OpenSSH CVE-2024-6387 Exploit 🚀

This repository contains a Python script designed to exploit the remote code execution (RCE) vulnerability in OpenSSH (CVE-2024-6387). This vulnerability involves a signal handler race condition that can lead to arbitrary code execution, allowing attackers to gain root access. This proof-of-concept is intended for educational purposes only.

Overview 📖

OpenSSH's CVE-2024-6387 is a critical vulnerability caused by a regression of a previously fixed issue. It involves a race condition in the signal handler that can be exploited to execute arbitrary code as root.

Features 🌟

• Multithreading: Increases the chances of winning the race condition.
• Success Event: Stops attempts once the exploit succeeds.
• Timing Adjustments: Fine-tunes the timing required to trigger the race condition.
• IPv4 and IPv6 Support: Handles both IPv4 and IPv6 addresses for broader compatibility. oferchen
• Command-Line Arguments: Allows flexible configuration of target IP, port, maximum attempts, number of threads, and glibc base address. oferchen

Usage 🚀

Prerequisites

• Python 3.x

Running the Exploit

1. Clone the repository:

   root@kitploit:~

   git clone https://github.com/d0rb/CVE-2024-6387.git
   cd CVE-2024-6387-exploit
   

2. Execute the script:

   root@kitploit:~

   python exploit_cve_2024_6387.py <target_ip> <target_port> --max_attempts 10000 --num_threads 10 --glibc_base 0xb7400000
   

   Example:

   root@kitploit:~

   python exploit_cve_2024_6387.py 192.168.1.100 22 --max_attempts 10000 --num_threads 10 --glibc_base 0xb7400000
   

Explanation 🛠️

Enhancing the Race Condition

To improve the chances of winning the race condition, the script uses multithreading, which allows multiple attempts to be made simultaneously. Each thread tries to exploit the vulnerability, increasing the likelihood of success. A threading event (success_event) is used to signal when the exploit has succeeded, stopping all further attempts. The script also adjusts the timing slightly after each attempt to better synchronize with the race condition.

Credits

Special thanks to Ofer Chen for his valuable contributions to improving this script.

Legal Disclaimer ⚠️

This exploit is for educational purposes only. Unauthorized use on systems without explicit permission is illegal and unethical. Always follow legal guidelines and obtain explicit permission before testing security on any system.

Contact 📬

For any issues or inquiries, please open an issue on GitHub.

---

Stay safe and responsible! 🔒💻