Invalid packet blocking

[sgrodzicki]

While trying to debug a SSH session between two black box systems I'm seeing the following error:

[12/10/23 19:50:52] INFO     ℹ session 002156aa-f5b2-4870-a6a5-ee4c7aa039d7 created         
                    ERROR    Exception (server): Invalid packet blocking                                   
                    ERROR    Traceback (most recent call last):                                            
                    ERROR      File                                                                        
                             "/opt/homebrew/Cellar/ssh-mitm/4.1.1/libexec/lib/python3.12/site-packages/sshm
                             itm/workarounds/transport.py", line 168, in transport_run                     
                    ERROR        ptype, m = self.packetizer.read_message()                                 
                    ERROR                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                 
                    ERROR      File                                                                        
                             "/opt/homebrew/Cellar/ssh-mitm/4.1.1/libexec/lib/python3.12/site-packages/para
                             miko/packet.py", line 487, in read_message                                    
                    ERROR        raise SSHException("Invalid packet blocking")                             
                    ERROR    paramiko.ssh_exception.SSHException: Invalid packet blocking                  
                    ERROR                                                                                  
                    WARNING  (('::ffff:192.168.1.26', 50548, 0, 0)->('::ffff:192.168.1.106', 22, 0, 0))    
                             session not started                                                           
                    INFO     ℹ session 002156aa-f5b2-4870-a6a5-ee4c7aa039d7 closed

I am able to "trick" the client to connect to my host and they don't mind random host keys, but I'm still unable to capture the unencrypted payloads:

[manfred-kaiser]

Without further information about the used client and server it's hard to help you with your problem.

The error comes from paramiko, which is not able to handle the packets from your ssh client: https://github.com/paramiko/paramiko/blob/94d553ffb11837013035c1a62c4af83c801c6f85/paramiko/packet.py#L487

There are some ssh implementations which are not fully compatible and SSH-MITM needs some workarounds for them. Some of them are implemented in https://github.com/ssh-mitm/ssh-mitm/blob/master/sshmitm/workarounds/transport.py

The ssh client of dropbear is such an example which needs a workaround to be compatible with paramiko.
I have already opened some pull requests to merge them in paramiko: paramiko/paramiko#2083

If you can give further information and if the ssh client and server are available I can try to implement a workaround for you.
Note: I can not support any commercial products which are not freely available, because of the costs and I don't have a Windows client to test windows software. If the software is running with wine, I can try it.

Please provide following information:

• SSH-MITM version -> It seems you are using 4.1.1 - is it the release version or are you using the latest development version from git?
• Are you using AppImage, Snap, ...?
• ssh client product name, vendor and version, operating system
• ssh server product name, vendor and version, operating system
• arguments to start SSH-MITM

[sgrodzicki]

Thanks for looking into this!

I'm running the latest version (4.1.1) of SSH-MITM available on Homebrew.

The client is UniFi's Network Server which makes outbound SSH connections to real devices to adopt/manage them.

The server is a hardware device (a Switch Flex Mini in this case), but luckily the error occurs already when trying to establish a connection.

Here's how to reproduce the error:

1. Spin up UniFi's Network Server (available on Windows, macOS, Linux, and Docker)
2. Go to https://localhost:8443 to access the web UI and go through setup (use "Advanced Setup" in second step to only set local access credentials)
3. Run SSH-MITM on port 22 (ssh-mitm server --listen-port 22)
4. Run the following Dart script to fake a discovery payload (you might need to run this from a different device since port 10001 is already in use by UniFi's Network Server). Also, make sure to alter the payload (see inline TODO) with your real IP which will be used to connect back:

#!/usr/bin/env dart

import 'dart:async';
import 'dart:io';

void main() {
  const int port = 10001;

  RawDatagramSocket.bind(InternetAddress.anyIPv4, port)
      .then((RawDatagramSocket udpSocket) {
    udpSocket.broadcastEnabled = true;
    List<int> payload = [
      2,
      6,
      0,
      122,
      2,
      0,
      10,
      208,
      33,
      249,
      231,
      211,
      113,
      192, // TODO: Change these
      168, // to your real
      1,   // IP address
      178, // (e.g., 192.168.1.178)
      1,
      0,
      6,
      208,
      33,
      249,
      231,
      211,
      113,
      10,
      0,
      4,
      0,
      0,
      170,
      41,
      11,
      0,
      8,
      85,
      83,
      87,
      95,
      77,
      73,
      78,
      73,
      12,
      0,
      6,
      85,
      83,
      77,
      73,
      78,
      73,
      3,
      0,
      9,
      50,
      46,
      48,
      46,
      48,
      46,
      55,
      48,
      52,
      22,
      0,
      9,
      50,
      46,
      48,
      46,
      48,
      46,
      55,
      48,
      52,
      21,
      0,
      6,
      85,
      83,
      77,
      73,
      78,
      73,
      23,
      0,
      1,
      1,
      24,
      0,
      1,
      0,
      25,
      0,
      1,
      1,
      26,
      0,
      1,
      1,
      19,
      0,
      6,
      208,
      33,
      249,
      231,
      211,
      113,
      18,
      0,
      4,
      0,
      0,
      6,
      134,
      27,
      0,
      5,
      49,
      46,
      55,
      46,
      51
    ];

    Timer.periodic(const Duration(seconds: 1), (timer) {
      udpSocket.send(payload, InternetAddress('255.255.255.255'), port);
    });
  });
}

5. Go to https://localhost:8443/manage/default/devices to list UniFi devices
6. Click "Click to Adopt" and wait for inbound SSH connection:

[manfred-kaiser]

Thanks for the information.
I did not know, that SSH-MITM is available on Homebrew 😃

The UniFi server is developed in Java and for SSH communications sshj is used.
UniFi server 8.0.7-24256-1 uses sshj 0.27.0, which is released 2019-01-24.

Perhaps it's easier to test SSH-MITM with sshj (in your case version 0.27.0) and if this works, this might also work for UniFi server.

Info: In the meantime later releases of sshj got some security fixes and compatibility enhancements for current OpenSSH versions (see release history).

Also some of sshj's dependency had some vulnerabilities: https://mvnrepository.com/artifact/com.hierynomus/sshj/0.27.0