PCMan FTP Server Buffer Overflow Vulnerability in MKDIR Command Handler

A critical buffer overflow vulnerability has been identified in PCMan FTP Server version 2.0.7. The issue arises in an unknown function of the MKDIR command handler, allowing remote exploitation. The vulnerability has been publicly disclosed and is actively exploitable.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a crafted MKDIR command that includes a payload designed to overflow the buffer. This can be done using an FTP client or a script that automates the FTP command sequence. The payload should be carefully crafted to include the desired shellcode and overwrite the return address with a location that executes the shellcode, such as a JMP ESP instruction.