CVE-2008-2573
freeSSHd 1.2.1 - Authenticated Stack-Based Buffer Overflow via SSH_FXP_OPENDIR Command
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-2573. PoCs published by ryujin, securfrog.
AI-analyzed exploit summary This exploit targets a remote SEH overflow vulnerability in FreeSSHD 1.2.1, leveraging a post-authentication buffer overflow to execute arbitrary shellcode. It includes target-specific payloads for Windows XP SP2 and Vista, using a combination of NOPs, shellcode, and precise offsets to achieve reliable exploitation.
Description
Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a long directory name in an SSH_FXP_OPENDIR (aka opendir) command.
Exploits (2)
This exploit targets a remote SEH overflow vulnerability in FreeSSHD 1.2.1, leveraging a post-authentication buffer overflow to execute arbitrary shellcode. It includes target-specific payloads for Windows XP SP2 and Vista, using a combination of NOPs, shellcode, and precise offsets to achieve reliable exploitation.
This exploit demonstrates a remote buffer overflow in FreeSSHD 1.2.1 by sending an overly long payload (4098 'A's) during an SFTP directory listing operation. The PoC uses Net::SSH2 to authenticate and trigger the vulnerability, causing a crash (EIP overwrite with 0x41414141).