Re: nsock READ timeout

Gerald Roy <[email protected]>
Newsgroups gmane.comp.security.nmap.devel
Message-ID <[email protected]> 
The Pi is using

OpenSSH_6.7p1 Raspbian-5+deb8u3, OpenSSL 1.0.1t 3 May 2016

The DD-WRT router runs dropbear_2016.74

pi@raspberrypi:~/dogbert $ ssh -vv [email protected]

OpenSSH_6.7p1 Raspbian-5+deb8u3, OpenSSL 1.0.1t 3 May 2016

debug1: Reading configuration data /etc/ssh/ssh_config

debug1: /etc/ssh/ssh_config line 19: Applying options for *

debug2: ssh_connect: needpriv 0

debug1: Connecting to 192.168.1.1 [192.168.1.1] port 22.

debug1: Connection established.

debug1: identity file /home/pi/.ssh/id_rsa type 1

debug1: key_load_public: No such file or directory

debug1: identity file /home/pi/.ssh/id_rsa-cert type -1

debug1: key_load_public: No such file or directory

debug1: identity file /home/pi/.ssh/id_dsa type -1

debug1: key_load_public: No such file or directory

debug1: identity file /home/pi/.ssh/id_dsa-cert type -1

debug1: key_load_public: No such file or directory

debug1: identity file /home/pi/.ssh/id_ecdsa type -1

debug1: key_load_public: No such file or directory

debug1: identity file /home/pi/.ssh/id_ecdsa-cert type -1

debug1: key_load_public: No such file or directory

debug1: identity file /home/pi/.ssh/id_ed25519 type -1

debug1: key_load_public: No such file or directory

debug1: identity file /home/pi/.ssh/id_ed25519-cert type -1

debug1: Enabling compatibility mode for protocol 2.0

debug1: Local version string SSH-2.0-OpenSSH_6.7p1
Raspbian-5+deb8u3

debug1: Remote protocol version 2.0, remote software version
dropbear_2016.74

debug1: no match: dropbear_2016.74

debug2: fd 3 setting O_NONBLOCK

debug1: SSH2_MSG_KEXINIT sent

debug1: SSH2_MSG_KEXINIT received

debug2: kex_parse_kexinit: [email protected] ,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

debug2: kex_parse_kexinit: [email protected] ,[email protected] ,ssh-rsa,[email protected] ,[email protected] ,[email protected] ,[email protected] ,[email protected] ,[email protected] ,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-dss

debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,[email protected] ,[email protected] ,[email protected] ,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]

debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,[email protected] ,[email protected] ,[email protected] ,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]

debug2: kex_parse_kexinit: [email protected] ,[email protected] ,[email protected] ,[email protected] ,[email protected] ,[email protected] ,[email protected] ,hmac-sha2-256,hmac-sha2-512,hmac-sha1,[email protected] ,[email protected] ,[email protected] ,[email protected] ,hmac-md5,hmac-ripemd160,[email protected] ,hmac-sha1-96,hmac-md5-96

debug2: kex_parse_kexinit: [email protected] ,[email protected] ,[email protected] ,[email protected] ,[email protected] ,[email protected] ,[email protected] ,hmac-sha2-256,hmac-sha2-512,hmac-sha1,[email protected] ,[email protected] ,[email protected] ,[email protected] ,hmac-md5,hmac-ripemd160,[email protected] ,hmac-sha1-96,hmac-md5-96

debug2: kex_parse_kexinit: none,[email protected] ,zlib

debug2: kex_parse_kexinit: none,[email protected] ,zlib

debug2: kex_parse_kexinit:

debug2: kex_parse_kexinit:

debug2: kex_parse_kexinit: first_kex_follows 0

debug2: kex_parse_kexinit: reserved 0

debug2: kex_parse_kexinit:
diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,[email protected]

debug2: kex_parse_kexinit: ssh-rsa

debug2: kex_parse_kexinit:
aes128-ctr,aes256-ctr,aes128-cbc,aes256-cbc

debug2: kex_parse_kexinit:
aes128-ctr,aes256-ctr,aes128-cbc,aes256-cbc

debug2: kex_parse_kexinit: hmac-sha1,hmac-md5

debug2: kex_parse_kexinit: hmac-sha1,hmac-md5

debug2: kex_parse_kexinit: none

debug2: kex_parse_kexinit: none

debug2: kex_parse_kexinit:

debug2: kex_parse_kexinit:

debug2: kex_parse_kexinit: first_kex_follows 0

debug2: kex_parse_kexinit: reserved 0

debug2: mac_setup: setup hmac-sha1

debug1: kex: server->client aes128-ctr hmac-sha1 none

debug2: mac_setup: setup hmac-sha1

debug1: kex: client->server aes128-ctr hmac-sha1 none

debug2: bits set: 980/2048

debug1: sending SSH2_MSG_KEXDH_INIT

debug1: expecting SSH2_MSG_KEXDH_REPLY

debug1: Server host key: RSA
e4:64:80:69:75:e8:16:0c:b6:30:0c:4a:6a:5e:17:1a

debug1: Host '192.168.1.1' is known and matches the RSA host
key.

debug1: Found key in /home/pi/.ssh/known_hosts:3

debug2: bits set: 1048/2048

debug2: kex_derive_keys

debug2: set_newkeys: mode 1

debug1: SSH2_MSG_NEWKEYS sent

debug1: expecting SSH2_MSG_NEWKEYS

debug2: set_newkeys: mode 0

debug1: SSH2_MSG_NEWKEYS received

debug1: SSH2_MSG_SERVICE_REQUEST sent

debug2: service_accept: ssh-userauth

debug1: SSH2_MSG_SERVICE_ACCEPT received

debug2: key: /home/pi/.ssh/id_rsa (0x5576a288),

debug2: key: /home/pi/.ssh/id_dsa ((nil)),

debug2: key: /home/pi/.ssh/id_ecdsa ((nil)),

debug2: key: /home/pi/.ssh/id_ed25519 ((nil)),

DD-WRT v3.0-r30796 std (c) 2016 NewMedia-NET GmbH

Release: 10/25/16

debug1: Authentications that can continue: publickey,password

debug1: Next authentication method: publickey

debug1: Offering RSA public key: /home/pi/.ssh/id_rsa

debug2: we sent a publickey packet, wait for reply

debug1: Server accepts key: pkalg ssh-rsa blen 279

debug2: input_userauth_pk_ok: fp
eb:1b:60:db:a4:2f:be:c6:3e:a6:c5:16:af:81:68:0c

debug1: Authentication succeeded (publickey).

Authenticated to 192.168.1.1 ([192.168.1.1]:22).

debug1: channel 0: new [client-session]

debug2: channel 0: send open

debug1: Entering interactive session.

debug2: callback start

debug2: fd 3 setting TCP_NODELAY

debug2: client_session2_setup: id 0

debug2: channel 0: request pty-req confirm 1

debug1: Sending environment.

debug1: Sending env LANG = en_GB.UTF-8

debug2: channel 0: request env confirm 0

debug2: channel 0: request shell confirm 1

debug2: callback done

debug2: channel 0: open confirm rwindow 24576 rmax 32759

debug2: channel_input_status_confirm: type 99 id 0

debug2: PTY allocation request accepted on channel 0

debug2: channel_input_status_confirm: type 99 id 0

debug2: shell request accepted on channel 0

==========================================================

___ ___ _ _____ ______ ____ ___

/ _ \/ _ \___| | /| / / _ \/_ __/ _ __|_ / / _ \

/ // / // /___/ |/ |/ / , _/ / / | |/ //_ <_/ // /

/____/____/ |__/|__/_/|_| /_/ |___/____(_)___/

DD-WRT v3.0

http://www.dd-wrt.com

==========================================================

BusyBox v1.24.2 (2016-10-25 00:34:18 CEST) built-in shell (ash)

Thanks

Gerald

On 2 October 2017 at 20:02, Fotis
Chantzis <[email protected] >
wrote:

Can you please paste the output of the ssh
client with verbose output on when connecting to that
server? (ssh -vv <user>@192.168.1.1 )

What ssh version is the server running on the
raspberry?

On Mon, Oct 2, 2017 at 1:32 PM, Gerald
Roy <[email protected] >
wrote:

Hi,

Running NCrack 0.6 on a Raspberry Pi 3 Raspbian
with the command

ncrack
-U 1user -P 1password -vv -d 10 -t 4 -iX
mynmap.xml -oN ncrack.log

I get the output below. It looks like it's not
doing much. 192.168.1.22 is a DD-WRT router.

ssh:// 192.168.1.1:22 (EID
223) Attempts: total 0 completed 0 supported
0 --- rate 0.00

ssh:// 192.168.1.1:22 (EID
224) nsock READ timeout!

ssh:// 192.168.1.1:22 (EID
224) Attempts: total 0 completed 0 supported
0 --- rate 0.00

ssh:// 192.168.1.1:22 (EID
225) nsock READ timeout!

ssh:// 192.168.1.1:22 (EID
225) Attempts: total 0 completed 0 supported
0 --- rate 0.00

ssh:// 192.168.1.1:22 (EID
226) nsock READ timeout!

ssh:// 192.168.1.1:22 (EID
226) Attempts: total 0 completed 0 supported
0 --- rate 0.00

ssh:// 192.168.1.1:22 (EID
229) Attempts: total 0 completed 0 supported
0 --- rate 0.00

Thank you for your help.

Gerald

_______________________________________________

Sent through the dev mailing list

https://nmap.org/mailman/listinfo/dev

Archived at http://seclists.org/nmap-dev/

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.