CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
Path: blob/master/documentation/modules/exploit/unix/ftp/proftpd_modcopy_exec.md
Views: 1904
Vulnerable Application
This module exploits the SITE CPFR/CPTO mod_copy commands in ProFTPD version 1.3.5. Any unauthenticated client can leverage these commands to copy files from any part of the filesystem to a chosen destination. The copy commands are executed with the rights of the ProFTPD service, which by default runs under the privileges of the 'nobody' user. By using /proc/self/cmdline to copy a PHP payload to the website directory, PHP remote code execution is made possible.
Installation Steps
Download and build:
Run ProFTPD using the sample default configuration file (in foreground with -n flag for testing):
Set up a web server with a world-writable directory:
Verification Steps
Install the application
Start msfconsole
Do:
use exploit/unix/ftp/proftpd_modcopy_execDo:
set rhosts <rhosts>Do:
set rport_ftp <remote ftp port>Do:
set tmppath <writable temporary file path>Do:
set sitepath <writable web server file path>Do:
runYou should get a new session.
Options
RPORT_FTP
FTP port (default: 21)
TMPPATH
Absolute writable path (default: /tmp)
SITEPATH
Absolute writable website path (default: /var/www)