Re: ftp conversions exploit

Subject: Re: ftp conversions exploit
From: David Malone (dwmaloneMATHS.TCD.IE)
Date: Wed Dec 22 1999 - 14:01:12 CST

• Next message: Rainer Link: "Re: Announcement: Solaris loadable kernel module backdoor"
• Previous message: Microsoft Product Security Response Team: "Re: The money: protocol in Internet Explorer"
• In reply to: Desi Hacker: "Re: ftp conversions exploit"
• Next in thread: Alexey Chetroi: "Re: ftp conversions exploit"
• Reply: David Malone: "Re: ftp conversions exploit"
• Reply: Alexey Chetroi: "Re: ftp conversions exploit"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Wed, Dec 22, 1999 at 04:47:25AM +0000, Desi Hacker wrote:

> during the exploiting process.. the final step as instructed by the auther
> doesn't work
>
> ftp> get "--use-compress-program=sh blah".tar
> or
> ftp> get "--use-compress-program=sh blah".tar
>
> instead is gives a warning of permission denied!
> in case of anon ftp logging

The ftpaccess man page contains the following example line:

        path-filter anonymous /etc/pathmsg ^[-A-Za-z0-9._]*$ ^\. ^-

which disallows filenames starting with . or - to anonymous users.
Maybe your ftpaccess line contains this?

        David.

• Next message: Rainer Link: "Re: Announcement: Solaris loadable kernel module backdoor"
• Previous message: Microsoft Product Security Response Team: "Re: The money: protocol in Internet Explorer"
• In reply to: Desi Hacker: "Re: ftp conversions exploit"
• Next in thread: Alexey Chetroi: "Re: ftp conversions exploit"
• Reply: David Malone: "Re: ftp conversions exploit"
• Reply: Alexey Chetroi: "Re: ftp conversions exploit"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b27 : Thu Dec 23 1999 - 11:56:45 CST