Skip to content

Comment on Unauthenticated Remote Code Execution in Erlang/OTP SSHparent

Comments

It makes for a fun demo, but a regular OS shell is more useful, and you can attach a debug shell to an existing BEAM process from there.

OTOH for example in Go people sometimes use the SSH protocol to provide access to cool things like an SSH based chat, instead of using it for shell access.

I haven’t looked at what the Erlang SSH server provides, but maybe you could do something like that? Write a chat server in Erlang and use the Erlang SSH server to provide users access to that chat?

Yes, the Erlang debug shell is just the default option; you can replace the interface with whatever, if you wanted to build a chat/mud/ascii cinema/etc, it should all be possible (but you'd be advised to review the OTP ssh code to confirm it does what you want and nothing extra)

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.