提交 #648834: PCman FTP Client 2.0.7 Buffer Overflow

Vulnerability Exploitation on PCMan FTP Server 2.0.7

This exploitation technique was successfully tested on Windows XP Professional Service Pack 2 and 3 systems. The target was a PCMan FTP Server version 2.0.7 (32-bit), known for having multiple vulnerabilities, making it ideal for studying and practicing buffer overflow exploitation techniques.

Note: This study is based on the source code available at https://github.com/moEbrahimi/pcmanftpd/blob/master/FtpCmdCon.cpp from the PCMan FTPD GitHub repository.

Test Environment

The PCMan FTP Server 2.0.7, a 32-bit application, served as the exploitation target. Its vulnerability in the "RESET" command allows practicing buffer overflow techniques, providing a controlled scenario for developing proof-of-concept exploits.

Objective

The main objective of this test was to create a functional Proof of Concept (PoC) demonstrating the possibility of exploiting the buffer overflow vulnerability in the "RESET" command, enabling remote code execution on the target system.

Exploitation Steps

1. Triggering the buffer overflow

Sending an excessive amount of data via the "RESET" command caused the application to crash, confirming the presence of a buffer overflow.

2. Determining the offset

To determine the exact number of bytes required to overwrite the EIP (Extended Instruction Pointer), tools from the Metasploit Framework were used:

msf-pattern_create -l 3000: generated a unique cyclic pattern of 3000 bytes.
After the crash, the overwritten EIP value was obtained using the debugger.
msf-pattern_offset -q <EIP_value>: determined the precise offset to the EIP, essential for correctly positioning the redirection address in the exploit.

Offset found: 2004 bytes

3. Stack preparation and JMP ESP discovery

After identifying the offset, it was necessary to locate a reliable JMP ESP instruction in memory to redirect execution to the shellcode:

Used the Mona plugin in Immunity Debugger:

!mona jmp -r esp -n

The memory address found was located in an unprotected system DLL, suitable for redirection.

4. Handling bad characters

During payload creation, key characters that could interrupt shellcode execution were removed:

0x00 – null byte
0x0a – newline
0x0d – carriage return

Since the environment was already known, a full bad characters analysis using a bytearray was not necessary.

5. Shellcode creation

To ensure reliable shellcode execution:

32 NOP instructions (\x90) were added before the shellcode, forming a NOP sled.
The shellcode was generated using msfvenom, allowing customized payloads such as reverse shells, bind shells, remote execution of Windows programs (Calculator, Notepad), or sending messages.

Final Result

With the correct offset, reliable JMP ESP, and clean shellcode, the exploitation was successfully executed. The test resulted in obtaining a remote shell, allowing command execution with the privileges of the vulnerable process.

exploit link: https://github.com/Gustavo-Redol/exploit-1/blob/main/Exploit

• 来源: ⚠️ https://github.com/Gustavo-Redol/exploit-1/blob/main/Exploit
• 用户: R3d0lx01 (UID 89277)
• 提交: 2025-09-05 17時27分 (1 年前)
• 管理: 2025-09-17 18時15分 (12 days later)
• 状态: 重复
• VulDB条目: 309413 [PCMan FTP Server 2.0.7 REST Command 内存损坏]
• 原因: RESET command not supported according to CFtpCmd::CFtpCmdMapEnt in FtpCmd.cpp
• 积分: 0