CVE-2003-0561
IglooFTP PRO 3.8 - Remote Code Execution via Long FTP Banner or Command Response
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2003-0561. PoCs published by inv[at]dtors, Peter Winter-Smith, vkhoshain.
AI-analyzed exploit summary This Perl script exploits a buffer overflow vulnerability in multiple FTP clients (IglooFTP, cftp, moxftp) by sending a maliciously crafted FTP banner or directory listing. It supports both portbind and connect-back shellcode for remote code execution.
Description
Multiple buffer overflows in IglooFTP PRO 3.8 allow remote FTP servers to execute arbitrary code via (1) a long FTP banner, or long responses to the client commands (2) USER, (3) PASS, (4) ACCT, and possibly other commands.
Exploits (3)
This Perl script exploits a buffer overflow vulnerability in multiple FTP clients (IglooFTP, cftp, moxftp) by sending a maliciously crafted FTP banner or directory listing. It supports both portbind and connect-back shellcode for remote code execution.
The provided text is a vulnerability writeup for CVE-2003-0561, describing multiple buffer overflow vulnerabilities in IglooFTP PRO for Windows. It lacks actual exploit code but references a binary exploit available via a GitLab link.
This exploit targets a buffer overflow vulnerability in IglooFTP PRO 3.8 by sending a crafted response to an FTP client connection, triggering arbitrary code execution (notepad.exe) via shellcode. The exploit sets up a malicious FTP server on port 21 to deliver the payload.