SSH Scanner Bug

[mikehacksthings]

There's an issue with the SSH credential scanner where it passes an invalid target to the connection. This raises gaierror Exception: [Errno -2] Name or service not known.

[16:25:58][scan_engine][_scan] 4 scanners remaining
[16:25:58][scanner][check_success] Invalid Raspberry Pi default cred pi:raspberry at ssh://192.168.1.162:22:22
[16:25:58][scanner][check_success] gaierror Exception: [Errno -2] Name or service not known
[16:25:58][scan_engine][_scan] 3 scanners remaining
[16:25:58][scanner][check_success] Invalid AT&T Arris NVG589 & NVG599 (SharknAT&To) default cred remotessh:5SaP9I26 at ssh://192.168.1.162:22:22
[16:25:58][scanner][check_success] gaierror Exception: [Errno -2] Name or service not known
[16:25:58][scan_engine][_scan] 2 scanners remaining
[16:25:58][scanner][check_success] Invalid ssh default cred root:password at ssh://192.168.1.162:22:22
[16:25:58][scanner][check_success] gaierror Exception: [Errno -2] Name or service not known
[16:25:58][scan_engine][_scan] 1 scanners remaining
[16:25:58][scanner][check_success] Invalid ssh default cred root:root at ssh://192.168.1.162:22:22
[16:25:58][scanner][check_success] gaierror Exception: [Errno -2] Name or service not known

This appears to be due to the fact that self.target in ssh.py contains the protocol and the port ssh://:22 when being passed as hostname to the paramiko connect() function in ssh.py.

[Graph-X]

What are the command line options you are using? I'm trying to replicate this issue and the stupid won't error out for me.

[mikehacksthings]

I set up a target to test this out which was a raspberry pi running with default credentials. The command line options I used to test it were:
$ ./changeme.py --debug --verbose --protocols ssh ip

[ztgrace]

I've been able to replicate this, and should have fixes pushed soon. I'm working to get some additional unit tests in place so similar regressions don't happen in the future.

[Graph-X]

I'm the only one that couldn't replicate? Wow, that's counter to normal process. I'm usually the one doing it wrong.

[ztgrace]

The issue is that in the current paramiko connect statement, it uses self.target which calls the Target.__str__ method that includes the protocol and passes something like ssh://192.168.1.1 to paramiko which blows up. So the fix is to call self.target.host to get back the direct host/ip without the protocol.

[ztgrace]

@mikehacksthings ssh & ssh_key scanners should be fixed

[mikehacksthings]

Confirmed that the recent pull fixes this issue. Thanks!