SSH与远程终端访问安全高危攻击链专题：OpenSSH / Dropbear 漏洞全解析

#!/bin/bash
# CVE-2024-6387 受影响版本检测脚本
TARGET="${1:-localhost}"
PORT="${2:-22}"

BANNER=$(echo "" | timeout 5 curl -s "telnet://${TARGET}:${PORT}" 2>/dev/null)
if echo "$BANNER" | grep -qE "SSH-2.0-OpenSSH_(8\.[5-9]|9\.[0-7])"; then
    echo "[!] ${TARGET}:${PORT} 可能受 CVE-2024-6387 影响: $BANNER"
else
    echo "[*] ${TARGET}:${PORT} Banner: $BANNER"
    echo "[*] 无法确认是否受影响，建议使用 ssh -V 进一步验证"
fi

import socket
import sys
import time

def detect_openssh_version(target, port=22, timeout=5):
    """检测目标 OpenSSH 版本，判断是否受 CVE-2024-6387 影响"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(timeout)
        sock.connect((target, port))

        banner = sock.recv(1024).decode('utf-8', errors='ignore').strip()
        sock.close()

        print(f"[*] SSH Banner: {banner}")

        if "OpenSSH" not in banner:
            print("[*] 目标不是 OpenSSH 服务器")
            return banner, False

        version_str = banner.split("OpenSSH_")[1].split("p")[0]
        parts = version_str.split(".")
        major, minor = int(parts[0]), int(parts[1])

        vulnerable = False
        if major == 8 and minor >= 5:
            vulnerable = True
        elif major == 9 and minor <= 7:
            vulnerable = True

        if vulnerable:
            print(f"[!] 目标可能受 CVE-2024-6387 (regreSSHion) 影响!")
            print(f"    OpenSSH {version_str} 在 8.5p1 - 9.7p1 受影响范围")
            print(f"    需要 glibc-based Linux + 32位架构才能完整利用")
        else:
            print(f"[*] OpenSSH {version_str} 不在受影响范围内")

        return banner, vulnerable

    except socket.timeout:
        print(f"[!] 连接超时")
        return None, False
    except ConnectionRefusedError:
        print(f"[!] 连接被拒绝")
        return None, False
    except Exception as e:
        print(f"[!] 错误: {e}")
        return None, False

def test_login_grace_race(target, port=22, attempts=3):
    """测试 LoginGraceTime 竞态条件窗口（仅检测，不利用）"""
    print(f"\n[*] 测试 LoginGraceTime 竞态窗口 ({attempts} 次)...")

    for i in range(attempts):
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(2)
            sock.connect((target, port))

            sock.send(b"SSH-2.0-TestClient\r\n")
            time.sleep(0.001)
            sock.close()

            print(f"    [{i+1}/{attempts}] 连接并快速关闭")
        except:
            print(f"    [{i+1}/{attempts}] 连接异常")

    print("[*] 竞态测试完成，检查服务端日志确认是否存在异常")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 22")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 22

    banner, vulnerable = detect_openssh_version(target, port)

    if vulnerable:
        test_login_grace_race(target, port)

id: openssh-cve-2024-6387
info:
  name: OpenSSH regreSSHion Race Condition - CVE-2024-6387
  author: x7peeps
  severity: high
  description: |
    OpenSSH 8.5p1 至 9.7p1 版本存在 SIGALRM 信号处理竞态条件，
    未认证远程攻击者可在 glibc Linux 系统上触发远程代码执行。
    此漏洞是 CVE-2006-5051 的安全回归。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6387
    - https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cwe-id: CWE-362
  metadata:
    max-request: 1
  tags: openssh,cve2024,cve,rce,race-condition,regresshion

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "OpenSSH_8.5"
          - "OpenSSH_8.6"
          - "OpenSSH_8.7"
          - "OpenSSH_8.8"
          - "OpenSSH_8.9"
          - "OpenSSH_9.0"
          - "OpenSSH_9.1"
          - "OpenSSH_9.2"
          - "OpenSSH_9.3"
          - "OpenSSH_9.4"
          - "OpenSSH_9.5"
          - "OpenSSH_9.6"
          - "OpenSSH_9.7"
        condition: or

    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-OpenSSH_[0-9.]+p[0-9]+'

# 使用官方 Terrapin Scanner 检测（Go 语言）
# 下载: https://github.com/RUB-NDS/Terrapin-Scanner/releases/latest
./terrapin-scanner scan --host <TARGET_IP> --port 22

# 或通过 SSH 手动检查是否支持 kex-strict
ssh -vv -o StrictHostKeyChecking=no <TARGET_IP> 2>&1 | grep -i "kex-strict"
# 如果输出包含 "kex-strict-s-v00@openssh.com"，则服务器已修补

import socket
import struct

def detect_terrapin_vulnerability(target, port=22):
    """检测目标是否易受 Terrapin 攻击"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((target, port))

        banner = sock.recv(1024).decode('utf-8', errors='ignore').strip()
        print(f"[*] SSH Banner: {banner}")

        if "OpenSSH" in banner:
            version = banner.split("OpenSSH_")[1]
            print(f"[*] OpenSSH 版本: {version}")

            major = int(version.split(".")[0])
            minor = int(version.split("p")[0].split(".")[-1])

            if major < 9 or (major == 9 and minor < 6):
                print("[!] 可能受 CVE-2023-48795 (Terrapin) 影响")
                print("[!] 检查是否支持 Strict Key Exchange:")
                print("    在服务器响应中查找 kex-strict-s-v00@openssh.com")
                print("[!] 建议禁用 chacha20-poly1305 和 -etm MAC 作为临时缓解")
            else:
                print("[*] 版本较新，但建议确认 kex-strict 支持")

        sock.close()
        return banner

    except Exception as e:
        print(f"[!] 检测失败: {e}")
        return None

if __name__ == "__main__":
    import sys
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target> [port]")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 22
    detect_terrapin_vulnerability(target, port)

id: openssh-cve-2023-48795-terrapin
info:
  name: SSH Terrapin Prefix Truncation - CVE-2023-48795
  author: x7peeps
  severity: medium
  description: |
    SSH 协议 Terrapin 前缀截断攻击，通过序列号操纵可删除
    握手阶段消息而不触发 MAC 失败，导致安全特性降级。
  reference:
    - https://terrapin-attack.com/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-48795
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 5.9
    cwe-id: CWE-354
  tags: ssh,terrapin,cve2023,cve,protocol-truncation

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "OpenSSH"

      - type: word
        negative: true
        words:
          - "kex-strict-s-v00"

    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-OpenSSH_[0-9.]+p[0-9]+'

# 检测系统是否启用了 agent forwarding 配置
grep -r "ForwardAgent\|ForwardAgent" /etc/ssh/ssh_config ~/.ssh/config 2>/dev/null

# 检查 ssh-agent 是否使用了 PKCS#11
ssh-agent -l 2>/dev/null || echo "未运行 ssh-agent 或无 PKCS#11 令牌"

import os
import subprocess

def check_agent_forwarding_risk():
    """检测 CVE-2023-38408 相关的 ssh-agent 配置风险"""
    print("[*] CVE-2023-38408 - ssh-agent 远程代码执行风险检测")
    print("=" * 55)

    # 检测 OpenSSH 版本
    try:
        result = subprocess.run(['ssh', '-V'], capture_output=True, text=True)
        version = result.stderr.strip()
        print(f"[*] OpenSSH 版本: {version}")

        if "OpenSSH" in version:
            ver_str = version.split("_")[1]
            parts = ver_str.split("p")[0].split(".")
            major, minor = int(parts[0]), int(parts[1])
            patch = int(ver_str.split("p")[1]) if "p" in ver_str else 0

            if major < 9 or (major == 9 and minor < 3) or (major == 9 and minor == 3 and patch < 2):
                print("[!] 版本受 CVE-2023-38408 影响!")
            else:
                print("[*] 版本已修复")
    except FileNotFoundError:
        print("[!] 未找到 ssh 命令")

    # 检测 Agent Forwarding 配置
    print("\n[*] 检查 Agent Forwarding 配置...")
    ssh_config = os.path.expanduser("~/.ssh/config")
    if os.path.exists(ssh_config):
        with open(ssh_config, 'r') as f:
            content = f.read()
            if "ForwardAgent yes" in content.lower():
                print("[!] ~/.ssh/config 中启用了 ForwardAgent!")
                print("    建议：仅在必要时启用，且避免转发到不受信任的主机")

    # 检测环境变量
    auth_sock = os.environ.get('SSH_AUTH_SOCK', '')
    if auth_sock:
        print(f"[*] SSH_AUTH_SOCK: {auth_sock}")

    print("\n[*] 缓解建议:")
    print("    1. 升级到 OpenSSH 9.3p2 或更高版本")
    print("    2. 启动 ssh-agent 时使用空 PKCS#11 允许列表: ssh-agent -P ''")
    print("    3. 避免将 agent 转发到不受信任的主机")

if __name__ == "__main__":
    check_agent_forwarding_risk()

id: openssh-cve-2023-38408
info:
  name: OpenSSH ssh-agent PKCS#11 RCE - CVE-2023-38408
  author: x7peeps
  severity: critical
  description: |
    OpenSSH ssh-agent 的 PKCS#11 功能存在不充分的搜索路径信任，
    当 agent 被转发到攻击者控制的系统时，可加载任意共享库实现 RCE。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38408
    - https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-428
  tags: openssh,cve2023,cve,ssh-agent,pkcs11,rce

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "OpenSSH"
          - "9.2"
          - "9.1"
          - "9.0"
          - "8.9"
          - "8.8"
        condition: and

    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-OpenSSH_[0-9.]+p[0-9]+'

ProxyCommand ssh -W %h:%p %r@` malicious_command `

# 检查 SSH 配置中是否存在不安全的 ProxyCommand 使用
grep -n "ProxyCommand\|LocalCommand\|Match exec" /etc/ssh/ssh_config ~/.ssh/config 2>/dev/null

import subprocess
import os

def check_proxycommand_injection_risk():
    """检测 ProxyCommand 命令注入风险"""
    print("[*] CVE-2023-51385 - OS 命令注入风险检测")
    print("=" * 50)

    configs = [
        '/etc/ssh/ssh_config',
        os.path.expanduser('~/.ssh/config')
    ]

    for config_path in configs:
        if not os.path.exists(config_path):
            continue

        print(f"\n[*] 检查 {config_path}...")
        with open(config_path, 'r') as f:
            for line_no, line in enumerate(f, 1):
                line = line.strip()
                if line.startswith('#'):
                    continue
                if 'ProxyCommand' in line or 'LocalCommand' in line:
                    if '%h' in line or '%u' in line:
                        print(f"  [!] 行 {line_no}: {line}")
                        print("      含有 %h/%u 转换令牌，需检查主机名是否来自可信来源")

    print("\n[*] 缓解建议:")
    print("    1. 升级到 OpenSSH 9.6p1 或更高版本")
    print("    2. 确保 ProxyCommand 中引用的主机名来自可信来源")
    print("    3. 避免在不受信任的仓库中递归克隆 submodules")

if __name__ == "__main__":
    check_proxycommand_injection_risk()

id: openssh-cve-2023-51385
info:
  name: OpenSSH ProxyCommand OS Command Injection - CVE-2023-51385
  author: x7peeps
  severity: medium
  description: |
    OpenSSH 9.6 之前版本中，当用户名或主机名包含 shell 元字符时，
    ProxyCommand/LocalCommand 中的 %h/%u 转换可能导致命令注入。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-51385
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cwe-id: CWE-78
  tags: openssh,cve2023,cve,command-injection,proxycommand

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "OpenSSH"
        negative: false

    matchers-condition: and

    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-OpenSSH_[0-9.]+p[0-9]+'

# 检查 OpenSSH 版本
ssh -V 2>&1

# 检查 VerifyHostKeyDNS 配置
grep -r "VerifyHostKeyDNS" /etc/ssh/ssh_config ~/.ssh/config 2>/dev/null
# 默认值为 "no"，如果设置为 "yes" 或 "ask" 则存在风险

import subprocess
import os

def check_verifyhostkeydns_risk():
    """检测 CVE-2025-26465 MitM 认证绕过风险"""
    print("[*] CVE-2025-26465 - VerifyHostKeyDNS MitM 绕过检测")
    print("=" * 55)

    try:
        result = subprocess.run(['ssh', '-V'], capture_output=True, text=True)
        version = result.stderr.strip()
        print(f"[*] SSH 版本: {version}")
    except:
        print("[!] 无法获取 SSH 版本")
        return

    configs = ['/etc/ssh/ssh_config', os.path.expanduser('~/.ssh/config')]
    vulnerable = False

    for config_path in configs:
        if not os.path.exists(config_path):
            continue
        with open(config_path, 'r') as f:
            for line in f:
                line = line.strip()
                if line.startswith('#'):
                    continue
                if 'VerifyHostKeyDNS' in line and ('yes' in line.lower() or 'ask' in line.lower()):
                    print(f"[!] {config_path} 中启用 VerifyHostKeyDNS: {line}")
                    vulnerable = True

    if not vulnerable:
        print("[*] VerifyHostKeyDNS 未启用（默认 no），风险较低")
    else:
        print("[!] 存在 CVE-2025-26465 风险，建议禁用 VerifyHostKeyDNS")

if __name__ == "__main__":
    check_verifyhostkeydns_risk()

id: openssh-cve-2025-26465
info:
  name: OpenSSH VerifyHostKeyDNS MitM Bypass - CVE-2025-26465
  author: x7peeps
  severity: medium
  description: |
    当 OpenSSH 客户端启用 VerifyHostKeyDNS 时，MitM 攻击者可
    绕过主机密钥验证，接受伪造的服务器密钥。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26465
    - https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
    cvss-score: 6.8
    cwe-id: CWE-390
  tags: openssh,cve2025,cve,mitm,verifyhostkeydns,auth-bypass

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "OpenSSH"

    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-OpenSSH_[0-9.]+p[0-9]+'

# 服务端缓解配置
# 在 /etc/ssh/sshd_config 中添加/修改：
# LoginGraceTime 60
# MaxStartups 10:30:60
# PerSourcePenalties 1:authfail:5,2:authfail:3

import socket
import time

def test_ping_flood_dos(target, port=22, packet_count=100):
    """CVE-2025-26466 - 预认证 DoS 检测（仅发送少量测试包）"""
    print(f"[*] CVE-2025-26466 - 预认证 DoS 检测")
    print(f"[*] 目标: {target}:{port}")
    print(f"[!] 注意: 仅发送 {packet_count} 个测试包")

    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((target, port))

        banner = sock.recv(1024)
        print(f"[*] Banner: {banner.decode('utf-8', errors='ignore').strip()}")

        sock.send(b"SSH-2.0-TestClient\r\n")

        for i in range(packet_count):
            try:
                pingo = b'\x00' * 32
                sock.send(pingo)
            except:
                break

        print(f"[*] 发送了 {i+1} 个测试消息")
        print("[*] 检查目标内存使用情况以确认是否存在内存增长")
        sock.close()

    except Exception as e:
        print(f"[!] 检测出错: {e}")

if __name__ == "__main__":
    import sys
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target> [port] [count]")
        sys.exit(1)
    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 22
    count = int(sys.argv[3]) if len(sys.argv) > 3 else 100
    test_ping_flood_dos(target, port, count)

id: openssh-cve-2025-26466
info:
  name: OpenSSH Pre-Auth DoS via Ping Flood - CVE-2025-26466
  author: x7peeps
  severity: medium
  description: |
    OpenSSH 9.5p1 至 9.9p1 存在预认证 DoS 漏洞，通过发送
    SSH2_MSG_PING 消息可耗尽服务器内存和 CPU。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26466
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 5.9
    cwe-id: CWE-400
  tags: openssh,cve2025,cve,dos,memory-exhaustion

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "OpenSSH_9.5"
          - "OpenSSH_9.6"
          - "OpenSSH_9.7"
          - "OpenSSH_9.8"
          - "OpenSSH_9.9"
        condition: or

    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-OpenSSH_[0-9.]+p[0-9]+'

# 检测客户端版本
ssh -V 2>&1

# 如果版本低于 10.4p1，存在风险
# 特别注意: CI/CD 管道、跳板机、Ansible 等自动化工具中的 SSH 客户端

import subprocess

def check_openssh_client_version():
    """检测 OpenSSH 客户端版本是否受 CVE-2026-60002 影响"""
    print("[*] CVE-2026-60002 - OpenSSH 客户端 UAF 检测")
    print("=" * 50)

    try:
        result = subprocess.run(['ssh', '-V'], capture_output=True, text=True)
        version = result.stderr.strip()
        print(f"[*] SSH 客户端: {version}")

        if "OpenSSH" in version:
            ver_str = version.split("_")[1]
            parts = ver_str.split("p")
            ver_num = parts[0]
            ver_parts = ver_num.split(".")

            if len(ver_parts) >= 2:
                major = int(ver_parts[0])
                minor = int(ver_parts[1])

                if major < 10 or (major == 10 and minor == 0):
                    print("[!] 客户端受 CVE-2026-60002 影响!")
                    print("    此漏洞为客户端侧 UAF，恶意服务器可在密钥重交换时触发")
                    print("    影响: ssh, scp, sftp 及所有使用 SSH 客户端的自动化工具")
                else:
                    print("[*] 客户端版本已修复")
    except FileNotFoundError:
        print("[!] 未找到 ssh 命令")

    print("\n[*] 高风险场景:")
    print("    - 跳板机/堡垒机的出站 SSH 连接")
    print("    - CI/CD 管道中通过 SSH 拉取代码或部署")
    print("    - Ansible/Fabric 等配置管理工具")

if __name__ == "__main__":
    check_openssh_client_version()

id: openssh-cve-2026-60002
info:
  name: OpenSSH Client Use-After-Free - CVE-2026-60002
  author: x7peeps
  severity: high
  description: |
    OpenSSH 10.4 之前的客户端存在 UAF 漏洞，当恶意服务器在
    密钥重交换时更改主机密钥，可导致客户端崩溃或 RCE。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-60002
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
    cvss-score: 7.7
    cwe-id: CWE-416
  tags: openssh,cve2026,cve,uaf,client

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "OpenSSH"

    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-OpenSSH_[0-9.]+p?[0-9]*'

# 检查 sshd 配置中的相关指令
grep -n "AuthorizedKeysCommand\|AuthorizedPrincipalsCommand\|AuthorizedKeysCommandUser" /etc/ssh/sshd_config

def check_authorizedkeyscommand_risk():
    """检测 CVE-2021-41617 权限提升风险"""
    print("[*] CVE-2021-41617 - AuthorizedKeysCommand 权限提升检测")

    try:
        with open('/etc/ssh/sshd_config', 'r') as f:
            config = f.read()

        has_akc = 'AuthorizedKeysCommand' in config
        has_apc = 'AuthorizedPrincipalsCommand' in config

        if has_akc or has_apc:
            print("[!] 检测到 AuthorizedKeysCommand/PrincipalsCommand 配置")
            print("    确认是否使用了对应的 User 指令以非 root 运行")
            print("    如果是，此系统可能受 CVE-2021-41617 影响")
        else:
            print("[*] 未检测到相关配置，风险较低")
    except FileNotFoundError:
        print("[!] 未找到 /etc/ssh/sshd_config")

if __name__ == "__main__":
    check_authorizedkeyscommand_risk()

id: openssh-cve-2021-41617
info:
  name: OpenSSH AuthorizedKeysCommand Privilege Escalation - CVE-2021-41617
  author: x7peeps
  severity: high
  description: |
    当使用非默认的 AuthorizedKeysCommand/PrincipalsCommand 配置时，
    辅助程序可能以 sshd 进程的补充组权限运行，导致权限提升。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-41617
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.0
    cwe-id: CWE-269
  tags: openssh,cve2021,cve,privilege-escalation,authorizedkeyscommand

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "SSH"
          - "OpenSSH"
        condition: or

# 检测 ssh-agent socket 权限
ls -la $SSH_AUTH_SOCK 2>/dev/null
# 确认 socket 文件权限是否限制为当前用户

import os
import stat

def check_agent_socket_permissions():
    """检测 CVE-2021-28041 相关的 agent socket 权限风险"""
    print("[*] CVE-2021-28041 - ssh-agent Double Free 风险检测")

    auth_sock = os.environ.get('SSH_AUTH_SOCK', '')
    if not auth_sock:
        print("[*] 未设置 SSH_AUTH_SOCK，ssh-agent 未运行")
        return

    print(f"[*] SSH_AUTH_SOCK: {auth_sock}")

    if os.path.exists(auth_sock):
        stat_info = os.stat(auth_sock)
        mode = stat.S_IMODE(stat_info.st_mode)
        print(f"[*] Socket 权限: {oct(mode)}")

        if mode & stat.S_IWOTH:
            print("[!] Socket 对其他用户可写！存在高风险")
        elif mode & stat.S_IROTH:
            print("[!] Socket 对其他用户可读，建议收紧权限")
        else:
            print("[*] Socket 权限正常")
    else:
        print("[!] Socket 文件不存在")

if __name__ == "__main__":
    check_agent_socket_permissions()

id: openssh-cve-2021-28041
info:
  name: OpenSSH ssh-agent Double Free - CVE-2021-28041
  author: x7peeps
  severity: high
  description: |
    OpenSSH 8.5 之前的 ssh-agent 存在 double free 漏洞，
    在 agent socket 不受约束或转发到攻击者主机时可利用。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-28041
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 7.0
    cwe-id: CWE-415
  tags: openssh,cve2021,cve,ssh-agent,double-free

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "OpenSSH"
    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-OpenSSH_[0-9.]+p?[0-9]*'

# 此漏洞需要通过 SSH 协议观察算法协商
# 可使用 ssh-audit 工具检测
# pip install ssh-audit
ssh-audit <TARGET_IP>:22

def check_algorithm_negotiation_risk():
    """检测 CVE-2020-14145 信息泄露风险"""
    print("[*] CVE-2020-14145 - 算法协商信息泄露检测")
    print("=" * 50)
    print("[*] 此漏洞为客户端侧信息泄露")
    print("[*] 攻击者通过观察算法偏好推断首次连接状态")
    print()
    print("[*] 缓解建议:")
    print("    1. 确保 known_hosts 文件包含所有常用服务器的主机密钥")
    print("    2. 使用 UpdateHostkeys yes 让服务器主动更新密钥")
    print("    3. 考虑部署 SSHFP DNS 记录配合 VerifyHostKeyDNS")
    print("    4. 注意: OpenSSH 上游认为禁用自动排序会降低整体安全性")

if __name__ == "__main__":
    check_algorithm_negotiation_risk()

id: openssh-cve-2020-14145
info:
  name: OpenSSH Algorithm Negotiation Info Leak - CVE-2020-14145
  author: x7peeps
  severity: medium
  description: |
    OpenSSH 客户端在算法协商中存在可观测差异，可泄露
    客户端是否缓存了服务器主机密钥，辅助 MitM 攻击。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-14145
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 5.9
    cwe-id: CWE-200
  tags: openssh,cve2020,cve,information-disclosure,mitm

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "OpenSSH"
    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-OpenSSH_[0-9.]+p?[0-9]*'

# 检测 Dropbear 版本
dropbear -V 2>&1 || strings /usr/sbin/dropbear | grep "dropbear_"

# 检查是否可通过 SSH 转发 Unix socket
# 需要有效的 SSH 认证
ssh -L /tmp/test.sock:/var/run/docker.sock user@target 2>/dev/null && \
    echo "[!] 可能受 CVE-2025-14282 影响"

import subprocess
import os

def check_dropbear_version():
    """检测 Dropbear 版本和 CVE-2025-14282 风险"""
    print("[*] CVE-2025-14282 - Dropbear Unix Socket 提权检测")
    print("=" * 55)

    try:
        result = subprocess.run(
            ['strings', '/usr/sbin/dropbear'],
            capture_output=True, text=True, timeout=5
        )
        for line in result.stdout.split('\n'):
            if 'dropbear_' in line:
                print(f"[*] Dropbear 标识: {line.strip()}")
                if 'dropbear_2024' in line or 'dropbear_2025.0' in line:
                    print("[!] 可能受 CVE-2025-14282 影响!")
                break
    except:
        print("[!] 无法检测 Dropbear 版本")

    print("\n[*] 受影响的典型设备:")
    print("    - OpenWRT 路由器（默认使用 Dropbear）")
    print("    - IoT 设备和 NAS")
    print("    - 嵌入式 Linux 系统")

    print("\n[*] 缓解措施:")
    print("    1. 升级到 Dropbear 2025.89 或更高版本")
    print("    2. 临时禁用: dropbear -j（同时禁用 TCP 转发）")
    print("    3. 源码编译: #define DROPBEAR_SVR_LOCALSTREAMFWD 0")

if __name__ == "__main__":
    check_dropbear_version()

id: dropbear-cve-2025-14282
info:
  name: Dropbear Unix Socket Privilege Escalation - CVE-2025-14282
  author: x7peeps
  severity: critical
  description: |
    Dropbear 2024.84 至 2025.88 存在 Unix socket 转发提权漏洞，
    任何已认证用户可通过 SO_PEERCRED 绕过以 root 身份连接敏感 socket。
  reference:
    - https://www.openwall.com/lists/oss-security/2025/12/16/2
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-266
  tags: dropbear,cve2025,cve,privilege-escalation,unix-socket

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "dropbear"
          - "Dropbear"
        condition: or

    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-dropbear_[0-9]+'

# 此漏洞需要本地访问或脚本调用
# 检查使用 dbclient 的自动化脚本
grep -rn "dbclient" /etc/ /usr/local/bin/ /opt/ 2>/dev/null | head -20

def check_dbclient_injection_risk():
    """检测 CVE-2025-47203 dbclient 命令注入风险"""
    print("[*] CVE-2025-47203 - Dropbear dbclient 命令注入检测")
    print("=" * 55)

    import os
    import subprocess

    # 检查系统是否安装了 Dropbear 的 dbclient
    try:
        result = subprocess.run(['which', 'dbclient'], capture_output=True, text=True)
        if result.returncode == 0:
            print(f"[!] 检测到 dbclient: {result.stdout.strip()}")
            print("    确认版本是否 < 2025.88")
        else:
            print("[*] 未检测到 dbclient")
    except:
        print("[*] 无法检测 dbclient")

    print("\n[*] 此漏洞影响使用 dbclient 的脚本和自动化工具")
    print("[*] 缓解措施:")
    print("    1. 升级到 Dropbear 2025.88 或更高版本")
    print("    2. 审计所有调用 dbclient 的脚本，确保主机名参数来自可信来源")
    print("    3. 实施严格的输入验证")

if __name__ == "__main__":
    check_dbclient_injection_risk()

id: dropbear-cve-2025-47203
info:
  name: Dropbear dbclient Command Injection - CVE-2025-47203
  author: x7peeps
  severity: moderate
  description: |
    Dropbear 2025.88 之前的 dbclient 通过 shell 处理主机名参数，
    允许攻击者通过恶意主机名注入任意命令。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-47203
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 4.5
    cwe-id: CWE-78
  tags: dropbear,cve2025,cve,command-injection,dbclient

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "dropbear"
        condition: or

    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-dropbear_[0-9]+'

# 此漏洞需要恶意 SSH 服务器配合
# 检测 Dropbear 版本
dropbear -V 2>&1

def check_dropbear_auth_bypass():
    """检测 CVE-2021-36369 认证绕过风险"""
    print("[*] CVE-2021-36369 - Dropbear 认证方法绕过检测")
    print("=" * 55)
    print("[*] 影响: Dropbear ≤ 2020.81")
    print("[*] 修复: Dropbear 2022.82")
    print()
    print("[*] 风险场景:")
    print("    - 使用 Dropbear 客户端连接不受信任的 SSH 服务器")
    print("    - 被恶意服务器滥用转发的 agent 进行横向移动")

if __name__ == "__main__":
    check_dropbear_auth_bypass()

id: dropbear-cve-2021-36369
info:
  name: Dropbear Authentication Method Bypass - CVE-2021-36369
  author: x7peeps
  severity: high
  description: |
    Dropbear 2020.81 及之前版本客户端认证方法检查不符合 RFC 标准，
    恶意服务器可绕过 FIDO2 等安全措施并滥用 agent forwarding。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-36369
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cwe-id: CWE-287
  tags: dropbear,cve2021,cve,auth-bypass

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22
    matchers:
      - type: word
        words:
          - "dropbear"
    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-dropbear_[0-9]+'

# 此漏洞需要恶意 SCP 服务器配合
# 检测 Dropbear 版本以确认风险
dropbear -V 2>&1

def check_scp_file_overwrite_risk():
    """检测 CVE-2020-36254 SCP 文件覆盖风险"""
    print("[*] CVE-2020-36254 - Dropbear SCP 文件覆盖检测")
    print("=" * 50)
    print("[*] 影响: Dropbear < 2020.79")
    print("[*] 漏洞: scp.c 错误处理 . 或空文件名")
    print("[*] 风险: 连接恶意 SCP 服务器时可被覆盖任意文件")
    print()
    print("[*] 缓解建议:")
    print("    1. 升级到 Dropbear 2020.79 或更高版本")
    print("    2. 避免使用 SCP 连接不受信任的服务器")
    print("    3. 考虑使用 SFTP 替代 SCP")

if __name__ == "__main__":
    check_scp_file_overwrite_risk()

id: dropbear-cve-2020-36254
info:
  name: Dropbear SCP Filename File Overwrite - CVE-2020-36254
  author: x7peeps
  severity: high
  description: |
    Dropbear 2020.79 之前的 scp.c 错误处理 . 或空文件名，
    可能导致连接恶意服务器时文件被覆盖。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-36254
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cwe-id: CWE-20
  tags: dropbear,cve2020,cve,scp,file-overwrite

tcp:
  - inputs:
      - data: "SSH-2.0-TestClient\r\n"
        read: 1024
    host:
      - "{{Hostname}}"
    port: 22
    matchers:
      - type: word
        words:
          - "dropbear"
    extractors:
      - type: regex
        regex:
          - 'SSH-2.0-dropbear_[0-9]+'

# 1. 检查 OpenSSH 版本
ssh -V 2>&1
# 确认版本号是否在受影响范围内

# 2. 检查 Dropbear 版本（嵌入式设备）
dropbear -V 2>&1 || strings /usr/sbin/dropbear | grep -i dropbear

# 3. 检查 SSH 服务状态和配置
systemctl status sshd
cat /etc/ssh/sshd_config | grep -E "LoginGraceTime|MaxStartups|PermitRootLogin|ForwardAgent|AuthorizedKeysCommand"

# 4. 检查 ssh-agent 相关配置
grep -r "ForwardAgent" /etc/ssh/ ~/.ssh/ 2>/dev/null
grep -r "VerifyHostKeyDNS" /etc/ssh/ ~/.ssh/ 2>/dev/null
grep -r "ProxyCommand\|LocalCommand" /etc/ssh/ ~/.ssh/ 2>/dev/null

# 5. 检查 SSH 连接日志
journalctl -u sshd --since "24 hours ago" | grep -iE "fail|error|invalid|refused"

# 6. 检查是否有异常 SSH 进程
ps aux | grep -E "ssh-agent|sshd" | grep -v grep

# 7. 检查 agent socket 权限
ls -la $SSH_AUTH_SOCK 2>/dev/null

# /etc/ssh/sshd_config 推荐加固配置

# 协议版本
Protocol 2

# 登录超时（降低 regreSSHion 利用窗口）
LoginGraceTime 60
MaxStartups 10:30:60

# 禁用密码认证（仅允许密钥认证）
PasswordAuthentication no
ChallengeResponseAuthentication no
PubkeyAuthentication yes

# 禁用不安全的转发
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
PermitTunnel no
DisableForwarding yes

# 使用强加密算法（防范 Terrapin）
Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256

# 限制认证尝试
MaxAuthTries 3
PerSourcePenalties 1:authfail:5,2:authfail:3

# 禁用不安全的选项
PermitUserEnvironment no
PermitEmptyPasswords no
IgnoreRhosts yes

# 启用日志级别
LogLevel VERBOSE