While doing a routine pen test for a client I came across a box that had OpenSSH 7.2p1 running.
Through a Google search I figured out this vulnerability with the above OpenSSH version
I went in to investigate it further. I was able to understand some of the details of the vulnerability and the exploit itself. However, I need help understanding some more things.
I have a basic understanding of how exactly does SSH work. This is a resource that is very much in sync with the understanding that I have.
Now investigating the issue further, from what I understand is that on the server
X11Forwarding yes is required in the sshd config file. Because I have SSH access to the box, I verified that this condition was met.
Next my understanding about it is that an account with the shell set to
/bin/false or a user account with forced-commands is needed to be able to demo the exploitation itself.
Also, additionally, the above user must already be authenticated. (Is this understanding correct?)
So I went in the box and tried to see if there is any such user that meets the above conditions.
I did a
cat /etc/passwd | grep /bin/false and it pulled up a list of users that had their shell set to /bin/false. One of these users was the user named
mongodb, that had it's home directory set to
/home/mongodb and also was protected by a password as indicated by the
x in the
I read about mongodb installation and came to know that it gets installed with its own user.
Now somethings that I need help with understanding :
- What is the use of this
mongodbuser? I looked thorough /home and could not find a home directory for this user despite that it was mentioned in the passwd file.
- How and when does this user get authenticated?
- Is there any way that when this user authenticates with the system, it can be leveraged to exploit the OpenSSH authenticated xauth command injection bug?
Please pardon my less understanding of Linux users or SSH and let me know if there are any resources that would help me understand these basics better.