Description
freeFTPd 1.0.10 and below contains an overflow condition that is triggered as user-supplied input is not properly validated when handling a specially crafted PASS command. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or allow the execution of arbitrary code.
freeFTPd must have an account set to authorization anonymous user account.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/windows/ftp/freeftpd/passmsf undefined(pass) > show actions ...actions...msf undefined(pass) > set ACTION < action-name >msf undefined(pass) > show options ...show and set options...msf undefined(pass) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub