Terrapin Attack Proxy PoC (CVE-2023-48795)

terrapinattack.py is a Proof of Concept (PoC) script written in Python that demonstrates the SSH Prefix Truncation Attack. This script functions as an active Man-in-the-Middle (MitM) proxy, manipulating SSH packet sequence numbers during the handshake phase to disable critical security features.

---

🛠️ Technical Mechanism

This script exploits vulnerabilities in the SSH Binary Packet Protocol (BPP) by performing three core manipulations:

1. Handshake Interception: Acts as a bridge between the SSH client and the target server on a specified port (default: 2222).
2. Sequence Number Injection: Detects the KEXINIT packet (Type 20). The proxy injects an SSH_MSG_IGNORE packet to intentionally shift the internal sequence numbers on the client side.
3. Prefix Truncation: Once encryption is initialized, the proxy identifies the EXT_INFO packet (Type 7). Due to the pre-injected sequence shift, the proxy can drop this packet without immediately breaking the connection. This results in the loss of modern security extensions (such as keystroke timing protection).

---

🚀 Usage

Prerequisites

• Python 3.x (No external dependencies; uses built-in socket and select modules).
• A target SSH server that supports ChaCha20-Poly1305 or CBC-EtM ciphers and has not implemented Strict Key Exchange.

Configuration & Execution

Edit the target parameters at the bottom of the script:

terrapin_proxy(2222, 'target.server.id', 22)