CVE-2024-6387 - PoC - Remote Unauthenticated Code Execution Vulner

项目说明

<di="right">
<a href=" src="
</a>
</div>

!openssh C - PoC

📜 Description

> Note: This script is a quick prototype PoC, expect some errors and bugs may occur.
> Tested on: Kali Linux, ParrotSec, Ubuntu 22.04

Remote Unauthenticated Code Execution in OpenSSH server

A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH ), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls functions that are not async-signal-safe, for example, syslog().

📁 Table of Contents

📖 Details

⚙️ Usage

🔍 Host Discovery

🛠️ Mitigation

💁 References

📌 Author

📢 Disclaimer

✍🏻 Details

You can find the technical details here.

The flaw, discovered by researchers at Qualys in May 2024, and assigned the identifier C, is due to a signal handler race condition in sshd that allows unauthenticated remote attackers to execute arbitrary code as root.

"If a client does not authenticate within LoginGraceTime seconds (120 by default), then sshd's SIGALRM handler is called asynchronously and calls functions that are not async-signal-safe,"

"A remote unauthenticated attacker can take ad of this flaw to execute arbitrary code with root pri."

⚙️ Usage

Scanning OpenSSH Server

> Requirement: python3 latest

Exporting (csv,txt,json)

Multiple targets

Adding timeout

Network ranges

Custom port

Escalation Process

Getting Reverse shell

Custom payload

Actual payload

Compiling and initiating payload

Executing payload

Catching payload

🔍 Host Discovery

Hunter: /product.name="OpenSSH"

FOFA: app="OpenSSH"

SHODAN: product:"OpenSSH"

CENSYS: (openssh) and labels=remote-access

🛠️ Mitigation

Patch Management: Swiftly applying a patches for OpenSSH is critical to closing the gap. Timely patching ensures that known exploits cannot be le against your systems, thereby reducing the window of opportunity for attackers.

Enhanced Access Control: Limiting SSH access through network-based controls adds an additional layer of defense. This approach minimizes exposure to potential attackers by restricting SSH connections to only authorized networks or IP addresses. Implementing tools like firewall rules or using VPNs for secure access can effectively enforce these restrictions.

Network Segmentation: Di your network into segments helps contain the impact of a potential breach. By segmenting critical systems and sensitive data from less critical parts of your network, you reduce the risk of lateral mo by attackers. This segmentation can be complemented with strict access controls and monitoring to detect and respond to any unauthorized attempts to breach these segments.

Intrusion Detection Systems (IDS): Deploying IDS or intrusion pre systems (IPS) enables real-time monitoring of network traffic and system logs. These systems can detect suspicious acti and potential exploitation attempts associated with the regreSSHion . Alerts triggered by such systems allow for prompt in and mitigation before significant damage can occur.

Monitoring for Exploitation Attempts: Continuous monitoring of network and system logs is crucial. Look for any unusual patterns or acti that could indicate an attempt to exploit the OpenSSH . This proacti helps in identifying and responding to threats before they can cause harm.

💁 References

Original Author: C Scanner

Original Author: C PoC

Further Referencess

📌 Author

Facebook

Twitter (X)

Medium

Website

📢 Disclaimer

Important Note:

- *This tool is de and used solely for authorized penetration testing and red teaming exercises only. It is designed to identify and exploit in OpenSSH's server, on glibc-based Linux systems. Unauthorized use of this tool is strictly prohibited, The owner of this tool is not responsible for any unauthorized access or malicious use of the tool.*

Legal Notice:

- *Unauthorized use of this tool on systems or networks without explicit authorization from the respecti may applicable laws and regulations. Users are responsible for ensuring compliance with legal and ethical standards go cybersecurity testing and assessments.*

项目信息

开发语言：C

Star 数：113

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕PoC - Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (Scanner and Exploit) 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。