ssh加解密教程 about ecapture

[blaisewang]

根据 Wireshark WIKI：https://wiki.wireshark.org/SSH

Unlike the TLS dissector, no code has been written to decrypt encrypted SSH packets/payload (yet). This is also not possible unless the shared secret (from the Diffie-Hellman key exchange) is extracted from the SSH server or client (see, as an example of a mechanism to extract internal information of that sort, the "SSLKEYLOGFILE" method in TLS). Work on SSH2 decryption is tracked at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16054

[cfc4n]

ping @sun363587351 ???

[blaisewang]

这篇文章似乎是一个可行的方案：https://blog.fox-it.com/2020/11/11/decrypting-openssh-sessions-for-fun-and-profit/

ecap 如果想要支持 ssh 协议，需要像文中一样获取 session key（我没有找到合适的 hook 点），写自定义的 parser 来解析 ssh packet，PR Welcome。

[cfc4n]

我觉得“SSH的密钥捕获”这需求不是一个常规的分析调试需求，有点偏向后门类需求，eCapture暂时无这类规划。

如果贴主是研究技术的话，可以通过楼上同学给的资料，自己分析学习一下。