I was researching the OpenSSH brute force vulnerability "onkeyborad-interactive devices", however I am not sure how this command really works

ssh -lusername -oKbdInteractiveDevices=`perl -e 'print "pam," x 10000'` targethost

As far as I investigated it seems that -l parameter is for login, -e is used for execution and pam is plug-gable authentication module that provides dynamical authentication support for system. Perl is programming language.

However i'm not sure what is onkeyboard-interactive devices(I did not managed to find any examples)? And I'm really interested how does this vulnerability opens the loop that can be used? Maybe someone could explain this more briefly ?

`perl -e 'print "pam," x 10000'`

is executed in subshell, prints 10000 times pam divided by comma (,).

The returned string is used as an argument for -oKbdInteractiveDevices= option (see manual page for ssh):


Specifies the list of methods to use in keyboard-interactive authentication. Multiple method names must be comma-sepa‐ rated. The default is to use the server specified list. The methods available vary depending on what the server supports. For an OpenSSH server, it may be zero or more of: “bsdauth”, “pam”, and “skey”.

This vulnerability is already fixed on most of the systems. But there was bug on server, that didn't check if the "device" was already tried. This allowed to issue much more passwords attempts than if you would have to issue the whole new connection for three attempt (you could do 10000 for exmaple).

For the record, it is CVE-2015-5600 shortly described in this blog post

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.