Scanning for open SSH connections (regardless of port) and reporting hostname and openssh versions
On July 1, 2024, a new OpenSSH unauthenticated remote code execution (RCE) vulnerability dubbed regreSSHion was reported, affecting glibc-based Linux systems. This vulnerability, identified as CVE-2024-6387, allows remote attackers to execute arbitrary code as root due to a signal handler race condition in sshd.
This vulnerability, if exploited, could lead to full system compromise, where an attacker can execute arbitrary code with the highest privileges, resulting in a complete system takeover, installation of malware, data manipulation, and the creation of backdoors for persistent access. It could facilitate network propagation, allowing attackers to use a compromised system as a foothold to traverse and exploit other vulnerable systems within the organization.
-
The regreSSHion flaw impacts OpenSSH servers on Linux from version 8.5p1 up to, but not including 9.8p1.
-
Versions 4.4p1 up to, but not including 8.5p1 are not vulnerable to CVE-2024-6387 thanks to a patch for CVE-2006-5051, which secured a previously unsafe function.
-
Versions older than 4.4p1 are vulnerable to regreSSHion unless they are patched for CVE-2006- 5051 and CVE-2008-4109. OpenBSD systems are not impacted by this flaw thanks to a secure mechanism introduced back in 2001
Openssh patches will need to be applied across various linux distributions. In order to know which systems require a patch, it may be necessary to scan the network for servers listening for SSH connections.
It is often a best practice to setup SSH on ports that are not the default (22). In this case, discovery can be more complicated.
openssh-cve-discovery.py will leverage nmap to scan your chosen CIDR block for open SSH services running on any port, not just 22. It will collect the hostname, local IP, and OpenSSH version running. Versions matching the above vulnerable versions will be logged in the ssh_scan_report.csv.
- Network Scanning: Scans a specified network range for SSH services using nmap’s version detection feature.
- Chunked Processing: Handles large networks efficiently by scanning in smaller chunks.
- Timeout and Error Handling: Includes timeouts for each scan chunk and robust error handling to manage exceptions gracefully.
- Command-Line Configuration: Allows users to specify the network range to scan via a command-line argument (
--cidr). - Detailed Logging: Logs all scan actions and results to a log file (
ssh_scan.log). - CSV Reporting: Generates a CSV report (
ssh_scan_report.csv) summarizing the hostname, IP address, OpenSSH version, and vulnerability status for each detected SSH service.
-
Run the Script: Execute the script with sudo privileges and the desired network range:
sudo python3 openssh-cve-discovery.py --cidr 192.168.0.0/24
-
Check Logs and Reports:
ssh_scan.log: Detailed log of all actions and results during the scan.ssh_scan_report.csv: Summarized CSV report with hostname, IP address, OpenSSH version, and vulnerability status.
test@ubuntu$ python3 openssh-cve-discovery.py --cidr 192.168.0.1/24
Scanning started at: 2024-07-02 19:19:03.655845
Total hosts to scan: 254
Host: ubuntu-linux-22-04-desktop, Port: 2222, OpenSSH Version: OpenSSH 8.9p1 Ubuntu 3ubuntu0.7, Vulnerability: Vulnerable to regreSSHion
Host: 192.168.0.150, Port: 22, OpenSSH Version: OpenSSH 8.9p1 Ubuntu 3ubuntu0.10, Vulnerability: Vulnerable to regreSSHion
Scanning completed at: 2024-07-02 19:25:23.480468
Duration: 0:06:19.824623
test@ubuntu$
test@ubuntu$$ cat ssh_scan_report.csv
Hostname,IP Address,OpenSSH Version,Vulnerability Status
ubuntu-linux-22-04-desktop,192.168.0.35,OpenSSH 8.9p1 Ubuntu 3ubuntu0.7,Vulnerable to regreSSHion
192.168.0.150,192.168.0.150,OpenSSH 8.9p1 Ubuntu 3ubuntu0.10,Vulnerable to regreSSHion
test@ubuntu$