedetails-lookup]
name        = cvedetails-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Cvedetails.com (requires product name+version)
tool        = cvedetails-lookup
command_1   = python3 cvedetails-lookup.py --vendor "[SSH-SERVER-VENDOR]" --product "[SSH-SERVER-NAME]" --version "[SSH-SERVER-VERSION]"
context_1   = { 'ssh-server': 'any|version_known' }


#########################################################################################
# Exploit
#########################################################################################
[check_user-enum-timing-attack]
name        = user-enum-timing-attack
category    = exploit
description = Try to perform OpenSSH (versions <= 7.2 and >= 5.*) user enumeration timing attack OpenSSH 
tool        = osueta
command_1   = python2.7 osueta.py -H [IP] -p [PORT] -L "[WORDLISTSDIR]/usernames/usernames-unix-default.txt" -v no
#context_1   = { 'auth_status': NO_AUTH }

[check_user-enum-cve2018-15473]
name        = user-enum-cve2018-15473
category    = exploit
description = Attempt to exploit OpenSSH <= 7.7 user enumeration (CVE-2018-15473)
# tool        = massh-enum
# command_1   = ./bin/massh-enum --hosts [IP] --port [PORT] --users "[WORDLISTSDIR]/usernames/usernames-unix-default.txt"
tool        = ssh-user-enum-cve-2018-15473
command_1   = python3 ssh-username-enum.py -p [PORT] -t 8 -v -w "[WORDLISTSDIR]/usernames/usernames-unix-short.txt" [IP]

[check_auth-bypass-libssh-cve2018-10933]
name        = auth-bypass-libssh-cve2018-10933
category    = exploit
description = Attempt authentication bypass (CVE-2018-10933) in libssh 0.6+ (fixed in 0.7.6 and 0.8.4)
tool        = libssh-scanner
command_1   = python2.7 libsshscan.py -p [PORT] -a [IP]


#########################################################################################
# Defaultcreds
#########################################################################################
[check_default-ssh-key]
name        = default-ssh-key
category    = defaultcreds
description = Try to authenticate on SSH server using known SSH keys
tool        = changeme
command_1   = python3 changeme.py -v --protocols ssh_key [IP]:[PORT]

[check_default-creds]
name        = default-creds
category    = defaultcreds
description = Check default/common credentials on SSH
# tool        = patator
# command_1   = python2.7 patator.py ssh_login host=[IP] port=[PORT] user=COMBO00 password=COMBO01 0=[WORDLISTSDIR]/services/ssh/ssh-default-combo-short.txt -x ignore:fgrep='failed'
# context_1   = { 'auth_status': NO_AUTH }
tool        = hydra
command_1   = hydra -C "[WORDLISTSDIR]/services/ssh/ssh-default-combo.txt" -s [PORT] -v -V -I [IP] ssh
#context_1   = { 'auth_status': NO_AUTH }
command_2   = hydra -L "[WORDLISTSDIR]/services/ssh/ssh-common-usernames.txt" -P "[WORDLISTSDIR]/services/ssh/ssh-common-passwords.txt" -s [PORT] -e nsr -v -V -I [IP] ssh


#########################################################################################
# Bruteforce
#########################################################################################
[check_bruteforce-creds]
name        = bruteforce-creds
category    = bruteforce
description = Bruteforce SSH accounts
tool        = hydra
# Run bruteforce only if no creds found/known
command_1   = hydra -L "[USERLIST default="services/ssh/ssh-usernames-short.txt"]" -P "[PASSLIST default="passwords/pass-short.txt"]" -s [PORT] -e nsr -v -V [IP] ssh
context_1   = { 'auth_status': NO_AUTH }
command_2   = hydra -l '[USERNAME]' -P "[PASSLIST default="passwords/pass-short.txt"]" -s [PORT] -e nsr -F -v -V [IP] ssh
context_2   = { 'auth_status': USER_ONLY }