SSHD hide version patch

by Qnix on Feb.25, 2008, under General, Projects, ssh

Hello guys .. as you know that someone could know the version of the sshd and many other information by using nmap or any other tools …

for example



root::qnix[0]@~/Codeing/Projects/SSHDH/openssh-4.7p1 $ nmap -q -sV -p 22 localhost
Starting Nmap 4.53 ( http://insecure.org ) at 2008-02-25 15:35 AST
Interesting ports on localhost (127.0.0.1):
PORT   STATE SERVICE VERSION
22/tcp open  ssh      (protocol 2.0 debian-4.7p1)

as you can see these info sometimes might be dangerous... and might be used in a mass hacking if a vulnerability found on this version which is 4.7p1 and it runs under Debian.
so i wrote this simple patch that hides these info

--- sshd.c.orig    2007-06-05 11:22:32.000000000 +0300
+++ sshd.c    2008-02-25 15:16:10.000000000 +0300
@@ -422,2 +422,2 @@
-    snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n", major, minor, SSH_VERSION);
+    snprintf(buf, sizeof buf, "SSH-%d.%d\n", major, minor);

or download it from here

http://www.0×80.org/code/app/sshdh/sshdh.patch

to patch it just go to the the folder where the openssh sourecode is and type

root::qnix[0]@~/Codeing/Projects/SSHDH/openssh-4.7p1 $ patch &lt; sshdh.patch
patching file sshd.c
Hunk #1 succeeded at 422 with fuzz 1.

Thats it now configure it and make it then install it and then try to telnet to it and you’ll see something like this

root::qnix[0]@~ $ telnet localhost 22
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-HIDDEN

Enjoy!!

Faking Xchat ctcp ‘VERSION’ replays
Xchat is a multiplatform IRC client , if you use it someone can easily know what version your using ...
Qsniffer v0.2
Just finish the new version of Qsniffer here's the changelog * A signal handler added to handle...
Upgrading Ubuntu from Gutsy to Hardy
The Hardy Heron Alpha 3 is the third alpha release of Ubuntu 8.04 lots of things has been fixed ...
Firestarter firewall continuously crashes
Free IPv6 With tunnelbroker.net

Share and Enjoy:

3 Comments for this entry

MQR-6114
March 6th, 2008 on 5:29 pm
Obscurity != security; besides, the vast majority of the worms/tools that constantly attempt to login via ssh never really seem to check the version numbers (or they’d see that the ssh on my machine is 2.0 only…).
Qnix
March 6th, 2008 on 6:07 pm
Dude don’t take things seriously in this blog … its all about a bored dude who write useless things …. and this patch is just to hide the version and not implement any kind of protection or whatever..
By the way i found another patch .. a good one with more options to Hide the Version
more about it can be found at
http://www.kramse.dk/projects/unix/opensshhideversion_en.html
Garth
November 26th, 2009 on 5:08 pm
n33t