Proof of Concept for CVE-2018-10933# Recreate & improve scenario of CVE-2018-10933
[Explaination]
This is educational purpose for CVE-2018-10933, which is libSSH bypass authentication!
libssh versions 0.6 and above have an authentication bypass vulnerability in the server code.
By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST
message which the server would expect to initiate authentication, the attacker could successfully authentciate
without any credentials.
The "patch" folder contains modified code in the server for testing purpose (which injects a SSH2_MSG_USERAUTH_SUCCESS packet during any authentication),
because of this vulnerability has been patched since libSSH-0.7.5 version (complicated to regenerate environment suit with old version of libSSH)
[Usage]
If you want to run this PoC on your machine, please follow instructions.
- Clone the repos.
- Adding library to your local machine
sudo cp CVE-2018-10933-PoC/libssh-0.8.3/src/* /usr/local/lib
- Install Python dependencies
pip install -r requirements.txt
- Starting the server (modified with patches):
cd libssh-0.8.3
./ssh_server -v [server_IP] -p [port] -d ssh_host_dsa_key -k ssh_host_rsa_key
- Checking version of server:
python3 libSSHcheck.py -t [server_IP] -p [server_port]
- Then you got the message which is the banner.
- Execute the payload, then you got a shell:
python3 paramikoBypass.py -t [server_IP] -p [server_port]
=> Succeed!
[Reference]
https://github.com/hackerhouse-opensource/
https://www.exploit-db.com/exploits/45638
[4.0K] /data/pocs/cc66745590f770819cc19c2c3e7f2268ac1f4a7e
├── [4.0K] libssh-0.8.3
│ ├── [4.0K] src
│ │ ├── [673K] libssh.so
│ │ ├── [673K] libssh.so.4
│ │ └── [673K] libssh.so.4.7.0
│ ├── [ 668] ssh_host_dsa_key
│ ├── [1.6K] ssh_host_rsa_key
│ └── [ 28K] ssh_server
├── [ 806] libSSHcheck.py
├── [1.7K] paramikoBypass.py
├── [4.0K] patch
│ ├── [ 969] cve-2018-10933.patch
│ └── [ 513] server.patch
├── [1.6K] README.md
└── [ 17] requirements.txt
3 directories, 12 files