CVE-2019-6111 PoC — OpenSSH 路径遍历漏洞

Source

Associated Vulnerability

Title:OpenSSH 路径遍历漏洞 (CVE-2019-6111)
Description:OpenSSH（OpenBSD Secure Shell）是Openbsd计划组的一套用于安全访问远程计算机的连接工具。该工具是SSH协议的开源实现，支持对所有的传输进行加密，可有效阻止窃听、连接劫持以及其他网络级的攻击。 OpenSSH中的scp client实用程序存在安全漏洞，该漏洞源于程序错误的验证了对象名称。攻击者可利用该漏洞覆盖文件。

Description

Case Study: SSHtranger Things (CVE-2019-6111, CVE-2019-6110) in Cisco SD-WAN

Readme

# MAL-008: SSHtranger Things (CVE-2019-6111, CVE-2019-6110) in Cisco SD-WAN

Cisco SD-WAN v20.4.2.1 uses an old version of SSH (OpenSSH_7.6p1) that is susceptible to the “SSHtranger Things” attack. If a victim tries to connect to a malicious/compromised SSH server this attack may be used to write/overwrite sensitive files.

By overwriting sensitive script files (e.g. “.bashrc”) this may allow an unauthenticated attacker to obtain Remote Code Execution (RCE) on the victim’s system.

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://bst.cisco.com/quickview/bug/CSCwb16963).

### Requirements:

This vulnerability requires:
<br/>
- Successful SSH MITM
  <br/>OR
- Social engineering to convince a legitimate SD-WAN user to connect to a malicious SSH server

### Proof Of Concept:

More details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/MAL-008/blob/main/Cisco%20SD-WAN%20-%20SSHtranger%20Things.pdf).

### Additional Information:

[PoC for CVE-2019-6111 and CVE-2019-6110](https://gist.github.com/mehaase/63e45c17bdbbd59e8e68d02ec58f4ca2)

File Snapshot


 [4.0K]  /data/pocs/5aacb2f6b35739f561a03a46b11a74c373928956
├── [796K]  Cisco SD-WAN - SSHtranger Things.pdf
└── [1.1K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!