About
This tool establishes SSH connections to a server, thereby enumerating through various client configurations, in order to determine whether the server allows a Diffie-Hellman (DH) key exchange based on a weak group. We hope that our tool will be useful to check SSH servers for weak DH key exchange configurations.
Note that this tool tests a limited number of configurations and therefore potentially fails to detect some weak configurations. Moreover, the server possibly blocks connections before the scan completes.
For further information about our tool, visit https://www.aon.com/cyber-solutions/aon_cyber_labs/ssh-weak-diffie-hellman-group-identification-tool/.
Consult the Logjam info page for suggestions on how to configure SSH servers to protect them as well as their clients from attacks exploiting DH key exchanges using a weak group.
Installation
Install docker and execute the following command:
docker build -t ssh-weak-dh .
Usage
Run the following commands:
docker run --rm -v "$(pwd)/logs/":/logs/ ssh-weak-dh hostname [port]
where hostname
is the host name or IP address of the SSH server to scan. The
optional argument port
allows you to specify the port on which the SSH server
listens. If the argument is not specified, it will default to 22
.
The scan results are printed on stdout.
More detailed results can be found in the ./logs/
directory under the
subfolder whose name has the form hostname-port
where hostname
and port
are the corresponding command line parameters.
The scan tool calls the script ssh-weak-dh-analyze.py
to analyze the scan
results stored in the aforementioned subfolder. This analysis script is a
standalone tool.
For example, run the following command to analyze the results of a scan of the SSH server running on port 22 on scanme.example.com inside a container shell:
docker run --rm -v "$(pwd)/logs/":/logs/ -it --entrypoint bash ssh-weak-dh
python3 -u ssh-weak-dh-analyze.py /logs/scanme.example.com-22/
It is also possible to run the scan script inside a container shell as follows:
docker run --rm -v "$(pwd)/logs/":/logs/ -it --entrypoint bash ssh-weak-dh
./ssh-weak-dh-test.sh hostname [port]
where hostname
and port
are the scanner arguments as explained before.
Copyright
Fabian Foerg, Gotham Digital Science, 2015-2023