CVE-2005-3992

WinEggDropShell 1.7 - Remote Code Execution via Long HTTP GET or FTP USER/PASS Commands

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-3992. PoCs published by Sowhat.

AI-analyzed exploit summary This PoC exploits a pre-authentication remote stack overflow in WinEggDropShell via malformed HTTP GET or FTP USER commands. It sends a buffer of 512 'A' characters to trigger a denial-of-service (crash) condition.

Description

Multiple buffer overflows in WinEggDropShell remote access trojan (RAT) 1.7 allow remote attackers to execute arbitrary code via (1) a long GET request to the HTTP server, or a long (2) USER or (3) PASS command to the FTP server.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Sowhat · pythondoswindows

https://www.exploit-db.com/exploits/1353

View Code ZIP pw:eip

This PoC exploits a pre-authentication remote stack overflow in WinEggDropShell via malformed HTTP GET or FTP USER commands. It sends a buffer of 512 'A' characters to trigger a denial-of-service (crash) condition.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: WinEggDropShell Eternity version (and possibly others)

No auth needed

Prerequisites: Network access to the target's HTTP (port 80) or FTP (port 21) service

MITRE ATT&CK