mrr0b0t19/cve-2024-6387-exploit-pocProof-of-concept exploit for CVE-2024-6387 targeting vulnerable OpenSSH servers via heap manipulation and race condition to achieve remote code execution.
This repository contains a Proof of Concept (POC) to exploit the vulnerability CVE-2024-6387 in SSH servers running vulnerable versions of OpenSSH.
A POC, or Proof of Concept, is a program or script that demonstrates the exploitation of a security vulnerability in a controlled and reproducible manner. Its main objective is to show that the vulnerability exists and that it can be leveraged to execute malicious code or perform unauthorized actions on the affected system.
The POC in this repository is designed to exploit the vulnerability CVE-2024-6387 in SSH servers. Below is a brief explanation of how each part of the code works:
CVE-2024-6387.py: This file contains the main POC code. It defines functions to establish a connection with the SSH server, send specific packets to manipulate the server heap, measure response times, and exploit the race condition on the server.
setup_connection(ip, port): Establishes a TCP/IP connection with the remote server. send_packet(sock, packet_type, data): Sends a packet to the remote server. perform_ssh_handshake(sock): Performs the full SSH handshake. prepare_heap(sock): Prepares the server heap with specific packets to exploit the vulnerability. time_final_packet(sock, parsing_time): Measures the final response time of the server. attempt_race_condition(sock, parsing_time, glibc_base): Attempts to exploit the race condition on the SSH server. perform_exploit(ip, port): Performs the full exploit by trying multiple glibc base addresses. Usage
For this POC to work with the vulnerability CVE-2024-6387, the following modifications or considerations must be made:
Shellcode update: Replace the shellcode placeholder shellcode = b"\x90\x90\x90\x90" with actual shellcode that executes the desired action on the affected server.
Adaptation to CVE-2024-6387: Ensure that the data structures and packets sent in the prepare_heap and create_public_key_packet functions are specifically designed to exploit the vulnerabilities described in CVE-2024-6387.
This repository is provided for educational and research purposes. Exploiting vulnerabilities without authorization may be illegal and is strictly prohibited in unauthorized environments. The author is not responsible for any misuse of this code.
