nuclei-templates/javascript/misconfiguration/ssh/ssh-weakkey-exchange-algo.yaml

id: ssh-weakkey-exchange-algo

info:
  name: SSH Weak Key Exchange Algorithms Enabled
  author: pussycat0x
  severity: low
  description: |
    SSH Weak Key Exchange Algorithms Enabled indicates that the SSH server or client is configured to allow the use of less secure key exchange methods, posing a potential security risk during the establishment of secure connections. It's crucial to update configurations to prioritize stronger key exchange algorithms.
  reference:
    - https://www.tenable.com/plugins/nessus/153953
  metadata:
    verified: true
    max-request: 2
    shodan-query: product:"OpenSSH"
  tags: js,enum,ssh,misconfig,network,vuln

javascript:
  - pre-condition: |
      isPortOpen(Host,Port);
    code: |
      let m = require("nuclei/ssh");
      let c = m.SSHClient();
      let response = c.ConnectSSHInfoMode(Host, Port);
      Export(response);
    args:
      Host: "{{Host}}"
      Port: "22"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "ServerKex"

      - type: word
        words:
          - "diffie-hellman-group-exchange-sha1"
          - "diffie-hellman-group1-sha1"
          - "gss-gex-sha1"
          - "gss-group1-sha1"
          - "gss-group14-sha1"
          - "rsa1024-sha1"
        condition: or
# digest: 4b0a00483046022100bb3ec953d01b159e56bdde2565a3f7b745c3df475b2da33db4eb0ca2ea39affa022100b3a2194f54f27651c8e443d3af75c57c1d3cde6f62c7eee4f9275ac2c5444fa1:922c64590222798bb761d5b6d8e72950