CVE-2012-6066
freeSSHd < 1.2.6 - Unauthenticated Authentication Bypass via Crafted Session
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2012-6066.
PoCs published by Metasploit, kingcope, bongbongco, including Metasploit module exploits/windows/ssh/freesshd_authbypass.
AI-analyzed exploit summary This Metasploit module exploits an authentication bypass vulnerability in FreeSSHd <= 1.2.6 by leveraging a flaw in the SSH protocol implementation. It attempts to log in with a list of usernames and, upon success, uploads and executes a payload via a VBS command stager.
Description
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.
Exploits (5)
This Metasploit module exploits an authentication bypass vulnerability in FreeSSHd <= 1.2.6 by leveraging a flaw in the SSH protocol implementation. It attempts to log in with a list of usernames and, upon success, uploads and executes a payload via a VBS command stager.
This is a writeup describing an authentication bypass vulnerability in FreeSSHD. It provides instructions on how to exploit the vulnerability by using an SSH client with a valid username, but does not include actual exploit code.
This exploit leverages an authentication bypass in FreeFTPD to upload a malicious MOF file and executable, achieving remote code execution with SYSTEM privileges via a connect-back shell. The technique abuses the Windows Management Instrumentation (WMI) service to execute arbitrary code.
This PoC exploits CVE-2012-6066, a remote authentication bypass vulnerability in freeSSHd 2.1.3. It leverages Paramiko to establish an SSH session, bypass authentication, and execute arbitrary commands (e.g., launching Internet Explorer) by manipulating the SSH session at the transport and channel level.
This Metasploit module exploits an authentication bypass vulnerability in FreeSSHd <= 1.2.6 (CVE-2012-6066) by leveraging flawed SSH authentication logic. It brute-forces usernames and executes arbitrary commands via PowerShell or a cmdstager payload upon successful bypass.