-
Notifications
You must be signed in to change notification settings - Fork 2.4k
Open
Labels
Description
Describe the bug
Specifiyng any SSH port has no effect if another default port is set in ~/.ssh/config as a default (for all hosts)
To Reproduce
$ hydra -l user -P ../wordlists/rockyou.txt ssh://10.10.4.100:22 -t 1
[DATA] max 1 task per 1 server, overall 1 task, 14344398 login tries (l:1/p:14344398), ~14344398 tries per task
[DATA] attacking ssh://10.10.4.100:22/
[ERROR] could not connect to ssh://10.10.4.100:22 - Connection refused
$ strace hydra -l user -P ../wordlists/rockyou.txt ssh://10.10.4.100:22 -t 1
socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
fcntl(3, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(2200), sin_addr=inet_addr("10.10.4.100")}, 16) = -1 EINPROGRESS (Operation now in progress)
poll([{fd=3, events=POLLIN|POLLOUT}], 1, 32000) = 1 ([{fd=3, revents=POLLIN|POLLOUT|POLLERR|POLLHUP}])
getsockopt(3, SOL_SOCKET, SO_ERROR, [ECONNREFUSED], [4]) = 0
As you can see, the sin_port=htons(2200) is used no matter the ssh://host:22 or -s 22 command-line switch
Steps to reproduce the behavior:
- Create ~/.ssh/config
Host *
Port 2200
- Run hydra -l user -p password ssh://host:22
Expected behavior
Hydra respects the port set in command-line parameters and connects to desired port
Desktop (please complete the following information):
- OS: Manjaro Linux
$ hydra
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak
$ ldd $(which hydra) | grep 'libssh'
libssh.so.4 => /usr/lib/libssh.so.4
$ pacman -Qi openssh libssh |grep -A 1 Name
Name : openssh
Version : 10.0p1-6
--
Name : libssh
Version : 0.11.3-1