3

Did anyone successfully exploit CVE-2010-4478 in the past? This is insufficient validation of the J-PAKE public key parameters in OpenSSH up to 5.6.

I'm dealing with a vulnerable machine running OpenSSH 5.1 p1. I need to get a flag but in order to do so, first I need access to the server. I found the vulnerability of jpake, but I've been trying to exploit it with no luck.

I downloaded the code from https://github.com/seb-m/jpake/tree/master/openssh-jpake then downloaded a OpenSSH client v5.1 p1, replaced the files downloaded from github and ran make. The code won't compile unless I comment lines 156-159 and 1316-1317 in sshconnect2.c.

I don't think those lines are relevant but when I try to use the exploit as said in the readme, ./ssh -o "ZeroKnowledgePasswordAuthentication yes" user@host, I'm getting an error saying that this option doesn't exist, so I don't know whether it's due to comment those lines out or due to another thing.

That's why I'm asking whether is there someone who have successfully exploited this vulnerability in the past, and can throw some ideas about why it's not working. Also, if you know any other way to bypass the authentication of this version of OpenSSH, it is very welcome.

edit: I already got access to the server by another mean, but I'm keeping this question opened to see whether or not someone has something to say about it.

4

It's unlikely that the server actually supports J-PAKE - it has never been enabled in any shipped version of OpenSSH. I don't know of any OS distribution that enabled it either.

Unless the server's admin manually enabled it by setting an undocumented build-time preprocessor flag, then the server won't support it.

You can check by running "ssh -vvv user@host" and looking for a line:

debug1: Authentications that can continue: ...

And looking for "jpake" in the list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.