SSH.java 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439
  1. package de.tudarmstadt.informatik.hostage.protocol;
  2. import java.math.BigInteger;
  3. import java.nio.ByteBuffer;
  4. import java.security.KeyFactory;
  5. import java.security.KeyPair;
  6. import java.security.KeyPairGenerator;
  7. import java.security.MessageDigest;
  8. import java.security.PublicKey;
  9. import java.security.Signature;
  10. import java.security.interfaces.DSAPublicKey;
  11. import java.util.ArrayList;
  12. import java.util.List;
  13. import java.security.SecureRandom;
  14. import javax.crypto.KeyAgreement;
  15. import javax.crypto.interfaces.DHPublicKey;
  16. import javax.crypto.spec.DHParameterSpec;
  17. import javax.crypto.spec.DHPublicKeySpec;
  18. import de.tudarmstadt.informatik.hostage.commons.HelperUtils;
  19. import de.tudarmstadt.informatik.hostage.wrapper.ByteArray;
  20. /**
  21. * SSH protocol.
  22. * @author Wulf Pfeiffer
  23. */
  24. public class SSH implements Protocol<ByteArray> {
  25. /**
  26. * Represents the states of the protocol.
  27. */
  28. private enum STATE {
  29. NONE,
  30. SERVER_VERSION,
  31. CLIENT_VERSION,
  32. KEX_INIT,
  33. CLOSED
  34. }
  35. /**
  36. * Denotes in which state the protocol is right now.
  37. */
  38. private STATE connectionState = STATE.NONE;
  39. /** Denotes in which state the protocol is right now */
  40. private STATE state = STATE.NONE;
  41. public int getPort() {
  42. return 22;
  43. }
  44. public TALK_FIRST whoTalksFirst() {
  45. return TALK_FIRST.SERVER;
  46. }
  47. public List<ByteArray> processMessage(ByteArray message) {
  48. List<ByteArray> response = new ArrayList<ByteArray>();
  49. byte[] request = null;
  50. if(message != null) request = message.get();
  51. switch(connectionState) {
  52. case NONE:
  53. response.add(new ByteArray(serverVersion + serverType + "\r\n"));
  54. connectionState = STATE.SERVER_VERSION;
  55. break;
  56. case SERVER_VERSION:
  57. extractType(request);
  58. extractCookie(request);
  59. response.add(new ByteArray(kexInit()));
  60. connectionState = STATE.CLIENT_VERSION;
  61. break;
  62. case CLIENT_VERSION:
  63. extractPubKey(request);
  64. response.add(new ByteArray(dhKexReply()));
  65. //FIXME signature in dhKexReply seems to be wrong
  66. response.add(new ByteArray(newKeys()));
  67. connectionState = STATE.KEX_INIT;
  68. break;
  69. case KEX_INIT:
  70. connectionState = STATE.CLOSED;
  71. break;
  72. case CLOSED:
  73. break;
  74. default:
  75. connectionState = STATE.CLOSED;
  76. break;
  77. }
  78. return response;
  79. }
  80. public boolean isClosed() {
  81. return (state == STATE.CLOSED);
  82. }
  83. public boolean isSecure() {
  84. return false;
  85. }
  86. public Class<ByteArray> getType() {
  87. return ByteArray.class;
  88. }
  89. public String toString() {
  90. return "SSH";
  91. }
  92. /**
  93. * Wraps the packets with packet length and padding.
  94. * @param packet content that is wrapped.
  95. * @return wrapped packet.
  96. */
  97. private byte[] wrapPacket(byte[] packet) {
  98. int packetLength = 5 + packet.length; //4 byte packet length, 1 byte padding length, payload length
  99. int paddingLengthCBS = cipherBlockSize - (packetLength % cipherBlockSize);
  100. int paddingLength8 = 8 - (packetLength % 8);
  101. int paddingLength = paddingLengthCBS > paddingLength8 ? paddingLengthCBS : paddingLength8;
  102. if(paddingLength < 4) paddingLength += cipherBlockSize;
  103. packetLength = packetLength + paddingLength - 4; //add padding string length to packet length
  104. byte[] packetLen = ByteBuffer.allocate(4).putInt(packetLength).array();
  105. byte[] paddingLen = {(byte) paddingLength};
  106. byte[] paddingString = new byte[paddingLength];
  107. for(int i = 0; i < paddingLength; i++) {
  108. SecureRandom rndm = new SecureRandom();
  109. paddingString[i] = (byte) rndm.nextInt(255);
  110. }
  111. return HelperUtils.concat(packetLen, paddingLen, packet, paddingString);
  112. }
  113. /**
  114. * Builds the Kex Init packet that contains all the allowed algorithms by the server.
  115. * @return Kex Init packet.
  116. */
  117. private byte[] kexInit() {
  118. byte[] msgCode = {0x14};
  119. I_S = randomBytes(16);
  120. byte[] kexLength = ByteBuffer.allocate(4).putInt(kex_alg.getBytes().length).array();
  121. byte[] serverLength = ByteBuffer.allocate(4).putInt(server_alg.getBytes().length).array();
  122. byte[] encrypt_c_Length = ByteBuffer.allocate(4).putInt(encrypt_alg_c.getBytes().length).array();
  123. byte[] encrypt_s_Length = ByteBuffer.allocate(4).putInt(encrypt_alg_s.getBytes().length).array();
  124. byte[] mac_c_Length = ByteBuffer.allocate(4).putInt(mac_alg_c.getBytes().length).array();
  125. byte[] mac_s_Length = ByteBuffer.allocate(4).putInt(mac_alg_s.getBytes().length).array();
  126. byte[] comp_c_Length = ByteBuffer.allocate(4).putInt(comp_alg_c.getBytes().length).array();
  127. byte[] comp_s_Length = ByteBuffer.allocate(4).putInt(comp_alg_s.getBytes().length).array();
  128. byte[] language_c_s = {0x00, 0x00, 0x00, 0x00};
  129. byte[] language_s_c = {0x00, 0x00, 0x00, 0x00};
  130. byte[] kexFirsPckt = {0x00};
  131. byte[] reserved = {0x00, 0x00, 0x00, 0x00};
  132. byte[] response = HelperUtils.concat(msgCode, I_S, kexLength, kex_alg.getBytes(), serverLength, server_alg.getBytes(),
  133. encrypt_c_Length, encrypt_alg_c.getBytes(), encrypt_s_Length, encrypt_alg_s.getBytes(), mac_c_Length, mac_alg_c.getBytes(),
  134. mac_s_Length, mac_alg_s.getBytes(), comp_c_Length, comp_alg_c.getBytes(), comp_s_Length, comp_alg_s.getBytes(),
  135. language_c_s, language_s_c, kexFirsPckt, reserved);
  136. return wrapPacket(response);
  137. }
  138. /**
  139. * Builds the Diffie-Hellman Kex Reply, containing the host key,f and the signature.
  140. * @return Diffie-Hellman Kex Reply packet.
  141. */
  142. private byte[] dhKexReply() {
  143. generateDHKeys();
  144. generateHostKey();
  145. generateSha1Hash();
  146. generateSignature();
  147. byte[] msgCode = {0x1f};
  148. byte[] hostKeyLength = ByteBuffer.allocate(4).putInt(K_S.length).array();
  149. byte[] fDHLength = ByteBuffer.allocate(4).putInt(f.length).array();
  150. byte[] signatureLength = ByteBuffer.allocate(4).putInt(sig.length).array();
  151. byte[] server_algLength = ByteBuffer.allocate(4).putInt(server_alg.getBytes().length).array();
  152. byte[] payloadLength = ByteBuffer.allocate(4).putInt(server_algLength.length + signatureLength.length + sig.length + server_alg.getBytes().length).array();
  153. byte[] response = HelperUtils.concat(msgCode, hostKeyLength, K_S,
  154. fDHLength, f, payloadLength, server_algLength, server_alg.getBytes(), signatureLength, sig);
  155. return wrapPacket(response);
  156. }
  157. /**
  158. * New Keys response.
  159. * @return New Keys response.
  160. */
  161. private byte[] newKeys() {
  162. byte[] msgCode = {0x15};
  163. return wrapPacket(msgCode);
  164. }
  165. /**
  166. * Generates the required Diffie-Hellman keys with p and g from Oakley Group 1.
  167. */
  168. private void generateDHKeys() {
  169. try {
  170. KeyPairGenerator myKpairGen = KeyPairGenerator.getInstance("DH");
  171. KeyAgreement myKeyAgree = KeyAgreement.getInstance("DH");
  172. BigInteger p = new BigInteger(this.p);
  173. BigInteger g = new BigInteger(this.g);
  174. BigInteger e = new BigInteger(this.e);
  175. DHParameterSpec dhParamSpec = new DHParameterSpec(p, g);
  176. myKpairGen.initialize(dhParamSpec);
  177. KeyPair myKpair = myKpairGen.generateKeyPair();
  178. myKeyAgree.init(myKpair.getPrivate());
  179. BigInteger f = ((DHPublicKey) (myKpair.getPublic())).getY();
  180. this.f = f.toByteArray();
  181. KeyFactory myKeyFac = KeyFactory.getInstance("DH");
  182. DHPublicKeySpec keySpec = new DHPublicKeySpec(e, p, g);
  183. PublicKey yourPubKey = myKeyFac.generatePublic(keySpec);
  184. myKeyAgree.doPhase(yourPubKey, true);
  185. byte[] mySharedSecret = myKeyAgree.generateSecret();
  186. k = mySharedSecret;
  187. } catch (Exception e) {
  188. e.printStackTrace();
  189. }
  190. }
  191. /**
  192. * Generates the Host Key based on the DSA algorithm
  193. */
  194. private void generateHostKey() {
  195. try {
  196. KeyPairGenerator generator = KeyPairGenerator.getInstance("DSA");
  197. dsa = generator.generateKeyPair();
  198. byte[] string = "ssh-dss".getBytes();
  199. byte[] stringLength = ByteBuffer.allocate(4).putInt(string.length).array();
  200. byte[] p = ((DSAPublicKey) dsa.getPublic()).getParams().getP().toByteArray();
  201. if(p[0] != 0x00) p = HelperUtils.concat(new byte[]{0x00}, p);
  202. byte[] pLength = ByteBuffer.allocate(4).putInt(p.length).array();
  203. byte[] q = ((DSAPublicKey) dsa.getPublic()).getParams().getQ().toByteArray();
  204. if(q[0] != 0x00) q = HelperUtils.concat(new byte[]{0x00}, q);
  205. byte[] qLength = ByteBuffer.allocate(4).putInt(q.length).array();
  206. byte[] g = ((DSAPublicKey) dsa.getPublic()).getParams().getG().toByteArray();
  207. if(g[0] != 0x00) g = HelperUtils.concat(new byte[]{0x00}, g);
  208. byte[] gLength = ByteBuffer.allocate(4).putInt(g.length).array();
  209. byte[] y = ((DSAPublicKey) dsa.getPublic()).getY().toByteArray();
  210. if(y[0] != 0x00) y = HelperUtils.concat(new byte[]{0x00}, y);
  211. byte[] yLength = ByteBuffer.allocate(4).putInt(y.length).array();
  212. K_S = HelperUtils.concat(stringLength, string, pLength, p, qLength, q, gLength, g, yLength, y);
  213. } catch (Exception e) {
  214. e.printStackTrace();
  215. }
  216. }
  217. /**
  218. * Generates the SHA-1 Hash from several values
  219. */
  220. private void generateSha1Hash() {
  221. try {
  222. MessageDigest sha = MessageDigest.getInstance("SHA-1");
  223. sha.update(V_C);
  224. sha.update(V_S);
  225. sha.update(I_C);
  226. sha.update(I_S);
  227. sha.update(K_S);
  228. sha.update(e);
  229. sha.update(f);
  230. sha.update(k);
  231. h = sha.digest();
  232. } catch (Exception e) {
  233. e.printStackTrace();
  234. }
  235. }
  236. /**
  237. * Generates the signature of the hash using DSA algorithm with SHA-1
  238. */
  239. private void generateSignature() {
  240. //FIXME something is wrong with this signature.. maybe one of the used components is generated wrong?!
  241. try {
  242. Signature sig = Signature.getInstance("SHA1withDSA");
  243. sig.initVerify(dsa.getPublic());
  244. sig.initSign(dsa.getPrivate());
  245. sig.update(h);
  246. this.sig = extractSignature(sig.sign());
  247. } catch (Exception e) {
  248. e.printStackTrace();
  249. }
  250. }
  251. /**
  252. * Extracts the type of the client
  253. * @param request containing the clients type
  254. */
  255. private void extractType(byte[] request) {
  256. int length = 0;
  257. for(int i = 8; i < request.length; i++, length++) { //start at 8 because "SSH-2.0-" is not part of type
  258. if(request[i] == 0x0d) break; //find the end of the type: '\r'
  259. }
  260. V_C = new byte[length];
  261. System.arraycopy(request, 8, V_C, 0, length);
  262. }
  263. /**
  264. * Extracts the cookie from the Kex Init client request
  265. * @param request containing the clients cookie
  266. */
  267. private void extractCookie(byte[] request) {
  268. int pos = 0;
  269. if(request[5] != 0x14) { //if type packet is in front of kex init
  270. pos = 1; //start behind the end of type message
  271. for(int i = 0; i < request.length; i++, pos++) {
  272. if(request[i] == 0x0a) break; //find end of type message: '\n'
  273. }
  274. }
  275. I_C = new byte[16];
  276. System.arraycopy(request, 6+pos, I_C, 0, 16); //srcLen: headersize+position after type packet
  277. }
  278. /**
  279. * Extracts the public key from the DH Kex Request
  280. * @param request containing the clients public key
  281. */
  282. private void extractPubKey(byte[] request) {
  283. e = new byte[byteToInt(new byte[] {request[6], request[7], request[8], request[9]})];
  284. for(int i = 0; i < e.length; i++) {
  285. e[i] = request[i+10];
  286. }
  287. }
  288. /**
  289. * Converts a byte[] to int
  290. * @param bytes that are converted
  291. * @return converted byte[] as int
  292. */
  293. private static int byteToInt(byte[] bytes) {
  294. int ret = 0;
  295. for (int i=0; i < bytes.length; i++) {
  296. ret <<= 8;
  297. ret |= bytes[i] & 0xFF;
  298. }
  299. return ret;
  300. }
  301. /**
  302. * Generates a random byte[] of a specified size
  303. * @param size of the byte[]
  304. * @return random byte[]
  305. */
  306. private byte[] randomBytes(int size) {
  307. byte[] bytes = new byte[size];
  308. SecureRandom rdm = new SecureRandom();
  309. rdm.nextBytes(bytes);
  310. return bytes;
  311. }
  312. /**
  313. * Extracts r and s from a DSA-signature
  314. * @param signature
  315. * @return r and s as byte[]
  316. */
  317. private byte[] extractSignature(byte[] signature) {
  318. int length = 0;
  319. int index = 3;
  320. length = signature[index++] & 0xff;
  321. byte[] r = new byte[length];
  322. System.arraycopy(signature, index, r, 0, r.length);
  323. index = index + length + 1;
  324. length = signature[index++] & 0xff;
  325. byte[] s = new byte[length];
  326. System.arraycopy(signature, index, s, 0, s.length);
  327. byte[] result = new byte[40];
  328. // result must be 40 bytes, but r and s may be longer than 20
  329. System.arraycopy(r,
  330. (r.length > 20) ? 1 : 0,
  331. result,
  332. (r.length > 20) ? 0 : 20 - r.length,
  333. (r.length > 20) ? 20 : r.length);
  334. System.arraycopy(s,
  335. (s.length > 20) ? 1 : 0,
  336. result,
  337. (s.length > 20) ? 20 : 40 - s.length,
  338. (s.length > 20) ? 20 : s.length);
  339. return result;
  340. }
  341. private String serverVersion = ProtocolSettings.getSshVersion();
  342. private String serverType = ProtocolSettings.getSshType();
  343. //Diffie-Hellman-Group-1 p and g
  344. private final byte[] p = {
  345. (byte)0x00,
  346. (byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,
  347. (byte)0xC9,(byte)0x0F,(byte)0xDA,(byte)0xA2,(byte)0x21,(byte)0x68,(byte)0xC2,(byte)0x34,
  348. (byte)0xC4,(byte)0xC6,(byte)0x62,(byte)0x8B,(byte)0x80,(byte)0xDC,(byte)0x1C,(byte)0xD1,
  349. (byte)0x29,(byte)0x02,(byte)0x4E,(byte)0x08,(byte)0x8A,(byte)0x67,(byte)0xCC,(byte)0x74,
  350. (byte)0x02,(byte)0x0B,(byte)0xBE,(byte)0xA6,(byte)0x3B,(byte)0x13,(byte)0x9B,(byte)0x22,
  351. (byte)0x51,(byte)0x4A,(byte)0x08,(byte)0x79,(byte)0x8E,(byte)0x34,(byte)0x04,(byte)0xDD,
  352. (byte)0xEF,(byte)0x95,(byte)0x19,(byte)0xB3,(byte)0xCD,(byte)0x3A,(byte)0x43,(byte)0x1B,
  353. (byte)0x30,(byte)0x2B,(byte)0x0A,(byte)0x6D,(byte)0xF2,(byte)0x5F,(byte)0x14,(byte)0x37,
  354. (byte)0x4F,(byte)0xE1,(byte)0x35,(byte)0x6D,(byte)0x6D,(byte)0x51,(byte)0xC2,(byte)0x45,
  355. (byte)0xE4,(byte)0x85,(byte)0xB5,(byte)0x76,(byte)0x62,(byte)0x5E,(byte)0x7E,(byte)0xC6,
  356. (byte)0xF4,(byte)0x4C,(byte)0x42,(byte)0xE9,(byte)0xA6,(byte)0x37,(byte)0xED,(byte)0x6B,
  357. (byte)0x0B,(byte)0xFF,(byte)0x5C,(byte)0xB6,(byte)0xF4,(byte)0x06,(byte)0xB7,(byte)0xED,
  358. (byte)0xEE,(byte)0x38,(byte)0x6B,(byte)0xFB,(byte)0x5A,(byte)0x89,(byte)0x9F,(byte)0xA5,
  359. (byte)0xAE,(byte)0x9F,(byte)0x24,(byte)0x11,(byte)0x7C,(byte)0x4B,(byte)0x1F,(byte)0xE6,
  360. (byte)0x49,(byte)0x28,(byte)0x66,(byte)0x51,(byte)0xEC,(byte)0xE6,(byte)0x53,(byte)0x81,
  361. (byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF,(byte)0xFF
  362. };
  363. private final byte[] g = {0x02};
  364. //SSH Parameters for Kex etc.
  365. private byte[] V_S = serverType.getBytes();
  366. private byte[] V_C;
  367. private byte[] I_S;
  368. private byte[] I_C;
  369. private byte[] e;
  370. private byte[] f;
  371. private byte[] k;
  372. private byte[] h;
  373. private byte[] K_S;
  374. private byte[] sig;
  375. //Keys for signature
  376. private KeyPair dsa;
  377. //allowed algorithms for kexinit
  378. private String kex_alg = "diffie-hellman-group1-sha1";
  379. private String server_alg = "ssh-dss";
  380. private String encrypt_alg_c = "aes128-ctr";
  381. private String encrypt_alg_s = "aes128-ctr";
  382. private String mac_alg_c = "hmac-sha1";
  383. private String mac_alg_s = "hmac-sha1";
  384. private String comp_alg_c = "none";
  385. private String comp_alg_s = "none";
  386. private int cipherBlockSize = 16;
  387. }