runzeroinc/sshambleHerramienta de investigación que escanea servicios SSH en busca de omisiones de autenticación, fugas de temporización, claves débiles y exposiciones posteriores a la sesión, con salida y análisis en JSON.
SSHamble es una herramienta de investigación para implementaciones de SSH que incluye:
Este proyecto está en desarrollo y es probable que cambie rápidamente.
Puedes contactar con nuestro equipo a través de research[α𝓽]runZero.com.
Los binarios están disponibles en la página de releases.
(Nota: en MacOS, probablemente tendrás que desactivar Gatekeeper para este binario, con sudo xattr -rd com.apple.quarantine ./sshamble. Esto no es una invitación a violar la política de seguridad del propietario de tus activos.)
Para compilar SSHamble desde el código fuente, asegúrate de tener instalada una versión reciente de Go (1.27.1+).
Puedes usar Go para instalar un binario en el directorio bin de tu GOPATH.
Si usas macOS, es posible que encuentres errores en tiempo de ejecución a menos que desactives CGO antes de compilar:
$ export CGO_ENABLED=0
$ go install github.com/runZeroInc/sshamble@latest
Para compilar desde el código fuente localmente:
$ git clone https://github.com/runZeroInc/sshamble
$ cd sshamble
$ go build -o sshamble
$ ./sshamble -h
Para habilitar el soporte de badkeys, ejecuta sshamble badkeys-update primero y luego escanea.
$ git clone https://github.com/runZeroInc/sshamble
$ cd sshamble
$ go generate ./...
$ go build -o sshamble
$ ./sshamble badkeys-update
$ ./sshamble -h
▀██▄ ▀███████████████████████████████████████████████████████████████████████████████████████████
▀██▄
▀██▄ ▄████████ ▄████████ ██ ██ ▄███████▄ ▄████████▄ ████████▄ ██ ▄███████
▀██▄ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
███ ▀███████▄ ▀███████▄ █████████ █████████ ██ ██ ██ █████████ ██ ████████
▄██▀ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
▄██▀ ████████▀ ████████▀ ██ ██ ██ ██ ██ ██ ██ ████████▀ ▀██████ ▀███████
▄██▀
▄██▀ ▄███████████████████████████████████████████████████████████████████████████████████████████
Una herramienta de exploración para servicios de shell (in)seguros.
Inicia un escaneo de red usando:
$ ./sshamble scan -o results.jsonl 192.168.0.0/24
Analiza los resultados usando:
$ ./sshamble analyze -o results-directory results.jsonl
Usage:
sshamble [command]
Available Commands:
analyze Analyzes a scan JSON output file and buckets results
badkeys-update Updates the badkeys.info blocklist cache.
help Help about any command
scan Enumerates a set of targets for SSH capabilities and exposures
Flags:
-h, --help help for sshamble
Use "sshamble [command] --help" for more information about a command.
$ ./sshamble scan -h
Enumerates a set of targets for SSH capabilities and exposures
Usage:
sshamble scan [-p 22] [-u root,admin] [-o scan.jsonl] [-l scan.log] [--log-level trace] 192.168.0.0/24 ... [flags]
Flags:
--categories string The list of categories to include. (default "bypass,gssapi,hostkey,keyboard,password,pubkey,userenum,vuln")
--checks string The list of checks to run. Non-default ("userenum-none-timing,userenum-password-timing,userenum-pubkey-timing,vuln-exec-skip-auth,vuln-exec-skip-userauth") (default "badkeys-blocklist,gssapi-any,keyboard-any,keyboard-empty,keyboard-null,keyboard-user,password-any,password-change-empty,password-change-null,password-empty,password-null,password-user,pubkey-any,pubkey-bulkhalf,pubkey-hunt,pubkey-user,skip-auth,skip-auth-method-empty,skip-auth-method-null,skip-auth-none,skip-auth-pubkeyany,skip-auth-success,skip-ssh-userauth,vuln-generic-env,vuln-gogs-env,vuln-ruckus-password-escape,vuln-softserve-env,vuln-tcp-forward")
--client-version string The client version string to send (default "OpenSSH_9.8p1")
--config string config file (default is $HOME/.sshamble.json)
-h, --help help for scan
-i, --input-targets string The optional file to read targets from
-I, --interact string Open an interactive shell for the 'first', 'all', or 'none' sessions (default "none")
--interact-auto string A comma-separated set of commands to run in the interactive session (default "pty,shell")
-l, --log string The file to write logs to (default is stderr) (default "-")
-L, --log-level string The log level to write (trace,debug,info,warn,error) (default "info")
-m, --max-connections uint The maximum number of concurrent connections (default 5000)
--one-session-only Only open one session per target
-o, --output string The destination file for JSON output (default "stdout")
--password string An optional password to try for authentication
--password-file string An optional file with clear-text passwords to try for authentication
-p, --ports string The list of ports to check when not specified with the target (comma-separated) (default "22")
--pprof string Start a Go pprof debug listener on the provided port
--private-key string The optional file containing a private key for authentication
--private-key-passphrase string The optional passphrase for a private key file
--pubkey-bulk-limit uint The number of pubkey half-auths to test for max attempts (default 10)
--pubkey-hunt-conn-limit uint The number of public keys to test in each connection (default 250000)
--pubkey-hunt-file string The optional file containing public keys to hunt
--retries uint The retry count for subsequent failed connections after an initial success (default 2)
--session-poke string A byte sequence sent to sessions to elicit further responses (hex or ascii) (default "\\x0a\\x0d\\r\\n")
--skip-versions string A regular expression of SSH versions to skip (ex: '(?i)openssh|dropbear)'
--timeout uint The number of seconds to wait for a target to respond (default 5)
--userenum-max-per-session-count uint The maximum number of authentication atempts per session (default 1023)
--userenum-test-count uint The number of tests to apply during username enumeration (default 2500)
-u, --users string The list of usernames to test on each target (comma-separated) (default "root")