cve-2008-0116 only is exploitable if the vulnerable machine has the public key in authorized_keys file! or MITM passive

download or locate debian_ssh_rsa (1024 and 2048) https://hdm.io/tools/debian-openssl/debian_ssh_dsa_1024_x86.tar.bz2 https://hdm.io/tools/debian-openssl/debian_ssh_rsa_2048_x86.tar.bz2 https://hdm.io/tools/debian-openssl/debian_ssh_rsa_1023_x86.tar.bz2 https://hdm.io/tools/debian-openssl/debian_ssh_rsa_1024_x86.tar.bz2 https://hdm.io/tools/debian-openssl/debian_ssh_rsa_4096_x86.tar.bz2

try it with ubuntu 8.04 [800 MB]

get privkey of vulnerable key: COMPROMISED: 2048 5c:10:8a:c0:55:8c:1f:d9:4b:05:f0:35:0a:0d:2f:5c /home/someuser/.ssh/authorized_keys