deardaniel/secdata-raw huggingface dataset:
Metasploit Module: ComSndFTP v1.3.7 Beta USER Format String (Write4) Vulnerability
Type: exploit
Path: modules/exploits/windows/ftp/comsnd_ftpd_fmtstr.rb
Platform: win
Disclosure date: 2012-06-08
References: CVE-2012-10055, OSVDB-82798, EDB-19024

Description:
This module exploits the ComSndFTP FTP Server version 1.3.7 beta by sending a specially
          crafted format string specifier as a username. The crafted username is sent to the server to
          overwrite the hardcoded function pointer from Ws2_32.dll!WSACleanup. Once this function pointer
          is triggered, the code bypasses dep and then repairs the pointer to execute arbitrary code.
          The SEH exit function is preferred so that the administrators are not left with an unhandled
          exception message. When using the meterpreter payload, the process will never die, allowing
          for continuous exploitation.

Check method (fingerprinting):
connect
    banner = sock.get_once || ""
    disconnect

    validate = "\x32\x32\x30\x20\xbb\xb6\xd3\xad\xb9"
    validate << "\xe2\xc1\xd9\x46\x54\x50\xb7\xfe\xce"
    validate << "\xf1\xc6\xf7\x21\x0d\x0a"

    if banner.to_s == validate
      return Exploit::CheckCode::Vulnerable('FTP banner matches known vulnerable ComSndFTP signature')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match ComSndFTP')
  end
Metasploit Module: Free Float FTP Server USER Command Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/freefloatftp_user.rb
Platform: win
Disclosure date: 2012-06-12
References: CVE-2012-10023, OSVDB-69621, EDB-23243

Description:
Freefloat FTP Server is prone to an overflow condition. It
          fails to properly sanitize user-supplied input resulting in a
          stack-based buffer overflow. With a specially crafted 'USER'
          command, a remote attacker can potentially have an unspecified
          impact.

Check method (fingerprinting):
connect
    disconnect
    if (banner =~ /FreeFloat/)
      # Software is never updated, so if you run this you're f*cked.
      return Exploit::CheckCode::Vulnerable('FTP banner indicates FreeFloat FTP Server')
    else
      return Exploit::CheckCode::Safe('FTP banner does not match FreeFloat FTP Server')
    end
  end
Metasploit Module: PCMAN FTP Server Buffer Overflow - PUT Command
Type: exploit
Path: modules/exploits/windows/ftp/pcman_put.rb
Platform: win
Disclosure date: 2015-08-07
References: CVE-2013-4730, EDB-37731, OSVDB-94624

Description:
This module exploits a buffer overflow vulnerability found in the PUT command of the
          PCMAN FTP v2.0.7 Server. This requires authentication but by default anonymous
          credentials are enabled.

Check method (fingerprinting):
connect_login
    disconnect

    if /220 PCMan's FTP Server 2\.0/ === banner
      Exploit::CheckCode::Appears('FTP banner indicates PCMan FTP Server 2.0')
    else
      Exploit::CheckCode::Safe('FTP banner does not match PCMan FTP Server 2.0')
    end
  end
Metasploit Module: Easy File Sharing FTP Server 2.0 PASS Overflow
Type: exploit
Path: modules/exploits/windows/ftp/easyfilesharing_pass.rb
Platform: win
Disclosure date: 2006-07-31
Authors: MC
References: CVE-2006-3952, OSVDB-27646, BID-19243

Description:
This module exploits a stack buffer overflow in the Easy File Sharing 2.0
          service. By sending an overly long password, an attacker can execute
          arbitrary code.

Check method (fingerprinting):
connect
    disconnect

    if (banner =~ /Easy File Sharing FTP Server/)
      return Exploit::CheckCode::Detected('FTP banner indicates Easy File Sharing FTP Server')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match Easy File Sharing FTP Server')
  end
Metasploit Module: 3Com 3CDaemon 2.0 FTP Username Overflow
Type: exploit
Path: modules/exploits/windows/ftp/3cdaemon_ftp_user.rb
Platform: win
Disclosure date: 2005-01-04
References: CVE-2005-0277, OSVDB-12810, OSVDB-12811, BID-12155

Description:
This module exploits a vulnerability in the 3Com 3CDaemon
          FTP service. This package is being distributed from the 3Com
          web site and is recommended in numerous support documents.
          This module uses the USER command to trigger the overflow.

Check method (fingerprinting):
connect
    disconnect
    if (banner =~ /3Com 3CDaemon FTP Server Version 2\.0/)
      return Exploit::CheckCode::Appears('FTP banner indicates 3Com 3CDaemon FTP Server Version 2.0')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match 3Com 3CDaemon')
  end
Metasploit Module: 32bit FTP Client Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/32bitftp_list_reply.rb
Platform: win
Disclosure date: 2010-10-12
References: CVE-2009-1675, OSVDB-68703, URL-http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/

Description:
This module exploits a stack buffer overflow in 32bit ftp client, triggered when trying to
          download a file that has an overly long filename.
Metasploit Module: SlimFTPd LIST Concatenation Overflow
Type: exploit
Path: modules/exploits/windows/ftp/slimftpd_list_concat.rb
Disclosure date: 2005-07-21
References: CVE-2005-2373, OSVDB-18172, BID-14339

Description:
This module exploits a stack buffer overflow in the SlimFTPd
          server. The flaw is triggered when a LIST command is
          received with an overly-long argument. This vulnerability
          affects all versions of SlimFTPd prior to 3.16 and was
          discovered by Raphael Rigo.
Metasploit Module: NetTerm NetFTPD USER Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/netterm_netftpd_user.rb
Disclosure date: 2005-04-26
References: CVE-2005-1323, OSVDB-15865, URL-https://seclists.org/lists/fulldisclosure/2005/Apr/0578.html, BID-13396

Description:
This module exploits a vulnerability in the NetTerm NetFTPD
          application. This package is part of the NetTerm package.
          This module uses the USER command to trigger the overflow.

Check method (fingerprinting):
connect
    disconnect
    if (banner =~ /NetTerm FTP server/)
      return Exploit::CheckCode::Detected('FTP banner indicates NetTerm FTP server')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match NetTerm FTP server')
  end
Metasploit Module: Sasser Worm avserve FTP PORT Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/sasser_ftpd_port.rb
Platform: win
Disclosure date: 2004-05-10
References: OSVDB-6197

Description:
This module exploits the FTP server component of the Sasser worm.
          By sending an overly long PORT command the stack can be overwritten.
Metasploit Module: PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/pcman_stor.rb
Platform: win
Disclosure date: 2013-06-27
References: CVE-2013-4730, OSVDB-94624, EDB-27703

Description:
This module exploits a buffer overflow vulnerability found in the STOR command of the
          PCMAN FTP v2.07 Server when the "/../" parameters are also sent to the server. Please
          note authentication is required in order to trigger the vulnerability. The overflowing
          string will also be seen on the FTP server log console.

Check method (fingerprinting):
c = connect_login
    disconnect

    if c and banner =~ /220 PCMan's FTP Server 2\.0/
      # Auth is required to exploit
      vprint_status("Able to authenticate, and banner shows the vulnerable version")
      return Exploit::CheckCode::Appears('Authenticated and banner shows PCMan FTP Server 2.0')
    elsif not c and banner =~ /220 PCMan's FTP Server 2\.0/
      vprint_status("Unable to authenticate, but banner shows the vulnerable version")
      # Auth failed, but based on version maybe the target is vulnerable
      return Exploit::CheckCode::Appears('Banner shows PCMan FTP Server 2.0 but authentication failed')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match PCMan FTP Server 2.0')
  end
Metasploit Module: Xlink FTP Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/xlink_server.rb
Platform: win
Disclosure date: 2009-10-03
References: CVE-2006-5792, OSVDB-58646, URL-http://www.xlink.com

Description:
This module exploits a stack buffer overflow in Xlink FTP Server
          that comes bundled with Omni-NFS Enterprise 5.2.
          When a overly long FTP request is sent to the server,
          arbitrary code may be executed.

Check method (fingerprinting):
connect
    disconnect

    if (banner =~ /XLINK FTP Server/)
      return Exploit::CheckCode::Detected('FTP banner indicates XLINK FTP Server')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match XLINK FTP Server')
  end
Metasploit Module: FTPShell client 6.70 (Enterprise edition) Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/ftpshell_cli_bof.rb
Platform: win
Disclosure date: 2017-03-04
References: CVE-2018-7573, EDB-44596

Description:
This module exploits a buffer overflow in the FTPShell client 6.70 (Enterprise
          edition) allowing remote code execution.
Metasploit Module: Vermillion FTP Daemon PORT Command Memory Corruption
Type: exploit
Path: modules/exploits/windows/ftp/vermillion_ftpd_port.rb
Platform: win
Disclosure date: 2009-09-23
References: CVE-2010-20115, OSVDB-62163, EDB-11293

Description:
This module exploits an out-of-bounds array access in the Arcane Software
          Vermillion FTP server. By sending a specially crafted FTP PORT command,
          an attacker can corrupt stack memory and execute arbitrary code.

          This particular issue is caused by processing data bound by attacker
          controlled input while writing into a 4 byte stack buffer. Unfortunately,
          the writing that occurs is not a simple byte copy.

          Processing is done using a source ptr (p) and a destination pointer (q).
          The vulnerable function walks the input string and continues while the
          source byte is non-null. If a comma is encountered, the function increments
          the destination pointer. If an ascii digit [0-9] is encountered, the
          following occurs:

          *q = (*q * 10) + (*p - '0');

          All other input characters are ignored in this loop.

          As a consequence, an attacker must craft input such that modifications
          to the current values on the stack result in usable values. In this exploit,
          the low two bytes of the return address are adjusted to point at the
          location of a 'call edi' instruction within the binary. This was chosen
          since 'edi' points at the source buffer when the function returns.

          NOTE: This server can be installed as a service using "vftpd.exe install".
          If so, the service does not restart automatically, giving an attacker only
          one attempt.

Check method (fingerprinting):
connect
    disconnect
    vprint_status("FTP Banner: #{banner}".strip)
    if banner =~ /\(vftpd .*\)/
      return Exploit::CheckCode::Detected('FTP banner indicates Vermillion FTP daemon')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match Vermillion FTP daemon')
  end
Metasploit Module: BolinTech Dream FTP Server 1.02 Format String
Type: exploit
Path: modules/exploits/windows/ftp/dreamftp_format.rb
Platform: win
Disclosure date: 2004-03-03
References: CVE-2004-2074, OSVDB-4986, BID-9800, EDB-823

Description:
This module exploits a format string overflow in the BolinTech
          Dream FTP Server version 1.02. Based on the exploit by SkyLined.

Check method (fingerprinting):
connect
    banner = sock.get_once
    disconnect
    if (banner.to_s =~ /Dream FTP Server/)
      return Exploit::CheckCode::Detected('FTP banner indicates Dream FTP Server')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match Dream FTP Server')
  end
Metasploit Module: QuickShare File Server 1.2.1 Directory Traversal Vulnerability
Type: exploit
Path: modules/exploits/windows/ftp/quickshare_traversal_write.rb
Platform: win
Disclosure date: 2011-02-03
References: CVE-2011-10010, OSVDB-70776, EDB-16105, URL-http://www.quicksharehq.com/blog/quickshare-file-server-1-2-2-released.html, URL-http://www.digital-echidna.org/2011/02/quickshare-file-share-1-2-1-directory-traversal-vulnerability/

Description:
This module exploits a vulnerability found in QuickShare File Server's FTP
          service.  By supplying "../" in the file path, it is possible to trigger a
          directory traversal flaw, allowing the attacker to read a file outside the
          virtual directory.  By default, the "Writable" option is enabled during account
          creation, therefore this makes it possible to create a file at an arbitrary
          location, which leads to remote code execution.

Check method (fingerprinting):
connect
    disconnect

    if banner =~ /quickshare ftpd/
      return Exploit::CheckCode::Detected('FTP banner indicates QuickShare File Server')
    else
      return Exploit::CheckCode::Safe('FTP banner does not match QuickShare File Server')
    end
  end
Metasploit Module: WS-FTP Server 5.03 MKD Overflow
Type: exploit
Path: modules/exploits/windows/ftp/wsftp_server_503_mkd.rb
Disclosure date: 2004-11-29
References: CVE-2004-1135, OSVDB-12509, BID-11772

Description:
This module exploits the buffer overflow found in the MKD
          command in IPSWITCH WS_FTP Server 5.03 discovered by Reed
          Arvin.

Check method (fingerprinting):
connect
    disconnect
    if (banner =~ /5\.0\.3/)
      return Exploit::CheckCode::Appears('FTP banner indicates WS_FTP Server version 5.0.3')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match WS_FTP Server 5.0.3')
  end
Metasploit Module: LeapFTP 3.0.1 Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/leapftp_list_reply.rb
Platform: win
Disclosure date: 2010-10-12
References: CVE-2010-20049, OSVDB-68640, URL-http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/

Description:
This module exploits a buffer overflow in the LeapFTP 3.0.1 client.
          This issue is triggered when a file with a long name is downloaded/opened.
Metasploit Module: ProFTP 2.9 Banner Remote Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/proftp_banner.rb
Platform: win
Disclosure date: 2009-08-25
References: CVE-2009-3976, OSVDB-57394, URL-http://www.labtam-inc.com/index.php?act=products&pid=1

Description:
This module exploits a buffer overflow in the ProFTP 2.9
          client that is triggered through an excessively long welcome message.
Metasploit Module: Turbo FTP Server 1.30.823 PORT Overflow
Type: exploit
Path: modules/exploits/windows/ftp/turboftp_port.rb
Disclosure date: 2012-10-03
References: CVE-2012-10035, EDB-22161, OSVDB-85887

Description:
This module exploits a buffer overflow vulnerability found in the PORT
          command in Turbo FTP Server 1.30.823 & 1.30.826, which results in remote
          code execution under the context of SYSTEM.

Check method (fingerprinting):
connect
    disconnect
    if (banner =~ /1\.30\.823/)
      return Exploit::CheckCode::Appears('FTP banner indicates TurboFTP version 1.30.823')
    elsif (banner =~ /1\.30\.826/)
      return Exploit::CheckCode::Appears('FTP banner indicates TurboFTP version 1.30.826')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match vulnerable TurboFTP version')
  end
Metasploit Module: AbsoluteFTP 1.9.6 - 2.2.10 LIST Command Remote Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/absolute_ftp_list_bof.rb
Platform: win
Disclosure date: 2011-11-09
References: CVE-2011-5164, OSVDB-77105, EDB-18102

Description:
This module exploits VanDyke Software AbsoluteFTP by overflowing
          a filename buffer related to the LIST command.
Metasploit Module: FreeFloat FTP Server Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/ftp/freefloatftp_wbem.rb
Platform: win
Disclosure date: 2012-12-07
References: CVE-2012-10030, OSVDB-88302, OSVDB-88303

Description:
This module abuses multiple issues in FreeFloat: 1. No credential is actually
          needed to login; 2. User's default path is in C:\, and this cannot be changed;
          3. User can write to anywhere on the server's file system.  As a result of these
          poor implementations, a malicious user can just log in and then upload files,
          and let WMI (Management Instrumentation service) to execute the payload uploaded.

Check method (fingerprinting):
connect
    disconnect

    if banner =~ /FreeFloat/
      return Exploit::CheckCode::Detected('FTP banner indicates FreeFloat FTP Server')
    else
      return Exploit::CheckCode::Safe('FTP banner does not match FreeFloat FTP Server')
    end
  end
Metasploit Module: Open-FTPD 1.2 Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/ftp/open_ftpd_wbem.rb
Platform: win
Disclosure date: 2012-06-18
References: OSVDB-65687, EDB-13932, CVE-2010-2620

Description:
This module exploits multiple vulnerabilities found in Open&Compact FTP
          server. The software contains an authentication bypass vulnerability and a
          arbitrary file upload vulnerability that allows a remote attacker to write
          arbitrary files to the file system as long as there is at least one user
          who has permission.

          Code execution can be achieved by first uploading the payload to the remote
          machine as an exe file, and then upload another mof file, which enables
          WMI (Management Instrumentation service) to execute the uploaded payload.
          Please note that this module currently only works for Windows before Vista.

Check method (fingerprinting):
connect
    disconnect

    if banner =~ /\*\*        Welcome on       \*\*/
      return Exploit::CheckCode::Detected('FTP banner indicates Open-FTPD')
    else
      return Exploit::CheckCode::Unknown('Could not confirm Open-FTPD from the FTP banner')
    end
  end
Metasploit Module: FileWrangler 5.30 Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/filewrangler_list_reply.rb
Platform: win
Disclosure date: 2010-10-12
References: CVE-2010-20045, OSVDB-94555, URL-http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/

Description:
This module exploits a buffer overflow in the FileWrangler client
          that is triggered when the client connects to a FTP server and lists
          the directory contents, containing an overly long directory name.
Metasploit Module: Xftp FTP Client 3.0 PWD Remote Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/xftp_client_pwd.rb
Platform: win
Disclosure date: 2010-04-22
References: CVE-2010-20122, OSVDB-63968, EDB-12332

Description:
This module exploits a buffer overflow in the Xftp 3.0 FTP client that is triggered
          through an excessively long PWD message.
Metasploit Module: FTPGetter Standard v3.55.0.05 Stack Buffer Overflow (PWD)
Type: exploit
Path: modules/exploits/windows/ftp/ftpgetter_pwd_reply.rb
Platform: win
Disclosure date: 2010-10-12
References: CVE-2019-9760, OSVDB-68638, URL-http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/

Description:
This module exploits a buffer overflow in FTPGetter Standard v3.55.0.05 ftp client.
          When processing the response on a PWD command, a stack based buffer overflow occurs.
          This leads to arbitrary code execution when a structured exception handler gets
          overwritten.
Metasploit Module: ScriptFTP LIST Remote Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/scriptftp_list.rb
Platform: win
Disclosure date: 2011-10-12
References: CVE-2011-3976, OSVDB-75633, EDB-17876, US-CERT-VU-440219

Description:
AmmSoft's ScriptFTP client is susceptible to a remote buffer overflow
          vulnerability that is triggered when processing a sufficiently long
          filename during a FTP LIST command resulting in overwriting the
          exception handler. Social engineering of executing a specially crafted
          ftp file by double click will result in connecting to our malicious
          server and perform arbitrary code execution which allows the attacker to
          gain the same rights as the user running ScriptFTP. This vulnerability
          affects versions 3.3 and earlier.
Metasploit Module: Ayukov NFTP FTP Client Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/ayukov_nftp.rb
Platform: win
Disclosure date: 2017-10-21
References: CVE-2017-15222, EDB-43025

Description:
This module exploits a stack-based buffer overflow vulnerability against Ayukov NFTPD FTP
          Client 2.0 and earlier. By responding with a long string of data for the SYST request, it
          is possible to cause a denail-of-service condition on the FTP client, or arbitrary remote
          code exeuction under the context of the user if successfully exploited.
Metasploit Module: Sami FTP Server LIST Command Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/sami_ftpd_list.rb
Platform: win
Disclosure date: 2013-02-27
References: CVE-2008-5106, OSVDB-90815, BID-58247, EDB-24557

Description:
This module exploits a stack based buffer overflow on Sami FTP Server 2.0.1.
          The vulnerability exists in the processing of LIST commands. In order to trigger
          the vulnerability, the "Log" tab must be viewed in the Sami FTP Server managing
          application, in the target machine. On the other hand, the source IP address used
          to connect with the FTP Server is needed. If the user can't provide it, the module
          will try to resolve it. This module has been tested successfully on Sami FTP Server
          2.0.1 over Windows XP SP3.
Metasploit Module: HTTPDX tolog() Function Format String Vulnerability
Type: exploit
Path: modules/exploits/windows/ftp/httpdx_tolog_format.rb
Platform: win
Disclosure date: 2009-11-17
References: CVE-2009-4769, OSVDB-60181

Description:
This module exploits a format string vulnerability in HTTPDX FTP server.
          By sending a specially crafted FTP command containing format specifiers, an
          attacker can corrupt memory and execute arbitrary code.

          By default logging is off for HTTP, but enabled for the 'moderator' user
          via FTP.

Check method (fingerprinting):
connect
    disconnect
    vprint_status("FTP Banner: #{banner}".strip)
    if banner =~ /httpdx.*\(Win32\)/
      return Exploit::CheckCode::Detected('FTP banner indicates httpdx on Win32')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match httpdx')
  end
Metasploit Module: EasyFTP Server MKD Command Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/easyftp_mkd_fixret.rb
Platform: win
Disclosure date: 2010-04-04
References: CVE-2011-10005, OSVDB-62134, EDB-12044, EDB-14399

Description:
This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11
          and earlier. EasyFTP fails to check input size when parsing 'MKD' commands, which
          leads to a stack based buffer overflow.

          NOTE: EasyFTP allows anonymous access by default. However, in order to access the
          'MKD' command, you must have access to an account that can create directories.

          After version 1.7.0.12, this package was renamed "UplusFtp".

          This exploit utilizes a small piece of code that I\'ve referred to as 'fixRet'.
          This code allows us to inject of payload of ~500 bytes into a 264 byte buffer by
          'fixing' the return address post-exploitation.  See references for more information.

Check method (fingerprinting):
connect
    disconnect

    if (banner =~ /BigFoolCat/)
      return Exploit::CheckCode::Detected('FTP banner indicates BigFoolCat EasyFTP Server')
    end

    return Exploit::CheckCode::Safe('FTP banner does not match BigFoolCat EasyFTP Server')
  end
Metasploit Module: LabF nfsAxe 3.7 FTP Client Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ftp/labf_nfsaxe.rb
Platform: win
Disclosure date: 2017-05-15
References: CVE-2017-18047, EDB-42011

Description:
This module exploits a buffer overflow in the LabF nfsAxe 3.7 FTP Client allowing remote
          code execution.