[pasadoorian]

Adds vuln-sshhole for the password bypass at https://sshhole.com/ (no CVE yet). OpenSSH sshd built against musl without PAM accepts any 257 to 1024 byte password for a valid user whose shadow field is *, when another account has a $5$ or $6$ hash. OpenSSH 10.6p2 (2026-11-05, "avoid password authn bypass") rejects short stored hashes, and Alpine backported that as pw.patch to 3.20, 3.22 and 3.24.

The first password attempt on a connection always fails. musl's getspnam() returns a pointer into a static buffer, and pick_salt() calls it for every account and zeroes the hash it copies, so sys_auth_passwd() compares against an empty string. pick_salt() caches the salt, so later attempts on the same connection compare against *. A probe that sends one long password per connection never finds the bug.

The check runs per user on OpenSSH servers older than 10.6p2 that offer password; fixed releases are skipped without a connection, and distribution backports with an older banner are probed but rejected cleanly. On one connection it sends a 256-byte random control password, then 257 bytes, then 1024 bytes if 257 fails, and reports only when the control is rejected and a longer password is accepted. A Too many authentication failures disconnect at MaxAuthTries counts as a rejected attempt. The proof records the output of id; uname -a; ls /lib/ld-musl-*; head -3 /etc/os-release.

A second connection then authenticates with the accepted password alone, wrapped in ssh.RetryableAuthMethod so it is resent once. When that opens a session the password is cached as SessionAuth, so -I first and -I all and the session checks work on real musl hosts, and the proof records which attempt logged in.

analyze now writes <id>.jsonl for each reported vuln. docs/targets/sshhole builds Docker controls: unpatched 10.3p1 from the tarball, the same with no $6$ account, a PAM build, Alpine's patched package, and Debian with glibc. docs/targets/README.md describes the layout for future targets.

It also fixes parseTargets, which appended every address of an expanded CIDR a second time, so each host was scanned twice and the password checks doubled their failed logins. TestParseTargetsCIDR covers it.

Testing: the original check flagged root and alpine only on 10.3p1/musl 1.2.6 and 9.7p1/musl 1.2.5 with the four negative controls clean. The merged check adds an in-process SSH server that models the first-attempt failure and covers the finding, MaxAuthTries 2, the version gate, the password-any skip, and reuse of the cached credential. go test ./... passes.