CVE-2024-6387 PoC — Openssh: regresshion - race condition in ssh allows rce/dos

Source

https://github.com/edsonjt81/CVE-2024-6387_Check

Associated Vulnerability

Title:Openssh: regresshion - race condition in ssh allows rce/dos (CVE-2024-6387)
Description:A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Readme

# CVE-2024-6387_Check

<img width="802" alt="image" src="https://github.com/xaitax/CVE-2024-6387_Check/assets/5014849/81d765ec-fe2b-45f9-9535-1b04c925910a">

## 📜 Description

CVE-2024-6387_Check is a lightweight, efficient tool designed to identify servers running vulnerable versions of OpenSSH, specifically targeting the recently discovered `regreSSHion` vulnerability (CVE-2024-6387). This script facilitates rapid scanning of multiple IP addresses, domain names, and CIDR network ranges to detect potential vulnerabilities and ensure your infrastructure is secure.

## 🌟 Features

- **Rapid Scanning**: Quickly scan multiple IP addresses, domain names, and CIDR ranges for the CVE-2024-6387 vulnerability.
- **Banner Retrieval**: Efficiently retrieves SSH banners without authentication.
- **Multi-threading**: Uses threading for concurrent checks, significantly reducing scan times.
- **Detailed Output**: Provides clear, emoji-coded output summarizing scan results.
- **Port Check**: Identifies closed ports and provides a summary of non-responsive hosts.

## 🚀 Usage

```bash
python CVE-2024-6387_Check.py <targets> [--port PORT] [--timeout TIMEOUT] [--list FILE]
```

### Examples

#### Single IP

```bash
python CVE-2024-6387_Check.py 192.168.1.1
```

#### IPs from a file

```bash
python CVE-2024-6387_Check.py -l ip_list.txt
```

#### Multiple IPs and Domains

```bash
python CVE-2024-6387_Check.py 192.168.1.1 example.com 192.168.1.2
```

#### CIDR Range

```bash
python CVE-2024-6387_Check.py 192.168.1.0/24
```

#### With Custom Port

```bash
python CVE-2024-6387_Check.py 192.168.1.1 example.com --port 2222
```

### Output

The script will provide a summary of the scanned targets:

* 🚨 Vulnerable: Servers running a vulnerable version of OpenSSH.
* 🛡️ Not Vulnerable: Servers running a non-vulnerable version of OpenSSH.
* ⚠️ Unknown: Servers running an unknown version of SSH
* 🔒 Closed Ports: Count of servers with port 22 (or specified port) closed.
* 📊 Total Scanned: Total number of targets scanned.

```text
🛡️ Servers not vulnerable: 2

   [+] Server at somedomain.cloudapp.azure.com (running SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.11)
   [+] Server at regresshion_test.cc (running SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.3)

🚨 Servers likely vulnerable: 1

   [+] Server at 4.231.170.122 (running SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u2)

⚠️ Servers with unknown SSH version: 1

   [+] Server at 103.97.85.85 (banner: SSH-2.0-ROSSSH)

🔒 Servers with port 22 closed: 254

📊 Total scanned targets: 257
```

## 📚 References
[Qualys Blog on regreSSHion Vulnerability](https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server)

File Snapshot


 [4.0K]  /data/pocs/234b4d8ecc21c7274caf916feffe19d552e853c4
├── [6.9K]  CVE-2024-6387_Check.py
├── [ 34K]  LICENSE
└── [2.7K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!