CVE-2023-51385_test

Verify CVE-2023-51385 First, add the following content to /.ssh/config root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Command injection exists in the .gitmodules file statement root@kitploit: url = ssh://echo helloworld cve.txtfoo.example.com/bar Afte...

CVE-2017-1000117

CVE-2017-1000117 How it works? root@kitploit: $ git clone --recursive [email protected]:ikmski/CVE-2017-1000117.git How to create this repository root@kitploit: $ cat message.txt | gzip | base64 command $ git submodule add [email protected]:ikmski/Hello-World.git subs/CVE-2017-1000117 $...

CVE-2023-51385_test

Verifying CVE-2023-51385 First, add the following content to /.ssh/config root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p There is a command injection in the .gitmodules file statement root@kitploit: url = ssh://echo helloworld cve.txtfoo.example.com/b...

CVE-2023-51385_poc-test

CVE-2023-51385 poc OpenSSH ProxyCommand RCE poc OpenSSH 9.6 vulnerabilidad de inyección de comandos poc Chino 1.vim /.ssh/config o edita C:/Users/username/.ssh/config en sistema Windows root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p 2. git clone...

CVE-2023-51385_test

Verify CVE-2023-51385 First, add the following to /.ssh/config root@kitploit: 主机 .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Command injection exists in the .gitmodules file statement root@kitploit: url = ssh://echo helloworld cve.txtfoo.example.com/bar After...

cve-2023-51385

Verify CVE-2023-51385 First, add the following content to /.ssh/config root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p There is a command injection in the .gitmodules file statement root@kitploit: url = ssh://echo helloworld cve.txtfoo.example.com/bar...

cve-2025-61984-poc

CVE-2025-61984 PoC This is a proof of concept using a newline to confuse OpenSSH's 10.1 ProxyCommand. Full write up. How to run Set up an .ssh/config containing: root@kitploit: Host .example.com ProxyCommand some-command %r@%h:%p The command doesn't matter, it just needs an unquoted %r in the...

poc-proxycommand-vulnerable

RCE через небезопасный /.ssh/config Использование токенов, таких как %h, %p, в ProxyCommand довольно популярно для организации туннелей и проксирования соединений через SSH. Уязвимая конфигурация root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p...

poc-proxycommand-vulnerable

RCE via insecure /.ssh/config Use of tokens like %h, %p in ProxyCommand is quite popular to use tunnels and connection proxying using SSH. Vulnerable config root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Note: in my initial assessment I was under the...

CVE-2026-4631-cockpit-RCE

CVE-2026-4631 — Cockpit Mass Exploit Tool Unauthenticated Remote Code Execution via SSH Command-Line Argument Injection Cockpit versions 327 – 359 | CVSS 9.8 Critical | CWE-78 Tool mass exploitation untuk CVE-2026-4631 pada Cockpit web service cockpit-ws, port 9090. Mendukung mode vulnerability...

CVE-2023-51385

CVE-2023-51385 OpenSSH ProxyCommand RCE 1. When your ProxyCommand is configured as follows: root@kitploit: Host .com ProxyCommand /usr/bin/nc -X connect -x 127.0.0.1:7890 %h %p 2. Use the following command for proof of concept root@kitploit: git clone https://github.com/Le1a/CVE-2023-51385...

CVE-2017-1000117

CVE-2017-1000117 This module can be used to test whether you are vulnerable to CVE-2017-1000117 root@kitploit: git clone https://github.com/timwr/CVE-2017-1000117.git --recurse-submodules ls CVE-2017-1000117 Output if you are vulnerable: root@kitploit: $ git clone...

CVE-2023-51385---OpenSSH-ProxyCommand-Injection-PoC

🔐 CVE-2023-51385 - PoC de Inyección de ProxyCommand en OpenSSH Este repositorio contiene una prueba de concepto para CVE-2023-51385, una vulnerabilidad de inyección de comandos en la opción ProxyCommand de OpenSSH. Un atacante con control sobre la configuración de SSH o cadenas ProxyCommand no...

libssh security update

An update is available for libssh. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list libssh is a library which implements the SSH protocol. It can be used to...

libssh: libssh: denial of service via unchecked ProxyCommand fork() failure

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service...

libssh: libssh: information disclosure via ProxyCommand %r username expansion

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

Moderate: Red Hat Security Advisory: libssh security update

An update for libssh is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

libssh: libssh: information disclosure via ProxyCommand %r username expansion

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

libssh: libssh: denial of service via unchecked ProxyCommand fork() failure

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service...

USN-8699-1 libssh vulnerabilities

It was discovered that libssh had a stack buffer overflow in its SFTP server when constructing directory listing entries for long filenames. An attacker could possibly use this issue to cause libssh to crash or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. CVE-2026-15370 It w...