CVE-2019-13115 PoC — libssh2 输入验证错误漏洞

Source

https://github.com/viz27/Libssh2-Exploit

Associated Vulnerability

Title: libssh2 输入验证错误漏洞 (CVE-2019-13115)
Description:In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

Description

Create an exploit to libssh2 vulnerabulity described in CVE-2019-13115

Readme

# Libssh2-Exploit

Goals
=====
In this project, we aim to create an exploit to an out of bounds read vulnerabulity in libssh2 described in CVE-2019-13115. Create a malicious ssh server to cause a client connecting to it to crash and see if this can be exploited further to steal data from the client.

Getting the OpenSSH Server Running
==================================
* Download and extract openssh-8.1p1.tar.gz(for unedited OpenSSH server) or openssh-malicious.zip(for the malicious server).
* Go to the folder and run the below commands
  1) ./configure --with-md5-passwords --with-pam --with-selinux --with-privsep-path=/var/lib/sshd/ --sysconfdir=/etc/ssh --with-audit=debug --disable-strip 
  2) make
  3) sudo make install
  4) sudo /usr/local/sbin/sshd

Setting up libssh2 and verifying crash
======================================
* Download and extract libssh2-1.8.2.tar.gz to any folder, say /usr/src/libssh2-1.8.2
* Run the following commands
  1) ./configure
  2) make
  3) make install
  4) ./ssh2 127.0.0.1 \<username\> \<password\>  ***This will trigger a crash***
* to compile any C program having libssh2 libraries, use the following commands
  1) gcc -g -I /usr/src/libssh2-1.8.2/include -I /usr/src/libssh2-1.8.2/src -L /usr/local/lib ssh2.c -o ssh222 -lssh2
  2) If while running, if there are issues with dynamically linked libraries
      <br/>a) ensure the libraries are present in /usr/local/lib
      <br/>b) LD_LIBRARY_PATH=/usr/local/lib
      <br/>c) export LD_LIBRARY_PATH

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →