Erlang opt ssh rce (CVE-2025-32433)#366
Open
girlier wants to merge 14 commits into
Open
Conversation
- Create secgen_metadata.xml with vulnerability details - Set CVSS 10.0, difficulty low, privilege root_rwx - Add CyBOK mappings and references - Document affected versions and exploit hints
- Include install, config, and service classes
- Install erlang package (vulnerable version 25.x on Debian 12) - Install screen for daemon persistence - Create erlang_ssh user for daemon and flag storage
- Create ssh_daemon.erl template with vulnerable SSH server - Create start_ssh.sh startup script template - Configure flag storage for CTF - Set up SSH keys directory
- Compile Erlang SSH daemon module - Generate SSH host keys - Start daemon in screen session - Verify port is listening
- Define class ordering: install -> config -> service
- Test Erlang installation - Verify SSH daemon is running on port 2222 - Check vulnerability exists (OTP version 25.x or 26.x) - Verify flag files created - Verify beam file compiled
- Create erlang_ssh_rce scenario targeting Debian 12 - Include new erlang_otp_ssh_rce vulnerability module - Configure SSH daemon on port 2222 - Add CyBOK mappings for CVE-2025-32433
- Replace complex Erlang module with simple escript (matches vulhub) - Start applications in correct order: asn1, crypto, public_key, ssh - Remove unused template files - Simplify config.pp and service.pp - Fix 'ssh_not_started' error by properly initializing dependencies
…rlangotp_rce, and update scenarios
…a and SSH_it_happens scenario
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Erlang OTP SSH RCE (CVE-2025-32433)
Vulnerability module paired with an example CTF (ssh-it happens).
The Erlang OPT SSH daemon vulnerability is configured on port 2222 and can be exploited through Metasploit.