Remix.run Logo
Remix clone Hacker News
new | show | ask | jobsGithub
▲ ssh2RCE(ssh2rce.com)
27 points by mcunninghamhn a day ago | 15 comments
▲robshep 13 hours ago | parent | next [-]

RSH is better as it eliminates credentials as potential attack surface.

▲ChrisArchitect 9 hours ago | parent | prev | next [-]

Related:

terminal2shell

https://news.ycombinator.com/item?id=50426769

▲JoshTriplett a day ago | parent | prev | next [-]

You don't even need a network port open; you might have the vulnerable software already on your system: https://terminal2shell.com/

</s>

▲K0IN a day ago | parent [-]

I think this can be chained.

▲ a day ago | parent | prev | next [-]
[deleted]
▲gnabgib a day ago | parent | prev | next [-]

This is a (bad) joke.

> A remote attacker with valid credentials can execute arbitrary commands on a server running an SSH service. The commands run on the target with the privileges of the authenticated account, and their output is returned to the attacker.

▲mcunninghamhn a day ago | parent [-]

If you read carefully, there's a tonne of give aways.. like a tonne. If people still haven't picked it up by the end, the very last faq actually explains it a bit more explicitly. But at first glance, works about as good as a strong coffee

▲28304283409234 2 hours ago | parent [-]

Sadly, our CISO does not understand enough of anything and will come down on us screaming come the morrow.

▲QuiCasseRien 13 hours ago | parent | prev | next [-]

> A remote attacker with valid credentials can execute arbitrary commands on a server running an SSH service. The commands run on the target with the privileges of the authenticated account, and their output is returned to the attacker.

Well, isn't the purpose of SSH ? ^^

▲account42 12 hours ago | parent | next [-]

Are you suggesting this is a deliberate back door attempt?

▲mcunninghamhn 11 hours ago | parent | prev [-]

I don't think we made it obvious enough that this was satire..? I mean the cvss score is literally 22 out of 10 I'm now half worried people are not going to read this closely enough and try do something. Friend and I designed it last night. But I've asked him to strip all the funny config changes out like making bash a setuid binary and allowing root login. Honestly I can't tell if anyone here is actually not understanding it's satire.. and by God I hope not. But just in case..

▲K0IN a day ago | parent | prev | next [-]

Oh no!

Well time to switch to telnet!

▲Bender 11 hours ago | parent [-]

Best. Advice. Ever.

    telnet ping.ohftp.org
    Escape character is '^]'.
    login: root
Password is toor.

    root@ping:~# uptime 
    13:19:18  up 30 days, 12:58,  1 user,  load average: 0.00, 0.00, 0.00
Maybe the internet can collectively help keep an eye on this thing.
▲davidee a day ago | parent | prev | next [-]

22/10. touché

▲account42 12 hours ago | parent | prev [-]

Would be funnier without the slop website.