ScriptFTP <= 3.3 Remote Buffer Overflow (LIST)

AmmSoft's ScriptFTP client is susceptible to a remote buffer overflow vulnerability that is triggered when processing a sufficiently long filename during a FTP LIST command resulting in overwriting the exception handler. Social engineering of executing a specially crafted ftp file by double click will result in connecting to our malcious server and perform arbitrary code execution which allows the attacker to gain the same rights as the user running ScriptFTP.

Search Other Modules

Exploit Rank

• Good

Exploit Authors

• modpr0be < >
• TecR0c < roccogiovannicalvi [at] gmail.com >
• mr_me < steventhomasseeley [at] gmail.com >

Vulnerability References

• CVE-2011-3976
• OSVDB-75633
• EDB-17876
• http://www.kb.cert.org/vuls/id/440219

Exploit Targets

• 0 - Windows XP SP3 / Windows Vista (default)

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/ftp/32bitftp_list_reply
• exploit/windows/ftp/3cdaemon_ftp_user
• exploit/windows/ftp/aasync_list_reply
• exploit/windows/ftp/ability_server_stor
• exploit/windows/ftp/absolute_ftp_list_bof
• exploit/windows/ftp/cesarftp_mkd
• exploit/windows/ftp/dreamftp_format
• exploit/windows/ftp/easyfilesharing_pass
• exploit/windows/ftp/easyftp_cwd_fixret
• exploit/windows/ftp/easyftp_list_fixret

Exploit Usage Information

Exploit Module Options