Помогите с CVE-2024-6387 RegreSSHion

[flex]

В общем, пытаюсь пробиться по уязвимому открытому SSH, но в пейлоад не стучит. Хотя сделал все правильно. Подскажите как решить эту проблему, буду очень благодарен!
Скриншот прикрепил, так же буду очень благодарен за другие реализации эксплоита для данной уязвимости.

 

[Joow]

Попробуй обход rate-limiting т.е. добавить паузу между попытками эксплуатации. Или сделай обфускацию, поменяй переменные и функций на случайные наборы символов var11, xYz, и т. д.. Удали все коментарии.

 

[mkhalilovx29]

In general, I'm trying to get through a vulnerable open SSH, but the payload doesn't knock. Although I did everything correctly. Tell me how to solve this problem, I will be very grateful!
I have attached a screenshot, and I would also be very grateful for other implementations of the exploit for this vulnerability.
Посмотреть вложение 93917

Hi there

Sorry because you dont explain i ask something before speak about payload

did you correctly make time regression for the winning the race condition ?

because in final poc from Qualys it pass to do for readers

 

[flex]

Hi there

Sorry because you dont explain i ask something before speak about payload

did you correctly make time regression for the winning the race condition ?

because in final poc from Qualys it pass to do for readers

Yes, I did everything right, but for some reason the payload does not knock, I used metasploit for linux as a payload.

 

[mkhalilovx29]

Yes, I did everything right, but for some reason the payload does not knock, I used metasploit for linux as a payload.

hi again

so if you are done the timing part of third exploit strategy that qualys mention , now maybe its better to see the logs and stack trace of gdb to follow what happened in the __fread_unlocked() and the sequence that it call to triaged vulnerability

i think create some test cases for yourself to found the error in your poc code, you can test different cases to know where error raised

- the error happened in SIGALARM call?
- the error happened in the frame of creating the holes and linking and malloc calls ?
- maybe you cant achieve the last packet before SIGALARM received to server ?
- are you sure about glibc address ? maybe some fault in placing the address
- you have sufficient resource for running race conditions for creating corrected heap layout ?

if you are sure about the above conditions , start debugging process after the alarm call and start of executing payload

maybe the address that return after allocating and free'ed the list raise the error on the server side

 

[dmitryutkin]

http://xssforum7mmh3n56inuf2h73hvhnzobi7h2ytb3gvklrfqm7ut3xdnyd.onion/threads/123746/

 

[flex]

В общем, пытаюсь пробиться по уязвимому открытому SSH, но в пейлоад не стучит. Хотя сделал все правильно. Подскажите как решить эту проблему, буду очень благодарен!
Скриншот прикрепил, так же буду очень благодарен за другие реализации эксплоита для данной уязвимости.
Посмотреть вложение 93917

Уже испытал очень много методов эксплуатации данной уязвимости, все плохо, в некоторых случаях вызывает на некоторое время отказ в обслуживание. Так же очень нуждаюсь в помощи, буду очень благодарен!