POC CVE-2018-15473 exploit

Adapted from https://github.com/Rhynorater/CVE-2018-15473-Exploit

To run this exploit you need to have installed:

• docker
• docker compose

SSH server

Let's start by pulling from DockerHub an image that has an old version (6.6) of SSH on an old Ubuntu: It may take a few minutes to download everything, but you only need to download it once.

docker pull dockerbase/openssh-server

We build our image and start the container

docker-compose build
docker-compose up

In another terminal, we open the server shell

docker exec -it server /bin/sh

We verify that the SSH version is old

ssh -V

We create a user

adduser mark

Enter the password twice to finish registration. We start the ssh server

/etc/init.d/ssh start

Discover the IP with ip a and try to connect from the host terminal to the server with the user you just created.

ssh mark@server

Attacker

In the attacker folder, we only need to

docker-compose build
docker-compose up

And we get inside the container

docker exec -it attacker /bin/sh

We can test the connection between the attacker and the server (shhh, he still doesn't suspect anything)

ping server

Then we can launch the attacks:

./single_attack.sh
./attack.sh