CVE-2010-20121
CRITICALEasyFTP Server <= 1.7.0.11 - Unauthenticated Stack-based Buffer Overflow via CWD Command
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2010-20121.
PoCs published by fdiskyou, Metasploit, Paul Makowski, including Metasploit module exploits/windows/ftp/easyftp_cwd_fixret.
AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in Easy FTP Server v1.7.0.11 via the CWD command post-authentication. It delivers a shellcode payload to execute calc.exe, leveraging a known return address in user32.dll.
Description
EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser. When processing the CWD (Change Working Directory) command, the server fails to properly validate the length of the input string, allowing attackers to overwrite memory on the stack. This flaw enables remote code execution without authentication, as EasyFTP allows anonymous access by default. The vulnerability was resolved in version 1.7.0.12, after which the product was renamed “UplusFtp.”
Exploits (5)
This exploit targets a buffer overflow vulnerability in Easy FTP Server v1.7.0.11 via the CWD command post-authentication. It delivers a shellcode payload to execute calc.exe, leveraging a known return address in user32.dll.
This exploit targets a stack-based buffer overflow in EasyFTP Server <= 1.7.0.11 via the CWD command. It uses a technique called 'fixRet' to inject a larger payload into a smaller buffer by overwriting the return address post-exploitation.
This is a Metasploit module exploiting a stack-based buffer overflow in EasyFTP Server via the CWD command. It uses a custom technique called 'fixRet' to bypass payload size limitations by overwriting the return address post-exploitation.
This is a functional Metasploit module exploiting a stack-based buffer overflow in Easy~FTP Server v1.7.0.2 via the CWD command. It includes a payload delivery mechanism and a return address for Windows XP SP3 English.
This Metasploit module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11 and earlier via the CWD command. It uses a technique called 'fixRet' to inject a larger payload into a smaller buffer by overwriting the return address post-exploitation.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H