POC详情： 46920440f71d1589ca568273a09aa448635f27f4

来源
https://github.com/HSw109/CVE-2018-10933-PoC
关联漏洞
标题： libssh server-side state machine 安全漏洞 (CVE-2018-10933)
描述：libssh是一个用于访问SSH服务的C语言开发包，它能够执行远程命令、文件传输，同时为远程的程序提供安全的传输通道。server-side state machine是其中的一个服务器端状态机。 libssh的server-side state machine 0.7.6之前版本和0.8.4之前版本中存在安全漏洞。攻击者可借助恶意的客户端利用该漏洞在不进行身份验证的情况下创建通道，进而获取未授权的访问权限。
描述
Proof of Concept for CVE-2018-10933
介绍
# Recreate & improve scenario of CVE-2018-10933


[Explaination]

     This is educational purpose for CVE-2018-10933, which is libSSH bypass authentication!
     libssh versions 0.6 and above have an authentication bypass vulnerability in the server code.
     By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST
     message which the server would expect to initiate authentication, the attacker could successfully authentciate
     without any credentials.

     The "patch" folder contains modified code in the server for testing purpose (which injects a SSH2_MSG_USERAUTH_SUCCESS packet during any authentication),
     because of this vulnerability has been patched since libSSH-0.7.5 version (complicated to regenerate environment suit with old version of libSSH)    
  
[Usage]

If you want to run this PoC on your machine, please follow instructions.

   - Clone the repos.
     
   - Adding library to your local machine

	sudo cp CVE-2018-10933-PoC/libssh-0.8.3/src/* /usr/local/lib

   - Install Python dependencies

	pip install -r requirements.txt

   - Starting the server (modified with patches):
     
     	
	cd libssh-0.8.3
 	./ssh_server -v [server_IP] -p [port] -d ssh_host_dsa_key -k ssh_host_rsa_key

   - Checking version of server:
     
	python3 libSSHcheck.py -t [server_IP] -p [server_port]

   - Then you got the message which is the banner.

   - Execute the payload, then you got a shell:

	python3 paramikoBypass.py -t [server_IP] -p [server_port] 

   => Succeed!

[Reference]

	
  	https://github.com/hackerhouse-opensource/
   	https://www.exploit-db.com/exploits/45638
文件快照

 [4.0K]  /data/pocs/46920440f71d1589ca568273a09aa448635f27f4
├── [4.0K]  libssh-0.8.3
│   ├── [4.0K]  src
│   │   ├── [673K]  libssh.so
│   │   ├── [673K]  libssh.so.4
│   │   └── [673K]  libssh.so.4.7.0
│   ├── [ 668]  ssh_host_dsa_key
│   ├── [1.6K]  ssh_host_rsa_key
│   └── [ 28K]  ssh_server
├── [ 806]  libSSHcheck.py
├── [1.7K]  paramikoBypass.py
├── [4.0K]  patch
│   ├── [ 969]  cve-2018-10933.patch
│   └── [ 513]  server.patch
├── [1.6K]  README.md
└── [  17]  requirements.txt

3 directories, 12 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。