EIP-2026-100966

This exploit targets a buffer overflow vulnerability in OpenSSH 3.5p1 on FreeBSD 4.9 and 4.11, allowing remote root access prior to authentication. The PoC modifies an OpenSSH client to send a long username, triggering a crash and controlling EIP to execute a reverse shell.