Exploitation Summary
EIP tracks 4 public exploits for CVE-2011-3976.
PoCs published by Metasploit, modpr0be, otoy, including Metasploit module exploits/windows/ftp/scriptftp_list.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in ScriptFTP <= 3.3 via a malicious FTP server responding to a LIST command with an overly long filename, leading to arbitrary code execution.
Description
Stack-based buffer overflow in AmmSoft ScriptFTP 3.3 allows remote FTP servers to execute arbitrary code via a long filename in a response to a LIST command, as demonstrated using (1) GETLIST or (2) GETFILE in a ScriptFTP script.
Exploits (4)
This Metasploit module exploits a buffer overflow in ScriptFTP <= 3.3 via a malicious FTP server responding to a LIST command with an overly long filename, leading to arbitrary code execution.
This exploit is a Python-based FTP server that triggers a buffer overflow in ScriptFTP <=3.3 via a malicious LIST command response. It includes shellcode for a bind shell on port 4444 and an egghunter for reliable exploitation.
This Metasploit module exploits a stack buffer overflow in ScriptFTP 3.3 by sending an overly long directory and filename in response to a GETLIST command, leading to remote code execution via SEH overwrite and egghunter techniques.
This Metasploit module exploits a remote buffer overflow in ScriptFTP client (versions 3.3 and earlier) via a malicious FTP server. It triggers the vulnerability during a LIST command by sending a crafted filename to overwrite the exception handler, achieving arbitrary code execution.