wtbacon/cve-2018-15473
OpenSSH through 7.7 allows remote attackers to enumerate valid usernames by sending malformed authentication requests and observing differential server responses.
| Field | Value |
|---|---|
| Affected Software | OpenSSH 2.3 through 7.7 |
| CVSS v3.1 | 5.3 (Medium) |
| Attack Vector | Network (remote, no authentication required) |
| Root Cause | Server does not delay bailout for invalid users until after the full packet is parsed (auth2-gss.c, auth2-hostbased.c, auth2-pubkey.c) |
| Impact | Information disclosure — valid username enumeration |
exploit.py — Malformed Packet (fast, multi-threaded)Sends a truncated SSH_MSG_USERAUTH_REQUEST (boolean field removed). Invalid users trigger an early bailout (USERAUTH_FAILURE), valid users cause the server to disconnect.
exploit_timing.py — Timing Attack (slower, works on patched servers)Sends a very long password (~100KB) via password auth. Valid users take longer because the server hashes the password before rejecting, while invalid users are rejected immediately. Runs sequentially and auto-calibrates the threshold.
Use this when exploit.py returns false positives (patched servers).
git clone <this-repo-url>
cd cve-2018-15473
pip install -r requirements.txt
# Malformed packet (try this first)
python3 exploit.py <target_ip> 22 <lhost> <lport> -u root
python3 exploit.py <target_ip> 22 <lhost> <lport> -w usernames.txt -t 8
# Timing attack (fallback for patched servers)
python3 exploit_timing.py <target_ip> 22 <lhost> <lport> -u root
python3 exploit_timing.py <target_ip> 22 <lhost> <lport> -w usernames.txt
| Argument | Description |
|---|
target_ip | Target SSH server IP |
target_port | Target SSH port (usually 22) |
lhost | Attacker IP (unused, kept for template consistency) |
lport | Attacker port (unused, kept for template consistency) |
-u, --username | Single username to test |
-w, --wordlist | Path to a wordlist file (one username per line) |
-t, --threads | Number of threads (default: 4, exploit.py only) |