Scanner_CVE_OpenSSH

Scanner for identifying servers with SSH software possibly vulnerable to CVEs CVE-2024-6387 and CVE-2023-48795.

Covered CVEs

CVE-2024-6387 — regreSSHion

Race condition in the SIGALRM signal handler of the OpenSSH server allows unauthenticated RCE as root on Linux systems with glibc. Affects all OpenSSH versions prior to 9.8p1.

CVE-2023-48795 — Terrapin

Prefix truncation attack on the SSH handshake (binary protocol) that allows a MITM adversary to remove security extension messages negotiated at the start of the session. Affects OpenSSH < 9.6.

How it works

The script directly connects to the SSH port of the targets and reads the identification banner (e.g., SSH-2.0-OpenSSH_9.7), without sending any credentials. With the version in hand, it compares against the fixed versions of each CVE and classifies the host.

Target → TCP connection port 22 → Read SSH banner → Software identification
     → Parse OpenSSH version → Compare with fixed versions → Classification + Log + CSV

The script also identifies the SSH vendor/software from the banner, recognizing:

Requirements

pip install requests packaging urllib3 dnspython

dnspython is optional but highly recommended — parallel reverse resolution is significantly faster with it. Without dnspython, the script uses socket as a fallback.

Usage

# IP individual
python ssh_scanner.py --ip 192.168.1.10

# Faixa CIDR
python ssh_scanner.py --cidr 10.0.0.0/24

# Múltiplos CIDRs
python ssh_scanner.py --cidr 10.0.0.0/24 192.168.1.0/24

# ASN (prefixos resolvidos via RIPE Stat, fallback para bgp.tools)
python ssh_scanner.py --asn AS12345

# Combinação de entradas
python ssh_scanner.py --asn AS12345 --cidr 10.0.0.0/8 --ip 1.2.3.4

# A partir de um arquivo (um IP, CIDR ou ASN por linha)
python ssh_scanner.py --file alvos.txt

# Portas adicionais (além da 22)
python ssh_scanner.py --cidr 10.0.0.0/24 --ports 22 2222 22222

Optional parameters

DNS resolution is performed in batch before the SSH scan, with a dedicated thread queue, preventing DNS latency from impacting scan speed.

Output

All results are written to ./logs/:

Structured CSV (formato_estruturado.csv)

Columns present:

Example lines:

IP               | PORTA | TIMESTAMP_UTC        | DOMINIO                  | FABRICANTE | SW_NAME | SW_VERSAO | CVEs                          | BANNER
192.168.1.10     | 22    | 2026-05-20T00:39:33Z | host.exemplo.com         | OpenSSH    | OpenSSH | 9.7       | cve-2024-6387;cve-2023-48795  | SSH-2.0-OpenSSH_9.7
192.168.1.20     | 22    | 2026-05-20T12:46:03Z | host2.exemplo.com        | OpenSSH    | OpenSSH | 9.4       | cve-2023-48795;cve-2024-6387  | SSH-2.0-OpenSSH_9.4
192.168.1.30     | 22    | 2026-05-20T12:47:11Z | router.exemplo.com       | Mikrotik   | ROSSSH  | N/D       |                               | SSH-2.0-ROSSSH

At the end of the scan, if there are vulnerable hosts, the script automatically displays a preview of the first 20 lines of the structured CSV in the terminal.

Host Status

Remediation

Update OpenSSH to version 9.8p1 or higher (covers both CVEs):

# Ubuntu / Debian — via repositório do sistema
sudo apt update && sudo apt install --only-upgrade openssh-server
ssh -V

# CentOS / RHEL / Rocky
sudo dnf update openssh-server
ssh -V

# Compilação a partir do fonte (versão mais recente)
wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.9p1.tar.gz
tar xzf openssh-9.9p1.tar.gz
cd openssh-9.9p1 && ./configure && make && sudo make install

After updating, restart the service:

sudo systemctl restart sshd

References

• NVD CVE-2024-6387: https://nvd.nist.gov/vuln/detail/CVE-2024-6387
• NVD CVE-2023-48795: https://nvd.nist.gov/vuln/detail/CVE-2023-48795
• OpenSSH Release Notes: https://www.openssh.com/releasenotes.html

Legal Disclaimer

This script is intended for use on your own infrastructure or under explicit authorization. Unauthorized scanning may violate various laws, so use with caution.

Any actions and consequences resulting from misuse of this tool are your own responsibility.

If you have suggestions for improvement or find bugs, open an issue or submit a Pull Request. All contributions are welcome! 🚀