# How to Use Exploitarium for libssh2 CVE‑2026‑55200: A Step‑by‑Step Exploitation Guide

> Learn how to use Exploitarium for libssh2 CVE-2026-55200 exploitation. This guide details the PoC for local RCE via a malicious SSH handshake.

- Repository: [bikini/exploitarium](https://github.com/bikini/exploitarium)
- Tags: how-to-guide
- Published: 2026-09-07

---

**Exploitarium provides a complete, self‑contained proof‑of‑concept (PoC) that demonstrates and exploits an integer‑wrap vulnerability in libssh2's `ssh2_transport_read()` function, enabling local RCE through a malicious SSH handshake.**

Exploitarium is an open‑source security research repository by **bikini** that packages reproducible exploits for high‑impact CVEs. The **libssh2 CVE‑2026‑55200 PoC** targets a critical integer overflow in libssh2 versions through 1.11.1, where an unchecked `packet_length` field triggers an out‑of‑bounds write. This guide walks through the full exploitation workflow using the tools provided in the repository's `libssh2-cve-2026-55200-poc/` directory.

## Understanding the CVE‑2026‑55200 Vulnerability

The root cause lies in `ssh2_transport_read()` in the libssh2 source: the parser adds the attacker‑controlled **32‑bit `packet_length`** to `mac_len` and `auth_len` **before** promoting the result to `size_t`.

When `packet_length` is set to `0xffffffff`, the intermediate sum wraps to `15`. The final allocation becomes **19 bytes** (4 + 15) instead of a massive buffer. However, the original `packet_length` value remains in scope, causing subsequent code to reference `packet_length‑1` against the tiny allocation—resulting in an **out‑of‑bounds write with RCE potential**.

Exploitarium's PoC decomposes this into four reproducible stages: arithmetic verification, malicious server deployment, vulnerable harness execution, and exploit‑driven code execution.

## Verifying the Integer‑Wrap Bug with [`cve_2026_55200_probe.c`](https://github.com/bikini/exploitarium/blob/main/cve_2026_55200_probe.c)

The first component validates the arithmetic behavior without needing a full network stack.

```bash

# Build the arithmetic verifier

gcc -std=c11 -Wall -Wextra -O0 -g -o cve_2026_55200_probe \
    libssh2-cve-2026-55200-poc/poc/cve_2026_55200_probe.c

# Run with the malicious packet length

./cve_2026_55200_probe --packet-length 0xffffffff --mac-len 0 --auth-len 16

```

**Expected output:** `vulnerable32_allocation=19`

This confirms the wrap‑around: `0xffffffff + 0 + 16 = 15` (truncated to 32 bits), plus 4 bytes of padding equals the undersized allocation that enables the exploit.

## Deploying the Malicious SSH Server

The [`libpwn_cve_2026_55200_server.py`](https://github.com/bikini/exploitarium/blob/main/libpwn_cve_2026_55200_server.py) script implements a minimal SSH server that delivers the crafted encrypted packet.

```bash

# Launch the malicious server on port 2222

python libssh2-cve-2026-55200-poc/poc/libpwn_cve_2026_55200_server.py \
    --serve --listen-host 0.0.0.0 --listen-port 2222

```

The server:
- Completes the SSH handshake to appear legitimate
- Transmits a packet whose decrypted `packet_length` field is `0xffffffff`
- Waits for the target to process the malformed payload

This stage simulates the network‑delivered attack vector against vulnerable libssh2 clients.

## Building and Running the Vulnerable Harness

[`libpwn_local_rce_harness.c`](https://github.com/bikini/exploitarium/blob/main/libpwn_local_rce_harness.c) provides a controlled target that replicates the libssh2 **allocation‑to‑callback pattern** without requiring the full library.

```bash

# Compile the vulnerable harness

gcc -O0 -g -Wall -Wextra -o libpwn_local_rce_harness \
    libssh2-cve-2026-55200-poc/poc/libpwn_local_rce_harness.c

```

The harness intentionally mirrors the vulnerable code path: it allocates based on the wrapped size, then uses the original `packet_length` to copy data—creating a reproducible crash or corruption target for exploit development.

## Executing the Full RCE Exploit

The [`libpwn_local_rce_exploit.py`](https://github.com/bikini/exploitarium/blob/main/libpwn_local_rce_exploit.py) driver automates the final exploitation phase: heap grooming, callback pointer overwrite, and proof‑of‑execution delivery.

```bash

# Run the exploit against the harness

python libssh2-cve-2026-55200-poc/poc/libpwn_local_rce_exploit.py \
    --harness ./libpwn_local_rce_harness \
    --proof ./libpwn_rce_proof.txt

# Verify successful code execution

cat libpwn_rce_proof.txt

```

**Expected proof file contents:**

```

RCE_PROOF=PASS
libpwn-rce-verified

```

The exploit works by:
1. Triggering the integer‑wrap allocation in the harness
2. Using the out‑of‑bounds write to corrupt adjacent heap metadata
3. Overwriting a function pointer with a controlled address
4. Redirecting execution to write the proof file

## Key Files and Their Purposes

| File | Location | Role |
|------|----------|------|
| [`README.md`](https://github.com/bikini/exploitarium/blob/main/README.md) | `libssh2-cve-2026-55200-poc/` | High‑level documentation and usage instructions |
| [`cve_2026_55200_probe.c`](https://github.com/bikini/exploitarium/blob/main/cve_2026_55200_probe.c) | `poc/` | Stand‑alone arithmetic verifier |
| [`libpwn_cve_2026_55200_server.py`](https://github.com/bikini/exploitarium/blob/main/libpwn_cve_2026_55200_server.py) | `poc/` | Malicious SSH server for payload delivery |
| [`libpwn_local_rce_harness.c`](https://github.com/bikini/exploitarium/blob/main/libpwn_local_rce_harness.c) | `poc/` | Controlled vulnerable target |
| [`libpwn_local_rce_exploit.py`](https://github.com/bikini/exploitarium/blob/main/libpwn_local_rce_exploit.py) | `poc/` | Exploit driver with callback overwrite |
| [`2026-06-23-local-harness-output.txt`](https://github.com/bikini/exploitarium/blob/main/2026-06-23-local-harness-output.txt) | `evidence/` | Sample successful execution log |

All paths are relative to `libssh2-cve-2026-55200-poc/` within the **bikini/exploitarium** repository.

## Adaptation Notes for Real‑World Targets

The provided PoC targets a **local research harness** by design. Porting to actual libssh2 deployments requires addressing:

- **Allocator differences:** The exploit assumes `ptmalloc2` behavior; other allocators (jemalloc, tcmalloc) need different grooming strategies
- **ASLR and PIE:** The harness disables these for reproducibility; production targets require leak primitives or partial overwrite techniques
- **Network delivery:** The malicious server must be adapted to the target's connection initiation pattern (reverse vs. bind)

The repository's `evidence/` directory contains reference outputs to validate your local setup before attempting adaptations.

## Summary

Exploitarium's **libssh2 CVE‑2026‑55200** PoC demonstrates a complete exploitation chain:

- **Integer‑wrap verification** via [`cve_2026_55200_probe.c`](https://github.com/bikini/exploitarium/blob/main/cve_2026_55200_probe.c)
- **Network‑based trigger** via [`libpwn_cve_2026_55200_server.py`](https://github.com/bikini/exploitarium/blob/main/libpwn_cve_2026_55200_server.py)
- **Controlled crash surface** via [`libpwn_local_rce_harness.c`](https://github.com/bikini/exploitarium/blob/main/libpwn_local_rce_harness.c)
- **Callback‑overwrite RCE** via [`libpwn_local_rce_exploit.py`](https://github.com/bikini/exploitarium/blob/main/libpwn_local_rce_exploit.py)

The repository packages everything needed to understand, reproduce, and extend research on this critical libssh2 vulnerability.

## Frequently Asked Questions

### What versions of libssh2 are affected by CVE‑2026‑55200?

All libssh2 versions through **1.11.1** contain the vulnerable `ssh2_transport_read()` implementation. The flaw was introduced by performing 32‑bit arithmetic on `packet_length` before converting to `size_t`, enabling the integer wrap exploit demonstrated in Exploitarium.

### Can this exploit work remotely against SSH servers?

The Exploitarium PoC is designed for **local research and CTF scenarios**. While the malicious server component ([`libpwn_cve_2026_55200_server.py`](https://github.com/bikini/exploitarium/blob/main/libpwn_cve_2026_55200_server.py)) demonstrates network delivery, achieving reliable RCE against remote production servers requires significant adaptation for specific allocator configurations, ASLR, and target binaries.

### Is the arithmetic verifier useful without running the full exploit?

**Yes.** [`cve_2026_55200_probe.c`](https://github.com/bikini/exploitarium/blob/main/cve_2026_55200_probe.c) serves as a lightweight sanity check to confirm compiler and architecture behavior regarding 32‑bit unsigned integer overflow. Run it independently to verify your environment reproduces the `vulnerable32_allocation=19` condition before investing time in the full exploit chain.

### What mitigations block this exploit in practice?

Modern deployments with **64‑bit `size_t`** still allocate tiny buffers due to the 32‑bit wrap, but subsequent hardening can impede exploitation: **ASLR** complicates target address prediction, **Control‑Flow Integrity (CFI)** blocks callback overwrites, and **hardened allocators** detect adjacent heap corruption. The Exploitarium harness intentionally disables these for educational clarity.