ssh man-in-the-middle (ssh-mitm) server for security audits supporting
publickey authentication, session hijacking and file manipulation
**SSH-MITM** is a man in the middle SSH Server for security audits and malware analysis.
Password and **publickey authentication** are supported and SSH-MITM is able to detect, if a user is able to login with publickey authentication on the remote server. This allows SSH-MITM to accept the same key as the destination server. If publickey authentication is not possible, the authentication will fall back to password-authentication.
When publickey authentication is possible, a forwarded agent is needed to login to the remote server. In cases, when no agent was forwarded, SSH-MITM can rediredt the session to a honeypot.
## Features
* publickey authentication
* accept same key as destination server
* Phishing FIDO Tokens ([Information from OpenSSH](https://www.openssh.com/agent-restrict.html))
* hijacking and logging of terminal sessions
* store and replace files during SCP/SFTP file transferes
* port porwarding
* SOCKS 4/5 support for dynamic port forwarding
* intercept MOSH connections
* audit clients against known vulnerabilities
* plugin support
## Installation
**SSH-MITM** can be installed as a [Ubuntu Snap](https://snapcraft.io/ssh-mitm), [PIP-Package](https://pypi.org/project/ssh-mitm/), [AppImage](https://github.com/ssh-mitm/ssh-mitm/releases/latest), [Nix](https://search.nixos.org/packages?channel=unstable&show=ssh-mitm&type=packages&query=ssh-mitm) and even runs on **[Android devices](https://github.com/ssh-mitm/ssh-mitm/discussions/83#discussioncomment-1531873)**
# install ssh-mitm as snap package
$ sudo snap install ssh-mitm
# install ssh-mitm as python pip package
$ python3 -m pip install ssh-mitm
# install as Nix package
$ nix-env -iA nixos.ssh-mitm
## Quickstart
To start SSH-MITM, all you have to do is run this command in your terminal of choice.
$ ssh-mitm server --remote-host 192.168.0.x
Now let's try to connect. SSH-MITM is listening on port 10022.
$ ssh -p 10022 testuser@proxyserver
You will see the credentials in the log output.
INFO Remote authentication succeeded
Remote Address: 127.0.0.1:22
Username: testuser
Password: secret
Agent: no agent
## Session hijacking
Getting the plain text credentials is only half the fun.
When a client connects, the ssh-mitm starts a new server, which is used for session hijacking.
INFO ℹ created mirrorshell on port 34463. connect with: ssh -p 34463 127.0.0.1
To hijack the session, you can use your favorite ssh client.
$ ssh -p 34463 127.0.0.1
Try to execute somme commands in the hijacked session or in the original session.
The output will be shown in both sessions.
## Phishing FIDO Tokens
SSH-MITM is able to phish FIDO2 Tokens which can be used for 2 factor authentication.
The attack is called [trivial authentication](https://docs.ssh-mitm.at/trivialauth.html) ([CVE-2021-36367](https://docs.ssh-mitm.at/CVE-2021-36367.html), [CVE-2021-36368](https://docs.ssh-mitm.at/CVE-2021-36368.html)) and can be enabled with the command line argument `--enable-trivial-auth`.
ssh-mitm server --enable-trivial-auth
Using the trivial authentication attack does not break password authentication, because the attack is only performed when a publickey login is possible.
Video explaining the phishing attack:
Click to view video on vimeo.com
ssh man-in-the-middle (ssh-mitm) server for security audits supporting
publickey authentication, session hijacking and file manipulation
**SSH-MITM** is a man in the middle SSH Server for security audits and malware analysis.
Password and **publickey authentication** are supported and SSH-MITM is able to detect, if a user is able to login with publickey authentication on the remote server. This allows SSH-MITM to accept the same key as the destination server. If publickey authentication is not possible, the authentication will fall back to password-authentication.
When publickey authentication is possible, a forwarded agent is needed to login to the remote server. In cases, when no agent was forwarded, SSH-MITM can rediredt the session to a honeypot.
## Features
* publickey authentication
* accept same key as destination server
* Phishing FIDO Tokens ([Information from OpenSSH](https://www.openssh.com/agent-restrict.html))
* hijacking and logging of terminal sessions
* store and replace files during SCP/SFTP file transferes
* port porwarding
* SOCKS 4/5 support for dynamic port forwarding
* intercept MOSH connections
* audit clients against known vulnerabilities
* plugin support
## Installation
**SSH-MITM** can be installed as a [Ubuntu Snap](https://snapcraft.io/ssh-mitm), [PIP-Package](https://pypi.org/project/ssh-mitm/), [AppImage](https://github.com/ssh-mitm/ssh-mitm/releases/latest), [Nix](https://search.nixos.org/packages?channel=unstable&show=ssh-mitm&type=packages&query=ssh-mitm) and even runs on **[Android devices](https://github.com/ssh-mitm/ssh-mitm/discussions/83#discussioncomment-1531873)**
# install ssh-mitm as snap package
$ sudo snap install ssh-mitm
# install ssh-mitm as python pip package
$ python3 -m pip install ssh-mitm
# install as Nix package
$ nix-env -iA nixos.ssh-mitm
## Quickstart
To start SSH-MITM, all you have to do is run this command in your terminal of choice.
$ ssh-mitm server --remote-host 192.168.0.x
Now let's try to connect. SSH-MITM is listening on port 10022.
$ ssh -p 10022 testuser@proxyserver
You will see the credentials in the log output.
INFO Remote authentication succeeded
Remote Address: 127.0.0.1:22
Username: testuser
Password: secret
Agent: no agent
## Session hijacking
Getting the plain text credentials is only half the fun.
When a client connects, the ssh-mitm starts a new server, which is used for session hijacking.
INFO ℹ created mirrorshell on port 34463. connect with: ssh -p 34463 127.0.0.1
To hijack the session, you can use your favorite ssh client.
$ ssh -p 34463 127.0.0.1
Try to execute somme commands in the hijacked session or in the original session.
The output will be shown in both sessions.
## Phishing FIDO Tokens
SSH-MITM is able to phish FIDO2 Tokens which can be used for 2 factor authentication.
The attack is called [trivial authentication](https://docs.ssh-mitm.at/trivialauth.html) ([CVE-2021-36367](https://docs.ssh-mitm.at/CVE-2021-36367.html), [CVE-2021-36368](https://docs.ssh-mitm.at/CVE-2021-36368.html)) and can be enabled with the command line argument `--enable-trivial-auth`.
ssh-mitm server --enable-trivial-auth
Using the trivial authentication attack does not break password authentication, because the attack is only performed when a publickey login is possible.
Video explaining the phishing attack:
Click to view video on vimeo.com
ssh man-in-the-middle (ssh-mitm) server for security audits supporting
publickey authentication, session hijacking and file manipulation
**SSH-MITM** is a man in the middle SSH Server for security audits and malware analysis.
Password and **publickey authentication** are supported and SSH-MITM is able to detect, if a user is able to login with publickey authentication on the remote server. This allows SSH-MITM to accept the same key as the destination server. If publickey authentication is not possible, the authentication will fall back to password-authentication.
When publickey authentication is possible, a forwarded agent is needed to login to the remote server. In cases, when no agent was forwarded, SSH-MITM can rediredt the session to a honeypot.
## Features
* publickey authentication
* accept same key as destination server
* Phishing FIDO Tokens ([Information from OpenSSH](https://www.openssh.com/agent-restrict.html))
* hijacking and logging of terminal sessions
* store and replace files during SCP/SFTP file transferes
* port porwarding
* SOCKS 4/5 support for dynamic port forwarding
* intercept MOSH connections
* audit clients against known vulnerabilities
* plugin support
## Installation
**SSH-MITM** can be installed as a [Ubuntu Snap](https://snapcraft.io/ssh-mitm), [PIP-Package](https://pypi.org/project/ssh-mitm/), [AppImage](https://github.com/ssh-mitm/ssh-mitm/releases/latest), [Nix](https://search.nixos.org/packages?channel=unstable&show=ssh-mitm&type=packages&query=ssh-mitm) and even runs on **[Android devices](https://github.com/ssh-mitm/ssh-mitm/discussions/83#discussioncomment-1531873)**
# install ssh-mitm as snap package
$ sudo snap install ssh-mitm
# install ssh-mitm as python pip package
$ python3 -m pip install ssh-mitm
# install as Nix package
$ nix-env -iA nixos.ssh-mitm
## Quickstart
To start SSH-MITM, all you have to do is run this command in your terminal of choice.
$ ssh-mitm server --remote-host 192.168.0.x
Now let's try to connect. SSH-MITM is listening on port 10022.
$ ssh -p 10022 testuser@proxyserver
You will see the credentials in the log output.
INFO Remote authentication succeeded
Remote Address: 127.0.0.1:22
Username: testuser
Password: secret
Agent: no agent
## Session hijacking
Getting the plain text credentials is only half the fun.
When a client connects, the ssh-mitm starts a new server, which is used for session hijacking.
INFO ℹ created mirrorshell on port 34463. connect with: ssh -p 34463 127.0.0.1
To hijack the session, you can use your favorite ssh client.
$ ssh -p 34463 127.0.0.1
Try to execute somme commands in the hijacked session or in the original session.
The output will be shown in both sessions.
## Phishing FIDO Tokens
SSH-MITM is able to phish FIDO2 Tokens which can be used for 2 factor authentication.
The attack is called [trivial authentication](https://docs.ssh-mitm.at/trivialauth.html) ([CVE-2021-36367](https://docs.ssh-mitm.at/CVE-2021-36367.html), [CVE-2021-36368](https://docs.ssh-mitm.at/CVE-2021-36368.html)) and can be enabled with the command line argument `--enable-trivial-auth`.
ssh-mitm server --enable-trivial-auth
Using the trivial authentication attack does not break password authentication, because the attack is only performed when a publickey login is possible.
Video explaining the phishing attack:
Click to view video on vimeo.com