CVE-2004-2523
OpenFTPD < 0.30.2 - Authenticated Remote Code Execution via Format String in Message Argument
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2004-2523. PoCs published by infamous41md, Andi.
AI-analyzed exploit summary This exploit targets a format string vulnerability in OpenFTPD, leveraging the 'site msg' command to execute arbitrary shellcode. It hijacks the fclose() jumpslot and manipulates stack addresses to achieve remote code execution.
Description
Format string vulnerability in the msg command (cat_message function in msg.c) in OpenFTPD 0.30.2 and earlier allows remote authenticated users to execute arbitrary code via format string specifiers in the message argument.
Exploits (2)
This exploit targets a format string vulnerability in OpenFTPD, leveraging the 'site msg' command to execute arbitrary shellcode. It hijacks the fclose() jumpslot and manipulates stack addresses to achieve remote code execution.
This exploit targets a format string vulnerability in OpenFTPD <= 0.30.2, allowing remote code execution via crafted SITE MSG commands. It uses a format string attack to overwrite the GOT entry of fgets with the address of system, then executes arbitrary commands.