关联漏洞
标题：
OpenSSH 竞争条件问题漏洞
(CVE-2018-15473)
描述：OpenSSH（OpenBSD Secure Shell）是OpenBSD计划组的一套用于安全访问远程计算机的连接工具。该工具是SSH协议的开源实现，支持对所有的传输进行加密，可有效阻止窃听、连接劫持以及其他网络级的攻击。 OpenSSH 7.7及之前版本中存在竞争条件问题漏洞。该漏洞源于网络系统或产品在运行过程中，并发代码需要互斥地访问共享资源时，对于并发访问的处理不当。
描述
Exploit written in Python for CVE-2018-15473 with threading and export formats
介绍
# CVE-2018-15473-Exploit
On August 15th, 2018, the following advisory was posted on the OSS-Security list: [http://openwall.com/lists/oss-security/2018/08/15/5](http://openwall.com/lists/oss-security/2018/08/15/5)
The [ShelIntel team](https://www.shellntel.com/) decided to invest some time and write an exploit for this vulnerability. The exploit below has the following features:
* Threading - default 5
* If more than 10 are used, often the OpenSSH service gets overwhelmed and causes retries
* Single username evaluation via `username` parameter
* Multiple username evaluation via `userList` parameter
* Multiple username evaluation file output via `outputFile` parameter
* Multiple output formats (list, json, csv) via `outputFormat` parameter
An example username input file is given in `exampleInput.txt`
An example results output file in List format is given in `exampleOutput.txt`
An example results output file in JSON format is given in `exampleOutput.json`
An example results output file in CSV format is given in `exampleOutput.csv`
#### Install the dependencies by running `pip install -r requirements.txt`
=======
## Build the image:
docker build -t cve-2018-15473 .
## Run the exploit:
docker run cve-2018-15473 -h
## Delete containers and image:
docker ps -a | awk '$2 == "cve-2018-15473" {print $1}' | xargs docker rm
docker rmi cve-2018-15473
文件快照
[4.0K] /data/pocs/208bf9b1f097570defc7654c76862da10a08ceae
├── [ 581] Dockerfile
├── [ 17] exampleInput.txt
├── [ 46] exampleOutput.csv
├── [ 47] exampleOutput.json
├── [ 55] exampleOutput.txt
├── [1.3K] README.md
├── [ 9] requirements.txt
└── [8.4K] sshUsernameEnumExploit.py
0 directories, 8 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。