EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow

This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11 and earlier. EasyFTP fails to check input size when parsing 'CWD' commands, which leads to a stack based buffer overflow. EasyFTP allows anonymous access by default; valid credentials are typically unnecessary to exploit this vulnerability. After version 1.7.0.12, this package was renamed "UplusFtp". This exploit utilizes a small piece of code that I\'ve referred to as 'fixRet'. This code allows us to inject of payload of ~500 bytes into a 264 byte buffer by 'fixing' the return address post-exploitation. See references for more information.

Search Other Modules

Exploit Rank

• Great

Exploit Authors

• Paul Makowski < my.hndl [at] gmail.com >
• jduck < jduck [at] metasploit.com >

Vulnerability References

• OSVDB-62134
• http://paulmakowski.wordpress.com/2010/02/28/increasing-payload-size-w-return...
• http://paulmakowski.wordpress.com/2010/04/19/metasploit-plugin-for-easyftp-se...
• http://seclists.org/bugtraq/2010/Feb/202
• http://code.google.com/p/easyftpsvr/
• https://tegosecurity.com/etc/return_overwrite/RCE_easy_ftp_server_1.7.0.2.zip
• http://www.securityfocus.com/bid/38262/exploit

Exploit Targets

• 0 - Windows Universal - v1.7.0.2 (default)
• 1 - Windows Universal - v1.7.0.3
• 2 - Windows Universal - v1.7.0.4
• 3 - Windows Universal - v1.7.0.5
• 4 - Windows Universal - v1.7.0.6
• 5 - Windows Universal - v1.7.0.7
• 6 - Windows Universal - v1.7.0.8
• 7 - Windows Universal - v1.7.0.9
• 8 - Windows Universal - v1.7.0.10
• 9 - Windows Universal - v1.7.0.11

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/ftp/32bitftp_list_reply
• exploit/windows/ftp/3cdaemon_ftp_user
• exploit/windows/ftp/aasync_list_reply
• exploit/windows/ftp/ability_server_stor
• exploit/windows/ftp/absolute_ftp_list_bof
• exploit/windows/ftp/cesarftp_mkd
• exploit/windows/ftp/dreamftp_format
• exploit/windows/ftp/easyfilesharing_pass
• exploit/windows/ftp/easyftp_list_fixret
• exploit/windows/ftp/easyftp_mkd_fixret

Exploit Usage Information

Exploit Module Options