CVE-2018-15473

Necesitarás Python 2.7 para usar este exploit. Instala todos los módulos que se indican a continuación en Python 2.7.

Como por ejemplo: python2 -m pip install numpy python2 -m pip install paramiko python2 -m pip install property

Para probar un solo nombre de usuario usa este comando: python ./sshuserenumeration.py -u

Ejemplo: python ./sshuserenumeration.py -u root site.com

Para probar varios nombres de usuario con un archivo de lista, usa este comando: python ./sshuserenumeration.py --userlist <name_list.txt>

Ejemplo: python ./sshuserenumeration.py --userlist users.txt site.com

usage: sshuserenumeration.py [-h] [-u USER | -U USERLIST] [-e] [-s] [--bytes BYTES] [--samples SAMPLES] [--factor FACTOR] [--trials TRIALS] host

positional arguments: host Give SSH server address like ip:port or just by ip

optional arguments: -h, --help show this help message and exit -u USER, --user USER Give a single user name -U USERLIST, --userlist USERLIST Give a file containing a list of users -e, --enumerated Only show enumerated users -s, --silent Like -e, but just the user names will be written to stdout (no banner, no anything) --bytes BYTES Send so many BYTES to the SSH daemon as a password --samples SAMPLES Collect so many SAMPLES to calculate a timing baseline for authenticating non-existing users --factor FACTOR Used to compute the upper timing boundary for user enumeration --trials TRIALS try to authenticate user X for TRIALS times and compare the mean of auth timings against the timing boundary