CVE-2019-25607

This exploit demonstrates a local stack-based buffer overflow in Axessh 4.2 by crafting a malicious log file name that triggers arbitrary code execution via a reverse TCP meterpreter shell. The payload leverages a known return address in ctl3d32.dll to bypass protections and execute shellcode.

This PoC exploits a buffer overflow vulnerability in Axessh 4.2 by writing a 500-byte string of 'A' characters to a file, which when pasted into the 'Log file name' field causes a denial of service (crash). The exploit is straightforward and demonstrates the vulnerability effectively.