diff --git a/modules/vulnerabilities/unix/ftp/pachev_ftp_server_1_path_traversal/manifests/service.pp b/modules/vulnerabilities/unix/ftp/pachev_ftp_server_1_path_traversal/manifests/service.pp
index dd3bbaf60..7fec08d2a 100644
--- a/modules/vulnerabilities/unix/ftp/pachev_ftp_server_1_path_traversal/manifests/service.pp
+++ b/modules/vulnerabilities/unix/ftp/pachev_ftp_server_1_path_traversal/manifests/service.pp
@@ -8,10 +8,18 @@ class pachev_ftp_server_1_path_traversal::service {
$release_dir = '/opt/pachev_ftp/pachev_ftp-master/ftp_server/target/release'
$user = $secgen_parameters['leaked_username'][0]
- # run on each boot via cron
- cron { 'ftp-port-iptables':
- command => "iptables -t nat -I PREROUTING -p tcp --dport $port -j DNAT --to 127.0.0.1:2121 &",
- special => 'reboot',
+ file { '/etc/network/if-pre-up.d':
+ ensure => directory,
+ } ->
+ file { '/etc/network/if-pre-up.d/iptables':
+ ensure => present,
+ owner => 'root',
+ mode => '0755', # execute permissions.
+ content => '#!/bin/sh'
+ } ->
+ file_line { 'ftp_redirect_port_rule':
+ path => '/etc/network/if-pre-up.d/iptables',
+ line => "iptables -t nat -I PREROUTING -p tcp --dport $port -j DNAT --to 127.0.0.1:2121",
}
# recreates in /etc/systemd/, but could link to the copy in /opt/
diff --git a/modules/vulnerabilities/unix/ftp/pachev_ftp_server_1_path_traversal/secgen_metadata.xml b/modules/vulnerabilities/unix/ftp/pachev_ftp_server_1_path_traversal/secgen_metadata.xml
index 0563b8a91..394790ed8 100644
--- a/modules/vulnerabilities/unix/ftp/pachev_ftp_server_1_path_traversal/secgen_metadata.xml
+++ b/modules/vulnerabilities/unix/ftp/pachev_ftp_server_1_path_traversal/secgen_metadata.xml
@@ -66,7 +66,7 @@
- $ftp^
+ ^ftp$
diff --git a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor/secgen_metadata.xml b/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor/secgen_metadata.xml
index f6f788c9d..7f642e064 100644
--- a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor/secgen_metadata.xml
+++ b/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor/secgen_metadata.xml
@@ -65,7 +65,7 @@
- $ftp^
+ ^ftp$
diff --git a/modules/vulnerabilities/unix/ftp/vsftpd_234_backdoor/secgen_metadata.xml b/modules/vulnerabilities/unix/ftp/vsftpd_234_backdoor/secgen_metadata.xml
index acc5884ab..c05d9963b 100644
--- a/modules/vulnerabilities/unix/ftp/vsftpd_234_backdoor/secgen_metadata.xml
+++ b/modules/vulnerabilities/unix/ftp/vsftpd_234_backdoor/secgen_metadata.xml
@@ -51,7 +51,7 @@
- $ftp^
+ ^ftp$