search

toxyl / ossh

... is a dirty mix of honey and tar, delivered by a fake SSH server.
Other
2 stars 1 forks source link

SCP support #5

Closed dylandreimerink closed 2 years ago

dylandreimerink commented 2 years ago

Once we have a dynamic file system(#4) we can add support for SCP file transfer which is a common method of getting files like scripts or executables on a server.

I found this article which explains how the scp protocol works: https://goteleport.com/blog/scp-familiar-simple-insecure-slow/

It seems to consist of 2 parts:

  1. we have to emulate the scp command, which if called with some undocumented flags should start capturing data sent over the connection.
  2. The data sent is a custom ASCII based protocol

There are a number of SCP client libraries, but no server libraries as far as I can find, since everyone used openssh as the SSH server. So this one will require some custom protocol implementation

toxyl commented 2 years ago

I skimmed over the link, the protocol seems simple enough to emulate. This caught my attention, though:

If a shell on the remote side prints out anything for non-interactive sessions, your local scp process will happily interpret that output as SCP commands. At best, this will break the SCP protocol with obscure errors. At worst, the remote shell startup script is malicious and sends you an exploit payload instead of the file you wanted.

Sounds like we might be able to achieve some nice things with an SCP implementation :D

toxyl commented 2 years ago

Also a good reference: https://web.archive.org/web/20170215184048/https://blogs.oracle.com/janp/entry/how_the_scp_protocol_works