The real exploit is staring at the auth log. 7.9p1 logs everything. Wait for an admin to mistype their password. Or for a cron job to leak an argument. The Verdict: Patch or Panic? Do not panic. But do patch.
Or, how I learned to stop worrying and love the changelog.
for user in root admin ubuntu; do ssh -o PreferredAuthentications=none $user@target "2>&1" | grep "Permission denied (publickey)"; done
Force the server to use SHA-1 signatures. ssh -o KexAlgorithms=diffie-hellman-group14-sha1 -o HostKeyAlgorithms=ssh-rsa user@target (Spoiler: 7.9p1 still allows some weak algorithms by default. Cry about it.)
Liked this? Check out my next post: "Is OpenSSL 1.0.2 really that bad? (Yes. Yes it is.)"
There is a specific thrill in typing ssh -V on a legacy server and seeing it return: OpenSSH_7.9p1 . The heart skips a beat. The fingers itch to search for openssh 7.9p1 exploit on GitHub. You imagine a single command—a sleek, one-liner—that drops a root shell faster than you can say "CVE."
The real exploit is staring at the auth log. 7.9p1 logs everything. Wait for an admin to mistype their password. Or for a cron job to leak an argument. The Verdict: Patch or Panic? Do not panic. But do patch.
Or, how I learned to stop worrying and love the changelog. openssh 7.9p1 exploit
for user in root admin ubuntu; do ssh -o PreferredAuthentications=none $user@target "2>&1" | grep "Permission denied (publickey)"; done The real exploit is staring at the auth log
Force the server to use SHA-1 signatures. ssh -o KexAlgorithms=diffie-hellman-group14-sha1 -o HostKeyAlgorithms=ssh-rsa user@target (Spoiler: 7.9p1 still allows some weak algorithms by default. Cry about it.) Or for a cron job to leak an argument
Liked this? Check out my next post: "Is OpenSSL 1.0.2 really that bad? (Yes. Yes it is.)"
There is a specific thrill in typing ssh -V on a legacy server and seeing it return: OpenSSH_7.9p1 . The heart skips a beat. The fingers itch to search for openssh 7.9p1 exploit on GitHub. You imagine a single command—a sleek, one-liner—that drops a root shell faster than you can say "CVE."
