From ac64f87327d9cc7e1c348c59b4c8bcf954951b42 Mon Sep 17 00:00:00 2001
From: Andris Raugulis <moo@arthepsy.eu>
Date: Wed, 7 Sep 2016 19:26:33 +0300
Subject: [PATCH] Extract software (Dropbear, OpenSSH, HP iLO, Cisco) and OS
 (NetBSD, FreeBSD) from banner.

---
 ssh-audit.py | 111 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 111 insertions(+)

diff --git a/ssh-audit.py b/ssh-audit.py
index 951b77b..60a2040 100755
--- a/ssh-audit.py
+++ b/ssh-audit.py
@@ -209,6 +209,114 @@ class SSH(object):
 	MSG_KEXDH_INIT  = 30
 	MSG_KEXDH_REPLY = 32
 	
+	class Software(object):
+		def __init__(self, vendor, product, version, patch, os):
+			self.__vendor = vendor
+			self.__product = product
+			self.__version = version
+			self.__patch = patch
+			self.__os = os
+		
+		@property
+		def vendor(self):
+			return self.__vendor
+		
+		@property
+		def product(self):
+			return self.__product
+		
+		@property
+		def version(self):
+			return self.__version
+		
+		@property
+		def patch(self):
+			return self.__patch
+		
+		@property
+		def os(self):
+			return self.__os
+		
+		def __str__(self):
+			out = '{0} '.format(self.vendor) if self.vendor else ''
+			out += self.product
+			if self.version:
+				out += ' {0}'.format(self.version)
+			if self.patch:
+				out += ' {0}'.format(self.patch)
+			if self.os:
+				out += ' running on {0}'.format(self.os)
+			return out
+		
+		def __repr__(self):
+			out = 'vendor={0} '.format(self.vendor) if self.vendor else ''
+			if self.product:
+				out += ', product={0}'.format(self.software)
+			if self.version:
+				out += ', version={0}'.format(self.version)
+			if self.patch:
+				out += ', patch={0}'.format(self.patch)
+			if self.os:
+				out += ', os={0}'.format(self.os)
+			return '<{0}({1})>'.format(self.__class__.__name__, out)
+		
+		@staticmethod
+		def _fix_patch(patch):
+			return re.sub(r'^[-_\.]+', '', patch)
+		
+		@staticmethod
+		def _fix_date(d):
+			if d is not None and len(d) == 8:
+				return '{0}-{1}-{2}'.format(d[:4], d[4:6], d[6:8])
+			else:
+				return None
+		
+		@classmethod
+		def _extract_os(cls, c):
+			if c is None:
+				return None
+			mx = re.match(r'^NetBSD(?:_Secure_Shell)?(?:[\s-]+(\d{8})(.*))?$', c)
+			if mx:
+				d = cls._fix_date(mx.group(1))
+				return 'NetBSD' if d is None else 'NetBSD ({0})'.format(d)
+			mx = re.match(r'^FreeBSD(?:\slocalisations)?[\s-]+(\d{8})(.*)$', c)
+			if not mx:
+				mx = re.match(r'^[^@]+@FreeBSD\.org[\s-]+(\d{8})(.*)$', c)
+			if mx:
+				d = cls._fix_date(mx.group(1))
+				return 'FreeBSD' if d is None else 'FreeBSD ({0})'.format(d)
+			generic = ['NetBSD', 'FreeBSD']
+			for g in generic:
+				if c.startswith(g) or c.endswith(g):
+					return g
+			return None
+		
+		@classmethod
+		def parse(cls, banner):
+			software = str(banner.software)
+			mx = re.match(r'^dropbear_(\d+.\d+)(.*)', software)
+			if mx:
+				patch = cls._fix_patch(mx.group(2))
+				v, p = 'Matt Johnston', 'Dropbear SSH'
+				v = None
+				return cls(v, p, mx.group(1), patch, None)
+			mx = re.match(r'^OpenSSH[_\.-]+([\d\.]+\d+)(.*)', software)
+			if mx:
+				patch = cls._fix_patch(mx.group(2))
+				v, p = 'OpenBSD', 'OpenSSH'
+				v = None
+				os = cls._extract_os(banner.comments)
+				return cls(v, p, mx.group(1), patch, os)
+			mx = re.match(r'^mpSSH_([\d\.]+\d+)', software)
+			if mx:
+				v, p = 'HP', 'iLO (Integrated Lights-Out) sshd'
+				return cls(v, p, mx.group(1), None, None)
+			mx = re.match(r'^Cisco-([\d\.]+\d+)', software)
+			if mx:
+				v, p = 'Cisco', 'IOS/PIX sshd'
+				return cls(v, p, mx.group(1), None, None)
+			return None
+	
 	class Banner(object):
 		_RXP, _RXR = r'SSH-\d\.\s*?\d+', r'(-([^\s]*)(?:\s+(.*))?)?'
 		RX_PROTOCOL = re.compile(_RXP.replace('\d', '(\d)'))
@@ -679,6 +787,9 @@ def output(banner, header, kex):
 			out.good('(gen) banner: {0}'.format(banner))
 			if banner.protocol[0] == 1:
 				out.fail('(gen) protocol SSH1 enabled')
+			software = SSH.Software.parse(banner)
+			if software is not None:
+				out.good('(gen) software: {0}'.format(software))
 		if kex is not None:
 			output_compatibility(kex)
 			compressions = [x for x in kex.server.compression if x != 'none']