Exploitation Summary
EIP tracks 4 public exploits for CVE-2006-4948.
PoCs published by Metasploit, SkD, Jacopo Cervini, including Metasploit module exploits/windows/tftp/tftpdwin_long_filename.
AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in ProSysInfo TFTPDWIN v0.4.2 by sending an overly long filename via UDP to port 69, overwriting the stack and executing arbitrary payloads. It uses a known return address (0x00458b91) in tftpd.exe for reliable exploitation.
Description
Stack-based buffer overflow in tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a long file name. NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Exploits (4)
This exploit targets a buffer overflow vulnerability in ProSysInfo TFTPDWIN v0.4.2 by sending an overly long filename via UDP to port 69, overwriting the stack and executing arbitrary payloads. It uses a known return address (0x00458b91) in tftpd.exe for reliable exploitation.
This exploit targets a buffer overflow vulnerability in ProSysInfo TFTP server TFTPDWIN <= 0.4.2. It sends a maliciously crafted UDP packet to port 69, triggering a remote code execution via shellcode that spawns a calculator (calc.exe).
This exploit targets a buffer overflow vulnerability in TFTPD Win 0.4.2 via a maliciously crafted UDP packet. It includes shellcode to spawn a bind shell on port 4444, allowing remote command execution.
This Metasploit module exploits a stack-based buffer overflow in ProSysInfo TFTPDWIN v0.4.2 by sending an overly long filename via UDP to port 69, allowing remote code execution. The exploit leverages a known return address (0x00458b91) in tftpd.exe to redirect execution to the payload.