frompartsunknown/evilsuncheckThis is a little Python script to detect the "EvilSun" vulnerability (CVE-2020-14871) on Solaris systems. The vulnerability is a buffer overflow in the Pluggable Authentication Module (PAM) `pam_unix_auth` when handling keyboard-interactive authentication in SSH.
This is a little Python script to detect the "EvilSun" vulnerability (CVE-2020-14871) on Solaris systems. The vulnerability is a buffer overflow in the Pluggable Authentication Module (PAM) pam_unix_auth when handling keyboard-interactive authentication in SSH. A successful exploit could potentially lead to remote code execution or denial of service.
paramiko librarypip3 install -r requirements.txt
When /etc/ssh/sshd_config has been configured with PAMAuthenticationViaKBDInt 'yes' you can expect the following output indicating a vulnerable state:
[*] Connecting to hostname 192.168.100.12 port: 22
[*] Using payload: ['AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA']
[*] Authentication failed: Authentication failed: transport shut down or saw EOF
[-] !!!!!!! VULNERABLE !!!!!!!
When /etc/ssh/sshd_config has been configured with PAMAuthenticationViaKBDIn 'no' you can expect the following output indicating a non-vulnerable state (for Sun SSHd anyway):
[*] Connecting to hostname 192.168.100.12 port: 22
[*] Authentication failed: Authentication failed.
Currently untested.