diff --git a/src/ssh_audit/dheat.py b/src/ssh_audit/dheat.py index 9d4c969..616e69f 100644 --- a/src/ssh_audit/dheat.py +++ b/src/ssh_audit/dheat.py @@ -194,7 +194,9 @@ class DHEat: self.num_connect_timeouts = 0 self.num_read_timeouts = 0 self.num_socket_exceptions = 0 - self.num_openssh_throttled_connections = 0 + self.num_em = 0 # Number of "Exceeded MaxStartups" messages. + self.num_naatt = 0 # Number of "No allowed at this time" messages. + self.num_invalid_banners = 0 # The time we started the attack. self.start_timer = 0.0 @@ -351,10 +353,10 @@ class DHEat: rate_str = "" if aconf.conn_rate_test_target_rate > 0: - rate_str = " at a max rate of %s%u%s connections per second" % (DHEat.WHITEB, aconf.conn_rate_test_target_rate, DHEat.CLEAR) + rate_str = f" at a max rate of {DHEat.WHITEB}{aconf.conn_rate_test_target_rate:d}{DHEat.CLEAR} connections per second" print() - print("Performing non-disruptive rate test against %s[%s]:%u%s with %s%u%s concurrent sockets%s. No Diffie-Hellman requests will be sent." % (DHEat.WHITEB, target_ip_address, aconf.port, DHEat.CLEAR, DHEat.WHITEB, concurrent_sockets, DHEat.CLEAR, rate_str)) + print(f"Performing non-disruptive rate test against {DHEat.WHITEB}[{target_ip_address}]:{aconf.port:d}{DHEat.CLEAR} with {DHEat.WHITEB}{concurrent_sockets:d}{DHEat.CLEAR} concurrent sockets{rate_str}. No Diffie-Hellman requests will be sent.\n") print() # Make room for the multi-line output. @@ -369,14 +371,17 @@ class DHEat: server_dh_kex.append(server_kex) if len(server_dh_kex) == 0: - out.d("Skipping DHEat.dh_rate_test() since server does not support any DH algorithms: [%s]" % ", ".join(kex.kex_algorithms)) + kex_list = ", ".join(kex.kex_algorithms) + out.d(f"Skipping DHEat.dh_rate_test() since server does not support any DH algorithms: [{kex_list}]") return "" else: - out.d("DHEat.dh_rate_test(): starting test; parameters: %f seconds, %u max connections, %u concurrent sockets." % (max_time, max_connections, concurrent_sockets), write_now=True) + out.d(f"DHEat.dh_rate_test(): starting test; parameters: {max_time:,.1f} seconds, {max_connections:,d} max connections, {concurrent_sockets:,d} concurrent sockets.", write_now=True) num_attempted_connections = 0 num_opened_connections = 0 - num_exceeded_maxstartups = 0 + num_em = 0 # Number of "Exceeded MaxStartups" messages. + num_naatt = 0 # Number of "Not available at this time" messages. + num_invalid_banners = 0 socket_dict: Dict[socket.socket, float] = {} start_timer = time.time() now = start_timer @@ -395,13 +400,15 @@ class DHEat: if (now - last_update) >= 1.0: seconds_running = now - start_timer if multiline_output: - print("\033[5ARun time: %s%.1f%s seconds" % (DHEat.WHITEB, seconds_running, DHEat.CLEAR)) - print("TCP SYNs: %s%u%s (total); %s%.1f%s (per second)" % (DHEat.WHITEB, num_attempted_connections, DHEat.CLEAR, DHEat.BLUEB, num_attempted_connections / seconds_running, DHEat.CLEAR)) - print("Completed connections: %s%u%s (total); %s%.1f%s (per second)" % (DHEat.WHITEB, num_opened_connections, DHEat.CLEAR, DHEat.BLUEB, num_opened_connections / seconds_running, DHEat.CLEAR)) - print("\"Exceeded MaxStartups\" responses: %s%u%s (total); %s%.1f%s (per second)" % (DHEat.WHITEB, num_exceeded_maxstartups, DHEat.CLEAR, DHEat.BLUEB, num_exceeded_maxstartups / seconds_running, DHEat.CLEAR)) - print("%s%s%s" % (DHEat.WHITEB, spinner[spinner_index], DHEat.CLEAR)) + print(f"\033[7A Run time: {DHEat.WHITEB}{seconds_running:,.1f}{DHEat.CLEAR} seconds") + print(f" TCP SYNs: {DHEat.WHITEB}{num_attempted_connections / seconds_running:,.1f}/sec{DHEat.CLEAR}; {DHEat.WHITEB}{num_attempted_connections:,d}{DHEat.CLEAR} total ") + print(f" Completed connections: {DHEat.WHITEB}{num_opened_connections / seconds_running:,.1f}/sec{DHEat.CLEAR}; {DHEat.WHITEB}{num_opened_connections:,d}{DHEat.CLEAR} total ") + print(f" \"Exceeded MaxStartups\" responses: {DHEat.WHITEB}{num_em / seconds_running:,.1f}/sec{DHEat.CLEAR}; {DHEat.WHITEB}{num_em:,d}{DHEat.CLEAR} total ") + print(f"\"Not allowed at this time\" responses: {DHEat.WHITEB}{num_naatt / seconds_running:,.1f}/sec{DHEat.CLEAR}; {DHEat.WHITEB}{num_naatt:,d}{DHEat.CLEAR} total ") + print(f" Invalid banners: {DHEat.WHITEB}{num_invalid_banners / seconds_running:,.1f}/sec{DHEat.CLEAR}; {DHEat.WHITEB}{num_invalid_banners:,d}{DHEat.CLEAR} total ") + print(DHEat.WHITEB + spinner[spinner_index] + DHEat.CLEAR) else: - print("%s%s%s Run time: %s%.1f%s; TCP SYNs: %s%u%s; Compl. conns: %s%u%s; TCP SYNs/sec: %s%.1f%s; Compl. conns/sec: %s%.1f%s \r" % (DHEat.WHITEB, spinner[spinner_index], DHEat.CLEAR, DHEat.WHITEB, seconds_running, DHEat.CLEAR, DHEat.WHITEB, num_attempted_connections, DHEat.CLEAR, DHEat.WHITEB, num_opened_connections, DHEat.CLEAR, DHEat.BLUEB, num_attempted_connections / seconds_running, DHEat.CLEAR, DHEat.BLUEB, num_opened_connections / seconds_running, DHEat.CLEAR), end="") + print(f"{DHEat.WHITEB}{spinner[spinner_index]}{DHEat.CLEAR} Run time: {DHEat.WHITEB}{seconds_running:,.1f}{DHEat.CLEAR}; TCP SYNs: {DHEat.WHITEB}{num_attempted_connections:,d}{DHEat.CLEAR}; Compl. conns: {DHEat.WHITEB}{num_opened_connections:,d}{DHEat.CLEAR}; TCP SYNs/sec: {DHEat.BLUEB}{num_attempted_connections / seconds_running:,.1f}{DHEat.CLEAR}; Compl. conns/sec: {DHEat.BLUEB}{num_opened_connections / seconds_running:,.1f}{DHEat.CLEAR} \r", end="") last_update = now spinner_index = (spinner_index + 1) % 4 @@ -467,8 +474,14 @@ class DHEat: num_opened_connections += 1 # out.d("Number of opened connections: %u (max: %u)." % (num_opened_connections, max_connections)) elif buf == b"Exceeded": - num_exceeded_maxstartups += 1 + num_em += 1 # out.d("Number of \"Exceeded MaxStartups\": %u" % num_exceeded_maxstartups) + elif buf == b"Not allo": + num_naatt += 1 + # out.d("Number of \"Not allowed at this time\": {num_naatt:,d}") + else: + num_invalid_banners += 1 + # out.d("Number of invalid banners: {num_invalid_banners:,d}") _close_socket(socket_dict, s) @@ -720,35 +733,39 @@ class DHEat: # Print extensive statistics on what just happened. seconds_running = time.time() - self.start_timer print("\n\n") - print(" %s %sSTATISTICS%s %s" % (self.BAR_CHART, self.WHITEB, self.CLEAR, self.CHART_UPWARDS)) - print(" %s----------%s" % (self.WHITEB, self.CLEAR)) + print(f" {self.BAR_CHART} {self.WHITEB}STATISTICS{self.CLEAR} {self.CHART_UPWARDS}") + print(f" {self.WHITEB}----------{self.CLEAR}") print() - print(" Run time: %s%.1f seconds%s" % (self.WHITEB, seconds_running, self.CLEAR)) + print(f" Run time: {self.WHITEB}{seconds_running:,.1f} seconds{self.CLEAR}") print() - print(" Attempted TCP connections: %s%.1f/sec, %u total%s" % (self.WHITEB, self.num_attempted_tcp_connections / seconds_running, self.num_attempted_tcp_connections, self.CLEAR)) - print(" Successful TCP connections: %s%.1f/sec, %u total%s" % (self.WHITEB, self.num_successful_tcp_connections / seconds_running, self.num_successful_tcp_connections, self.CLEAR)) + print(f" Attempted TCP connections: {self.WHITEB}{self.num_attempted_tcp_connections / seconds_running:,.1f}/sec, {self.num_attempted_tcp_connections:,d} total{self.CLEAR}") + print(f" Successful TCP connections: {self.WHITEB}{self.num_successful_tcp_connections / seconds_running:,.1f}/sec, {self.num_successful_tcp_connections:,d} total{self.CLEAR}") print() - print(" Bytes written: %s%s/sec, %s total%s" % (self.WHITEB, DHEat.add_byte_units(self.num_bytes_written / seconds_running), DHEat.add_byte_units(self.num_bytes_written), self.CLEAR)) + print(f" Bytes written: {self.WHITEB}{DHEat.add_byte_units(self.num_bytes_written / seconds_running)}/sec, {DHEat.add_byte_units(self.num_bytes_written)} total{self.CLEAR}") print() - print(" Successful DH KEX replies: %s%.1f/sec, %u total%s" % (self.WHITEB, self.num_successful_dh_kex / seconds_running, self.num_successful_dh_kex, self.CLEAR)) - print(" Unexpected DH KEX replies: %s%.1f/sec, %u total%s" % (self.WHITEB, self.num_failed_dh_kex / seconds_running, self.num_failed_dh_kex, self.CLEAR)) - print("\"Exceeded MaxStartups\" replies*: %s%.1f/sec, %u total%s" % (self.WHITEB, self.num_openssh_throttled_connections / seconds_running, self.num_openssh_throttled_connections, self.CLEAR)) + print(f" Successful DH KEX replies: {self.WHITEB}{self.num_successful_dh_kex / seconds_running:,.1f}/sec, {self.num_successful_dh_kex:,d} total{self.CLEAR}") + print(f" Unexpected DH KEX replies: {self.WHITEB}{self.num_failed_dh_kex / seconds_running:,.1f}/sec, {self.num_failed_dh_kex:,d} total{self.CLEAR}") + print(f" \"Exceeded MaxStartups\" replies*: {self.WHITEB}{self.num_em / seconds_running:,.1f}/sec, {self.num_em:,d} total{self.CLEAR}") + print(f"\"Not allowed at this time\" replies+: {self.WHITEB}{self.num_naatt / seconds_running:,.1f}/sec, {self.num_naatt:,d} total{self.CLEAR}") + print(f" Invalid banners: {self.WHITEB}{self.num_invalid_banners / seconds_running:,.1f}/sec, {self.num_invalid_banners:,.1f} total{self.CLEAR}") print() - print(" Connection timeouts: %s%.1f/sec, %u total%s (timeout setting: %.1f sec)" % (self.WHITEB, self.num_connect_timeouts / seconds_running, self.num_connect_timeouts, self.CLEAR, self.connect_timeout)) - print(" Read timeouts: %s%.1f/sec, %u total%s (timeout setting: %.1f sec)" % (self.WHITEB, self.num_read_timeouts / seconds_running, self.num_read_timeouts, self.CLEAR, self.read_timeout)) - print(" Socket exceptions: %s%.1f/sec, %u total%s" % (self.WHITEB, self.num_socket_exceptions / seconds_running, self.num_socket_exceptions, self.CLEAR)) + print(f" Connection timeouts: {self.WHITEB}{self.num_connect_timeouts / seconds_running:,.1f}/sec, {self.num_connect_timeouts:,d} total{self.CLEAR} (timeout setting: {self.connect_timeout:,.1f} sec)") + print(f" Read timeouts: {self.WHITEB}{self.num_read_timeouts / seconds_running:,.1f}/sec, {self.num_read_timeouts:,d} total{self.CLEAR} (timeout setting: {self.read_timeout:,.1f} sec)") + print(f" Socket exceptions: {self.WHITEB}{self.num_socket_exceptions / seconds_running:,.1f}/sec, {self.num_socket_exceptions:,d} total{self.CLEAR}") print() if seconds_running < 5.0: - print("%sTotal run time was under 5 seconds; try running it for longer to get more accurate analysis.%s" % (DHEat.YELLOWB, DHEat.CLEAR)) + print(f"{DHEat.YELLOWB}Total run time was under 5 seconds; try running it for longer to get more accurate analysis.{DHEat.CLEAR}") elif self.num_successful_tcp_connections / seconds_running < DHEat.MAX_SAFE_RATE: - print("Because the number of successful TCP connections per second (%.1f) is less than %.1f, it appears that the target %sis using rate limiting%s to prevent CPU exaustion." % (self.num_successful_tcp_connections / seconds_running, DHEat.MAX_SAFE_RATE, DHEat.GREENB, DHEat.CLEAR)) + print(f"Because the number of successful TCP connections per second ({self.num_successful_tcp_connections / seconds_running:,.1f}) is less than {DHEat.MAX_SAFE_RATE:,.1f}, it appears that the target {DHEat.GREENB}is using rate limiting{DHEat.CLEAR} to prevent CPU exaustion.") else: - print("Because the number of successful TCP connections per second (%.1f) is greater than %.1f, it appears that the target %sis NOT using rate limiting%s to prevent CPU exaustion." % (self.num_successful_tcp_connections / seconds_running, DHEat.MAX_SAFE_RATE, DHEat.REDB, DHEat.CLEAR)) + print(f"Because the number of successful TCP connections per second ({self.num_successful_tcp_connections / seconds_running:,.1f}) is greater than {DHEat.MAX_SAFE_RATE:,.1f}, it appears that the target {DHEat.REDB}is NOT using rate limiting{DHEat.CLEAR} to prevent CPU exaustion.") print() print() - print(" * OpenSSH has a throttling mechanism (controlled by the MaxStartups directive) to prevent too many pre-authentication connections from overwhelming the server. When triggered, the server will probabilistically return \"Exceeded MaxStartups\" instead of the usual SSH banner, then terminate the connection. In order to maximize the DoS effectiveness, this metric should be greater than zero, though the ideal rate of rejections depends on the target server's CPU resources.") + print(" [*] Prior to OpenSSH 9.8, the sole connection throttling mechanism is controlled by the MaxStartups directive. This prevents too many pre-authentication connections from overwhelming the server. When triggered, the server will probabilistically return \"Exceeded MaxStartups\" instead of the usual SSH banner, then terminate the connection. In order to maximize the DoS effectiveness, this metric should be greater than zero, though the ideal rate of rejections depends on the target server's CPU resources.") + print() + print(" [+] Starting in OpenSSH 9.8, a more fine-gained connection throttling mechanism was added via the PerSourcePenalties directive. When triggered, the server returns \"Not allowed at this time\" instead of the usual SSH banner. This countermeasure is more effective than simply relying on the MaxStartups directive, and seems to block this attack under its default settings.") print() @@ -775,7 +792,6 @@ class DHEat: def _run(self) -> bool: '''Where all the magic happens.''' - self.output() if sys.platform == "win32": self.output("%sWARNING:%s this feature has not been thoroughly tested on Windows. It may perform worse than on UNIX OSes." % (self.YELLOWB, self.CLEAR)) @@ -887,14 +903,16 @@ class DHEat: self.num_connect_timeouts += thread_statistics['num_connect_timeouts'] self.num_read_timeouts += thread_statistics['num_read_timeouts'] self.num_socket_exceptions += thread_statistics['num_socket_exceptions'] - self.num_openssh_throttled_connections += thread_statistics['num_openssh_throttled_connections'] + self.num_em += thread_statistics['num_em'] + self.num_naatt += thread_statistics['num_naatt'] + self.num_invalid_banners += thread_statistics['num_invalid_banners'] except queue.Empty: # If Queue.get() timeout exceeded. pass now = time.time() if (now - last_update) >= 1.0: seconds_running = now - self.start_timer - print("%s%s%s TCP SYNs/sec: %s%u%s; Compl. conns/sec: %s%u%s; Bytes sent/sec: %s%s%s; DH kex/sec: %s%u%s \r" % (self.WHITEB, spinner[spinner_index], self.CLEAR, self.BLUEB, self.num_attempted_tcp_connections / seconds_running, self.CLEAR, self.BLUEB, self.num_successful_tcp_connections / seconds_running, self.CLEAR, self.BLUEB, DHEat.add_byte_units(self.num_bytes_written / seconds_running), self.CLEAR, self.PURPLEB, self.num_successful_dh_kex / seconds_running, self.CLEAR), end="") + print(f"{self.WHITEB}{spinner[spinner_index]}{self.CLEAR} TCP SYNs/sec: {self.BLUEB}{int(self.num_attempted_tcp_connections / seconds_running):,d}{self.CLEAR}; Compl. conns/sec: {self.BLUEB}{int(self.num_successful_tcp_connections / seconds_running):,d}{self.CLEAR}; Bytes sent/sec: {self.BLUEB}{DHEat.add_byte_units(self.num_bytes_written / seconds_running)}{self.CLEAR}; DH kex/sec: {self.PURPLEB}{self.num_successful_dh_kex / seconds_running:,.1f}{self.CLEAR} \r", end="") last_update = now spinner_index = (spinner_index + 1) % 4 @@ -942,13 +960,16 @@ class DHEat: num_connect_timeouts = 0 num_read_timeouts = 0 num_socket_exceptions = 0 - num_openssh_throttled_connections = 0 + num_em = 0 # Number of "Exceeded MaxStartups" messages received. + num_naatt = 0 # Number of "Not allowed at this time" messages received. + num_invalid_banners = 0 num_loops_since_last_statistics_sync = 0 while True: num_loops_since_last_statistics_sync += 1 # Instead of flooding the parent process with statistics, report our stats only every 5 connections. + # TODO: this sends too quickly in the case of application-level rate limiting, resulting in client-side CPU exhaustion instead! :O Perhaps a dynamic number of loops should be skipped, based on what would result in 1 message per 2-3 seconds. if num_loops_since_last_statistics_sync > 5: num_loops_since_last_statistics_sync = 0 @@ -961,7 +982,9 @@ class DHEat: 'num_connect_timeouts': num_connect_timeouts, 'num_read_timeouts': num_read_timeouts, 'num_socket_exceptions': num_socket_exceptions, - 'num_openssh_throttled_connections': num_openssh_throttled_connections, + 'num_em': num_em, + 'num_naatt': num_naatt, + 'num_invalid_banners': num_invalid_banners }) # Since we sent our statistics, reset them all back to zero. @@ -973,7 +996,9 @@ class DHEat: num_connect_timeouts = 0 num_read_timeouts = 0 num_socket_exceptions = 0 - num_openssh_throttled_connections = 0 + num_em = 0 + num_naatt = 0 + num_invalid_banners = 0 s = socket.socket(target_address_family, socket.SOCK_STREAM) s.settimeout(connect_timeout) @@ -1016,11 +1041,16 @@ class DHEat: if banner.startswith(b"SSH-2.0-") or banner.startswith(b"SSH-1"): num_successful_tcp_connections += 1 elif banner == b'Exceeded MaxStartups': - num_openssh_throttled_connections += 1 + num_em += 1 + _close_socket(s) + continue + elif banner == b'Not allowed at this time': + num_naatt += 1 _close_socket(s) continue else: - self.debug("Invalid banner received: %r" % banner) + num_invalid_banners += 1 + # self.debug("Invalid banner received: %r" % banner) _close_socket(s) continue