-
Notifications
You must be signed in to change notification settings - Fork 10
/
fake_ssh.py
executable file
·189 lines (162 loc) · 6.1 KB
/
fake_ssh.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
#!/usr/bin/env python
"""Fake SSH Server Utilizing Paramiko"""
import argparse
import threading
import socket
import sys
import traceback
import paramiko
LOG = open("logs/log.txt", "a")
HOST_KEY = paramiko.RSAKey(filename='keys/private.key')
SSH_BANNER = "SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.3"
def handle_cmd(cmd, chan):
"""Branching statements to handle and prepare a response for a command"""
response = ""
if cmd.startswith("sudo"):
send_ascii("sudo.txt", chan)
return
elif cmd.startswith("ls"):
response = "pw.txt"
elif cmd.startswith("version"):
response = "Super Amazing Awesome (tm) Shell v1.1"
elif cmd.startswith("pwd"):
response = "/home/clippy"
elif cmd.startswith("cd"):
send_ascii("cd.txt", chan)
return
elif cmd.startswith("cat"):
send_ascii("cat.txt", chan)
return
elif cmd.startswith("rm"):
send_ascii("bomb.txt", chan)
response = "You blew up our files! How could you???"
elif cmd.startswith("whoami"):
send_ascii("wizard.txt", chan)
response = "You are a wizard of the internet!"
elif ".exe" in cmd:
response = "Hmm, trying to access .exe files from an ssh terminal..... Your methods are unconventional"
elif cmd.startswith("cmd"):
response = "Command Prompt? We only use respectable shells on this machine.... Sorry"
elif cmd == "help":
send_ascii("help.txt", chan)
return
else:
send_ascii("clippy.txt", chan)
response = "Use the 'help' command to view available commands"
LOG.write(response + "\n")
LOG.flush()
chan.send(response + "\r\n")
def send_ascii(filename, chan):
"""Print ascii from a file and send it to the channel"""
with open('ascii/{}'.format(filename)) as text:
chan.send("\r")
for line in enumerate(text):
LOG.write(line[1])
chan.send(line[1] + "\r")
LOG.flush()
class FakeSshServer(paramiko.ServerInterface):
"""Settings for paramiko server interface"""
def __init__(self):
self.event = threading.Event()
def check_channel_request(self, kind, chanid):
if kind == 'session':
return paramiko.OPEN_SUCCEEDED
return paramiko.OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED
def check_auth_password(self, username, password):
# Accept all passwords as valid by default
return paramiko.AUTH_SUCCESSFUL
def get_allowed_auths(self, username):
return 'password'
def check_channel_shell_request(self, channel):
self.event.set()
return True
def check_channel_pty_request(self, channel, term, width, height, pixelwidth, pixelheight, modes):
return True
def handle_connection(client, addr):
"""Handle a new ssh connection"""
LOG.write("\n\nConnection from: " + addr[0] + "\n")
print('Got a connection!')
try:
transport = paramiko.Transport(client)
transport.add_server_key(HOST_KEY)
# Change banner to appear legit on nmap (or other network) scans
transport.local_version = SSH_BANNER
server = FakeSshServer()
try:
transport.start_server(server=server)
except paramiko.SSHException:
print('*** SSH negotiation failed.')
raise Exception("SSH negotiation failed")
# wait for auth
chan = transport.accept(20)
if chan is None:
print('*** No channel.')
raise Exception("No channel")
server.event.wait(10)
if not server.event.is_set():
print('*** Client never asked for a shell.')
raise Exception("No shell request")
try:
chan.send("Welcome to the my control server\r\n\r\n")
run = True
while run:
chan.send("$ ")
command = ""
while not command.endswith("\r"):
transport = chan.recv(1024)
# Echo input to psuedo-simulate a basic terminal
chan.send(transport)
command += transport.decode("utf-8")
chan.send("\r\n")
command = command.rstrip()
LOG.write("$ " + command + "\n")
print(command)
if command == "exit":
run = False
else:
handle_cmd(command, chan)
except Exception as err:
print('!!! Exception: {}: {}'.format(err.__class__, err))
traceback.print_exc()
try:
transport.close()
except Exception:
pass
chan.close()
except Exception as err:
print('!!! Exception: {}: {}'.format(err.__class__, err))
traceback.print_exc()
try:
transport.close()
except Exception:
pass
def start_server(port, bind):
"""Init and run the ssh server"""
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock.bind((bind, port))
except Exception as err:
print('*** Bind failed: {}'.format(err))
traceback.print_exc()
sys.exit(1)
threads = []
while True:
try:
sock.listen(100)
print('Listening for connection ...')
client, addr = sock.accept()
except Exception as err:
print('*** Listen/accept failed: {}'.format(err))
traceback.print_exc()
new_thread = threading.Thread(target=handle_connection, args=(client, addr))
new_thread.start()
threads.append(new_thread)
for thread in threads:
thread.join()
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='Run a fake ssh server')
parser.add_argument("--port", "-p", help="The port to bind the ssh server to (default 22)", default=22, type=int, action="store")
parser.add_argument("--bind", "-b", help="The address to bind the ssh server to", default="", type=str, action="store")
args = parser.parse_args()
start_server(args.port, args.bind)