Attack Chain

1. The attacker performs network reconnaissance to identify targets running PCMan FTP Server 2.0 on port 21.
2. The attacker establishes a TCP connection to the target's FTP service.
3. The attacker performs initial authentication or leverages anonymous access, which is often enabled by default in this server version.
4. The attacker sends a crafted 'pwd' command containing a 2007-byte padding sequence followed by a custom return address (e.g., JMP ESP).
5. The server process crashes or redirects execution flow as it attempts to process the oversized 'pwd' argument, triggering the stack overflow.
6. The injected shellcode, appended to the request, is executed with the privileges of the FTP service process.
7. The attacker establishes a reverse TCP meterpreter session or similar payload to achieve remote command-and-control access.
8. The attacker gains unauthorized control over the host system, typically with administrative or system privileges depending on the service execution context.

Impact

Successful exploitation results in full system compromise. As the FTP service often runs with high privileges, attackers can gain administrative access, exfiltrate sensitive files, or deploy additional malware. Given the publicly available PoC scripts and Metasploit modules, the barrier to entry for this exploit is low for actors targeting legacy infrastructure.

Recommendation

Prioritize the decommissioning of PCMan FTP Server 2.0. As this is legacy software, immediate migration to a modern, supported FTP or SFTP solution is the primary mitigation. Ensure network perimeter security blocks unauthorized access to port 21.