deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Novell ZENworks Configuration Management Preboot Service 0x4c Buffer Overflow
Type: exploit
Path: modules/exploits/windows/novell/zenworks_preboot_op4c_bof.rb
Platform: win
Disclosure date: 2012-02-22
References: CVE-2011-3176, OSVDB-80231, BID-52659, URL-http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=974

Description:
This module exploits a remote buffer overflow in the ZENworks Configuration
          Management. The vulnerability exists in the Preboot service and can be triggered
          by sending a specially crafted packet with the opcode 0x4c
          (PROXY_CMD_PREBOOT_TASK_INFO2) to port 998/TCP. The module has been successfully
          tested on Novell ZENworks Configuration Management 10 SP2 / SP3 and Windows Server
          2003 SP2 (DEP bypass).
Metasploit Module: Novell ZENworks 6.5 Desktop/Server Management Overflow
Type: exploit
Path: modules/exploits/windows/novell/zenworks_desktop_agent.rb
Platform: win
Disclosure date: 2005-05-19
References: CVE-2005-1543, OSVDB-16698, BID-13678

Description:
This module exploits a heap overflow in the Novell ZENworks
          Desktop Management agent. This vulnerability was discovered
          by Alex Wheeler.
Metasploit Module: Novell ZENworks Configuration Management Preboot Service 0x06 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/novell/zenworks_preboot_op6_bof.rb
Platform: win
Disclosure date: 2010-03-30
References: OSVDB-65361, BID-40486, ZDI-10-090, URL-http://www.novell.com/support/kb/doc.php?id=7005572

Description:
This module exploits a remote buffer overflow in the ZENworks Configuration
          Management 10 SP2. The vulnerability exists in the Preboot service and can be
          triggered by sending a specially crafted packet with the opcode 0x06
          (PROXY_CMD_CLEAR_WS) to the 998/TCP port. The module has been successfully tested
          on Novell ZENworks Configuration Management 10 SP2 and Windows Server 2003 SP2
          (DEP bypass).
Metasploit Module: GAMSoft TelSrv 1.5 Username Buffer Overflow
Type: exploit
Path: modules/exploits/windows/telnet/gamsoft_telsrv_username.rb
Platform: win
Disclosure date: 2000-07-17
References: CVE-2000-0665, OSVDB-373, BID-1478, URL-http://cdn.simtel.net/pub/simtelnet/win95/inetmisc/telsrv15.zip

Description:
This module exploits a username sprintf stack buffer overflow in GAMSoft TelSrv 1.5.
          Other versions may also be affected. The service terminates after exploitation,
          so you only get one chance!

Check method (fingerprinting):
connect
    print_status("Attempting to determine if target is possibly vulnerable...")
    select(nil, nil, nil, 7)
    banner = sock.get_once || ''
    vprint_status("Banner: #{banner}")

    if banner.to_s =~ /TelSrv 1\.5/
      return Exploit::CheckCode::Appears('TelSrv 1.5 detected')
    end

    return Exploit::CheckCode::Safe('TelSrv 1.5 not detected')
  end
Metasploit Module: GoodTech Telnet Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/telnet/goodtech_telnet.rb
Platform: win
Disclosure date: 2005-03-15
Authors: MC
References: CVE-2005-0768, OSVDB-14806, BID-12815

Description:
This module exploits a stack buffer overflow in GoodTech Systems Telnet Server
          versions prior to 5.0.7. By sending an overly long string, an attacker can
          overwrite the buffer and control program execution.
Metasploit Module: GlobalSCAPE Secure FTP Server Input Overflow
Type: exploit
Path: modules/exploits/windows/ftp/globalscapeftp_input.rb
Disclosure date: 2005-05-01
References: CVE-2005-1415, OSVDB-16049, BID-13454, URL-http://archives.neohapsis.com/archives/fulldisclosure/2005-04/0674.html

Description:
This module exploits a buffer overflow in the GlobalSCAPE Secure FTP Server.
          All versions prior to 3.0.3 are affected by this flaw. A valid user account (
          or anonymous access) is required for this exploit to work.
Metasploit Module: FileCopa FTP Server Pre 18 Jul Version
Type: exploit
Path: modules/exploits/windows/ftp/filecopa_list_overflow.rb
Platform: win
Disclosure date: 2006-07-19
References: CVE-2006-3726, OSVDB-27389, BID-19065

Description:
This module exploits the buffer overflow found in the LIST command
          in fileCOPA FTP server pre 18 Jul 2006 version discovered by www.appsec.ch
Metasploit Module: KarjaSoft Sami FTP Server v2.0.2 USER Overflow
Type: exploit
Path: modules/exploits/windows/ftp/sami_ftpd_user.rb
Platform: win
Disclosure date: 2006-01-24
References: CVE-2006-0441, CVE-2006-2212, OSVDB-25670, BID-16370, BID-22045, BID-17835, EDB-1448, EDB-1452, EDB-1462, EDB-3127

Description:
This module exploits an unauthenticated stack buffer overflow in
          KarjaSoft Sami FTP Server version 2.0.2 by sending an overly long
          USER string during login.

          The payload is triggered when the administrator opens the application
          GUI. If the GUI window is open at the time of exploitation, the
          payload will be executed immediately. Keep this in mind when selecting
          payloads. The application will crash following execution of the
          payload and will not restart automatically.

          When the application is restarted, it will re-execute the payload
          unless the payload has been manually removed from the SamiFTP.binlog
          log file.

          This module has been tested successfully on Sami FTP Server versions:
          2.0.2 on Windows XP SP0 (x86);
          2.0.2 on Windows 7 SP1 (x86);
          2.0.2 on Windows 7 SP1 (x64); and
          2.0.2 on Windows 10 (1909) (x64).

Check method (fingerprinting):
connect
    banner = sock.get_once(-1, 3)
    disconnect

    unless banner.include?('Sami FTP Server')
      return CheckCode::Safe('Target is not Sami FTP Server')
    end

    if banner.include?('Sami FTP Server 2.0.2')
      return CheckCode::Appears('Sami FTP Server version 2.0.2.')
    end

    CheckCode::Detected('Target is running Sami FTP Server')
  end
Metasploit Module: Odin Secure FTP 4.1 Stack Buffer Overflow (LIST)
Type: exploit
Path: modules/exploits/windows/ftp/odin_list_reply.rb
Platform: win
Disclosure date: 2010-10-12
References: CVE-2010-10014, OSVDB-68824, URL-http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/

Description:
This module exploits a stack buffer overflow in Odin Secure FTP 4.1,
          triggered when processing the response on a LIST command. During the overflow,
          a structured exception handler record gets overwritten.
Metasploit Module: WinaXe 7.7 FTP Client Remote Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/winaxe_server_ready.rb
Platform: win
Disclosure date: 2016-11-03
References: CVE-2025-34107, EDB-40693, URL-http://hyp3rlinx.altervista.org/advisories/WINAXE-FTP-CLIENT-REMOTE-BUFFER-OVERFLOW.txt

Description:
This module exploits a buffer overflow in the WinaXe 7.7 FTP client.
          This issue is triggered when a client connects to the server and is
          expecting the Server Ready response.
Metasploit Module: Serv-U FTP Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/servu_chmod.rb
Platform: win
Disclosure date: 2004-12-31
Authors: theLightCosine
References: CVE-2004-2111, OSVDB-3713, BID-9483

Description:
This module exploits a stack buffer overflow in the site chmod command
          in versions of Serv-U FTP Server prior to 4.2.

          You must have valid credentials to trigger this vulnerability. Exploitation
          also leaves the service in a non-functional state.

Check method (fingerprinting):
connect
    disconnect

    if (banner =~ /Serv-U FTP Server v((4.(0|1))|3.\d)/)
      return Exploit::CheckCode::Appears('FTP banner indicates vulnerable Serv-U FTP Server version')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match vulnerable Serv-U FTP Server version')
  end
Metasploit Module: AASync v2.2.1.0 (Win32) Stack Buffer Overflow (LIST)
Type: exploit
Path: modules/exploits/windows/ftp/aasync_list_reply.rb
Platform: win
Disclosure date: 2010-10-12
References: CVE-2019-5619, OSVDB-68701, EDB-16738, URL-http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/

Description:
This module exploits a stack buffer overflow in AASync v2.2.1.0, triggered when
          processing the response on a LIST command. During the overflow, a structured exception
          handler record gets overwritten.
Metasploit Module: LeapWare LeapFTP v2.7.3.600 PASV Reply Client Overflow
Type: exploit
Path: modules/exploits/windows/ftp/leapftp_pasv_reply.rb
Platform: win
Disclosure date: 2003-06-09
References: CVE-2003-0558, OSVDB-4587, BID-7860, EDB-54

Description:
This module exploits a buffer overflow in the LeapWare LeapFTP v2.7.3.600
          client that is triggered through an excessively long PASV reply command. This
          module was ported from the original exploit by drG4njubas with minor improvements.
Metasploit Module: FTPPad 1.2.0 Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/ftppad_list_reply.rb
Platform: win
Disclosure date: 2010-10-12
References: CVE-2010-20108, OSVDB-68714, URL-http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/

Description:
This module exploits a stack buffer overflow FTPPad 1.2.0 ftp client. The overflow is
          triggered when the client connects to a FTP server which sends an overly long directory
          and filename in response to a LIST command.

          This will cause an access violation, and will eventually overwrite the saved extended
          instruction pointer.  Payload can be found at EDX+5c and ESI+5c, so a little pivot/
          sniper was needed to make this one work.
Metasploit Module: Wing FTP Server Authenticated Command Execution
Type: exploit
Path: modules/exploits/windows/ftp/wing_ftp_admin_exec.rb
Platform: win
Disclosure date: 2014-06-19
References: CVE-2025-47812, URL-http://www.wftpserver.com, URL-https://www.wftpserver.com/help/ftpserver/index.html?administrator_console.htm

Description:
This module exploits the embedded Lua interpreter in the admin web interface for
          versions 3.0.0 and above. When supplying a specially crafted HTTP POST request
          an attacker can use os.execute() to execute arbitrary system commands on
          the target with SYSTEM privileges.

Check method (fingerprinting):
@session_cookie = authenticate(datastore['USERNAME'], datastore['PASSWORD'])
    if @session_cookie.nil?
      return CheckCode::Unknown('Authentication failed')
    end

    ver = send_request_cgi(
      'uri' => '/admin_license.html',
      'method' => 'POST',
      'cookie' => @session_cookie,
      'ctype' => 'text/plain;charset=UTF-8'
    )

    unless ver
      vprint_error("Connection failed!")
      return CheckCode::Unknown('Connection failed')
    end

    unless ver.code == 200 && ver.body.include?('Wing FTP Server')
      return CheckCode::Safe('Target is not Wing FTP Server')
    end

    @version = Rex::Version.new(ver.body.scan(/Wing FTP Server ([\d\.]+)/).flatten.first)
    print_status("Found Wing FTP Server #{@version}")

    # Lua capabilities and administrator console were added in version 3.0.0, so everything above that is (probably) vulnerable
    unless @version >= Rex::Version.new('3.0.0')
      @vuln_check = false
      return CheckCode::Safe("Wing FTP Server #{@version} is below 3.0.0")
    end

    @vuln_check = true
    winenv_path = execute_command("PATH")

    unless winenv_path
      vprint_error("Connection failed!")
      return CheckCode::Unknown('Connection failed while executing command')
    end

    if winenv_path.code == 200
      winenv_path.body.split(';').each do |path_val|
        if (/powershell/i) =~ path_val
          print_good("Found Powershell at #{path_val}")
          @psh = true
        end
      end
    else
      @psh = fa
Metasploit Module: Ipswitch WS_FTP Server 5.05 XMD5 Overflow
Type: exploit
Path: modules/exploits/windows/ftp/wsftp_server_505_xmd5.rb
Platform: win
Disclosure date: 2006-09-14
Authors: MC
References: CVE-2006-4847, OSVDB-28939, BID-20076

Description:
This module exploits a buffer overflow in the XMD5 verb in
          IPSWITCH WS_FTP Server 5.05.

Check method (fingerprinting):
connect
    disconnect
    if (banner =~ /WS_FTP Server 5\.0\.5/)
      return Exploit::CheckCode::Appears('FTP banner indicates WS_FTP Server 5.0.5')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match WS_FTP Server 5.0.5')
  end
Metasploit Module: Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow
Type: exploit
Path: modules/exploits/windows/ftp/kmftp_utility_cwd.rb
Platform: win
Disclosure date: 2015-08-23
References: CVE-2015-7768, EDB-37908

Description:
This module exploits an SEH overflow in Konica Minolta FTP Server 1.00.
          Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which
          leads to an SEH overflow.  Konica FTP allows anonymous access by default; valid
          credentials are typically unnecessary to exploit this vulnerability.

Check method (fingerprinting):
connect
    disconnect

    if banner =~ /FTP Utility FTP server \(Version 1\.00\)/
      return Exploit::CheckCode::Detected('FTP banner indicates FTP Utility FTP server Version 1.00')
    else
      return Exploit::CheckCode::Safe('FTP banner does not match FTP Utility FTP server')
    end
  end
Metasploit Module: freeFTPd 1.0 Username Overflow
Type: exploit
Path: modules/exploits/windows/ftp/freeftpd_user.rb
Platform: win
Disclosure date: 2005-11-16
Authors: MC
References: CVE-2005-3683, OSVDB-20909, BID-15457

Description:
This module exploits a stack buffer overflow in the freeFTPd
          multi-protocol file transfer service. This flaw can only be
          exploited when logging has been enabled (non-default).

Check method (fingerprinting):
connect
    disconnect
    if (banner =~ /freeFTPd 1\.0/)
      return Exploit::CheckCode::Appears('FTP banner indicates freeFTPd 1.0')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match freeFTPd 1.0')
  end
Metasploit Module: War-FTPD 1.65 Password Overflow
Type: exploit
Path: modules/exploits/windows/ftp/warftpd_165_pass.rb
Platform: win
Disclosure date: 1998-03-19
Authors: hdm
References: CVE-1999-0256, OSVDB-875, BID-10078

Description:
This exploits the buffer overflow found in the PASS command
          in War-FTPD 1.65. This particular module will only work
          reliably against Windows 2000 targets. The server must be
          configured to allow anonymous logins for this exploit to
          succeed. A failed attempt will bring down the service
          completely.
Metasploit Module: Texas Imperial Software WFTPD 3.23 SIZE Overflow
Type: exploit
Path: modules/exploits/windows/ftp/wftpd_size.rb
Platform: win
Disclosure date: 2006-08-23
Authors: MC
References: CVE-2006-4318, OSVDB-28134, BID-19617

Description:
This module exploits a buffer overflow in the SIZE verb in
          Texas Imperial's Software WFTPD 3.23.
Metasploit Module: FTP Synchronizer Professional 4.0.73.274 Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/ftpsynch_list_reply.rb
Platform: win
Disclosure date: 2010-10-12
References: CVE-2010-20107, URL-http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/

Description:
This module exploits a stack buffer overflow vulnerability in FTP Synchronizer Pro
          version 4.0.73.274 The overflow gets triggered by sending an overly long filename to
          the client in response to a LIST command.
          The LIST command gets issued when doing a preview or when you have just created a new
          sync profile and allow the tool to see the differences.
          This will overwrite a structured exception handler and trigger an access violation.
Metasploit Module: Oracle 9i XDB FTP PASS Overflow (win32)
Type: exploit
Path: modules/exploits/windows/ftp/oracle9i_xdb_ftp_pass.rb
Platform: win
Disclosure date: 2003-08-18
References: CVE-2003-0727, OSVDB-2449, BID-8375, URL-http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-litchfield-paper.pdf

Description:
By passing an overly long string to the PASS command, a
          stack based buffer overflow occurs. David Litchfield, has
          illustrated multiple vulnerabilities in the Oracle 9i XML
          Database (XDB), during a seminar on "Variations in exploit
          methods between Linux and Windows" presented at the Blackhat
          conference.

Check method (fingerprinting):
connect
    disconnect
    if (banner =~ /9\.2\.0\.1\.0/)
      return Exploit::CheckCode::Appears('FTP banner indicates Oracle 9i version 9.2.0.1.0')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match Oracle 9i XDB')
  end
Metasploit Module: Ricoh DC DL-10 SR10 FTP USER Command Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/ricoh_dl_bof.rb
Platform: win
Disclosure date: 2012-03-01
References: CVE-2012-5002, OSVDB-79691, URL-http://web.archive.org/web/[PII_REDACTED]2629/http://secunia.com/advisories/47912/, URL-http://www.inshell.net/2012/03/ricoh-dc-software-dl-10-ftp-server-sr10-exe-remote-buffer-overflow-vulnerability/

Description:
This module exploits a vulnerability found in Ricoh DC's DL-10 SR10 FTP
          service.  By supplying a long string of data to the USER command, it is
          possible to trigger a stack-based buffer overflow, which allows remote code
          execution under the context of the user.

          Please note that in order to trigger the vulnerability, the server must
          be configured with a log file name (by default, it's disabled).

Check method (fingerprinting):
connect
    disconnect
    if banner =~ /220 DSC ftpd 1\.0 FTP Server/
      return Exploit::CheckCode::Appears('FTP banner indicates Ricoh DSC ftpd 1.0')
    else
      return Exploit::CheckCode::Safe('FTP banner does not match Ricoh DSC ftpd')
    end
  end
Metasploit Module: MS09-053 Microsoft IIS FTP Server NLST Response Overflow
Type: exploit
Path: modules/exploits/windows/ftp/ms09_053_ftpd_nlst.rb
Disclosure date: 2009-08-31
References: EDB-9541, CVE-2009-3023, OSVDB-57589, BID-36189, MSB-MS09-053

Description:
This module exploits a stack buffer overflow flaw in the Microsoft IIS FTP
          service. The flaw is triggered when a special NLST argument is passed
          while the session has changed into a long directory path. For this exploit
          to work, the FTP server must be configured to allow write access to the
          file system (either anonymously or in conjunction with a real account)
Metasploit Module: BisonWare BisonFTP Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/bison_ftp_bof.rb
Platform: win
Disclosure date: 2011-08-07
References: CVE-1999-1510, BID-49109, EDB-17649, URL-http://secpod.org/msf/bison_server_bof.rb

Description:
BisonWare BisonFTP Server 3.5 is prone to an overflow condition.
          This module exploits a buffer overflow vulnerability in the said
          application.

Check method (fingerprinting):
connect_login
    disconnect
    if /BisonWare BisonFTP server product V3\.5/i === banner
      return Exploit::CheckCode::Appears('FTP banner indicates BisonWare BisonFTP server V3.5')
    else
      return Exploit::CheckCode::Safe('FTP banner does not match BisonWare BisonFTP')
    end
  end
Metasploit Module: GoldenFTP PASS Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/goldenftp_pass_bof.rb
Platform: win
Disclosure date: 2011-01-23
References: CVE-2006-6576, OSVDB-35951, BID-45957, EDB-16036

Description:
This module exploits a vulnerability in the Golden FTP service, using the PASS
          command to cause a buffer overflow.  Please note that in order trigger the vulnerable
          code, the victim machine must have the "Show new connections" setting enabled.  By
          default, this option is unchecked.

Check method (fingerprinting):
connect
    disconnect
    vprint_status("FTP Banner: #{banner}".strip)
    if banner =~ /Golden FTP Server ready v(4\.\d{2})/ and $1 == "4.70"
      return Exploit::CheckCode::Appears('FTP banner indicates Golden FTP Server v4.70')
    else
      return Exploit::CheckCode::Safe('FTP banner does not match Golden FTP Server v4.70')
    end
  end
Metasploit Module: EasyFTP Server LIST Command Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/easyftp_list_fixret.rb
Platform: win
Disclosure date: 2010-07-05
References: CVE-2024-0546, OSVDB-62134, EDB-14400, EDB-14451

Description:
This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11.
          credit goes to Karn Ganeshan.

          NOTE: Although, this is likely to exploit the same vulnerability as the
          'easyftp_cwd_fixret' exploit, it uses a slightly different vector.

Check method (fingerprinting):
connect
    disconnect

    if (banner =~ /BigFoolCat/)
      return Exploit::CheckCode::Detected('FTP banner indicates BigFoolCat EasyFTP Server')
    end

    Exploit::CheckCode::Safe('FTP banner does not match BigFoolCat EasyFTP Server')
  end
Metasploit Module: Ability Server 2.34 STOR Command Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/ability_server_stor.rb
Platform: win
Disclosure date: 2004-10-22
References: CVE-2004-1626, OSVDB-11030, EDB-588

Description:
This module exploits a stack-based buffer overflow in Ability Server 2.34.
          Ability Server fails to check input size when parsing 'STOR' and 'APPE' commands,
          which leads to a stack based buffer overflow. This plugin uses the 'STOR' command.

          The vulnerability has been confirmed on version 2.34 and has also been reported
          in version 2.25 and 2.32. Other versions may also be affected.

Check method (fingerprinting):
connect
    disconnect
    if banner =~ /Ability Server 2\.34/
      return Exploit::CheckCode::Appears('FTP banner indicates Ability Server 2.34')
    else
      if banner =~ /Ability Server/
        return Exploit::CheckCode::Detected('FTP banner indicates Ability Server')
      end
    end

    return Exploit::CheckCode::Safe('FTP banner does not match Ability Server')
  end
Metasploit Module: Gekko Manager FTP Client Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/gekkomgr_list_reply.rb
Platform: win
Disclosure date: 2010-10-12
References: CVE-2010-20034, OSVDB-68641, URL-http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/

Description:
This module exploits a buffer overflow in Gekko Manager ftp client, triggered when
          processing the response received after sending a LIST request. If this response contains
          a long filename, a buffer overflow occurs, overwriting a structured exception handler.
Metasploit Module: Trellian FTP Client 3.01 PASV Remote Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/trellian_client_pasv.rb
Platform: win
Disclosure date: 2010-04-11
References: CVE-2010-1465, OSVDB-63812, EDB-12152

Description:
This module exploits a buffer overflow in the Trellian 3.01 FTP client that is triggered
          through an excessively long PASV message.
Metasploit Module: Xlink FTP Client Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/xlink_client.rb
Platform: win
Disclosure date: 2009-10-03
References: CVE-2006-5792, OSVDB-33969, URL-http://www.xlink.com

Description:
This module exploits a stack buffer overflow in Xlink FTP Client 32
          Version 3.01 that comes bundled with Omni-NFS Enterprise 5.2.
          When an overly long FTP server response is received by a client,
          arbitrary code may be executed.