POC详情： 91e2451e6830724289241735c882a032e82dcf49

来源
https://github.com/FromPartsUnknown/EvilSunCheck
关联漏洞
标题： Oracle Solaris 缓冲区错误漏洞 (CVE-2020-14871)
描述：Oracle Solaris是美国甲骨文（Oracle）公司的一套UNIX操作系统。 Oracle Solaris 可插入身份验证模块10版本，11版本存在安全漏洞，该漏洞允许未经身份验证攻击者通过多种协议进行网络访问，从而危害Oracle Solaris。尽管此漏洞位于Oracle Solaris中，但攻击可能会严重影响其他产品。
描述
This is a little Python script to detect the "EvilSun" vulnerability (CVE-2020-14871) on Solaris systems. The vulnerability is a buffer overflow in the Pluggable Authentication Module (PAM) `pam_unix_auth` when handling keyboard-interactive authentication in SSH.
介绍
# EvilSun Vulnerability Checker (CVE-2020-14871)

This is a little Python script to detect the "EvilSun" vulnerability (CVE-2020-14871) on Solaris systems. The vulnerability is a buffer overflow in the Pluggable Authentication Module (PAM) `pam_unix_auth` when handling keyboard-interactive authentication in SSH. A successful exploit could potentially lead to remote code execution or denial of service.

## Requirements 

*   Python 3.x
*   `paramiko` library

## Installation

```bash
pip3 install -r requirements.txt
```

## Interpreting Output

### Solaris 9 & 10

When /etc/ssh/sshd_config has been configured with PAMAuthenticationViaKBDInt 'yes' you can expect the following output indicating a vulnerable state:
<pre>
    [*] Connecting to hostname 192.168.100.12 port: 22
    [*] Using payload: ['AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA']
    [*] Authentication failed: Authentication failed: transport shut down or saw EOF
    [-] !!!!!!! VULNERABLE !!!!!!!
</pre>

When /etc/ssh/sshd_config has been configured with PAMAuthenticationViaKBDIn 'no' you can expect the following output indicating a non-vulnerable state (for Sun SSHd anyway):

<pre>
    [*] Connecting to hostname 192.168.100.12 port: 22
    [*] Authentication failed: Authentication failed.
</pre>

### Solaris 11

Currently untested.
文件快照

 [4.0K]  /data/pocs/91e2451e6830724289241735c882a032e82dcf49
├── [1.8K]  evilsun_check.py
├── [1.8K]  README.md
└── [   8]  requirements.txt

0 directories, 3 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。