CVE-2009-3023
EXPLOITEDMicrosoft Internet Information Server 5.0-6.0 - Authenticated Remote Code Execution via FTP NLST Command Buffer Overflow
Title source: llmExploitation Summary
CVE-2009-3023 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 4 public exploits from researchers including Metasploit, muts, kingcope, including a Metasploit module exploits/windows/ftp/ms09_053_ftpd_nlst.
AI-analyzed exploit summary This exploit targets a stack buffer overflow in Microsoft IIS FTP Server via a malformed NLST command. It uses an egg hunter to locate shellcode stored on the stack, achieving remote code execution.
Description
Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to execute arbitrary code via a crafted NLST (NAME LIST) command that uses wildcards, leading to memory corruption, aka "IIS FTP Service RCE and DoS Vulnerability."
Exploits (4)
This exploit targets a stack buffer overflow in Microsoft IIS FTP Server via a malformed NLST command. It uses an egg hunter to locate shellcode stored on the stack, achieving remote code execution.
This exploit targets a buffer overflow vulnerability in IIS 5.0 FTP Server on Windows 2000 SP4. It uses a combination of shellcode, an egghunter, and a bind shell payload to achieve remote code execution as SYSTEM.
This exploit targets a buffer overflow vulnerability in IIS 5.0 FTPd on Windows 2000 SP4. It uses a crafted SITE command to overwrite the stack and execute shellcode, resulting in remote code execution.
This exploit targets a stack buffer overflow in Microsoft IIS FTP Server (CVE-2009-3023) via a malformed NLST command. It uses an egg hunter to locate and execute shellcode stored on the stack, achieving remote code execution.