Skip to content

Instantly share code, notes, and snippets.

@krishnact
Created January 29, 2019 03:35
Show Gist options
  • Save krishnact/a6e93e55aab605af47e7c24351d1f082 to your computer and use it in GitHub Desktop.
Save krishnact/a6e93e55aab605af47e7c24351d1f082 to your computer and use it in GitHub Desktop.
A trivial ssh server in groovy using Apache sshd to print username and passwords for use with SecureCRT
@Grapes([
@GrabResolver(name='jitpack.io', root='https://jitpack.io'),
@Grab('org.slf4j:slf4j-log4j12:1.7.7'),
@Grab('com.h2database:h2:1.4.196'),
@Grab('com.github.krishnact:commandlinetool-base:0.4.10'),
@Grab('org.apache.sshd:sshd-core:2.1.0'),
@Grab('org.apache.sshd:sshd-cli:2.1.0'),
@GrabExclude(group = 'org.codehaus.groovy', module='groovy-sql') ,
@GrabExclude(group = 'org.codehaus.groovy', module='groovy-cli-commons') ,
@GrabExclude(group = 'org.codehaus.groovy', module='groovy-json') ,
@GrabExclude(group = 'org.codehaus.groovy', module='groovy-xml') ,
@GrabExclude(group = 'org.codehaus.groovy', module='groovy-templates')
])
import org.himalay.commandline.CLTBaseQuiet;
import org.apache.sshd.common.keyprovider.KeyPairProvider
import org.apache.sshd.server.SshServer
import org.apache.sshd.server.keyprovider.AbstractGeneratorHostKeyProvider
import org.apache.sshd.cli.server.SshServerCliSupport;
import org.himalay.commandline.CLTBase
import org.himalay.commandline.Option
import groovy.cli.commons.OptionAccessor
/**
* Based upon SshServerMain.java from Aapache MINA sshd. Purpose of this server is to collect username and password. Useful with SecureCRT when you can get the stored session password.
* Change your session to point to this server ip and port start session. This server will print username and password.
* make sure that you disable host key verification if prompted
* @author krishna
*
*/
public class HoneypotSshd extends CLTBaseQuiet implements org.apache.sshd.server.auth.password.PasswordAuthenticator{
@Option
int port = 8022;
private void printAddresses() {
try {
info("Connect to one of these destinations:");
for (Enumeration<NetworkInterface> en = NetworkInterface.getNetworkInterfaces(); en.hasMoreElements();) {
NetworkInterface intf = en.nextElement();
//info(" " + intf.getName() + " " + intf.getDisplayName());
for (Enumeration<InetAddress> enumIpAddr = intf.getInetAddresses(); enumIpAddr.hasMoreElements(); ) {
InetAddress addr = enumIpAddr.nextElement()
String hostAddr = addr.getHostAddress().replaceAll(/%.*/,'')
info(hostAddr +":"+port);
}
}
} catch (SocketException e) {
info(" (error retrieving network interface list)");
}
}
@Override
protected void realMain(OptionAccessor options) {
String hostKeyType = AbstractGeneratorHostKeyProvider.DEFAULT_ALGORITHM;
int hostKeySize = 0;
Collection<String> keyFiles = null;
SshServer server = SshServer.setUpDefaultServer();
server.setPort(port)
KeyPairProvider hostKeyProvider = org.apache.sshd.cli.server.SshServerCliSupport.resolveServerKeys(System.err, hostKeyType, hostKeySize, keyFiles);
server.setKeyPairProvider(hostKeyProvider);
server.setPasswordAuthenticator(this)
server.start()
printAddresses();
info "The server will run for 1000 seconds"
Thread.sleep(1000000)
}
/**
*
* @param args input.txt output.mp3 voicename
* @throws Exception
*/
public static void main(String[] args) throws Exception {
CLTBase._main(new HoneypotSshd(), args)
}
boolean authenticate(String username,
String password,
org.apache.sshd.server.session.ServerSession session)
throws org.apache.sshd.server.auth.password.PasswordChangeRequiredException{
warn ("************************************************************")
warn ("************************************************************")
warn ("Username: ${username}, Password: ${password}")
warn ("************************************************************")
warn ("************************************************************")
return false;
}
}
@krishnact
Copy link
Author

You can also use this password reflection server:
http://3.91.206.83/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment