OpenSSH 2.3 to 7.7 - Username Enumeration | CVE-2018-15473 Exploitation
#SSH #exploit #Username #openssh #pentesthint #chandanghodela
Join this channel to get access to perks:
/ @pentesthint
Method
The attacker can try to authenticate a user with a malformed packet (for example, a truncated packet), and:
if the user is invalid (it does not exist), then userauth_pubkey() returns immediately, and the server sends an SSH2_MSG_USERAUTH_FAILURE to the attacker;
if the user is valid (it exists), then sshpkt_get_u8() fails, and the server calls fatal() and closes its connection to the attacker.
Description
A user enumeration vulnerability flaw was found in OpenSSH, though version 7.7. The vulnerability occurs by not delaying bailout for an invalid authenticated user until after the packet containing the request has been fully parsed. The highest threat from this vulnerability is to data confidentiality.
Statement
Red Hat Product Security has rated this issue as having Low severity. An attacker could use this flaw to determine whether given usernames exist or not on the server, but no further information is disclosed and there is no availability or integrity impact. A future update may address this issue.
Mitigation
Configuring your firewall to limit the origin and/or rate of incoming ssh connections (using the netfilter xt_recent module) will limit the impact of this attack, as it requires a new TCP connection for each username tested. This configuration also provides some protection against brute-force attacks on SSH passwords or keys.
See the following article for more information on limiting access to SSHD: https://access.redhat.com/solutions/8687
As per Rapid7 Website:
Description
This module uses a malformed packet or timing attack to enumerate users on an OpenSSH server. The default action sends a malformed (corrupted) SSH_MSG_USERAUTH_REQUEST packet using public key authentication (must be enabled) to enumerate users. On some versions of OpenSSH under some configurations, OpenSSH will return a "permission denied" error for an invalid user faster than for a valid user, creating an opportunity for a timing attack to enumerate users. Testing note: invalid users were logged, while valid users were not. YMMV.
Module Options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf : use auxiliary/scanner/ssh/ssh_enumusers
msf auxiliary(ssh_enumusers) : show actions
...actions...
msf auxiliary(ssh_enumusers) : set ACTION action-name
msf auxiliary(ssh_enumusers) : show options
...show and set options...
msf auxiliary(ssh_enumusers) : run