CVE-2007-5256
FSD 2.052 d9 and earlier - Remote Code Execution via Long HELP Command
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2007-5256. PoCs published by weak, Luigi Auriemma.
AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in FSFDT Windows FSD Beta (CVE-2007-5256) to execute a reverse shell. It uses a JMP ESP address from KERNEL32.DLL and encoded shellcode to spawn a connection to 10.0.0.100:4321.
Description
Multiple stack-based buffer overflows in FSD 2.052 d9 and earlier, and FSFDT FSD 3.000 d9 and earlier, allow (1) remote attackers to execute arbitrary code via a long HELP command on TCP port 3010 to the sysuser::exechelp function in sysuser.cc and (2) remote authenticated users to execute arbitrary code via long commands on TCP port 6809 to the servinterface::sendmulticast function in servinterface.cc, as demonstrated by a PIcallsign command.
Exploits (3)
This exploit targets a buffer overflow vulnerability in FSFDT Windows FSD Beta (CVE-2007-5256) to execute a reverse shell. It uses a JMP ESP address from KERNEL32.DLL and encoded shellcode to spawn a connection to 10.0.0.100:4321.
This exploit targets a buffer overflow vulnerability in FSD (Fraglab Server Daemon) by sending a crafted HELP command with a malicious payload. It includes a reverse shell payload encoded with Metasploit's PexFnstenvSub encoder, targeting Windows 2000 SP4.
This exploit demonstrates two buffer overflow vulnerabilities in FSD (Flight Simulator Daemon) versions 2.052 d9 and 3.0000 d9. The first involves sending an overly long 'HELP' command to port 3010/3011, while the second involves sending a malformed user authentication string to port 6809. Both can lead to remote code execution or denial-of-service.