关联漏洞
标题：
PuTTY 安全漏洞
(CVE-2024-31497)
描述：PuTTY是Simon Tatham个人开发者的一套免费的Telnet、Rlogin和SSH客户端软件。该软件主要用于对Linux系统进行远程管理。 PuTTY 0.68版本至0.80版本存在安全漏洞，该漏洞源于存在有偏差的随机数生成，允许攻击者通过快速攻击来恢复用户的NIST P-521密钥。
描述
Proof Of Concept that exploits PuTTy CVE-2024-31497.
介绍
# CVE-2024-31497 POC
This vulnerability exploits the biased ECDSA nonce generation in the ```ecc-ssh.c``` file. The nonce is generated with $sha512(ID\ ||\ sha512(privKey)\ ||\ sha1(data))\ mod\ q$ leaving the top 9 bits to zero. In order to recover the private key we need 60 signatures but with 58 we still have 50% probability of success.
Vuln discovered by Bäumer and Marcus Brinkmann.
## Requirements
In order to use this exploit you must have [sagemath](https://github.com/sagemath/sage/) and the python dependencies in ```requirements.txt``` installed.
## Attack Surface
1. Extract the ECDSA signatures from 60 verified GitHub commits that used PuTTy or TortoiseGit to sign the commit content.
2. Another possible attack is to set up a rogue SSH server where victims connect (using PuTTY or Pageant) and after several connections you can retrieve the 60 signatures to recover the private key.
## Arguments
- The signature file must contain the **message hash**, a space and the values of **r** and **s** concatenated.
- The **pubkey** file input, can be in raw, PEM, DER or OpenSSH format.
## Acknowledgements
This poc uses part of the [malb](https://github.com/malb) implementation of the paper [On Bounded Distance Decoding with Predicate: Breaking the "Lattice Barrier" for the Hidden Number Problem](https://eprint.iacr.org/2020/1540.pdf)
文件快照
[4.0K] /data/pocs/e633b58ef641e0bd9a76e8f56cdd4716f9d69b8f
├── [4.0K] attack
│ ├── [ 22K] ecdsa_hnp.py
│ ├── [1.1K] exploit.py
│ ├── [ 31K] usvp.py
│ └── [1003] utils.py
├── [2.5K] main.py
├── [1.3K] README.md
├── [ 74] requirements.txt
├── [4.0K] test
│ ├── [ 267] pubkey.pub
│ └── [ 23K] signatures.txt
└── [ 557] test.py
2 directories, 10 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。