diff --git a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/files/proftpd-1.3.3c.tar.gz b/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/files/proftpd-1.3.3c.tar.gz deleted file mode 100644 index 78437717e..000000000 Binary files a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/files/proftpd-1.3.3c.tar.gz and /dev/null differ diff --git a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/files/proftpd.init.d b/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/files/proftpd.init.d deleted file mode 100644 index 43a96f92a..000000000 --- a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/files/proftpd.init.d +++ /dev/null @@ -1,223 +0,0 @@ -#!/bin/sh - -### BEGIN INIT INFO -# Provides: proftpd -# Required-Start: $remote_fs $syslog $local_fs $network -# Required-Stop: $remote_fs $syslog $local_fs $network -# Should-Start: $named -# Should-Stop: $named -# Default-Start: 2 3 4 5 -# Default-Stop: 0 1 6 -# Short-Description: Starts ProFTPD daemon -# Description: This script runs the FTP service offered -# by the ProFTPD daemon -### END INIT INFO - -# Start the proftpd FTP daemon. - -PATH=/bin:/usr/bin:/sbin:/usr/sbin -DAEMON=/usr/local/sbin/proftpd -NAME=proftpd - -# Defaults -RUN="no" -OPTIONS="" -CONFIG_FILE=/etc/proftpd/proftpd.conf - -PIDFILE=`grep -i 'pidfile' $CONFIG_FILE|sed -e 's/pidfile[\t ]\+//i'` -if [ "x$PIDFILE" = "x" ]; -then - PIDFILE=/var/run/proftpd.pid -fi - -# Read config (will override defaults) -[ -r /etc/default/proftpd ] && . /etc/default/proftpd - -trap "" 1 -trap "" 15 - -test -f $DAEMON || exit 0 - -. /lib/lsb/init-functions - -# -# Servertype could be inetd|standalone|none. -# In all cases check against inetd and xinetd support. -# -if ! egrep -qi "^[[:space:]]*ServerType.*standalone" $CONFIG_FILE -then - if egrep -qi "server[[:space:]]*=[[:space:]]*/usr/sbin/proftpd" /etc/xinetd.conf 2>/dev/null || \ - egrep -qi "server[[:space:]]*=[[:space:]]*/usr/sbin/proftpd" /etc/xinetd.d/* 2>/dev/null || \ - egrep -qi "^ftp.*/usr/sbin/proftpd" /etc/inetd.conf 2>/dev/null - then - RUN="no" - INETD="yes" - else - if ! egrep -qi "^[[:space:]]*ServerType.*inetd" $CONFIG_FILE - then - RUN="yes" - INETD="no" - else - RUN="no" - INETD="no" - fi - fi -fi - -# /var/run could be on a tmpfs - -[ ! -d /var/run/proftpd ] && mkdir /var/run/proftpd - -inetd_check() -{ - if [ ! -x /usr/sbin/inetd -a ! -x /usr/sbin/xinetd ]; then - echo "Neither inetd nor xinetd appears installed: check your configuration." - fi -} - -start() -{ - log_daemon_msg "Starting ftp server" "$NAME" - - start-stop-daemon --start --quiet --pidfile "$PIDFILE" --oknodo --exec $DAEMON -- -c $CONFIG_FILE $OPTIONS - if [ $? != 0 ]; then - log_end_msg 1 - exit 1 - else - log_end_msg 0 - fi -} - -signal() -{ - - if [ "$1" = "stop" ]; then - SIGNAL="TERM" - log_daemon_msg "Stopping ftp server" "$NAME" - else - if [ "$1" = "reload" ]; then - SIGNAL="HUP" - log_daemon_msg "Reloading ftp server" "$NAME" - else - echo "ERR: wrong parameter given to signal()" - exit 1 - fi - fi - if [ -f "$PIDFILE" ]; then - start-stop-daemon --stop --signal $SIGNAL --quiet --pidfile "$PIDFILE" - if [ $? = 0 ]; then - log_end_msg 0 - else - SIGNAL="KILL" - start-stop-daemon --stop --signal $SIGNAL --quiet --pidfile "$PIDFILE" - if [ $? != 0 ]; then - log_end_msg 1 - [ $2 != 0 ] || exit 0 - else - log_end_msg 0 - fi - fi - if [ "$SIGNAL" = "KILL" ]; then - rm -f "$PIDFILE" - fi - else - log_end_msg 0 - fi -} - -case "$1" in - start) - if [ "x$RUN" = "xyes" ] ; then - start - else - start -# if [ "x$INETD" = "xyes" ] ; then -# echo "ProFTPD is started from inetd/xinetd." -# inetd_check -# else -# echo "ProFTPD warning: cannot start neither in standalone nor in inetd/xinetd mode. Check your configuration." -# fi - fi - ;; - - force-start) - if [ "x$INETD" = "xyes" ] ; then - echo "Warning: ProFTPD is started from inetd/xinetd (trying to start anyway)." - inetd_check - fi - start - ;; - - stop) - if [ "x$RUN" = "xyes" ] ; then - signal stop 0 - else - if [ "x$INETD" = "xyes" ] ; then - echo "ProFTPD is started from inetd/xinetd." - inetd_check - else - echo "ProFTPD warning: cannot start neither in standalone nor in inetd/xinetd mode. Check your configuration." - fi - fi - ;; - - force-stop) - if [ "x$INETD" = "xyes" ] ; then - echo "Warning: ProFTPD is started from inetd/xinetd (trying to kill anyway)." - inetd_check - fi - signal stop 0 - ;; - - reload) - signal reload 0 - ;; - - force-reload|restart) - if [ "x$RUN" = "xyes" ] ; then - signal stop 1 - sleep 2 - start - else - if [ "x$INETD" = "xyes" ] ; then - echo "ProFTPD is started from inetd/xinetd." - inetd_check - else - echo "ProFTPD warning: cannot start neither in standalone nor in inetd/xinetd mode. Check your configuration." - fi - fi - ;; - - status) - if [ "x$INETD" = "xyes" ] ; then - echo "ProFTPD is started from inetd/xinetd." - inetd_check - exit 0 - else - if [ -f "$PIDFILE" ]; then - pid=$(cat $PIDFILE) - else - pid="x" - fi - if [ `pidof proftpd|grep "$pid"|wc -l` -ne 0 ] ; then - echo "ProFTPD is started in standalone mode, currently running." - exit 0 - else - echo "ProFTPD is started in standalone mode, currently not running." - exit 3 - fi - fi - ;; - - check-config) - $DAEMON -t >/dev/null && echo "ProFTPD configuration OK" && exit 0 - exit 1 - ;; - - *) - echo "Usage: /etc/init.d/$NAME {start|status|force-start|stop|force-stop|reload|restart|force-reload|check-config}" - exit 1 - ;; -esac - -exit 0 diff --git a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/manifests/config.pp b/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/manifests/config.pp deleted file mode 100644 index 9a731d7a3..000000000 --- a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/manifests/config.pp +++ /dev/null @@ -1,59 +0,0 @@ -class proftpd_133c_backdoor_nonroot::config { - $secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file) - $raw_org = $secgen_parameters['organisation'] - $leaked_filenames = $secgen_parameters['leaked_filenames'] - $strings_to_leak = $secgen_parameters['strings_to_leak'] - $strings_to_pre_leak = $secgen_parameters['strings_to_pre_leak'] - $pre_leaked_filenames = $secgen_parameters['pre_leaked_filenames'] - - if $raw_org and $raw_org[0] and $raw_org[0] != '' { - $organisation = parsejson($raw_org[0]) - } else { - $organisation = '' - } - - $anon_user = 'anon' #$secgen_parameters['leaked_username'][0] - $anon_user_home = "/home/$anon_user" - $deploy_user = 'ftp' - $deploy_user_home = "/home/$deploy_user" - - Exec { path => [ '/bin/', '/sbin/' , '/usr/bin/', '/usr/sbin/' ] } - - # Create user - user { $anon_user: - ensure => present, - home => "$anon_user_home", - managehome => true, - } -> - user { $deploy_user: - ensure => present, - home => "$deploy_user_home", - managehome => true, - } -> - - - - file { '/etc/proftpd/proftpd.conf': - ensure => present, - owner => 'root', - group => 'root', - mode => '0644', - content => template('proftpd_133c_backdoor_nonroot/proftpd.erb') - } - - ::secgen_functions::leak_files { 'proftpd_133c_backdoor_nonroot-file-leak': - storage_directory => '/root', - leaked_filenames => $leaked_filenames, - strings_to_leak => $strings_to_leak, - leaked_from => "proftpd_133c_backdoor_nonroot", - mode => '0600' - } - ::secgen_functions::leak_files { 'proftpd_133c_backdoor_nonroot-file-pre-leak': - storage_directory => $anon_user_home, - leaked_filenames => $pre_leaked_filenames, - strings_to_leak => $strings_to_pre_leak, - leaked_from => "proftpd_133c_backdoor_nonroot-pre", - mode => '0644', - owner => $anon_user - } -} diff --git a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/manifests/install.pp b/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/manifests/install.pp deleted file mode 100644 index 52dd92857..000000000 --- a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/manifests/install.pp +++ /dev/null @@ -1,72 +0,0 @@ -class proftpd_133c_backdoor_nonroot::install { - - # Install ProFTPd 1.3.3c backdoored version from source tar - - file { '/usr/local/src/proftpd-1.3.3c.tar.gz': - owner => root, - group => root, - mode => '0775', - ensure => file, - source => 'puppet:///modules/proftpd_133c_backdoor_nonroot/proftpd-1.3.3c.tar.gz', - notify => Exec['unpack'], - } - - exec { 'unpack': - cwd => '/usr/local/src', - command => 'tar -xzvf proftpd-1.3.3c.tar.gz', - creates => '/usr/local/src/backdoored_proftpd-1.3.3c/', - path => [ '/bin/', '/sbin/' , '/usr/bin/', '/usr/sbin/' ], - notify => Exec['install_proftpd-1.3.3c'], - } - - ensure_packages('build-essential') - ensure_packages('gcc-multilib') - - exec { 'install_proftpd-1.3.3c': - cwd => '/usr/local/src/backdoored_proftpd-1.3.3c/', - command => '/usr/local/src/backdoored_proftpd-1.3.3c/configure', #--prefix=/usr/local/ - notify => Exec['make_proftpd-1.3.3c'], - require => Package['build-essential', 'gcc-multilib'], - } - - exec { 'make_proftpd-1.3.3c': - require => Exec['install_proftpd-1.3.3c'], - cwd => '/usr/local/src/backdoored_proftpd-1.3.3c/', - command => '/usr/bin/make', - notify => Exec['make_install_proftpd-1.3.3c'], - } - - exec { 'make_install_proftpd-1.3.3c': - require => Exec['install_proftpd-1.3.3c'], - cwd => '/usr/local/src/backdoored_proftpd-1.3.3c/', - command => '/usr/bin/make install', - notify => File['/etc/init.d/proftpd'], - } - - # ProFTPd init.d service installation - - file { '/etc/init.d/proftpd': - require => Exec['make_install_proftpd-1.3.3c'], - path => '/etc/init.d/proftpd', - owner => root, - group => root, - mode => '0755', - ensure => file, - source => 'puppet:///modules/proftpd_133c_backdoor_nonroot/proftpd.init.d', - } - - # Required log and config files/directories - - file { ['/etc/proftpd', '/var/log/proftpd', '/var/log/proftpd/xferlog', '/etc/proftpd/conf.d/']: - ensure => directory, - } - - file { [ '/etc/proftpd/modules.conf', '/var/log/proftpd/proftpd.log']: - ensure => file, - } - - # Cleanup - exec { 'directory-cleanup': - command => '/bin/rm /usr/local/src/* -rf', - } -} diff --git a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/manifests/service.pp b/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/manifests/service.pp deleted file mode 100644 index 89e56083a..000000000 --- a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/manifests/service.pp +++ /dev/null @@ -1,7 +0,0 @@ -class proftpd_133c_backdoor_nonroot::service { - service { 'proftpd': - ensure => running, - enable => true, - require => File['/etc/init.d/proftpd','/etc/proftpd/proftpd.conf'], - } -} diff --git a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/proftpd_133c_backdoor_nonroot.pp b/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/proftpd_133c_backdoor_nonroot.pp deleted file mode 100644 index 0398bed9d..000000000 --- a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/proftpd_133c_backdoor_nonroot.pp +++ /dev/null @@ -1,3 +0,0 @@ -include proftpd_133c_backdoor_nonroot::install -include proftpd_133c_backdoor_nonroot::config -include proftpd_133c_backdoor_nonroot::service diff --git a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/secgen_metadata.xml b/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/secgen_metadata.xml deleted file mode 100644 index 76e2c1f9d..000000000 --- a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/secgen_metadata.xml +++ /dev/null @@ -1,100 +0,0 @@ - - - - ProFTPD v1.3.3c Backdoor Command Execution - Thomas Shaw - Jason Keighley - MIT - A backdoor was introduced into the proftpd-1.3.3c.tar.[bz2|gz] archive between November 28th and December - 2nd 2010. - - - ftp - root_rwx - remote - linux - low - - server_name - strings_to_leak - leaked_filenames - welcome_msg - port - strings_to_pre_leak - pre_leaked_filenames - - - organisation - - - 21 - - - - - - - - - - - - - - - - - - - - - - - - note - - - - - 10 - AV:N/AC:L/Au:N/C:C/I:C/A:C - - OSVDB-69562 - https://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_133c_backdoor - proftpd - GPL - - - - A backdoor in a service - Remotely exploitable backdoor in the FTP service - - - - proftpd - - - - ^ftp$ - - - - update - - - - EXPLOITATION - EXPLOITATION FRAMEWORKS - BACKDOOR TROJANS - - - PENETRATION TESTING - SOFTWARE TOOLS - PENETRATION TESTING - ACTIVE PENETRATION - - - FILE - TRANSFER PROTOCOL (FTP) - - - diff --git a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/secgen_test/proftpd_133c_backdoor.rb b/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/secgen_test/proftpd_133c_backdoor.rb deleted file mode 100644 index 23564515c..000000000 --- a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/secgen_test/proftpd_133c_backdoor.rb +++ /dev/null @@ -1,16 +0,0 @@ -require_relative '../../../../../lib/post_provision_test' - -class Proftpd133cBackdoorTest < PostProvisionTest - def initialize - self.module_name = 'proftpd_133c_backdoor_nonroot' - self.module_path = get_module_path(__FILE__) - super - end - - def test_module - super - test_service_up - end -end - -Proftpd133cBackdoorTest.new.run diff --git a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/templates/proftpd.erb b/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/templates/proftpd.erb deleted file mode 100644 index 97e7ccae5..000000000 --- a/modules/vulnerabilities/unix/ftp/proftpd_133c_backdoor_nonroot/templates/proftpd.erb +++ /dev/null @@ -1,201 +0,0 @@ -<% $port = @secgen_parameters['port'].first - - if @organisation and @organisation != '' - $welcome_msg = "Welcome to the #{@organisation['business_name']} FTP server!" - $server_name = @organisation['domain'] - else - $server_name = @secgen_parameters['server_name'].first - $welcome_msg = @secgen_parameters['welcome_msg'].first - end --%> -# -# /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file. -# To really apply changes, reload proftpd after modifications, if -# it runs in daemon mode. It is not required in inetd/xinetd mode. -# - -# Includes DSO modules -Include /etc/proftpd/modules.conf - -# Set off to disable IPv6 support which is annoying on IPv4 only boxes. -UseIPv6 off -# If set on you can experience a longer connection delay in many cases. -IdentLookups off - -ServerName "<%=$server_name%>" -ServerType standalone -DeferWelcome off - -MultilineRFC2228 on -DefaultServer on -ShowSymlinks on - -TimeoutNoTransfer 600 -TimeoutStalled 600 -TimeoutIdle 1200 - -DisplayLogin welcome.msg -DisplayChdir .message true -ListOptions "-l" - -DenyFilter \*.*/ - -AccessGrantMsg "<%=$welcome_msg.gsub("\n", '\n')%>" - -# Use this to jail all users in their homes -# DefaultRoot ~ - -# Users require a valid shell listed in /etc/shells to login. -# Use this directive to release that constrain. -# RequireValidShell off - -# Port 21 is the standard FTP port. -Port <%=$port%> - -# In some cases you have to specify passive ports range to by-pass -# firewall limitations. Ephemeral ports can be used for that, but -# feel free to use a more narrow range. -# PassivePorts 49152 65534 - -# If your host was NATted, this option is useful in order to -# allow passive tranfers to work. You have to use your public -# address and opening the passive ports used on your firewall as well. -# MasqueradeAddress 1.2.3.4 - -# This is useful for masquerading address with dynamic IPs: -# refresh any configured MasqueradeAddress directives every 8 hours - - # DynMasqRefresh 28800 - - -# To prevent DoS attacks, set the maximum number of child processes -# to 30. If you need to allow more than 30 concurrent connections -# at once, simply increase this value. Note that this ONLY works -# in standalone mode, in inetd mode you should use an inetd server -# that allows you to limit maximum number of processes per service -# (such as xinetd) -MaxInstances 30 - -# Set the user and group that the server normally runs at. -User <%= @deploy_user %> -Group nogroup - -# Umask 022 is a good standard umask to prevent new files and dirs -# (second parm) from being group and world writable. -Umask 022 022 -# Normally, we want files to be overwriteable. -AllowOverwrite on - -# Uncomment this if you are using NIS or LDAP via NSS to retrieve passwords: -# PersistentPasswd off - -# This is required to use both PAM-based authentication and local passwords -# AuthOrder mod_auth_pam.c* mod_auth_unix.c - -# Be warned: use of this directive impacts CPU average load! -# Uncomment this if you like to see progress and transfer rate with ftpwho -# in downloads. That is not needed for uploads rates. -# -# UseSendFile off - -TransferLog /var/log/proftpd/xferlog -SystemLog /var/log/proftpd/proftpd.log - -# Logging onto /var/log/lastlog is enabled but set to off by default -#UseLastlog on - -# In order to keep log file dates consistent after chroot, use timezone info -# from /etc/localtime. If this is not set, and proftpd is configured to -# chroot (e.g. DefaultRoot or Anonymous-->), it will use the non-daylight - # savings timezone regardless of whether DST is in effect. - #SetEnv TZ :/etc/localtime - - - QuotaEngine off - - - - Ratios off - - - - # Delay engine reduces impact of the so-called Timing Attack described in - # http://www.securityfocus.com/bid/11430/discuss - # It is on by default. - - DelayEngine on - - - - ControlsEngine off - ControlsMaxClients 2 - ControlsLog /var/log/proftpd/controls.log - ControlsInterval 5 - ControlsSocket /var/run/proftpd/proftpd.sock - - - - AdminControlsEngine off - - - # - # Alternative authentication frameworks - # - #Include /etc/proftpd/ldap.conf - #Include /etc/proftpd/sql.conf - - # - # This is used for FTPS connections - # - #Include /etc/proftpd/tls.conf - - # - # Useful to keep VirtualHost/VirtualRoot directives separated - # - #Include /etc/proftpd/virtuals.conf - - # A basic anonymous configuration, no upload directories. - - > - User <%= @anon_user %> - Group nogroup - # We want clients to be able to login with "anonymous" as well as "ftp" - UserAlias anonymous <%= @anon_user %> - # Cosmetic changes, all files belongs to ftp user - DirFakeUser on <%= @anon_user %> - DirFakeGroup on <%= @anon_user %> - - RequireValidShell off - - # Limit the maximum number of anonymous logins - MaxClients 10 - - # We want 'welcome.msg' displayed at login, and '.message' displayed - # in each newly chdired directory. - DisplayLogin welcome.msg - DisplayChdir .message - - # Limit WRITE everywhere in the anonymous chroot - - - DenyAll - - - - # Uncomment this if you're brave. - # - # # Umask 022 is a good standard umask to prevent new files and dirs - # # (second parm) from being group and world writable. - # Umask 022 022 - # - # DenyAll - # - # - # AllowAll - # - # - - - - # Include other custom configuration files - Include /etc/proftpd/conf.d/ diff --git a/scenarios/ctf/rooting_for_a_win_user.xml b/scenarios/ctf/rooting_for_a_win_user.xml deleted file mode 100644 index 3cdba8fea..000000000 --- a/scenarios/ctf/rooting_for_a_win_user.xml +++ /dev/null @@ -1,131 +0,0 @@ - - - - - Rooting for a win2 - Z. Cliffe Schreuders - Hack the server from kali. - - - ctf - attack-ctf - pwn-ctf - medium - - - - EXPLOITATION - EXPLOITATION FRAMEWORKS - BACKDOOR TROJANS - - - CVEs and CWEs - - - PENETRATION TESTING - SOFTWARE TOOLS - PENETRATION TESTING - ACTIVE PENETRATION - - - FILE - TRANSFER PROTOCOL (FTP) - - - - - access control - Elevated privileges - Vulnerabilities and attacks on access control misconfigurations - - - Access controls and operating systems - Linux security model - Attacks against SUDO - - - - kill chains - - - cyber kill chain - - - - - attack_vm - - - - - - 172.16.0.2 - - 172.16.0.3 - - - - - {"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]} - - - - - - {"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]} - - - false - - - - - - - - - IP_addresses - - - - - - - - spoiler_admin_pass - - - - - - server - - - - - - - - - - - - - - - - - - - - - IP_addresses - - - - - spoiler_admin_pass - - - - -