Hey, sir.
Buffer overflow exists in the text variable of the do_mkd function in the ftpproto.c file.Overwrite ebp when new folder and absolute path name length exceeds 412.
char text[200] = {0}; //it just 200 byte
char dir[200] = {0};
getcwd(dir, sizeof(dir));
sprintf(text, ""%s%s" created", dir, sess->arg);//it more then 200