Lovely. A function pointer

Lovely. A function pointer. Examining sshd source in further detail, it can
be seen that for each cleanup function, a 'fatal_cleanup' structure is
dynamically allocated on the heap. One such cleanup function,
packet_close(), is always registered. The function packet_close() is what
gets invoked on line 230 above. It isn't interesting.

What we need to do is overwrite the function pointer in the 'fatal_cleanup'
structure that corresponds to packet_close(). To do this we need the
'response' buffer to be allocated at a lower memory address than that used
for the cleanup structure. This requirement is closely tied to the memory
profile of the process, but given the general way in which phk malloc
operates, we can assume that we'll need to reuse a free()'d memory chunk. To
do this, we have to be very particular about our 'nresp' value.

Unfortunately, the memory profile varies considerably depending on which
keyboard-interactive device is used -- skey or bsdauth. The ssh(1) patch
submitted to Bugtraq by another party reuses a 4096 byte chunk (1 page),
which seems to work fine in most cases when using bsdauth. However, results
are mixed when using skey. Nevertheless, we have devised an extremely simple
procedure to follow that should result in almost flawless exploitation of
vulnerable sshd daemons on at least OpenBSD. You can read all about it in
the HOWTO file.