Did anyone successfully exploit CVE-2010-4478 in the past? This is insufficient validation of the J-PAKE public key parameters in OpenSSH up to 5.6.
I'm dealing with a vulnerable machine running OpenSSH 5.1 p1. I need to get a flag but in order to do so, first I need access to the server. I found the vulnerability of jpake, but I've been trying to exploit it with no luck.
I downloaded the code from https://github.com/seb-m/jpake/tree/master/openssh-jpake then downloaded a OpenSSH client v5.1 p1, replaced the files downloaded from github and ran make. The code won't compile unless I comment lines 156-159 and 1316-1317 in sshconnect2.c.
I don't think those lines are relevant but when I try to use the exploit as said in the readme,
./ssh -o "ZeroKnowledgePasswordAuthentication yes" user@host, I'm getting an error saying that this option doesn't exist, so I don't know whether it's due to comment those lines out or due to another thing.
That's why I'm asking whether is there someone who have successfully exploited this vulnerability in the past, and can throw some ideas about why it's not working. Also, if you know any other way to bypass the authentication of this version of OpenSSH, it is very welcome.
edit: I already got access to the server by another mean, but I'm keeping this question opened to see whether or not someone has something to say about it.