CVE-2011-5166

This exploit targets a buffer overflow vulnerability in KnFTP 1.0.0 Server via the 'USER' command. It uses an egghunter and shellcode to execute calc.exe, leveraging a JMP ESP instruction in kernel32.dll.

This exploit demonstrates a buffer overflow vulnerability in KnFTP Server by sending an overly long string (9000 'A' characters) via the PWD command, causing a denial-of-service (DoS) condition. The PoC includes register states showing SEH/EIP overwrites, confirming the vulnerability.

This exploit targets a buffer overflow vulnerability in KnFTP server by sending a maliciously crafted PASS command. It uses an egghunter technique to locate and execute shellcode, which spawns calc.exe as a proof of concept.

This Metasploit module exploits a buffer overflow vulnerability in KnFTP FTP Server to achieve remote code execution by bypassing DEP via ROP chains. It targets specific Windows versions (XP SP2/SP3 and Windows 7 SP1) with tailored ROP gadgets.