CVE-2002-1059
SecureCRT < 3.4.6 and 4.x < 4.0 beta 3 - Remote Code Execution via Long SSH1 Protocol Version String
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2002-1059.
PoCs published by Metasploit, andrea lisci, Kyuzo, including Metasploit module exploits/windows/ssh/securecrt_ssh1.
AI-analyzed exploit summary This exploit targets a buffer overflow in SecureCRT <= 4.0 Beta 2 by sending an overly long SSH1 protocol identifier string. It achieves remote code execution by overwriting the return address and injecting shellcode.
Description
Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SSH1 protocol version string.
Exploits (4)
This exploit targets a buffer overflow in SecureCRT <= 4.0 Beta 2 by sending an overly long SSH1 protocol identifier string. It achieves remote code execution by overwriting the return address and injecting shellcode.
This exploit targets a buffer overflow vulnerability in SecureCRT's SSH1 protocol identifier handling. It crafts a malicious payload with shellcode to execute arbitrary code, establishing a reverse shell to a specified host and port.
This exploit triggers a buffer overflow in SecureCRT by sending an overly long SSH1 protocol identifier string. It creates a malicious server that sends a crafted payload to crash or potentially execute arbitrary code on the client.
This Metasploit module exploits a buffer overflow in SecureCRT <= 4.0 Beta 2 by sending an overly long SSH1 protocol identifier string, allowing arbitrary code execution. It targets SecureCRT.exe version 3.4.4 with a specific return address (0x0041b3e0).