An update to my SSHole coverage (exploited in under nine hours and ISC’s attempt counts). Now we have more detail on what attackers do once they’re in.
What’s new
- GreyNoise saw its first successful exploitation on Nov. 7 at 00:46 UTC (about 40 hours after the fix) and logged 16 successful chains from six IPs.
- Post-exploitation: system and container recon, cloud metadata queries, reading password hashes and root SSH keys, and editing
authorized_keysfor persistence. - One attacker got root and installed TAC Agent, a Python C2 implant with Chinese-language comments. It couldn’t reach its C2 server.
- Previdian confirmed successful exploitation too, and watchTowr tied attacks to botnets and cryptomining.
What to do
Update to OpenSSH 10.6p2 or later, or turn off SSH password auth on musl systems like Alpine. Then check authorized_keys on anything that was exposed. My SSHole check how-to still applies.
God Bless, and Happy hacking!
References & Further Reading
- Hackers exploit SSHole OpenSSH flaw to breach Linux systems (BleepingComputer)
- Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH (SecurityWeek)
- OpenSSH Release Notes
- Update: SANS ISC Sees SSHole Exploit Attempts Peak (EtherNinja)
- How-To: Verify Your OpenSSH Build Is Patched for SSHole (EtherNinja)
