""ET EXPLOIT FTPShell client Stack Buffer Overflow""

SID: 2025779

Revision: 2

Class Type: attempted-user

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_07_03, cve CVE_2018_8734, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, updated_at 2018_07_03

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: 21

Destination Network: $HOME_NET

Destination Port: any

Flow: established,from_server

Contents:

  • Value: "220|20 22|"

  • Value: !"|00|"

  • Value: !"|22|"

  • Value: !"|0b|"

  • Value: !"|0a|"

  • Value: !"|0d|"

  • Value: "|ed 2e 45 22 20|"

Within: 400

PCRE:

Special Options:

  • fast_pattern

source