CVE-2018-10933 PoC — libssh server-side state machine 安全漏洞

Source

https://github.com/xFreed0m/CVE-2018-10933

Associated Vulnerability

Title: libssh server-side state machine 安全漏洞 (CVE-2018-10933)
Description:A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Description

a python script to exploit libssh authentication vulnerability

Readme

This tool provides the ability to scan and exploit server running vulnerable versions of libssh.
vulnerability: https://www.libssh.org/security/advisories/CVE-2018-10933.txt
fix: https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/

this tool is meant to be used only on server you have approval to test and for educational purposes.

![POC](https://github.com/xFreed0m/CVE-2018-10933/raw/master/poc.bmp?raw=true "POC")

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →