CVE-2025-32433 PoC — Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

Description

This script is a custom security tool designed to test for a critical pre-authentication vulnerability in systems running Erlang-based SSH servers

Readme

# CVE-2025-32433_Erlang-OTP
This script is a custom security tool designed to test for a critical pre-authentication vulnerability in systems running Erlang-based SSH servers

This script is a custom security tool designed to test for a critical pre-authentication vulnerability in systems running Erlang-based SSH servers (such as those used in embedded systems, IoT devices, and some backend services). The vulnerability being tested for is similar to CVE-2025-32433, which allows unauthenticated remote command execution during the SSH handshake phase.

# How It Works
## Target Enumeration:
- Accepts either a single IP:port or bulk IPs and ports from ips.txt and ports.txt.
- Matches IPs and ports line-by-line to scan environments systematically.

## SSH Protocol Emulation:
- Initiates a raw TCP connection and mimics a legitimate SSH client.
- Sends a valid SSH banner and KEXINIT packet to initiate key exchange.

## Brute-Force Channel Types:
- Tries multiple SSH CHANNEL_OPEN types (e.g., session, direct-tcpip, etc.).
- Some vulnerable servers respond differently based on accepted channel types.

## Command Injection:
- If a channel is successfully opened pre-auth, it sends a payload (e.g., whoami or a reverse shell).
- Designed to detect execution capability without crashing or alerting services unnecessarily.

## Resilience and Reporting:
- Automatically reconnects if the server disconnects.
- Supports multithreading for faster scans across large inventories.
- Includes timestamps, logs all results to results.txt, and provides a live progress bar.

File Snapshot

Remarks