Browse Source

Fixed some SSH issues (signature still not working though)

qam 10 years ago
parent
commit
da5eb99ebc
1 changed files with 47 additions and 29 deletions
  1. 47 29
      src/de/tudarmstadt/informatik/hostage/protocol/SSH.java

+ 47 - 29
src/de/tudarmstadt/informatik/hostage/protocol/SSH.java

@@ -31,8 +31,8 @@ public final class SSH implements Protocol<ByteArray> {
 	 */
 	private enum STATE {
 		NONE,
-		SRVR_VERSION,
-		CLNT_VERSION,
+		SERVER_VERSION,
+		CLIENT_VERSION,
 		KEX_INIT,
 		DH_KEX_REP,
 		CLOSED
@@ -108,32 +108,33 @@ public final class SSH implements Protocol<ByteArray> {
 	public List<ByteArray> processMessage(ByteArray message) {
 		List<ByteArray> response = new ArrayList<ByteArray>();
 		byte[] request = null;
-		if(message != null) request = message.get();
+		if(message != null) {
+			request = message.get();
+			System.out.println("AWDLWDAO:   "+message.size());
+		}
 		
 		switch(connectionState) {
 		case NONE:			
 			response.add(new ByteArray(serverVersion + serverType + "\r\n"));
+			connectionState = STATE.SERVER_VERSION;
+			System.out.println("NONE");
+			break;
+		case SERVER_VERSION:
+			extractType(request);
+			extractCookie(request);
 			response.add(new ByteArray(kexInit()));
-			connectionState = STATE.SRVR_VERSION;
+			connectionState = STATE.KEX_INIT;
+			System.out.println("SERVER");
 			break;
-		case SRVR_VERSION:
-			if(request != null && request.length >= 8) {
-				extractType(request);
-				connectionState = STATE.CLNT_VERSION;
-			}
-			break;
-		case CLNT_VERSION:
-			if(request != null && request.length > 5 && request[5] == 0x14) {
-				extractCookie(request);
-				connectionState = STATE.KEX_INIT;
-			}
+		case CLIENT_VERSION:
+			connectionState = STATE.KEX_INIT;
+			System.out.println("CLIENT");
 			break;
 		case KEX_INIT:
-			if(request.length > 5 && request[5] == 0x1e) {
-				extractPubKey(request);
-				response.add(new ByteArray(dhKexReply()));
-				connectionState = STATE.DH_KEX_REP;
-			}
+			extractPubKey(request);
+			response.add(new ByteArray(dhKexReply()));
+			connectionState = STATE.DH_KEX_REP;
+			System.out.println("KEX");
 			break;
 		case DH_KEX_REP:
 			connectionState = STATE.CLOSED;
@@ -344,11 +345,12 @@ public final class SSH implements Protocol<ByteArray> {
 	 * @param request containing the clients type
 	 */
 	private void extractType(byte[] request) {
-		V_C = new byte[request.length - 10];
-		for(int i = 0; i < V_C.length; i++) {
-			if(request[i] == 0x0d) break;
-			V_C[i] = request[i+8];
+		int length = 0;
+		for(int i = 8; i < request.length; i++, length++) { 	//start at 8 because "SSH-2.0-" is not part of type
+			if(request[i] == 0x0d) break;			//find the end of the type: '\r'
 		}
+		V_C = new byte[length];
+		System.arraycopy(request, 8, V_C, 0, length);
 	}
 	
 	/**
@@ -356,10 +358,15 @@ public final class SSH implements Protocol<ByteArray> {
 	 * @param request containing the clients cookie
 	 */
 	private void extractCookie(byte[] request) {
-		I_C = new byte[16];
-		for(int i = 0; i < I_C.length; i++) {
-			I_C[i] = request[i+6];
+		int pos = 0;
+		if(request[5] != 0x14) {	//if type packet is in front of kex init
+			pos = 1;				//start behind the end of type message
+			for(int i = 0; i < request.length; i++, pos++) {
+				if(request[i] == 0x0a) break;		//find end of type message: '\n'
+			}
 		}
+		I_C = new byte[16];
+		System.arraycopy(request, 6+pos, I_C, 0, 16); //srcLen: headersize+position after type packet
 	}
 	
 	/**
@@ -429,6 +436,17 @@ public final class SSH implements Protocol<ByteArray> {
                          (s.length > 20) ? 20 : s.length);
         return result;
     }
-
-
+	
+	
+	public static String bytesToHex(byte[] bytes) {
+		final char[] hexArray = "0123456789ABCDEF".toCharArray();
+	    char[] hexChars = new char[bytes.length * 2];
+	    int v;
+	    for ( int j = 0; j < bytes.length; j++ ) {
+	        v = bytes[j] & 0xFF;
+	        hexChars[j * 2] = hexArray[v >>> 4];
+	        hexChars[j * 2 + 1] = hexArray[v & 0x0F];
+	    }
+	    return new String(hexChars);
+	}
 }