POC详情： adda1c9fbc74480660d8f37fbee1a82f7640e8e6

来源
https://github.com/youkergav/CVE-2018-10933
关联漏洞
标题： libssh server-side state machine 安全漏洞 (CVE-2018-10933)
描述：libssh是一个用于访问SSH服务的C语言开发包，它能够执行远程命令、文件传输，同时为远程的程序提供安全的传输通道。server-side state machine是其中的一个服务器端状态机。 libssh的server-side state machine 0.7.6之前版本和0.8.4之前版本中存在安全漏洞。攻击者可借助恶意的客户端利用该漏洞在不进行身份验证的情况下创建通道，进而获取未授权的访问权限。
描述
Authentication Bypass in Server Code for LibSSH
介绍
# Authentication Bypass in Server Code

CVE-2018-10933
Versions 0.7.6 to 0.8.4

## Description
libssh versions 0.6 and above have an authentication bypass vulnerability in the server code.  By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without any credentials.

The bug was discovered by Peter Winter-Smith of NCC Group.

## Installation
A POC demo of this vulnerability exists as a docker image.
```bash
cd ./CVE-2018-10933/docker
docker-compose up
```
## Credits
Docker image and vulnerability based off of <a href="https://github.com/hackerhouse-opensource/cve-2018-10933" target="_blank">https://github.com/hackerhouse-opensource/cve-2018-10933</a>.

Description based off of <a href="https://www.libssh.org/security/advisories/CVE-2018-10933.txt" target="_blank">https://www.libssh.org/security/advisories/CVE-2018-10933.txt</a>.

CVE based off of <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-10933" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2018-10933</a>.

The bug was discovered by Peter Winter-Smith of NCC Group.

Patches are provided by the Anderson Toshiyuki Sasaki of Red Hat and the libssh team.
文件快照

 [4.0K]  /data/pocs/adda1c9fbc74480660d8f37fbee1a82f7640e8e6
├── [4.0K]  docker
│   ├── [ 969]  cve-2018-10933.patch
│   ├── [ 183]  docker-compose.yml
│   ├── [1.2K]  Dockerfile
│   ├── [412K]  libssh-0.8.3.tar.xz
│   └── [ 513]  server.patch
├── [4.0K]  exploit
│   └── [ 422]  exploit.py
└── [1.3K]  README.md

2 directories, 7 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。