USArmyResearchLab / Dshell

Dshell is a network forensic analysis framework.
Other
5.44k stars 1.14k forks source link

New decoder: SSH Public Key Information #122

Closed amm3 closed 3 years ago

dev195 commented 3 years ago

I regularly see unicode errors when I run this decoder. Is this something that needs to be fixed, or can it be routed around with a try-except block?

One example:

ERROR (dshell.core) - The connection_handler for the 'ssh-pubkey' plugin raised an exception and failed! (UnicodeDecodeError: 'utf-8' codec can't decode bytes in position 1-2: invalid continuation byte)
ERROR (dshell.core) - 'utf-8' codec can't decode bytes in position 1-2: invalid continuation byte
Traceback (most recent call last):
  File "/home/user/Dshell/build/lib/dshell/core.py", line 674, in _close_connection
    connection_handler_out = self.connection_handler(conn)
  File "/home/user/Dshell/build/lib/dshell/plugins/ssh/ssh-pubkey.py", line 43, in connection_handler
    info['clientbanner'] = blob.data.split(b'\x0d')[0].rstrip().decode('utf-8')
UnicodeDecodeError: 'utf-8' codec can't decode bytes in position 1-2: invalid continuation byte
amm3 commented 3 years ago

Good catch. In my haste, I didn't test this against enough non-SSH traffic. So I didn't see that the decode was failing on other content streams. This commit should fix that.

dev195 commented 3 years ago

Okay, I tested it and everything looks good. I will pull this plugin into the main repository.

If you have the time, I would recommend eventually updating this plugin with a longdescription value that provides more detail for what the plugin is parsing and displaying.