02 May 2011 | 8,654 views

sslsnoop v0.6 – Dump Live Session Keys From SSH & Decrypt Traffic On The Fly

Cyber Raptors Hunting Your Data?

sslsnoop dumps live session keys from openssh and can also decrypt the traffic on the fly.

  1. Works if scapy doesn’t drop packets. using pcap instead of SOCK_RAW helps a lot now.
  2. Works better on interactive traffic with no traffic at the time of the ptrace. It follows the flow, after that.
  3. Dumps one file by fd in outputs/
  4. Attaching a process is quickier with –addr 0xb788aa98 as provided by haystack INFO:abouchet:found instance @ 0xb788aa98
  5. how to get a pickled session_state file : $ sudo haystack –pid pgrep ssh sslsnoop.ctypes_openssh.session_state search > ss.pickled

Not all ciphers are implemented.

Workings ciphers: aes128-ctr, aes192-ctr, aes256-ctr, blowfish-cbc, cast128-cbc
Partially workings ciphers (INBOUND only ?!): aes128-cbc, aes192-cbc, aes256-cbc
Non workings ciphers: 3des-cbc, 3des, ssh1-blowfish, arcfour, arcfour1280

It can also dump DSA and RSA keys from ssh-agent or sshd ( or others ).

You can download sslsnoop here:

trolldbois-sslsnoop.zip

Or read more here.

Advertisements



Recent in Cryptography:
- The Logjam Attack – ANOTHER Critical TLS Weakness
- BitTorrent Bleep – Encrypted, Decentralized Voice & Text App
- Google Revoking Trust In CNNIC Issued Certificates

Related Posts:
- Blue-Ray DRM Cracked Already?
- Mimikatz – Gather Windows Credentials
- AxCrypt – Open Source Windows File Encryption Software

Most Read in Cryptography:
- The World’s Fastest MD5 Cracker – BarsWF - 47,234 views
- Hackers Crack London Tube Oyster Card - 43,197 views
- WPA2 Vulnerability Discovered – “Hole 196″ – A Flaw In GTK (Group Temporal Key) - 32,194 views

Advertise on Darknet

Comments are closed.