[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20240728182225.GA19232@openwall.com>
Date: Sun, 28 Jul 2024 20:22:25 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2024-6387: RCE in OpenSSH's server, on glibc-based Linux systems
On Wed, Jul 03, 2024 at 11:26:54AM +0000, Qualys Security Advisory wrote:
> Many people have asked us about an alleged proof of concept named
> "7etsuo-regreSSHion.c": it is not a proof of concept, it is essentially
> empty code (it might even be dangerous to compile and execute, we have
> not checked). It is not just the shellcode that is missing, everything
> else is missing too: the key-exchange code does nothing, the public-key
> code does nothing useful, etc etc.
>
> It looks great but it does nothing. A working proof of concept for this
> vulnerability will be much longer and complex, and will take much more
> time to write than this.
It's been almost a month, but apparently there still isn't a public
exploit. 7etsuo's unfinished code was forked to lots of GitHub repos -
some acknowledge it's a fork, most don't, a few claim it's their own.
Most made no changes at all, a few added non-English comments, a few
added Python wrappers (it's quite ridiculous to have wrappers for
non-working code), none brought it significantly closer to completion.
Perhaps most interestingly, someone tried to lure people into
downloading and perhaps running Linux malware apparently (if I
understood and recall some tweet threads right) by scanning the Internet
for SSH servers from an IP address that also had a web server running.
The web server had a directory listing with a variation of 7etsuo's
code to make this look real, along with malware binaries. Targeted
advertising, right? Here's a lengthy blog post on this incident:
The Wild West of Proof of Concept Exploit Code (PoC)
By Vlad O & Daniel C
https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
> On closer examination it quickly became evident that the source code of
> the exploit itself was a decoy designed as a lure to infect the machine
> on which it was executed. This attack chain primary component was
> identified as a heavily modified version of a relatively obscure Golang,
> multi-platform Command and Control (C2) framework The Remote Access
> Trojan (RAT) called Chaos (https://github.com/tiagorlampert/CHAOS).
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
