themalwareguardian/cve-2007-1567Classic stack-based buffer overflow in War FTP Daemon 1.65 demonstrating old-school remote code execution through malformed FTP commands.
Classic stack-based buffer overflow in War FTP Daemon 1.65 demonstrating old-school remote code execution through malformed FTP commands.
This repository is part of the material I use when teaching memory corruption exploitation (in addition to my regular work, I also teach in different cybersecurity courses where I help train the next generation of reverse engineers).
CVE-2007-1567 is a case I use right after introducing the basics of vanilla EIP overwrites. The exploitation is clean and direct, but it comes with a detail that makes it slightly more interesting than a typical first exercise, an extra bad character that the FTP protocol introduces and that students must identify and account for when building their shellcode. It is a small constraint, but enough to make students think rather than just copy a technique they already used.
War FTP Daemon 1.65 is a legacy Windows FTP server from the late 1990s. The vulnerability is in the USER command handler, which uses sprintf to copy user-controlled input into a fixed-size stack buffer without validating its length. What makes this case useful for teaching:
War FTP Daemon is a Windows FTP server originally written in the late 1990s. It listens on TCP port 21 and handles standard FTP commands. The vulnerability is in the USER command handler, which processes the username sent by a connecting client using sprintf without length validation.
Key technical details:
War FTP Daemon processes the USER command by passing the supplied username to sprintf, which copies it into a fixed-size stack buffer without checking its length. A simplified version of the vulnerable logic looks like this:
char buffer[256];
sprintf(buffer, "%sCRLF", username);
Sending a sufficiently long string as the USER argument causes the copy to write past the end of the buffer, corrupting the stack until the saved return address is overwritten. When the function returns, the CPU loads the attacker-controlled value from the stack into EIP and jumps to it.
The crash can be reproduced by sending an oversized USER argument over FTP. No authentication is required. Example using Python:
import socket
HOST = '127.0.0.1'
PORT = 21
payload = b"A" * 700
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
s.recv(1024)
s.send(b"USER " + payload + b"\r\n")
s.close()
When executed under a debugger, the crash shows EIP overwritten with user-controlled data:
EIP = 41414141
confirming that the saved return address has been corrupted by the overflow.
The goal of this repository is not only to demonstrate the crash, but to walk through the complete exploitation process step by step, from fuzzing to a working reverse shell.
To keep the main README clean, the detailed exploitation notes, scripts, and debugger steps are placed inside the Vulnerability 📂 folder of this repository.
There you will find the complete workflow used to exploit this CVE, including: