FTPPad 1.2.0 Stack Buffer Overflow

This module exploits a stack buffer overflow FTPPad 1.2.0 ftp client. The overflow is triggered when the client connects to a FTP server which sends an overly long directory and filename in response to a LIST command. This will cause an access violation, and will eventually overwrite the saved extended instruction pointer. Payload can be found at EDX+5c and ESI+5c, so a little pivot/ sniper was needed to make this one work.

Search Other Modules

Exploit Rank

• Good

Exploit Authors

• corelanc0d3r < >

Vulnerability References

• http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/

Exploit Targets

• 0 - XP SP3 Professional, English - shlwapi 6.00.2900.5912 (default)
• 1 - XP SP3 Professional, German - shlwapi 6.00.2900.5912
• 2 - XP SP3 Professional, English - shlwapi 6.00.2900.5512

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/ftp/32bitftp_list_reply
• exploit/windows/ftp/3cdaemon_ftp_user
• exploit/windows/ftp/aasync_list_reply
• exploit/windows/ftp/ability_server_stor
• exploit/windows/ftp/absolute_ftp_list_bof
• exploit/windows/ftp/cesarftp_mkd
• exploit/windows/ftp/dreamftp_format
• exploit/windows/ftp/easyfilesharing_pass
• exploit/windows/ftp/easyftp_cwd_fixret
• exploit/windows/ftp/easyftp_list_fixret

Exploit Usage Information

Exploit Module Options