Skip to content

Conversation

@rudraditya21
Copy link
Contributor

@rudraditya21 rudraditya21 commented Jan 27, 2026

Fixes: #20642

Summary

  • Treat a trailing newline as an explicit command terminator in SingleCommandShell token execution.
  • Prevents SSH command shells from injecting a separator after a newline, which could terminate non‑PTY sessions.
  • Adds a small spec for the newline case.

Local Test Setup

  1. Build a minimal SSH server:
   rm -rf /tmp/ssh-nosh
   mkdir -p /tmp/ssh-nosh

   ssh-keygen -t ed25519 -f /tmp/ssh-nosh/id_ed25519 -N ""
   cat /tmp/ssh-nosh/id_ed25519.pub > /tmp/ssh-nosh/authorized_keys

   cat <<'EOF' > /tmp/ssh-nosh/sshd_config
   Port 2222
   Protocol 2
   PubkeyAuthentication yes
   AuthorizedKeysFile .ssh/authorized_keys
   PermitRootLogin no
   PasswordAuthentication no
   KbdInteractiveAuthentication no
   ChallengeResponseAuthentication no
   UsePAM no
   AllowUsers git
   LogLevel VERBOSE
   Subsystem sftp /usr/lib/openssh/sftp-server
   EOF

   cat <<'EOF' > /tmp/ssh-nosh/Dockerfile
   FROM ubuntu:22.04
   RUN apt-get update && apt-get install -y openssh-server && mkdir /var/run/sshd
   RUN useradd -m -s /bin/bash git && passwd -d git && usermod -U git
   RUN mkdir -p /home/git/.ssh
   COPY authorized_keys /home/git/.ssh/authorized_keys
   COPY sshd_config /etc/ssh/sshd_config
   RUN chmod 700 /home/git/.ssh && chmod 600 /home/git/.ssh/authorized_keys && chown -R git:git /home/git/.ssh
   EXPOSE 2222
   CMD ["/usr/sbin/sshd","-D","-e"]
   EOF

   docker build -t ssh-nosh /tmp/ssh-nosh
   docker run --rm -p 2222:2222 ssh-nosh
  1. In msfconsole:
   use auxiliary/scanner/ssh/ssh_login
   set RHOSTS 127.0.0.1
   set RPORT 2222
   set USERNAME git
   set PRIVATE_KEY file:/tmp/ssh-nosh/id_ed25519
   set CreateSession true
   run
   sessions -i <id>
   irb
   self.shell_command_token("id\n")

Expected behavior

  • The command runs and the SSH session remains alive.
  • Prior to this change, the trailing newline could terminate the session.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

cmd_exec: Trailing line feed in command terminates ssh session

2 participants