# FTPShell 6.7 windows client has DOS which can be converted to RCE by a malicious server

This is another one of the exploits we tried to port on my local machine using immunity debugger.

Credits to original author for the exploit.

[https://www.cvedetails.com/cve/CVE-2018-7573/](https://www.cvedetails.com/cve/CVE-2018-7573/)[https://www.exploit-db.com/exploits/44596/](https://www.exploit-db.com/exploits/44596/)

[https://www.exploit-db.com/exploits/44968/](https://www.exploit-db.com/exploits/44968/)

## Basic Flow to Port the exploit:

%[https://youtu.be/SSL8wq-jQi0] 

Load program Lets start the malicious FTP server now

Lets try to connect to our malicious FTP server As you can see ESI is completely overloaded with \\x41

lets find jmp esi in windows memory, from which our RIP will jump to NOPS and then to payload shellcode for calc

new jmp.txt is generated by mona

Lets select any one of the address from this for our jmp

lets modify our eip for this new address

0x004539c0 – Normal

\\xc0\\x39\\x45 – Endian Shit

Let restart ftpshell from mona something went wrong, let try with different address, I did not select correct payload calc spawned in other screen. Now i have set single screen so calc.exe should pop up now

%[https://youtu.be/4qRSht5bbBU] 

%[https://youtu.be/Tj53Hxj6Q78] 

%[https://youtu.be/Uq2OYzO4cn8] 

Great — thats it.