Combine ssh_login and ssh_login_pubkey modules

[dwelch-r7]

Resolves #14902

Combines the ssh_login and ssh_login_pubkey modules for an improved user experience

There will be an accompanying Pro PR so I will draft this until we're sure Pro works with these changes

my setup for testing can be found here #20546

Verification Steps

• Run the ssh_login module and gain a session with username/password
• Run the module again and gain a session with a non-password protected private key (via KEY_PATH and PRIVATE_KEY)
• Run the module again and gain a session with a password protected private key (via KEY_PATH and PRIVATE_KEY)

[ptownes-r7]

If you want to avoid chaining && maybe something like?

Suggested change

	if datastore['USER_FILE'].blank? && datastore['USERNAME'].blank? && datastore['USERPASS_FILE'].blank?
	if datastore.values_at('USER_FILE', 'USERNAME', 'USERPASS_FILE').all?(&:blank?)

[cpomfret-r7]

My testing

Created a keypair for testing: ssh-keygen -t ed25519 -C "[email protected]"

Username & Password

Setup SSH server

docker run -e PASSWORD_ACCESS=true -e USER_PASSWORD=password -e USER_NAME=username -e LOG_STDOUT=true -p 2222:2222 lscr.io/linuxserver/openssh-server:latest

Confirmed session created with:

run RHOSTS=127.0.0.1 RPORT=2222 USERNAME=username PASSWORD=password

or put username/password in files:

run RHOSTS=127.0.0.1 RPORT=2222 USER_FILE=./userfile PASS_FILE=./passfile

or put username/password in file on same line, separated by space:

run RHOSTS=127.0.0.1 RPORT=2222 USERPASS_FILE=./userpass

Key based access

Setup SSH server. For some reason I could not get PUBLIC_KEY_FILE to work, so I quoted the public key directly:

 docker run -e PASSWORD_ACCESS=false -e USER_NAME=username -e PUBLIC_KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSd0qRXKH6o3lgqEanN6cvr5URCubmo7uL4ahFHfw0e [email protected]'  -e LOG_STDOUT=true -p 2222:2222 lscr.io/linuxserver/openssh-server:latest

Confirmed session created with KEY_PATH:

run RHOSTS=127.0.0.1 RPORT=2222 USERNAME=username KEY_PATH=~/.ssh/id_ed25519

Confirmed session created with KEY_PATH + password protected keypair (recreate a keypair and set a passphrase:

run RHOSTS=127.0.0.1 RPORT=2222 USERNAME=username KEY_PATH=~/.ssh/id_ed25519 KEY_PASS=passphrase

Also confirmed key and password auth works via PRO

[cpomfret-r7]

Questions

• Is createsession=true the default? I didn't specify this and sessions were created
• I couldn't work out how to set the PRIVATE_KEY option

[dwelch-r7]

Questions

• Is createsession=true the default? I didn't specify this and sessions were created
• I couldn't work out how to set the PRIVATE_KEY option

sure seems to be set by default

metasploit-framework/lib/msf/base/sessions/create_session_options.rb

Line 19 in d52220c

OptBool.new('CreateSession', [false, 'Create a new session for every successful login', true])

you should be able to do it like this:
run RHOSTS=127.0.0.1 RPORT=2222 PRIVATE_KEY=file:/Users/dwelch/dev/ssh_keys_test/ssh_pass_protected USERNAME=vagrant createsession=true KEY_PASS=password
so using file://path_to_keyfile

[cpomfret-r7]

Release Notes

The module auxiliary/scanner/ssh/ssh_login_pubkey has been removed.
Its functionality has been moved into auxiliary/scanner/ssh/ssh_login.